Authentication method and device based on terminal device identifier and storage medium

Abstract

The application discloses a terminal device identification-based authentication method and device and a storage medium, and belongs to the technical field of communication security. The method comprises the following steps: collecting static attribute information and dynamic behavior information of a terminal device; generating a current device fingerprint for identifying the terminal device according to the static attribute information; performing static authentication on the terminal device based on the current device fingerprint and original device fingerprints in a fingerprint library; and performing dynamic authentication on the terminal device according to the dynamic behavior information in the case that the static authentication is passed. According to the application, the static authentication is performed on the terminal device through static attributes, and in the case that the static authentication is passed, the dynamic operation of the terminal device is analyzed to determine whether the behavior mode of the terminal device in the operation process is in line with the expectation. The multi-dimensional authentication mechanism combining the static and dynamic modes can not only resist traditional identity impersonation attacks, but also effectively prevent complex network threats, and the reliability and security of the authentication process are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of communication security, and particularly relates to a terminal device identification-based authentication method and device and storage medium. BACKGROUND

[0002] With the gradual acceleration of the construction of source, network, load and storage links of new power systems, a large number of distributed terminals represented by new energy need to be connected to the power monitoring system, which will bring major security challenges to the safety of the power grid. The demand for identity authentication of equipment has become more urgent.

[0003] In related technologies, Internet of Things device authentication mainly includes MAC (Media Access Control Address) based authentication, identification based authentication, and certificate based authentication. The MAC based authentication and the identification based authentication are easy to be tampered and forged, and the certificate based authentication method usually relies on certificate management, which needs to distribute and update certificates, process a large number of certificates, and ensure the integrity and credibility of the identity verification process. The process is complex and the maintenance cost is high, which is difficult to adapt to the changing device environment and real-time authentication requirements in modern power systems. SUMMARY

[0004] The present application aims to at least solve one of the technical problems existing in the prior art. To this end, the present application provides a terminal device identification-based authentication method, device and storage medium to improve the reliability and security of the authentication process.

[0005] In a first aspect, the present application provides a terminal device identification-based authentication method, comprising:

[0006] Collecting static attribute information and dynamic behavior information of a terminal device;

[0007] Generating a current device fingerprint for identifying the terminal device according to the static attribute information;

[0008] Performing static authentication on the terminal device based on the current device fingerprint and an original device fingerprint in a fingerprint library;

[0009] In the case that the static authentication is passed, performing dynamic authentication on the terminal device according to the dynamic behavior information.

[0010] According to the terminal device identification-based authentication method of the present application, static attribute information and dynamic behavior information of a terminal device are collected; a current device fingerprint for identifying the terminal device is generated according to the static attribute information; the terminal device is subjected to static authentication based on the current device fingerprint and original device fingerprints in a fingerprint library; and the terminal device is subjected to dynamic authentication according to the dynamic behavior information in the case of passing the static authentication. The embodiments of the present application perform static authentication on the terminal device through static attributes, and determine whether the behavior mode of the terminal device in the operation process conforms to the expectation by analyzing the dynamic operation of the terminal device in the case of passing the static authentication. This multi-dimensional authentication mechanism combining static and dynamic can not only resist traditional identity impersonation attacks, but also effectively prevent complex network threats, thereby improving the reliability and security of the authentication process.

[0011] According to an embodiment of the present application, the static attribute information includes at least one of basic information, operating system information, chip architecture information and communication information of the terminal device.

[0012] In this embodiment, the static attribute information such as device basic information, operating system information, chip architecture and communication information provides a unique identity information for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing accurate reference for the authentication process.

[0013] According to an embodiment of the present application, the dynamic behavior information includes at least one of communication protocol type, uplink and downlink communication port, communication behavior information, data domain maximum value, data domain minimum value and data domain standard deviation of the terminal device.

[0014] In this embodiment, the dynamic behavior information of the terminal device such as communication protocol type, uplink and downlink communication port, communication behavior information, data domain maximum value, data domain minimum value and data domain standard deviation can provide accurate behavior portrait for the terminal device, which can not only capture the normal use mode of the device, but also identify abnormal behavior, thereby effectively preventing potential security threats.

[0015] According to an embodiment of the present application, collecting static attribute information of the terminal device includes:

[0016] The static attribute information is collected based on hardware driver and / or API call.

[0017] In this embodiment, the static attribute information of the terminal device is collected by using hardware driver and / or API call, which can obtain more accurate and comprehensive device information. The hardware driver provides a direct way of communicating with hardware, which can access and control the functions of hardware devices, and the API call allows the software level to access these hardware information.

[0018] According to one embodiment of the present application, collecting dynamic behavior information of the terminal device comprises:

[0019] The terminal device collects the dynamic behavior information based on feedback of a probe message actively sent by the terminal device and / or collects the dynamic behavior information through passive traffic monitoring.

[0020] In this embodiment, a real network request can be simulated through active probe messages, thereby triggering a response of the terminal device and collecting information such as a communication protocol type and port usage of the terminal device. Passive traffic monitoring can monitor network activities of the terminal device in real time and record communication behavior and data transmission characteristics of the terminal device, such as maximum value, minimum value and standard deviation of a data field and other statistical information. This way of collecting dynamic information can comprehensively monitor behavior patterns of the terminal device.

[0021] According to one embodiment of the present application, generating a current device fingerprint for identifying the terminal device according to the static attribute information comprises:

[0022] extracting feature components of the terminal device from the static attribute information;

[0023] performing a hash operation on the feature components, and taking a hash value obtained as the current device fingerprint.

