Authentication method and device based on terminal equipment identifier and storage medium

Abstract

The invention discloses an authentication method and device based on a terminal equipment identifier, and a storage medium, and belongs to the technical field of communication security. The method comprises the following steps: collecting static attribute information and dynamic behavior information of terminal equipment; generating a current equipment fingerprint for identifying the terminal equipment according to the static attribute information; performing static authentication on the terminal equipment based on the current equipment fingerprint and an original equipment fingerprint in a fingerprint database; and under the condition that the static authentication is passed, performing dynamic authentication on the terminal equipment according to the dynamic behavior information. According to the embodiment of the invention, static authentication is carried out on the terminal equipment through the static attribute, and whether the behavior mode of the terminal equipment in the operation process meets the expectation or not is determined by analyzing the dynamic operation of the terminal equipment under the condition that the static authentication is passed, so that the static and dynamic combined multi-dimensional authentication mechanism can improve the user experience. The method not only can resist traditional identity fraudulent use attacks, but also can effectively prevent complex network threats, and improves the reliability and safety of the authentication process.

Description

Technical Field

[0001] The present application belongs to the field of communication security technology, and in particular, relates to an authentication method, device and storage medium based on terminal device identification. Background Art

[0002] As the construction of all links of the new power system, including source, grid, load and storage, gradually accelerates, a large number of distributed terminals represented by new energy sources need to be connected to the power monitoring system, which will bring major security challenges to the power grid and the need for device identity authentication has become more urgent.

[0003] In the related technologies, IoT device authentication mainly includes MAC (Media Access Control Address)-based authentication, identity-based authentication, certificate-based authentication, etc. MAC-based authentication and identity-based authentication are easily tampered with and forged, and certificate-based authentication methods usually rely on certificate management, which requires the distribution and update of certificates, the processing of a large number of certificates, and the assurance of the integrity and credibility of the identity authentication process. The process is complex and the maintenance cost is high, making it difficult to adapt to the changing equipment environment and real-time authentication requirements in modern power systems. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes an authentication method, device and storage medium based on terminal device identification to improve the reliability and security of the authentication process.

[0005] In a first aspect, the present application provides an authentication method based on a terminal device identification, comprising:

[0006] Collect static attribute information and dynamic behavior information of terminal devices;

[0007] Generating a current device fingerprint for identifying the terminal device according to the static attribute information;

[0008] Performing static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint library;

[0009] When the static authentication is passed, the terminal device is dynamically authenticated according to the dynamic behavior information.

[0010] According to the authentication method based on terminal device identification of the present application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated based on the static attribute information; the terminal device is statically authenticated based on the current device fingerprint and the original device fingerprint in the fingerprint library; if the static authentication passes, the terminal device is dynamically authenticated based on the dynamic behavior information. The embodiment of the present application statically authenticates the terminal device through static attributes, and if the static authentication passes, determines whether the behavior pattern of the terminal device during operation meets expectations by analyzing the dynamic operation of the terminal device. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity fraud attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0011] According to one embodiment of the present application, the static attribute information includes at least one of basic information, operating system information, chip architecture information, and communication information of the terminal device.

[0012] In this embodiment, static attribute information, such as basic device information, operating system information, chip architecture and communication information, is used to provide a unique identity information for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing an accurate reference for the authentication process.

[0013] According to one embodiment of the present application, the dynamic behavior information includes at least one of the communication protocol type, uplink and downlink communication ports, communication behavior information, data domain maximum value, data domain minimum value, and data domain standard deviation of the terminal device.

[0014] In this embodiment, by collecting dynamic behavior information of the terminal device, such as communication protocol type, upstream and downstream communication ports, communication behavior information, maximum value, minimum value and standard deviation of the data domain, etc., an accurate behavior portrait can be provided for the terminal device, which can not only capture the normal usage mode of the device, but also identify abnormal behavior, thereby effectively preventing potential security threats.

[0015] According to one embodiment of the present application, collecting static attribute information of a terminal device includes:

[0016] The static attribute information is collected based on hardware drivers and / or API calls.

[0017] In this embodiment, by using hardware drivers and / or API calls to collect static attribute information of terminal devices, more accurate and comprehensive device information can be obtained. Among them, hardware drivers provide a way to communicate directly with hardware, which can access and control the functions of hardware devices, while API calls allow software to access such hardware information.

[0018] According to an embodiment of the present application, collecting dynamic behavior information of a terminal device includes:

[0019] By actively sending a detection message to the terminal device, the terminal device collects the dynamic behavior information based on feedback from the detection message and / or collects the dynamic behavior information through passive traffic monitoring.

[0020] In this embodiment, active detection messages can simulate real network requests, thereby triggering the response of the terminal device and collecting information such as its communication protocol type and port usage. Passive traffic monitoring can monitor the network activity of the device in real time, record its communication behavior and data transmission characteristics, such as the maximum value, minimum value and standard deviation of the data field and other statistical information. This dynamic information collection method can comprehensively monitor the behavior pattern of the terminal device.

[0021] According to an embodiment of the present application, generating a current device fingerprint for identifying the terminal device according to the static attribute information includes:

[0022] Extracting characteristic components of the terminal device from the static attribute information;

[0023] A hash operation is performed on the feature component, and the obtained hash value is used as the current device fingerprint.

[0024] According to one embodiment of the present application, according to the formula

[0025] ID=Hash(f1||f2||…||f n ||timetmp)

[0026] Performing a hash operation on the feature component;

[0027] Among them, ID represents the current device fingerprint, Hash() represents the hash operation of the content in the brackets, {f1,f2,…,f n} represents the feature component, and timstmp represents the timestamp.

[0028] In this embodiment, the key attributes of the terminal device are included in the identification process by extracting feature components. These attributes are relatively stable and relatively unique. These feature components are converted into a hash value of a fixed length through hash operation. This hash value is the device fingerprint, which can uniquely represent the terminal device. Due to the unidirectionality and anti-collision properties of the hash function, even a slight change in the device attributes will result in a significant change in the hash value, which increases the difficulty of forging the device fingerprint, thereby improving security.

[0029] According to one embodiment of the present application, the static authentication includes fingerprint matching;

[0030] The fingerprint matching includes: matching and comparing the current device fingerprint with the original device fingerprint, and determining that the matching is successful if the current device fingerprint and the original device fingerprint are the same.