[0024] According to one embodiment of the present application, according to a formula

[0025] ID = Hash (f1||f2||…||f n ||timetmp)

[0026] performing a hash operation on the feature components;

[0027] wherein ID represents a current device fingerprint, Hash() represents a hash operation on content in parentheses, {f1, f2, …, f n} represents feature components, and timstmp represents a time stamp.

[0028] In this embodiment, feature components are extracted so that key attributes of the terminal device are included in the identification process. These attributes are relatively stable and relatively unique. The feature components are converted into a fixed-length hash value through a hash operation. The hash value is a device fingerprint and can uniquely represent the terminal device. Since the hash function is unidirectional and collision-resistant, even a slight change in device attributes will cause a significant change in the hash value, which increases the difficulty of forging a device fingerprint and improves security.

[0029] According to one embodiment of the present application, the static authentication comprises fingerprint matching;

[0030] The fingerprint matching comprises: matching and comparing the current device fingerprint and the original device fingerprint, and determining that the matching is successful in a case where the current device fingerprint and the original device fingerprint are the same.

[0031] In this embodiment, the device fingerprint is generated by extracting the static attribute information of the terminal device as a feature component and performing a hash operation. Due to the one-way and collision-resistant characteristics of the hash operation, even a slight change in the data volume will cause a significant difference in the hash value, thereby greatly enhancing the difficulty of forging the device fingerprint. The introduction of the timestamp records the time point at which the original device fingerprint is generated, so that the current device fingerprint and the original device fingerprint are generated by using the same timestamp. When the device identity needs to be verified, it is only necessary to compare whether the current device fingerprint matches the stored original device fingerprint, so that the authentication can be quickly completed. This not only improves the accuracy of the authentication, but also guarantees the security of the authentication process.

[0032] According to one embodiment of the present application, the static authentication comprises fingerprint matching;

[0033] The fingerprint matching comprises: performing similarity calculation on the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; and determining that the matching is successful in a case where the similarity value is greater than or equal to a matching threshold.

[0034] In this embodiment, the similarity value between the current device fingerprint and the original device fingerprint is calculated, and the similarity value is compared with a preset matching threshold, so as to determine whether the devices match. A certain degree of change in the device fingerprint can be tolerated, for example, normal changes caused by system updates or configuration changes, so that the security is ensured, and the accuracy of the authentication and the convenience of the user are improved.

[0035] According to one embodiment of the present application, the static authentication further comprises: in a case where the matching is successful, performing certificateless authentication of an encryption algorithm;

[0036] The certificateless authentication of the encryption algorithm comprises:

[0037] Obtaining information sent by the terminal device, the information comprising a digital signature generated by the terminal device through an encryption algorithm;

[0038] Calculating the public key of the terminal device according to the declared public key of the terminal device; the declared public key is generated by a key generation center according to a temporary public-private key pair of the terminal device;

[0039] Verifying the signature value of the digital signature by using the public key.

[0040] In this embodiment, certificate-free authentication using cryptographic algorithms is introduced into the static authentication process, particularly through digital signatures and public key verification. The public key is declared to be generated by a key generation center based on a temporary public-private key pair from the terminal device, thus improving the trustworthiness and security of the public key. This authentication method not only avoids the complexity of traditional certificate management but also reduces security risks caused by certificate issues.

[0041] According to one embodiment of this application, the step of dynamically authenticating the terminal device based on the dynamic behavior information includes:

[0042] Establish a trust assessment model;

[0043] Calculate the security trust value corresponding to the dynamic behavior information based on the trust assessment model;

[0044] If the security trust value is greater than or equal to a preset threshold, authentication is confirmed.

[0045] In this embodiment, by establishing a trust assessment model and calculating the security trust value corresponding to dynamic behavior information, it is possible not only to detect the current state of the device but also to predict and issue warnings based on the device's behavior patterns, promptly identifying abnormal behavior and effectively preventing potential security threats. When the security trust value reaches or exceeds a preset threshold, the device can be confirmed to have passed authentication, indicating that the device's behavior matches the trust model, further enhancing the security and reliability of the authentication.

[0046] Secondly, this application provides an authentication device based on a terminal device identifier, comprising:

[0047] The data acquisition module is used to collect static attribute information and dynamic behavior information of terminal devices;

[0048] The fingerprint generation module is used to generate a current device fingerprint for identifying the terminal device based on the static attribute information;

[0049] The static authentication module is used to perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint database;

[0050] The dynamic authentication module is used to perform dynamic authentication on the terminal device based on the dynamic behavior information, provided that static authentication has passed.

[0051] According to the authentication apparatus and method based on terminal device identifier of this application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated based on the static attribute information; static authentication of the terminal device is performed based on the current device fingerprint and the original device fingerprint in the fingerprint database; and if the static authentication is successful, dynamic authentication of the terminal device is performed based on the dynamic behavior information. This embodiment of the application performs static authentication of the terminal device through static attributes, and if the static authentication is successful, analyzes the dynamic operation of the terminal device to determine whether the behavior pattern of the terminal device during the operation process meets expectations. This multi-dimensional authentication mechanism combining static and dynamic methods can not only resist traditional identity spoofing attacks, but also effectively prevent complex network threats, improving the reliability and security of the authentication process.

[0052] According to one embodiment of this application, the fingerprint generation module is further configured to:

[0053] Extract the feature components of the terminal device from the static attribute information;

[0054] Perform a hash operation on the feature components and use the resulting hash value as the fingerprint of the current device.