[0031] In this embodiment, the device fingerprint is generated by extracting the static attribute information of the terminal device as a feature component and performing a hash operation. Due to the unidirectional and anti-collision characteristics of the hash operation, even a slight change in the amount of data will result in a significant difference in the hash value, thereby greatly enhancing the difficulty of forging the device fingerprint. The introduction of the timestamp records the time point when the original device fingerprint was generated, so that the current device fingerprint and the original device fingerprint are generated using the same timestamp. When the device identity needs to be verified, it is only necessary to compare the current device fingerprint with the stored original device fingerprint to see if they match, and the authentication can be completed quickly, which not only improves the accuracy of the authentication, but also ensures the security of the authentication process.

[0032] According to one embodiment of the present application, the static authentication includes fingerprint matching;

[0033] The fingerprint matching includes: calculating the similarity between the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; and determining that the match is successful when the similarity value is greater than or equal to a matching threshold.

[0034] In this embodiment, by calculating the similarity value between the current device fingerprint and the original device fingerprint, and comparing the similarity value with the preset matching threshold, it is determined whether the device matches. A certain degree of device fingerprint change can be tolerated, such as normal changes caused by system updates or configuration changes, thereby ensuring security while also improving authentication accuracy and user convenience.

[0035] According to an embodiment of the present application, the static authentication further comprises: in case of successful matching, performing certificateless authentication of the encryption algorithm;

[0036] The encryption algorithm certificateless authentication includes:

[0037] Acquire information sent by the terminal device, the information including a digital signature generated by the terminal device through an encryption algorithm;

[0038] Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device;

[0039] The signature value of the digital signature is verified using the public key.

[0040] In this embodiment, by introducing encryption algorithm certificateless authentication in the static authentication process, especially by digital signature and public key verification, in which the public key is declared to be generated by the key generation center based on the temporary public and private key pair of the terminal device, the credibility and security of the public key are improved. This authentication method not only avoids the complexity of traditional certificate management, but also reduces the security risks caused by certificate problems.

[0041] According to an embodiment of the present application, dynamically authenticating the terminal device according to the dynamic behavior information includes:

[0042] Establish a trust assessment model;

[0043] Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model;

[0044] When the security trust value is greater than or equal to a preset threshold, the authentication is confirmed to be successful.

[0045] In this embodiment, by establishing a trust evaluation model and calculating the security trust value corresponding to the dynamic behavior information, it is not only possible to detect the current state of the device, but also to make predictions and early warnings based on the device behavior pattern, and to detect abnormal behavior in a timely manner, thereby effectively preventing potential security threats. When the security trust value reaches or exceeds the preset threshold, it can be confirmed that the device has passed the authentication, which indicates that the device's behavior matches the trust model, further enhancing the security and reliability of the authentication.

[0046] In a second aspect, the present application provides an authentication device based on a terminal device identification, comprising:

[0047] A collection module, used to collect static attribute information and dynamic behavior information of terminal devices;

[0048] A fingerprint generation module, used to generate a current device fingerprint for identifying the terminal device according to the static attribute information;

[0049] A static authentication module, used to perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint library;

[0050] The dynamic authentication module is used to dynamically authenticate the terminal device according to the dynamic behavior information when the static authentication passes.

[0051] According to the terminal device identification-based authentication device of the present application, according to the terminal device identification-based authentication method of the present application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated according to the static attribute information; the terminal device is statically authenticated based on the current device fingerprint and the original device fingerprint in the fingerprint library; if the static authentication passes, the terminal device is dynamically authenticated according to the dynamic behavior information. The embodiment of the present application statically authenticates the terminal device through static attributes, and if the static authentication passes, determines whether the behavior pattern of the terminal device during operation meets expectations by analyzing the dynamic operation of the terminal device. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity fraud attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0052] According to one embodiment of the present application, the fingerprint generation module is further used for:

[0053] Extracting characteristic components of the terminal device from the static attribute information;

[0054] A hash operation is performed on the feature component, and the obtained hash value is used as the current device fingerprint.

[0055] According to one embodiment of the present application, the static authentication module is further used to:

[0056] The current device fingerprint and the original device fingerprint are matched and compared, and if the current device fingerprint and the original device fingerprint are the same, it is determined that the match is successful.

[0057] According to one embodiment of the present application, the static authentication module is further used to:

[0058] A similarity calculation is performed on the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; when the similarity value is greater than or equal to a matching threshold, it is determined that the match is successful.

[0059] According to one embodiment of the present application, the static authentication module is further used to:

[0060] In case of successful matching, the encryption algorithm is authenticated without certificate;

[0061] The encryption algorithm certificateless authentication includes:

[0062] Acquire information sent by the terminal device, the information including a digital signature generated by the terminal device through an encryption algorithm;

[0063] Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device;

[0064] The signature value of the digital signature is verified using the public key.

[0065] According to one embodiment of the present application, the dynamic authentication module is further used to:

[0066] Establish a trust assessment model;

[0067] Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model;

[0068] When the security trust value is greater than or equal to a preset threshold, the authentication is confirmed to be successful.

[0069] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the authentication method based on terminal device identification as described in the first aspect above is implemented.

[0070] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the authentication method based on terminal device identification as described in the first aspect above is implemented.

[0071] In a fifth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the authentication method based on terminal device identification as described in the first aspect above.

[0072] In a sixth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the authentication method based on terminal device identification as described in the first aspect above.

[0073] The above one or more technical solutions in the embodiments of the present application have at least one of the following technical effects:

[0074] According to the authentication method based on terminal device identification of the present application, according to the authentication method based on terminal device identification of the present application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated according to the static attribute information; the terminal device is statically authenticated based on the current device fingerprint and the original device fingerprint in the fingerprint library; if the static authentication passes, the terminal device is dynamically authenticated according to the dynamic behavior information. The embodiment of the present application statically authenticates the terminal device through static attributes, and if the static authentication passes, determines whether the behavior pattern of the terminal device during operation meets expectations by analyzing the dynamic operation of the terminal device. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity fraud attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0075] Furthermore, in some embodiments, static attribute information, such as basic device information, operating system information, chip architecture, and communication information, is used to provide a unique identity information for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing an accurate reference for the authentication process.

[0076] Furthermore, in some embodiments, by collecting dynamic behavior information of terminal devices, such as communication protocol type, upstream and downstream communication ports, communication behavior information, maximum value, minimum value and standard deviation of data domain, etc., an accurate behavior portrait can be provided for the terminal device, which can not only capture the normal usage mode of the device, but also identify abnormal behavior, thereby effectively preventing potential security threats.

[0077] Furthermore, in some embodiments, by using hardware drivers and / or API calls to collect static attribute information of terminal devices, more accurate and comprehensive device information can be obtained. Among them, hardware drivers provide a way to communicate directly with hardware, which can access and control the functions of hardware devices, while API calls allow software to access such hardware information.