[0055] According to one embodiment of this application, the static authentication module is further configured to:

[0056] The current device fingerprint and the original device fingerprint are matched and compared. If the current device fingerprint and the original device fingerprint are the same, the match is determined to be successful.

[0057] According to one embodiment of this application, the static authentication module is further configured to:

[0058] A similarity calculation is performed on the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; if the similarity value is greater than or equal to the matching threshold, a successful match is determined.

[0059] According to one embodiment of this application, the static authentication module is further configured to:

[0060] If a match is successful, the encryption algorithm will be authenticated without a certificate.

[0061] The certificate-free authentication of the encryption algorithm includes:

[0062] Obtain information sent by the terminal device, the information including a digital signature generated by the terminal device using an encryption algorithm;

[0063] The public key of the terminal device is calculated based on the declared public key of the terminal device; the declared public key is generated by the key generation center based on the temporary public-private key pair of the terminal device.

[0064] The signature value of the digital signature is verified using the public key.

[0065] According to one embodiment of this application, the dynamic authentication module is further configured to:

[0066] Establish a trust assessment model;

[0067] Calculate the security trust value corresponding to the dynamic behavior information based on the trust assessment model;

[0068] If the security trust value is greater than or equal to a preset threshold, authentication is confirmed.

[0069] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the authentication method based on the terminal device identifier as described in the first aspect above.

[0070] Fourthly, this application provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the authentication method based on terminal device identifier as described in the first aspect above.

[0071] Fifthly, this application provides a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the authentication method based on terminal device identifier as described in the first aspect above.

[0072] In a sixth aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements the authentication method based on a terminal device identifier as described in the first aspect above.

[0073] The above-described one or more technical solutions in the embodiments of this application have at least one of the following technical effects:

[0074] According to the terminal device identifier-based authentication method of this application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated based on the static attribute information; static authentication of the terminal device is performed based on the current device fingerprint and the original device fingerprint in the fingerprint database; and if the static authentication is successful, dynamic authentication of the terminal device is performed based on the dynamic behavior information. This embodiment of the application performs static authentication of the terminal device through static attributes, and if the static authentication is successful, analyzes the dynamic operation of the terminal device to determine whether the behavior pattern of the terminal device during the operation process meets expectations. This multi-dimensional authentication mechanism combining static and dynamic methods can not only resist traditional identity spoofing attacks, but also effectively prevent complex network threats, improving the reliability and security of the authentication process.

[0075] Furthermore, in some embodiments, static attribute information, such as basic device information, operating system information, chip architecture, and communication information, is used to provide a unique identity for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing an accurate reference for the authentication process.

[0076] Furthermore, in some embodiments, by collecting dynamic behavior information of the terminal device, such as communication protocol type, uplink and downlink communication ports, communication behavior information, maximum value, minimum value and standard deviation of data field, a precise behavioral profile of the terminal device can be provided. This not only captures the normal usage mode of the device, but also identifies abnormal behavior, thereby effectively preventing potential security threats.

[0077] Furthermore, in some embodiments, by using hardware drivers and / or API calls to collect static attribute information of the terminal device, more accurate and comprehensive device information can be obtained. Hardware drivers provide a direct means of communicating with the hardware, allowing access to and control of the hardware device's functions, while API calls allow software-level access to this hardware information.

[0078] Furthermore, in some embodiments, active probing messages can simulate real network requests, thereby triggering a response from the terminal device and collecting information such as its communication protocol type and port usage. Passive traffic monitoring can monitor the device's network activity in real time, recording its communication behavior and data transmission characteristics, such as statistical information like the maximum, minimum, and standard deviation of data fields. This dynamic information collection method can comprehensively monitor the behavior patterns of the terminal device.

[0079] Furthermore, in some embodiments, key attributes of the terminal device are incorporated into the identification process by extracting feature components. These attributes are relatively stable and relatively unique. These feature components are transformed into a fixed-length hash value through hash operations. This hash value is the device fingerprint, which can uniquely represent the terminal device. Due to the one-wayness and collision resistance of the hash function, even small changes in device attributes will lead to significant changes in the hash value. This increases the difficulty of forging device fingerprints, thereby improving security.

[0080] Furthermore, in some embodiments, a device fingerprint is generated by extracting the static attribute information of the terminal device into feature components and performing hash operations. Due to the one-way and collision-resistant nature of hash operations, even a small change in the amount of data will lead to a significant difference in the hash value, thereby greatly increasing the difficulty of forging device fingerprints. The introduction of timestamps records the time point when the original device fingerprint was generated, so that the current device fingerprint and the original device fingerprint were generated using the same timestamp. When it is necessary to verify the device identity, it is only necessary to compare whether the current device fingerprint matches the stored original device fingerprint to quickly complete the authentication, which not only improves the accuracy of authentication but also ensures the security of the authentication process.

[0081] Furthermore, in some embodiments, by calculating the similarity value between the current device fingerprint and the original device fingerprint, and comparing the similarity value with a preset matching threshold, it is determined whether the device matches. This can tolerate a certain degree of device fingerprint change, such as normal changes caused by system updates or configuration changes, thereby improving the accuracy of authentication and user convenience while ensuring security.

[0082] Furthermore, in some embodiments, certificate-free authentication using cryptographic algorithms is introduced into the static authentication process, particularly through digital signatures and public key verification. Here, the public key is declared to be generated by a key generation center based on a temporary public-private key pair from the terminal device, thereby improving the credibility and security of the public key. This authentication method not only avoids the complexity of traditional certificate management but also reduces security risks caused by certificate issues.

[0083] Furthermore, in some embodiments, by establishing a trust assessment model and calculating the security trust value corresponding to dynamic behavioral information, it is possible not only to detect the current state of the device but also to predict and issue warnings based on the device's behavioral patterns, promptly identifying abnormal behavior and effectively preventing potential security threats. When the security trust value reaches or exceeds a preset threshold, the device can be confirmed to have passed authentication, indicating that the device's behavior matches the trust model, further enhancing the security and reliability of authentication.

[0084] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0085] The above and / or additional aspects and advantages of this application will become apparent and readily understood in conjunction with the following description of the embodiments in conjunction with the accompanying drawings, wherein:

[0086] Figure 1 This is a flowchart illustrating the authentication method based on terminal device identifier provided in an embodiment of this application;

[0087] Figure 2 This is a schematic diagram of the certificateless authentication process of the encryption algorithm provided in the embodiments of this application;

[0088] Figure 3 This is a schematic diagram illustrating a scenario example provided in an embodiment of this application;

[0089] Figure 4 This is a schematic diagram illustrating an example of a static authentication process provided in an embodiment of this application;

[0090] Figure 5 This is a schematic diagram of the structure of the authentication device based on the terminal device identifier provided in the embodiments of this application;

[0091] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0092] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0093] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0094] MAC-based authentication is a network access control technology that authenticates users using the MAC address of a terminal device. Its advantage is that user terminals do not need to install client software, and the authentication process does not require users to manually enter usernames and passwords.

[0095] Identity-based authentication is an asymmetric public-key cryptography system where a user's identifier (such as an email address or IP address) serves directly as the public key, while the user's private key is calculated by a key generation center based on the system master key and the user's identifier. This method simplifies the key management process, eliminates the need for certificates, and directly associates user identity with the public key, making it suitable for scenarios requiring streamlined management processes.

[0096] Certificate-based authentication uses digital certificates to verify a user's identity. A digital certificate contains the user's identity information, public key, and the digital signature of the certificate authority. This authentication method provides a high level of security because the issuance and verification of certificates involve a trusted third-party certification authority. When a user logs in, they send their certificate to the server, which verifies the certificate's validity to confirm the user's identity.

[0097] However, MAC-based and identifier-based authentication are easily tampered with and forged. Certificate-based authentication methods usually rely on certificate management, which requires the distribution and renewal of certificates, the handling of a large number of certificates, and ensuring the integrity and credibility of the authentication process. The process is complex and has high maintenance costs, making it difficult to adapt to the changing equipment environment and real-time authentication needs of modern power systems.

[0098] To address at least one of the aforementioned technical problems, this application proposes an authentication method, apparatus, and storage medium based on a terminal device identifier. The following, in conjunction with the accompanying drawings, provides a detailed description of the authentication method, apparatus, and storage medium based on a terminal device identifier provided in this application, through specific embodiments and application scenarios.

[0099] Among them, the authentication method based on the terminal device identifier can be applied to the terminal, and can be executed by the hardware or software in the terminal.

[0100] The terminal includes, but is not limited to, portable communication devices such as mobile phones or tablets with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads). It should also be understood that, in some embodiments, the terminal may not be a portable communication device, but rather a desktop computer with touch-sensitive surfaces (e.g., touchscreen displays and / or touchpads).

[0101] The following embodiments describe a terminal including a display and a touch-sensitive surface. However, it should be understood that the terminal may include one or more other physical user interface devices such as a physical keyboard, mouse, and joystick.

[0102] The authentication method based on terminal device identifier provided in this application embodiment can be executed by an electronic device or a functional module or functional entity in an electronic device that can implement the authentication method based on terminal device identifier. The electronic devices mentioned in this application embodiment include, but are not limited to, mobile phones, tablets, computers, cameras and wearable devices. The following uses an electronic device as the execution subject to illustrate the authentication method based on terminal device identifier provided in this application embodiment.

[0103] like Figure 1 As shown, the authentication method based on the terminal device identifier includes steps 110, 120, 130 and 140.

[0104] Step 110: Collect static attribute information and dynamic behavior information of the terminal device.

[0105] In this application embodiment, the terminal device can be any device that requires security authentication. For example, in the electrical field, the terminal device can be a generator, transformer, smart meter, substation automation equipment, etc.; in the industrial automation field, the terminal device can be a sensor, actuator, etc.; in the medical device field, the terminal device can be various medical devices, such as medical imaging equipment, monitors, etc. This application embodiment does not limit the terminal device.

[0106] In this embodiment, static attribute information can be attribute information inherent to the terminal device that does not change frequently. Static attribute information can be determined during device manufacturing or configured during device setup and remain relatively stable during device use.

[0107] In some embodiments, static attribute information may include basic information of the terminal device, such as device model, manufacturer, serial number, etc.; it may also include operating system information, such as operating system type, version number, etc.; it may also include hardware configuration, such as CPU model, memory size, hard disk capacity, etc.; it may also include communication information, such as MAC address, IP address (Internet Protocol Address), subnet mask, etc.; and it may also include chip architecture information, such as instruction set architecture, execution unit, etc. Of course, static attribute information may also include other information, which is not limited in this embodiment.

[0108] In this embodiment, static attribute information, such as basic device information, operating system information, chip architecture and communication information, provides a unique identity for the terminal device, which helps to generate a stable and unique device fingerprint, thereby providing an accurate reference for the authentication process.

[0109] In this embodiment, dynamic behavior information can be information related to the behavior patterns and activity states of the terminal device during operation. Dynamic behavior information changes continuously as the device is used, reflecting the actual operating state of the device.