[0078] Furthermore, in some embodiments, active detection messages can simulate real network requests, thereby triggering the response of terminal devices and collecting information such as their communication protocol type and port usage. Passive traffic monitoring can monitor the network activities of devices in real time, record their communication behaviors and data transmission characteristics, such as statistical information such as the maximum value, minimum value and standard deviation of the data domain. This dynamic information collection method can comprehensively monitor the behavior patterns of terminal devices.

[0079] Furthermore, in some embodiments, key attributes of the terminal device are incorporated into the identification process by extracting feature components. These attributes are relatively stable and relatively unique. These feature components are converted into a hash value of a fixed length through hash operations. This hash value is the device fingerprint, which can uniquely represent the terminal device. Due to the unidirectionality and anti-collision properties of the hash function, even slight changes in device attributes will result in significant changes in the hash value, which increases the difficulty of forging device fingerprints and thus improves security.

[0080] Furthermore, in some embodiments, a device fingerprint is generated by extracting static attribute information of a terminal device as a feature component and performing a hash operation. Due to the unidirectional and anti-collision characteristics of the hash operation, even a slight change in the amount of data will result in a significant difference in the hash value, thereby greatly enhancing the difficulty of forging a device fingerprint. The introduction of a timestamp records the time point when the original device fingerprint was generated, so that the current device fingerprint and the original device fingerprint are generated using the same timestamp. When the device identity needs to be verified, it is only necessary to compare the current device fingerprint with the stored original device fingerprint to see if they match, and the authentication can be completed quickly, which not only improves the accuracy of the authentication, but also ensures the security of the authentication process.

[0081] Furthermore, in some embodiments, by calculating the similarity value between the current device fingerprint and the original device fingerprint, and comparing the similarity value with a preset matching threshold, it is determined whether the device matches. A certain degree of device fingerprint change can be tolerated, such as normal changes caused by system updates or configuration changes, thereby ensuring security while also improving authentication accuracy and user convenience.

[0082] Furthermore, in some embodiments, by introducing encryption algorithm certificateless authentication in the static authentication process, especially by means of digital signature and public key verification, in which the public key is declared to be generated by the key generation center based on the temporary public-private key pair of the terminal device, the credibility and security of the public key are improved. This authentication method not only avoids the complexity of traditional certificate management, but also reduces the security risks caused by certificate problems.

[0083] Furthermore, in some embodiments, by establishing a trust evaluation model and calculating the security trust value corresponding to the dynamic behavior information, it is possible not only to detect the current state of the device, but also to make predictions and early warnings based on the device behavior pattern, and to detect abnormal behavior in a timely manner, thereby effectively preventing potential security threats. When the security trust value reaches or exceeds the preset threshold, it can be confirmed that the device has passed the authentication, which indicates that the device's behavior matches the trust model, further enhancing the security and reliability of the authentication.

[0084] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0086] Figure 1 It is a flowchart of an authentication method based on terminal device identification provided in an embodiment of the present application;

[0087] Figure 2 It is a schematic diagram of the certificateless authentication process of the encryption algorithm provided in the embodiment of the present application;

[0088] Figure 3 is a schematic diagram of a scenario example provided in an embodiment of the present application;

[0089] Figure 4 is a schematic diagram of an example of a static authentication process provided in an embodiment of the present application;

[0090] Figure 5 It is a schematic diagram of the structure of an authentication device based on terminal device identification provided in an embodiment of the present application;

[0091] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0092] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0093] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0094] MAC-based authentication is a network access control technology that authenticates identity through the MAC address of the terminal device. The advantage is that the user terminal does not need to install client software, and the authentication process does not require the user to manually enter the username and password

[0095] Identity-based authentication is an asymmetric public key cryptography system in which the user's identity (such as email address, IP address, etc.) is directly used as the public key, and the user's private key is calculated by the key generation center based on the system master key and the user's identity. This method simplifies the key management process, does not require certificates, and directly associates the user identity with the public key. It is suitable for scenarios where simplified management processes are required.

[0096] Certificate-based authentication is a method of using digital certificates to verify user identities. A digital certificate contains information such as the user's identity information, public key, and the digital signature of the certificate authority. This authentication method provides higher security because the issuance and verification of certificates involve a trusted third-party certification authority. When a user logs in, they send the certificate to the server, and the server confirms the user's identity by verifying the validity of the certificate.

[0097] However, MAC-based authentication and identity-based authentication are prone to tampering and forgery, and certificate-based authentication methods usually rely on certificate management, which requires the distribution and update of certificates, the processing of a large number of certificates, and ensuring the integrity and credibility of the identity authentication process. The process is complex and the maintenance cost is high, making it difficult to adapt to the changing equipment environment and real-time authentication requirements in modern power systems.

[0098] In order to solve at least one of the above technical problems, the present application proposes an authentication method, device and storage medium based on terminal device identification. In conjunction with the accompanying drawings, the present application provides an authentication method, device and storage medium based on terminal device identification in detail through specific embodiments and their application scenarios.

[0099] Among them, the authentication method based on the terminal device identification can be applied to the terminal, and can be specifically executed by hardware or software in the terminal.

[0100] The terminal includes, but is not limited to, a portable communication device such as a mobile phone or tablet computer with a touch-sensitive surface (e.g., a touch screen display and / or a touch pad). It should also be understood that in some embodiments, the terminal may not be a portable communication device, but a desktop computer with a touch-sensitive surface (e.g., a touch screen display and / or a touch pad).

[0101] In the following various embodiments, a terminal including a display and a touch-sensitive surface is described. However, it should be understood that the terminal may include one or more other physical user interface devices such as a physical keyboard, a mouse and a joystick.

[0102] The authentication method based on terminal device identification provided in the embodiment of the present application may be executed by an electronic device or a functional module or functional entity in the electronic device that can implement the authentication method based on terminal device identification. The electronic devices mentioned in the embodiment of the present application include but are not limited to mobile phones, tablet computers, computers, cameras, wearable devices, etc. The authentication method based on terminal device identification provided in the embodiment of the present application is described below using an electronic device as an example of the execution subject.

[0103] like Figure 1 As shown, the authentication method based on terminal device identification includes: step 110, step 120, step 130 and step 140.

[0104] Step 110: Collect static attribute information and dynamic behavior information of the terminal device.

[0105] In the embodiments of the present application, the terminal device may be any device that needs to be security authenticated. For example, in the electrical field, the terminal device may be a generator, a transformer, a smart meter, a substation automation device, etc.; in the industrial automation field, the terminal device may be a sensor, an actuator, etc.; in the medical equipment field, the terminal device may be various medical devices, such as medical imaging equipment, monitors, etc. The embodiments of the present application do not limit the terminal device.

[0106] In the embodiment of the present application, static attribute information may be attribute information inherent to the terminal device and not frequently changed. Static attribute information may be determined when the device is manufactured, or configured when the device is set up, and remain relatively stable during the use of the device.

[0107] In some embodiments, static attribute information may include basic information of the terminal device, such as device model, manufacturer, serial number, etc.; it may also include operating system information, such as operating system type, version number, etc.; it may also include hardware configuration, such as central processing unit model, memory size, hard disk capacity, etc.; it may also include communication information, such as MAC address, IP address (Internet Protocol Address), subnet mask, etc.; it may also include chip architecture information, such as instruction set architecture, execution unit, etc. Of course, static attribute information may also include other information, which is not limited in the embodiments of the present application.

[0108] In this embodiment, static attribute information, such as basic device information, operating system information, chip architecture and communication information, is used to provide a unique identity information for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing an accurate reference for the authentication process.

[0109] In the embodiment of the present application, the dynamic behavior information may be information related to the behavior mode and activity status of the terminal device during operation. The dynamic behavior information changes continuously with the use of the device and may reflect the actual operation status of the device.

[0110] In some embodiments, dynamic behavior information may include communication protocol types, such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), HTTP (HyperText Transfer Protocol), FTP (File Transfer Protocol), etc.; it may also include upstream and downstream communication ports, such as the network port number used by the terminal device; it may also include communication behavior information, such as the frequency, size, direction, etc. of data transmission; it may also include data features, such as statistical information such as the maximum value, minimum value, standard deviation, etc. of the data domain; it may also include access modes, such as the frequency, time, and duration of user logins, etc. Of course, dynamic behavior information may also include other information, which is not limited in the embodiments of the present application.

[0111] In this embodiment, by collecting dynamic behavior information of the terminal device, such as communication protocol type, upstream and downstream communication ports, communication behavior information, maximum value, minimum value and standard deviation of the data domain, etc., an accurate behavior portrait can be provided for the terminal device, which can not only capture the normal usage mode of the device, but also identify abnormal behavior, thereby effectively preventing potential security threats.

[0112] In an embodiment of the present application, static attribute information and dynamic behavior information of a terminal device may be collected in any manner. For example, the traffic of the terminal device may be monitored to obtain dynamic behavior information, and static attribute information fed back by the terminal device may be obtained by initiating a request to the terminal device.

[0113] Step 120: Generate a current device fingerprint for identifying the terminal device according to the static attribute information.

[0114] In the embodiment of the present application, the device fingerprint is a unique identifier used to identify and distinguish terminal devices, that is, the device fingerprints of different terminal devices are different, and through the device fingerprint, the terminal device uniquely corresponding to the device fingerprint can be determined.

[0115] In the embodiment of the present application, the static attribute information of the terminal device can be analyzed to find the unique and stable characteristic components in the static attribute information. For example, these characteristic components can be information such as the device serial number, MAC address, international mobile equipment identity code, operating system version, motherboard serial number, etc. In different terminal devices, these characteristic components are usually different, or these characteristic components are relatively stable, not easy to change and not easy to be tampered with or forged. Combining these characteristic components can generate a device fingerprint corresponding to the terminal device. For example, the device fingerprint can be represented by vectors, numerical values ​​or any other means in combination with these characteristic components.

[0116] Step 130: statically authenticate the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint library.

[0117] In the embodiment of the present application, the original device fingerprint is a device fingerprint pre-stored in the fingerprint library, and the device fingerprint is a device fingerprint used to authenticate the identity of the terminal device. For example, a device fingerprint is generated for terminal device A in advance, and the device fingerprint is stored in the database as an original device fingerprint. When a terminal device needs to be authenticated, the current device fingerprint can be generated according to the static attribute information of the terminal device, and then the current device fingerprint is authenticated by the original device fingerprint. If the authentication is successful, it means that the terminal device may be terminal device A.

[0118] In the embodiments of the present application, static authentication refers to an authentication method that does not change frequently. Static authentication relies on pre-set, infrequently changing information to authenticate the identity. For example, the original device fingerprint is pre-stored, and the current device fingerprint can be compared with the original device fingerprint. If they are the same or similar, it can indicate that the authentication is passed.

[0119] Step 140: When the static authentication is passed, dynamically authenticate the terminal device according to the dynamic behavior information.

[0120] In the embodiment of the present application, dynamic authentication is a security mechanism that dynamically updates authentication information. The authentication information of dynamic authentication may be different at different times, which increases security. For example, the dynamic behavior information of the terminal device may be different at different times.

[0121] In the embodiment of the present application, the terminal device can be evaluated based on the dynamic behavior information. For example, the behavior of the terminal device can be analyzed based on the CPU (Central Processing Unit) utilization, access frequency, disk utilization, transmission delay and other indicators in the dynamic behavior information to determine whether the behavior of the terminal device is normal. For example, if multiple indicators among these indicators are abnormal, it can be considered that the behavior of the terminal device is abnormal and may be a malicious device. If these indicators are normal, it can be considered that the behavior of the terminal device is normal and the authentication is passed.

[0122] According to the authentication method based on terminal device identification of the present application, static attribute information and dynamic behavior information of the terminal device are collected; the current device fingerprint for identifying the terminal device is generated according to the static attribute information; the terminal device is statically authenticated based on the current device fingerprint and the original device fingerprint in the fingerprint library; if the static authentication passes, the terminal device is dynamically authenticated according to the dynamic behavior information. The embodiment of the present application statically authenticates the terminal device through static attributes, and if the static authentication passes, it determines whether the behavior pattern of the terminal device during operation meets expectations by analyzing the dynamic operation of the terminal device. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity fraud attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0123] In some embodiments, collecting static attribute information of a terminal device includes:

[0124] Collect static attribute information based on hardware drivers and / or API calls.

[0125] In this embodiment, the hardware driver is a bridge between the operating system and the hardware device, and the hardware driver allows the operating system to control and monitor the hardware device. Through the driver, the functions of the hardware device can be accessed and controlled, thereby obtaining static attribute information of the terminal device.

[0126] API (Application Programming Interface) enables software applications to request data or services provided by another program. Through the API provided by the terminal device, specific functions or commands can be called in the application to obtain static attribute information of the device.

[0127] In this embodiment, by using hardware drivers and / or API calls to collect static attribute information of terminal devices, more accurate and comprehensive device information can be obtained. Among them, hardware drivers provide a way to communicate directly with hardware, which can access and control the functions of hardware devices, while API calls allow software to access such hardware information.