[0110] In some embodiments, dynamic behavior information may include communication protocol types, such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol), HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), etc.; it may also include uplink and downlink communication ports, such as the network port number used by the terminal device; it may also include communication behavior information, such as the frequency, size, and direction of data transmission; it may also include data characteristics, such as statistical information such as the maximum value, minimum value, and standard deviation of the data field; and it may also include access patterns, such as the frequency, time, and duration of user logins. Of course, dynamic behavior information may also include other information, which is not limited in this embodiment.

[0111] In this embodiment, by collecting dynamic behavior information of the terminal device, such as communication protocol type, uplink and downlink communication ports, communication behavior information, maximum value, minimum value and standard deviation of data field, a precise behavioral profile of the terminal device can be provided. This not only captures the normal usage mode of the device, but also identifies abnormal behavior, thereby effectively preventing potential security threats.

[0112] In the embodiments of this application, static attribute information and dynamic behavior information of the terminal device can be collected in any way. For example, the traffic of the terminal device can be monitored to obtain dynamic behavior information, and static attribute information fed back by the terminal device can be obtained by initiating a request to the terminal device.

[0113] Step 120: Generate the current device fingerprint to identify the terminal device based on the static attribute information.

[0114] In this application embodiment, a device fingerprint is a unique identifier used to identify and distinguish terminal devices. That is, different terminal devices have different device fingerprints, and the terminal device that the device fingerprint uniquely corresponds to can be determined through the device fingerprint.

[0115] In this embodiment, the static attribute information of the terminal device can be analyzed to find unique and stable feature components. These feature components may include device serial number, MAC address, International Mobile Equipment Identity (IMEI), operating system version, motherboard serial number, etc. These feature components are typically different across different terminal devices, or they are relatively stable, not easily changed, and not easily tampered with or forged. Combining these feature components can generate a device fingerprint corresponding to the terminal device. For example, these feature components can be combined to represent the device fingerprint using vectors, numerical values, or other arbitrary methods.

[0116] Step 130: Perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint database.

[0117] In this embodiment, the original device fingerprint is a device fingerprint pre-stored in a fingerprint database. This device fingerprint is used to authenticate the identity of the terminal device. For example, a device fingerprint is pre-generated for terminal device A and stored in the database as the original device fingerprint. When an authentication of a terminal device is required, the current device fingerprint can be generated based on the static attribute information of the terminal device. Then, the original device fingerprint is used to authenticate the current device fingerprint. If the authentication is successful, it indicates that the terminal device may be terminal device A.

[0118] In the embodiments of this application, static authentication refers to an authentication method that does not change frequently. Static authentication relies on pre-set, infrequently changing information for identity verification. For example, the original device fingerprint is pre-stored, and the current device fingerprint can be compared with the original device fingerprint. If they are the same or similar, authentication is successful.

[0119] Step 140: If static authentication is successful, perform dynamic authentication on the terminal device based on dynamic behavior information.

[0120] In this embodiment, dynamic authentication is a security mechanism that dynamically updates authentication information. The authentication information in dynamic authentication may differ at different times, thus increasing security. For example, the dynamic behavior information of a terminal device may differ at different times.

[0121] In this embodiment, the terminal device can be evaluated based on dynamic behavior information. For example, the behavior of the terminal device can be analyzed based on indicators such as CPU (Central Processing Unit) utilization, access frequency, disk utilization, and transmission latency. For instance, if multiple indicators are abnormal, the terminal device's behavior can be considered abnormal, possibly indicating a malicious device. If all indicators are normal, the terminal device's behavior can be considered normal, and authentication can be successful.

[0122] According to the terminal device identifier-based authentication method of this application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated based on the static attribute information; static authentication of the terminal device is performed based on the current device fingerprint and the original device fingerprint in the fingerprint database; and if the static authentication is successful, dynamic authentication of the terminal device is performed based on the dynamic behavior information. This embodiment of the application performs static authentication of the terminal device through static attributes, and if the static authentication is successful, it analyzes the dynamic operation of the terminal device to determine whether the behavior pattern of the terminal device during the operation process meets expectations. This multi-dimensional authentication mechanism combining static and dynamic methods can not only resist traditional identity spoofing attacks, but also effectively prevent complex network threats, improving the reliability and security of the authentication process.

[0123] In some embodiments, the static attribute information of the terminal device collected includes:

[0124] Static attribute information is collected based on hardware drivers and / or API calls.

[0125] In this embodiment, the hardware driver acts as a bridge between the operating system and the hardware device, allowing the operating system to control and monitor the hardware device. Through the driver, the functions of the hardware device can be accessed and controlled, thereby obtaining static attribute information of the terminal device.

[0126] APIs (Application Programming Interfaces) enable software applications to request data or services from other programs. Through the APIs provided by terminal devices, applications can call specific functions or commands to obtain static attribute information about the device.

[0127] In this embodiment, by using hardware drivers and / or API calls to collect static attribute information of the terminal device, more accurate and comprehensive device information can be obtained. Hardware drivers provide a direct means of communicating with the hardware, allowing access to and control of the hardware device's functions, while API calls allow software-level access to this hardware information.

[0128] In some embodiments, collecting dynamic behavior information of the terminal device includes:

[0129] By actively sending probe messages to the terminal device, the terminal device collects dynamic behavior information based on the feedback of the probe messages and / or collects dynamic behavior information through passive traffic monitoring.