[0128] In some embodiments, collecting dynamic behavior information of the terminal device includes:

[0129] By actively sending a detection message to the terminal device, the terminal device collects dynamic behavior information based on feedback from the detection message and / or collects dynamic behavior information through passive traffic monitoring.

[0130] In this embodiment, the communication protocol between devices may include a data link layer protocol, a network layer protocol, a transport layer protocol, and an application layer protocol. For example, the transport layer protocol may include TCP and UDP protocols, and the application layer protocol may include HTTP, DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol), SSH (Secure Shell), and other protocols.

[0131] The Modbus protocol, IEC 61850 protocol, S7COMM protocol, etc. can be used to actively send detection messages to terminal devices. For example, you can use a network scanning tool to send detection messages, and identify the device's operating system, open ports, and running services based on the characteristics of the terminal device's response, such as the behavior of the TCP / IP stack. This method can detect specific IPs, and even if the terminal device does not actively generate traffic, it can still be detected by constructing a detection packet.

[0132] Passive traffic monitoring collects behavioral information of terminal devices by monitoring network traffic. For example, you can use network analysis tools or intrusion detection systems to capture data packets passing through terminal devices and analyze these data packets to obtain information such as communication protocol type, port, and amount of data transmitted. Passive traffic monitoring usually does not require sending data packets to terminal devices. Instead, it uses packet capture tools to collect data packets flowing through the network and then obtain dynamic behavior information from these packets.

[0133] In this embodiment, active detection messages can simulate real network requests, thereby triggering the response of the terminal device and collecting information such as its communication protocol type and port usage. Passive traffic monitoring can monitor the network activity of the device in real time, record its communication behavior and data transmission characteristics, such as the maximum value, minimum value and standard deviation of the data field and other statistical information. This dynamic information collection method can comprehensively monitor the behavior pattern of the terminal device.

[0134] In some embodiments, generating a current device fingerprint for identifying a terminal device according to static attribute information includes:

[0135] Extracting characteristic components of the terminal device from the static attribute information;

[0136] Perform a hash operation on the feature components and use the resulting hash value as the current device fingerprint.

[0137] According to one embodiment of the present application, according to the formula

[0138] ID=Hash(f1||f2||…||f n ||timetmp)

[0139] Perform hash operations on feature components;

[0140] Among them, ID represents the current device fingerprint, Hash() represents the hash operation of the content in the brackets, {f1,f2,…,f n} represents the feature component, and timstmp represents the timestamp.

[0141] In this embodiment, the characteristic components may be information such as the device serial number, MAC address, international mobile equipment identity code, operating system version, mainboard serial number, etc. These characteristic components are usually different in different terminal devices, or these characteristic components are relatively stable, not easy to change, and not easy to be tampered with or forged. Combining these characteristic components can generate a device fingerprint corresponding to the terminal device.

[0142] In this embodiment, the characteristic components can be hashed by a hash algorithm to obtain a hash value. Among them, the hash algorithm can receive input data of any length and generate an output string of a fixed length. This output string is the hash value, that is, the device fingerprint of the terminal device, which can uniquely identify the terminal device. The characteristic of the hash operation is that even a slight change in the data will cause a significant change in the hash value, which increases the uniqueness and security of the device fingerprint. In this embodiment, the hash algorithm used can be an SM3 algorithm, or it can be an MD5 (Message Digest Algorithm 5) algorithm, a SHA (Secure Hash Algorithm) algorithm, etc., which is not limited in this embodiment of the present application.

[0143] According to one embodiment of the present application, according to the formula

[0144] ID=Hash(f1||f2||…||f n ||timetmp)

[0145] Perform hash operations on feature components;

[0146] Among them, ID represents the current device fingerprint, Hash() represents the hash operation of the content in the brackets, {f1,f2,…,f n} represents the feature component, and timstmp represents the timestamp.

[0147] In this embodiment, the key attributes of the terminal device are included in the identification process by extracting feature components. These attributes are relatively stable and relatively unique. These feature components are converted into a hash value of a fixed length through hash operation. This hash value is the device fingerprint, which can uniquely represent the terminal device. Due to the unidirectionality and anti-collision properties of the hash function, even a slight change in the device attributes will result in a significant change in the hash value, which increases the difficulty of forging the device fingerprint, thereby improving security.

[0148] In some embodiments, static authentication includes fingerprint matching;

[0149] Fingerprint matching includes: matching and comparing the current device fingerprint with the original device fingerprint, and determining that the match is successful when the current device fingerprint and the original device fingerprint are the same.

[0150] In this embodiment, the original device fingerprint and the current device fingerprint are both obtained through hash operations, the hash algorithms used are the same, and the types of feature components used are also the same. The timestamp used in the hash operation process of the current device fingerprint is the same as the timestamp used in the hash operation process of the original device fingerprint. In this way, if the terminal device and the terminal device corresponding to the original device fingerprint are the same device, the values ​​of the various feature components used in the current device fingerprint are the same as the values ​​of the various feature components used in the original device fingerprint, and the current device fingerprint is also the same as the original device fingerprint.

[0151] In this embodiment, by comparing the current device fingerprint with the original device fingerprint, if the current device fingerprint and the original device fingerprint are the same, it means that the current terminal device and the terminal device corresponding to the original device fingerprint are the same device, and the current terminal device passes the fingerprint authentication.

[0152] In this embodiment, the device fingerprint is generated by extracting the static attribute information of the terminal device as a feature component and performing a hash operation. Due to the unidirectional and anti-collision characteristics of the hash operation, even a slight change in the amount of data will result in a significant difference in the hash value, thereby greatly enhancing the difficulty of forging the device fingerprint. The introduction of the timestamp records the time point when the original device fingerprint was generated, so that the current device fingerprint and the original device fingerprint are generated using the same timestamp. When the device identity needs to be verified, it is only necessary to compare the current device fingerprint with the stored original device fingerprint to see if they match, and the authentication can be completed quickly, which not only improves the accuracy of the authentication, but also ensures the security of the authentication process.

[0153] In some embodiments, static authentication includes fingerprint matching;

[0154] Fingerprint matching includes: calculating the similarity between the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; and determining that the match is successful when the similarity value is greater than or equal to a matching threshold.

[0155] In this embodiment, if the device fingerprint is not represented by a hash value but by other means, such as numerical data, set data, etc., the similarity between the current device fingerprint and the original device fingerprint can be calculated by a similarity algorithm, and whether the match is successful can be determined based on the size of the similarity value.

[0156] For example, if the device fingerprint is represented by numerical data, the Euclidean distance can be used to calculate the similarity. The calculation formula is as follows:

[0157]

[0158] Among them, sim(X A ,X B ) indicates the current device fingerprint X A With original device fingerprint X B The similarity.

[0159] If the device fingerprint is represented by a collection of data, the Jaccard similarity can be used to measure it. The calculation formula is as follows:

[0160]

[0161] Among them, set A represents the current device fingerprint, set B represents the original device fingerprint, and sim(A,B) represents the similarity.

[0162] In this embodiment, by calculating the similarity value between the current device fingerprint and the original device fingerprint, and comparing the similarity value with the preset matching threshold, it is determined whether the device matches. A certain degree of device fingerprint change can be tolerated, such as normal changes caused by system updates or configuration changes, thereby ensuring security while also improving authentication accuracy and user convenience.

[0163] In some embodiments, static authentication further includes: in the event of a successful match, performing certificateless authentication of the encryption algorithm;

[0164] Certificateless authentication of encryption algorithms includes:

[0165] Obtain information sent by the terminal device, including a digital signature generated by the terminal device through an encryption algorithm;

[0166] Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device;

[0167] Use the public key to verify the digital signature value.

[0168] In this embodiment, the encryption algorithm SM2 algorithm is taken as an example to introduce the encryption algorithm certificateless authentication process. The encryption algorithm certificateless authentication process includes three steps: key generation, digital signature, and signature verification.

[0169] like Figure 2 As shown, key generation includes:

[0170] KGC (Key Generation Center) is initialized to form its own master public and private key pair {P p ,S p}, and the master public-private key pair {P p ,S p} is sent to the terminal device, where P p Represents the public key in the master public-private key pair, S p Represents the private key in the master public-private key pair;

[0171] The terminal device generates a temporary public-private key pair, and sends the temporary public key and device fingerprint in the temporary public-private key pair to the KGC; wherein the temporary public key pair is used to communicate with the KGC;

[0172] KGC generates the public key factor w of the terminal device based on the temporary public key of the terminal device A , the public key factor is the declared public key of the terminal device; and KGC will also generate the private key factor t of the terminal device based on a random number, the device fingerprint and the master public-private key pair of KGC. A ;

[0173] KGC sends the public key factor and private key factor of the terminal device to the terminal device;

[0174] The private key S of the terminal device A It consists of the device fingerprint, KGC's master private key, and the temporary private key of the terminal device. KGC only knows the private key factor but not the private key of the terminal device, which provides additional security.

[0175] The public key P of the terminal device A Can be generated by the private key of the terminal device: P A =[S A ]G, G represents the generator of the elliptic curve; and other devices can generate the public key of the terminal device through the device fingerprint of the terminal device, the master public key of KGC, and the public key factor of the terminal device: P A =w A +[λ]P p ,λ is composed of the declared public key of the terminal device;

[0176] During the key generation process, the public key of the terminal device is generated based on the device fingerprint. Other devices can obtain the public key of the terminal device without applying for a CA (Certificate Authority) certificate, saving maintenance resources.

[0177] The digital signature steps include:

[0178] Calculate M * =Z A ||X WA ||Y WA ||m and e=H(M * ),in,

[0179] Z A =H 256 (ENTLA||ID A ||a||b||X G ||Y G ||X p ||Y p )

[0180] Among them, ENTLA represents the device fingerprint ID A Length, M * is the encoding form of the message, X WA Indicates the X coordinate of the public key point, Y WA represents the Y coordinate of the public key point, m represents the original message, and Z A Represents a value composed of the hash values ​​of multiple parameters, H represents a hash function, H 256 indicates that the hash function is SHA-256, a and b represent the parameters that define the elliptic curve equation in elliptic curve cryptography, and X G represents the X coordinate of the generator G of the elliptic curve, Y G represents the Y coordinate of the generator of the elliptic curve, X p The X coordinate of point P on the elliptic curve, Y p represents the Y coordinate of point P on the elliptic curve. Point P can be a public key point on the elliptic curve. e represents the message digest.

[0181] Randomly select k∈R and calculate (x1,y1)=[k]G; (x1,y1) is the coordinate of the point on the elliptic curve;

[0182] Calculate r = (e + x1) mod n and s = (kr·S A ) / (S A +1)modn, where S Ais the private key of the terminal device, and outputs the signature value (r, s); where r represents the first part of the signature value, s represents the second part of the signature value, mod represents the modular operation, and n is a prime number. n is a parameter in elliptic curve cryptography, which is used to define the modulus of the modular operation.

[0183] The steps to verify the signature include:

[0184] When authentication is required, the terminal device to be authenticated sends the information {f1′,f2′,…,f n ′,timetmp}IDsig(ID), where {f1,f2,…,f n} is a feature component extracted from the static attribute information of the terminal device to be authenticated, timstmp is the timestamp of the original device fingerprint, ID represents the device fingerprint of the terminal device to be authenticated, and sig(ID) represents the digital signature of the terminal device to be authenticated;

[0185] After receiving the information, firstly based on {f1′,f2′,…,f n ′,timetmp} generates the current device fingerprint of the terminal device to be authenticated, and checks whether the current device fingerprint matches the original device fingerprint in the fingerprint library. If not, the authentication fails. If the match is successful, the following signature verification process is performed:

[0186] Verify the validity of the signature values ​​r′ and s′ in sig(ID). If r′∈[1,n-1], s′∈[1,n-1], the signature value is valid and proceed to the next step; otherwise, the verification fails.

[0187] Calculate M *′ =Z A ||X WA ||Y WA ||m and e′=H(M *′ ),in,

[0188] Z A =H 256 (ENTLA||ID A ||a||b||X G ||Y G ||X p ||Y p )

[0189] Among them, M *′ is the encoded form of the message, e′ represents the message digest;

[0190] Calculate t = (r′ + s′) mod n, (x′1, y′1) = [s′] G + [t] P A, R = (e′+x1′) mod n; where (x′1, y′1) represents the public key P of the terminal device A The coordinates of the corresponding point on the elliptic curve, t represents the temporarily calculated value, and R represents the signature verification parameter;

[0191] Compare R and r' to see if they are equal. If they are equal, the verification passes.

[0192] In this embodiment, by introducing encryption algorithm certificateless authentication in the static authentication process, especially by digital signature and public key verification, in which the public key is declared to be generated by the key generation center based on the temporary public and private key pair of the terminal device, the credibility and security of the public key are improved. This authentication method not only avoids the complexity of traditional certificate management, but also reduces the security risks caused by certificate problems.