[0130] In this embodiment, the communication protocol between devices may include data link layer protocols, network layer protocols, transport layer protocols, and application layer protocols. For example, transport layer protocols may include TCP and UDP protocols, and application layer protocols may include HTTP, DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol), SSH (Secure Shell), and other protocols.

[0131] Proactively sending probe packets to terminal devices can employ protocols such as Modbus, IEC 61850, and S7COMM. For example, network scanning tools can be used to send probe packets and identify the device's operating system, open ports, and running services based on the characteristics of the terminal device's response, such as TCP / IP stack behavior. This method can probe specific IP addresses, even if the terminal device does not actively generate traffic, probe packets can still be constructed for detection.

[0132] Passive traffic monitoring collects behavioral information about end devices by monitoring network traffic. For example, network analysis tools or intrusion detection systems can be used to capture data packets passing through end devices and analyze these packets to obtain information such as communication protocol type, port, and amount of data transmitted. Passive traffic monitoring typically does not require sending data packets to end devices; instead, it uses packet capture tools to collect data packets flowing through the network and then extracts dynamic behavioral information from these packets.

[0133] In this embodiment, active probing messages can simulate real network requests, triggering responses from terminal devices and collecting information such as their communication protocol type and port usage. Passive traffic monitoring, on the other hand, can monitor the device's network activity in real time, recording its communication behavior and data transmission characteristics, such as statistical information like the maximum, minimum, and standard deviation of data fields. This dynamic information collection method enables comprehensive monitoring of the terminal device's behavioral patterns.

[0134] In some embodiments, generating a current device fingerprint for identifying a terminal device based on static attribute information includes:

[0135] Extracting feature components of the terminal device from static attribute information;

[0136] Perform a hash operation on the feature components and use the resulting hash value as the fingerprint of the current device.

[0137] According to one embodiment of this application, based on the formula

[0138] ID = Hash(f1||f2||…||f n ||timetmp)

[0139] Perform hash operations on the feature components;

[0140] Where ID represents the current device fingerprint, and Hash() represents performing a hash operation on the content within the parentheses, {f1, f2, ..., f n} represents the feature component, and timstmp represents the timestamp.

[0141] In this embodiment, the feature components may be information such as device serial number, MAC address, International Mobile Equipment Identity (IMEI), operating system version, motherboard serial number, etc. These feature components are usually different in different terminal devices, or these feature components are relatively stable, not easy to change, and not easy to be tampered with or forged. Combining these feature components can generate the device fingerprint corresponding to the terminal device.

[0142] In this embodiment, a hash algorithm can be used to perform hash operations on the feature components to obtain a hash value. The hash algorithm can accept input data of arbitrary length and produce a fixed-length output string. This output string is the hash value, i.e., the device fingerprint of the terminal device, which uniquely identifies the terminal device. A characteristic of hash operations is that even small changes in data will lead to significant changes in the hash value, which increases the uniqueness and security of the device fingerprint. In this embodiment, the hash algorithm used can be the SM3 algorithm, or the MD5 (Message Digest Algorithm 5) algorithm, SHA (Secure Hash Algorithm), etc., and this application embodiment is not limited to this.

[0143] According to one embodiment of this application, the formula can be used...

[0144] ID = Hash(f1||f2||…||f n ||timetmp)

[0145] Perform hash operations on the feature components;

[0146] Where ID represents the current device fingerprint, and Hash() represents performing a hash operation on the content within the parentheses, {f1, f2, ..., f n} represents the feature component, and timstmp represents the timestamp.

[0147] In this embodiment, key attributes of the terminal device are incorporated into the identification process by extracting feature components. These attributes are relatively stable and relatively unique. These feature components are converted into a fixed-length hash value through hash operation. This hash value is the device fingerprint, which can uniquely represent the terminal device. Due to the one-wayness and collision resistance of the hash function, even small changes in device attributes will lead to significant changes in the hash value. This increases the difficulty of forging device fingerprints, thereby improving security.

[0148] In some embodiments, static authentication includes fingerprint matching;

[0149] Fingerprint matching includes: comparing the current device fingerprint with the original device fingerprint; if the current device fingerprint and the original device fingerprint are the same, the match is considered successful.

[0150] In this embodiment, both the original device fingerprint and the current device fingerprint are obtained through hash operations, using the same hash algorithm and the same type of feature components. The timestamp used in the hash operation of the current device fingerprint is the same as the timestamp used in the hash operation of the original device fingerprint. Thus, if the terminal device corresponding to the original device fingerprint is the same device, and the values ​​of each feature component used in the current device fingerprint are the same as the values ​​of each feature component used in the original device fingerprint, then the current device fingerprint and the original device fingerprint are also identical.

[0151] In this embodiment, by comparing the current device fingerprint with the original device fingerprint, if the current device fingerprint and the original device fingerprint are the same, it means that the current terminal device and the terminal device corresponding to the original device fingerprint are the same device, and the current terminal device passes fingerprint authentication.

[0152] In this embodiment, a device fingerprint is generated by extracting the static attribute information of the terminal device into feature components and performing hash operations. Due to the one-way and collision-resistant nature of hash operations, even a small change in the amount of data will lead to a significant difference in the hash value, thereby greatly increasing the difficulty of forging device fingerprints. The introduction of timestamps records the time point when the original device fingerprint was generated, so that the current device fingerprint and the original device fingerprint are generated using the same timestamp. When it is necessary to verify the device identity, it is only necessary to compare whether the current device fingerprint matches the stored original device fingerprint to quickly complete the authentication. This not only improves the accuracy of authentication but also ensures the security of the authentication process.

[0153] In some embodiments, static authentication includes fingerprint matching;

[0154] Fingerprint matching includes: calculating the similarity between the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; if the similarity value is greater than or equal to the matching threshold, the match is determined to be successful.

[0155] In this embodiment, if the device fingerprint is not represented by a hash value, but by other means, such as numerical data or set data, the similarity between the current device fingerprint and the original device fingerprint can be calculated using a similarity algorithm, and the matching success can be determined based on the magnitude of the similarity value.

[0156] For example, if device fingerprints are represented by numerical data, similarity can be calculated using Euclidean distance, as shown in the following formula:

[0157]

[0158] Where, sim(X) A ,X B ) indicates the current device fingerprint X A fingerprint X from original device B The similarity.

[0159] If device fingerprints are represented using aggregate data, then Jaccard similarity can be used to measure them, calculated as follows:

[0160]

[0161] Here, set A represents the current device fingerprint, set B represents the original device fingerprint, and sim(A,B) represents the similarity.

[0162] In this embodiment, the similarity value between the current device fingerprint and the original device fingerprint is calculated, and the similarity value is compared with a preset matching threshold to determine whether the device matches. This can tolerate a certain degree of device fingerprint change, such as normal changes caused by system updates or configuration changes. Thus, while ensuring security, it also improves the accuracy of authentication and the convenience of users.

[0163] In some embodiments, static authentication further includes: performing certificateless authentication of the encryption algorithm if a match is successful;

[0164] Certificate-free authentication of encryption algorithms includes:

[0165] Obtain information sent by the terminal device, including a digital signature generated by the terminal device using an encryption algorithm;

[0166] The public key of the terminal device is calculated based on the declared public key of the terminal device; the declared public key is generated by the key generation center based on the temporary public-private key pair of the terminal device.

[0167] Use the public key to verify the signature value of the digital signature.

[0168] In this embodiment, the SM2 encryption algorithm is used as an example to illustrate the certificateless authentication process. The certificateless authentication process includes three steps: key generation, digital signature, and signature verification.

[0169] like Figure 2 As shown, key generation includes:

[0170] KGC (Key Generation Center) initialization, forming its own master-public-private key pair {P p ,S p}, and pair the master public key with {P p ,S p}Sent to the terminal device, where P p S represents the public key in the master-public-private key pair. p This refers to the private key in the master-public key pair;

[0171] The terminal device generates a temporary public-private key pair and sends the temporary public key and device fingerprint from the temporary public-private key pair to the KGC; the temporary public key pair is used for communication with the KGC.

[0172] KGC generates the terminal device's public key factor w based on the terminal device's temporary public key. A This public key factor is the declared public key of the terminal device; furthermore, KGC will generate the private key factor t of the terminal device based on a random number, the device fingerprint, and KGC's master public-private key pair. A ;

[0173] KGC sends the public key factor and private key factor of the terminal device to the terminal device;

[0174] The private key S of the terminal device A It consists of the device fingerprint, the KGC's master private key, and the terminal device's temporary private key. The KGC only knows the private key factor and not the terminal device's private key, which provides additional security.

[0175] The public key P of the terminal device A It can be generated from the private key of the terminal device: P A =[S A G, where G represents the generator of the elliptic curve; and other devices can generate the terminal device's public key using the terminal device's device fingerprint, the KGC's master public key, and the terminal device's public key factor: P. A =w A +[λ]P p λ is composed of the public key declared by the terminal device;

[0176] During the key generation process, the public key of the terminal device is generated based on the device fingerprint. Other devices can obtain the public key of the terminal device without applying for a CA (Certificate Authority) certificate, thus saving maintenance resources.

[0177] Digital signature steps include:

[0178] Calculate M * =Z A ||X WA ||Y WA ||m and e = H(M) * ),in,

[0179] Z A =H 256 (ENTLA||ID A ||a||b||X G ||Y G ||X p ||Y p )

[0180] ENTLA represents the device fingerprint ID. A Length, M * X is the encoded form of the message. WA Represents the X and Y coordinates of the public key point. WA The Y-coordinate of the public key point is represented by m, and the Z-coordinate is represented by m. A This represents a value composed of hash values ​​from multiple parameters, where H represents the hash function. 256 This indicates that the hash function is SHA-256, a and b represent the parameters defining the elliptic curve equation in elliptic curve cryptography, and X... G Represent the X and Y coordinates of the generator G of the elliptic curve. G The X represents the Y-coordinate of the generator of the elliptic curve. p Represent the X and Y coordinates of point P on the elliptic curve. p The Y-coordinate of point P on the elliptic curve is given. Point P can be a public key point on the elliptic curve. e represents the message digest.

[0181] Randomly select k∈R, and calculate (x1,y1)=[k]G; (x1,y1) are the coordinates of a point on the elliptic curve;

[0182] Calculate r = (e + x1) mod n and s = (kr·S) A ) / (S A +1)modn, where S AGiven the private key of the terminal device, output the signature value (r, s); where r represents the first part of the signature value, s represents the second part of the signature value, mod represents the modulo operation, n is a prime number, and n is a parameter in elliptic curve cryptography used to define the modulus of the modulo operation.

[0183] The signature verification steps include:

[0184] When authentication is required, the terminal device to be authenticated sends information {f1′,f2′,…,f n ′,timetmp}IDsig(ID), where {f1,f2,…,f n} represents the feature components extracted from the static attribute information of the terminal device to be authenticated, timstmp is the timestamp of the original device fingerprint, ID represents the device fingerprint of the terminal device to be authenticated, and sig(ID) represents the digital signature of the terminal device to be authenticated.