[0193] In some embodiments, dynamically authenticating the terminal device according to the dynamic behavior information includes:

[0194] Establish a trust assessment model;

[0195] Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model;

[0196] When the security trust value is greater than or equal to the preset threshold, the authentication is confirmed.

[0197] In this embodiment, the trust evaluation model can be a model established according to the calculation rules of the security trust value, or a model built and trained by a machine learning algorithm for determining the security trust value. The embodiment of the present application does not limit the way to establish the trust evaluation model.

[0198] In this embodiment, the behavior information of each dimension in the dynamic behavior information can be analyzed separately. For example, the protocol behavior of the data packets obtained through passive traffic monitoring can be analyzed to identify legitimacy and abnormal traffic. Monitor performance indicators such as CPU utilization, disk utilization, and memory utilization to evaluate the use of system resources, so as to discover potential performance problems or abnormal activities. By monitoring the packet loss rate, transmission delay, and mean time between failures (MTBF), the reliability and stability of the environment can be evaluated to ensure the communication quality and continuous operation of the system. At the same time, analyze the uplink and downlink communication data and business logs to identify abnormal business behavior. By analyzing different indicators, a comprehensive score can be calculated, and the comprehensive score can be determined as a security trust value. The higher the comprehensive score, the more credible the behavior of the terminal device.

[0199] In this embodiment, by establishing a trust evaluation model and calculating the security trust value corresponding to the dynamic behavior information, it is not only possible to detect the current state of the device, but also to make predictions and early warnings based on the device behavior pattern, and to detect abnormal behavior in a timely manner, thereby effectively preventing potential security threats. When the security trust value reaches or exceeds the preset threshold, it can be confirmed that the device has passed the authentication, which indicates that the device's behavior matches the trust model, further enhancing the security and reliability of the authentication.

[0200] The following is an example scenario to introduce the authentication method based on terminal device identification in an embodiment of the present application.

[0201] like Figure 3 As shown, in this scenario example, static attribute information of the terminal device can be collected, including basic information, operating system information, chip architecture information and communication information, and the device fingerprint of the terminal device can be generated based on this information. The dynamic behavior information of the terminal device is obtained through active detection messages and passive traffic monitoring. Specifically, static authentication can be performed using SM2 and SM3 algorithms. For example, the device fingerprint is generated and fingerprint matching is performed through the SM3 algorithm. After the match is successful, certificateless authentication is performed through the SM2 algorithm. The dynamic authentication process can be performed based on the dynamic behavior information of the terminal device. For example, the trust measurement and risk analysis of the terminal device can be performed through the trust evaluation model, thereby generating a security trust value of the terminal device, and implementing dynamic authentication and permission management based on the security trust value. Finally, the terminal device with a security trust value higher than or equal to the preset threshold will pass the dynamic authentication and obtain access rights, and the terminal device with a security trust value lower than the preset threshold will be denied access, thereby ensuring the security and reliability of the system.

[0202] The following is an example of a static authentication process in an embodiment of the present application.

[0203] like Figure 4 As shown, the static authentication process includes the following steps:

[0204] Collect static attribute information of the terminal device, including basic information, operating system information, chip architecture information and communication information, as well as obtain the timestamp of the original device fingerprint generation, and generate the current device fingerprint ID′ based on the static attribute information timestamp;

[0205] Compare the current device fingerprint ID' with the original device fingerprint ID in the fingerprint library. If the two are consistent, continue to execute the subsequent steps; if they are inconsistent, the static authentication fails and the terminal device is not allowed to interact;

[0206] Generate the public key of the terminal device based on the declared public key of the terminal device, the current device fingerprint ID′ and other information;

[0207] Use the public key of the terminal device to verify the signature value (r′, s′);

[0208] If r′∈[1,n-1], then execute the subsequent steps, otherwise static authentication fails and the terminal device is not allowed to interact;

[0209] If s′∈[1,n-1], then execute the subsequent steps, otherwise static authentication fails and the terminal device is not allowed to interact;

[0210] Calculate R. If R = r′, execute the subsequent steps. Otherwise, static authentication fails and the terminal device is not allowed to interact.

[0211] Static authentication succeeds, allowing the terminal device to interact.

[0212] The authentication method based on terminal device identification provided in the embodiment of the present application can be executed by an authentication device based on terminal device identification. In the embodiment of the present application, an authentication method based on terminal device identification is executed by an authentication device based on terminal device identification as an example to illustrate the authentication device based on terminal device identification provided in the embodiment of the present application.

[0213] The embodiment of the present application also provides an authentication device based on terminal device identification.

[0214] like Figure 5 As shown, the authentication device based on the terminal device identification includes:

[0215] The collection module 510 is used to collect static attribute information and dynamic behavior information of the terminal device;

[0216] A fingerprint generation module 520, configured to generate a current device fingerprint for identifying a terminal device according to static attribute information;

[0217] A static authentication module 530, configured to perform static authentication on a terminal device based on a current device fingerprint and an original device fingerprint in a fingerprint library;

[0218] The dynamic authentication module 540 is used to perform dynamic authentication on the terminal device according to the dynamic behavior information when the static authentication passes.

[0219] According to the terminal device identification-based authentication device of the present application, according to the terminal device identification-based authentication method of the present application, static attribute information and dynamic behavior information of the terminal device are collected; the current device fingerprint for identifying the terminal device is generated according to the static attribute information; the terminal device is statically authenticated based on the current device fingerprint and the original device fingerprint in the fingerprint library; if the static authentication passes, the terminal device is dynamically authenticated according to the dynamic behavior information. The embodiment of the present application statically authenticates the terminal device through static attributes, and if the static authentication passes, determines whether the behavior pattern of the terminal device during operation meets expectations by analyzing the dynamic operation of the terminal device. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity fraud attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0220] In some embodiments, the acquisition module 510 is further configured to:

[0221] Collect static attribute information based on hardware drivers and / or API calls.

[0222] In some embodiments, the acquisition module 510 is further configured to:

[0223] By actively sending a detection message to the terminal device, the terminal device collects dynamic behavior information based on feedback from the detection message and / or collects dynamic behavior information through passive traffic monitoring.

[0224] In some embodiments, the fingerprint generation module 520 is further configured to:

[0225] Extracting characteristic components of the terminal device from the static attribute information;

[0226] Perform a hash operation on the feature components and use the resulting hash value as the current device fingerprint.

[0227] In some embodiments, the fingerprint generation module 520 is further configured to:

[0228] According to the formula

[0229] ID=Hash(f1||f2||…||f n ||timetmp)

[0230] Perform hash operations on feature components;

[0231] Among them, ID represents the current device fingerprint, Hash() represents the hash operation of the content in the brackets, {f1,f2,…,f n} represents the feature component, and timstmp represents the timestamp.

[0232] In some embodiments, the static authentication module 530 is further configured to:

[0233] The current device fingerprint is matched and compared with the original device fingerprint. If the current device fingerprint and the original device fingerprint are the same, it is determined that the match is successful.

[0234] In some embodiments, the static authentication module 530 is further configured to:

[0235] The current device fingerprint and the original device fingerprint are similarly calculated to obtain a similarity value representing the current device fingerprint and the original device fingerprint; when the similarity value is greater than or equal to the matching threshold, it is determined that the match is successful.

[0236] In some embodiments, the static authentication module 530 is further configured to:

[0237] In case of successful matching, the encryption algorithm is authenticated without certificate;

[0238] Certificateless authentication of encryption algorithms includes:

[0239] Obtain information sent by the terminal device, including a digital signature generated by the terminal device through an encryption algorithm;

[0240] Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device;

[0241] Use the public key to verify the digital signature value.

[0242] In some embodiments, the dynamic authentication module 540 is further configured to:

[0243] Establish a trust assessment model;

[0244] Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model;

[0245] When the security trust value is greater than or equal to the preset threshold, the authentication is confirmed.

[0246] The authentication device based on the terminal device identification in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than the terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a car electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0247] The authentication device based on the terminal device identification in the embodiment of the present application may be a device having an operating system. The operating system may be a Microsoft (Windows) operating system, an Android (Android) operating system, an IOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0248] In some embodiments, Figure 6 As shown, an embodiment of the present application also provides an electronic device 600, including a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the program is executed by the processor 601, the various processes of the above-mentioned authentication method embodiment based on terminal device identification are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0249] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0250] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned authentication method embodiment based on terminal device identification are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0251] The processor is the processor in the electronic device in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0252] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned authentication method based on terminal device identification when executed by a processor.

[0253] The processor is the processor in the electronic device in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0254] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned authentication method embodiment based on terminal device identification, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0255] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0256] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0257] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0258] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0259] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0260] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. An authentication method based on terminal device identification, characterized in that: include: Collect static attribute information and dynamic behavior information of terminal devices; Generating a current device fingerprint for identifying the terminal device according to the static attribute information; Performing static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint library; When the static authentication is passed, the terminal device is dynamically authenticated according to the dynamic behavior information.

2. The method according to claim 1, characterized in that The static attribute information includes at least one of the basic information of the terminal device, operating system information, chip architecture information, and communication information.

3. The method according to claim 1, characterized in that The dynamic behavior information includes at least one of the communication protocol type, uplink and downlink communication ports, communication behavior information, data field maximum value, data field minimum value, and data field standard deviation of the terminal device.

4. The method according to claim 1, characterized in that: The static attribute information of the collected terminal devices includes: The static attribute information is collected based on hardware drivers and / or API calls.

5. The method according to claim 1, characterized in that The dynamic behavior information of the terminal device collected includes: By actively sending a detection message to the terminal device, the terminal device collects the dynamic behavior information based on feedback from the detection message and / or collects the dynamic behavior information through passive traffic monitoring.

6. The method according to claim 1, characterized in that The generating a current device fingerprint for identifying the terminal device according to the static attribute information includes: Extracting characteristic components of the terminal device from the static attribute information; A hash operation is performed on the feature component, and the obtained hash value is used as the current device fingerprint.

7. The method according to claim 6, characterized in that According to the formula ID=Hash(f1||f2||…||f n ||timetmp) Performing a hash operation on the feature component; Where ID represents the current device fingerprint, Hash() represents the hash operation of the contents in brackets, {f1,f2,…,f n } represents the feature component, and timstmp represents the timestamp.

8. The method according to claim 6, characterized in that The static authentication includes fingerprint matching; The fingerprint matching includes: matching and comparing the current device fingerprint with the original device fingerprint, and determining that the matching is successful if the current device fingerprint and the original device fingerprint are the same.

9. The method according to claim 1, characterized in that: The static authentication includes fingerprint matching; The fingerprint matching includes: calculating the similarity between the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; and determining that the match is successful when the similarity value is greater than or equal to a matching threshold.

10. The method according to claim 8 or 9, characterized in that: The static authentication further includes: in case of successful matching, performing certificateless authentication of the encryption algorithm; The encryption algorithm certificateless authentication includes: Acquire information sent by the terminal device, the information including a digital signature generated by the terminal device through an encryption algorithm; Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device; The signature value of the digital signature is verified using the public key.

11. The method according to claim 1, characterized in that: The dynamically authenticating the terminal device according to the dynamic behavior information includes: Establish a trust assessment model; Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model; When the security trust value is greater than or equal to a preset threshold, the authentication is confirmed to be successful.

12. An authentication device based on terminal device identification, characterized in that: include: A collection module, used to collect static attribute information and dynamic behavior information of terminal devices; A fingerprint generation module, used to generate a current device fingerprint for identifying the terminal device according to the static attribute information; A static authentication module, used to perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint library; The dynamic authentication module is used to dynamically authenticate the terminal device according to the dynamic behavior information when the static authentication passes.

13. The device according to claim 12, characterized in that The fingerprint generation module is also used for: Extracting characteristic components of the terminal device from the static attribute information; A hash operation is performed on the feature component, and the obtained hash value is used as the current device fingerprint.

14. The device according to claim 12, characterized in that The static authentication module is also used for: The current device fingerprint and the original device fingerprint are matched and compared, and if the current device fingerprint and the original device fingerprint are the same, it is determined that the match is successful.

15. The device according to claim 12, characterized in that The static authentication module is also used for: A similarity calculation is performed on the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; when the similarity value is greater than or equal to a matching threshold, it is determined that the match is successful.

16. The device according to claim 14 or 15, characterized in that The static authentication module is also used for: In case of successful matching, the encryption algorithm is authenticated without certificate; The encryption algorithm certificateless authentication includes: Acquire information sent by the terminal device, the information including a digital signature generated by the terminal device through an encryption algorithm; Calculate the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by the key generation center according to the temporary public-private key pair of the terminal device; The signature value of the digital signature is verified using the public key.

17. The device according to claim 12, characterized in that The dynamic authentication module is also used for: Establish a trust assessment model; Calculate the security trust value corresponding to the dynamic behavior information according to the trust evaluation model; When the security trust value is greater than or equal to a preset threshold, the authentication is confirmed to be successful.

18. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 11 is implemented.

19. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images