[0185] Upon receiving the information, first, based on {f1′,f2′,…,f n Generate the current device fingerprint of the terminal device to be authenticated (',timetmp}), and check whether the current device fingerprint matches the original device fingerprint in the fingerprint database. If they do not match, authentication fails. If they match, the following signature verification process is performed:

[0186] Verify the validity of the signature values ​​r′ and s′ in sig(ID). If r′∈[1,n-1] and s′∈[1,n-1], the signature values ​​are valid and proceed to the next step; otherwise, the verification fails.

[0187] Calculate M *′ =Z A ||X WA ||Y WA ||m and e′=H(M *′ ),in,

[0188] Z A =H 256 (ENTLA||ID A ||a||b||X G ||Y G ||X p ||Y p )

[0189] Among them, M *′ Here, e′ represents the message's encoded form.

[0190] Calculate t = (r′ + s′) mod n, (x′1, y′1) = [s′]G + [t]P AR = (e′ + x1′) mod n; where (x′1, y′1) represents the public key P of the terminal device. A The coordinates of the corresponding point on the elliptic curve, where t represents the temporarily calculated value and R represents the signature verification parameter;

[0191] Compare whether R and r′ are equal. If they are equal, the verification is successful.

[0192] In this embodiment, certificate-free authentication using cryptographic algorithms is introduced into the static authentication process, particularly through digital signatures and public key verification. The public key is declared to be generated by a key generation center based on a temporary public-private key pair from the terminal device, thus improving the trustworthiness and security of the public key. This authentication method not only avoids the complexity of traditional certificate management but also reduces security risks caused by certificate issues.

[0193] In some embodiments, dynamic authentication of the terminal device based on dynamic behavior information includes:

[0194] Establish a trust assessment model;

[0195] Calculate the security trust value corresponding to dynamic behavioral information based on the trust assessment model;

[0196] If the security trust value is greater than or equal to the preset threshold, the authentication is confirmed.

[0197] In this embodiment, the trust assessment model can be a model built according to the calculation rules of security trust value, or a model constructed and trained through machine learning algorithms to determine the security trust value. This application does not limit the method of building the trust assessment model.

[0198] In this embodiment, behavioral information from various dimensions within dynamic behavioral information can be analyzed separately. For example, data packets acquired through passive traffic monitoring can be analyzed to identify legitimate and abnormal traffic. Performance metrics such as CPU utilization, disk utilization, and memory utilization are monitored to assess system resource usage and identify potential performance issues or abnormal activity. By monitoring packet loss rate, transmission latency, and mean time between failures (MTBF), the reliability and stability of the environment are assessed to ensure communication quality and continuous system operation. Simultaneously, uplink and downlink communication data and service logs are analyzed to identify abnormal service behavior. By analyzing different metrics, a comprehensive score can be calculated, which is then determined as a security trust value. A higher comprehensive score indicates more trustworthy behavior from the terminal device.

[0199] In this embodiment, by establishing a trust assessment model and calculating the security trust value corresponding to dynamic behavior information, it is possible not only to detect the current state of the device but also to predict and issue warnings based on the device's behavior patterns, promptly identifying abnormal behavior and effectively preventing potential security threats. When the security trust value reaches or exceeds a preset threshold, the device can be confirmed to have passed authentication, indicating that the device's behavior matches the trust model, further enhancing the security and reliability of the authentication.

[0200] The following scenario example illustrates the authentication method based on terminal device identifier in this application.

[0201] like Figure 3 As shown in the example scenario, static attribute information of the terminal device can be collected, including basic information, operating system information, chip architecture information, and communication information, and a device fingerprint of the terminal device can be generated based on this information. Dynamic behavior information of the terminal device is obtained through active probe packets and passive traffic monitoring. Specifically, static authentication can be performed using SM2 and SM3 algorithms. For example, the device fingerprint can be generated using the SM3 algorithm and fingerprint matching can be performed. After successful matching, certificate-free authentication can be performed using the SM2 algorithm. The dynamic authentication process can be carried out based on the dynamic behavior information of the terminal device. For example, a trust assessment model can be used to perform trust measurement and risk analysis on the terminal device, thereby generating a security trust value for the terminal device. Based on the security trust value, dynamic authentication and access control are implemented. Finally, terminal devices with a security trust value higher than or equal to a preset threshold will pass dynamic authentication and obtain access rights, while terminal devices with a security trust value lower than the preset threshold will be denied access, thereby ensuring the security and reliability of the system.

[0202] The static authentication process of this application embodiment is illustrated below through a scenario example.

[0203] like Figure 4 As shown, the static authentication process includes the following steps:

[0204] Collect static attribute information of the terminal device, including basic information, operating system information, chip architecture information and communication information, as well as obtain the timestamp of the original device fingerprint generation, and generate the current device fingerprint ID' based on the timestamp of the static attribute information;

[0205] The current device fingerprint ID is compared with the original device fingerprint ID in the fingerprint database. If they match, the subsequent steps are executed. If they do not match, static authentication fails and terminal device interaction is not allowed.

[0206] Generate the public key of the terminal device based on the declared public key of the terminal device, the current device fingerprint ID, and other information.

[0207] The signature value (r′, s′) is verified using the public key of the terminal device;

[0208] If r′∈[1,n-1], then proceed with the next steps; otherwise, static authentication fails and terminal device interaction is not allowed.

[0209] If s′∈[1,n-1], then proceed with the next steps; otherwise, static authentication fails and terminal device interaction is not allowed.

[0210] Calculate R. If R = r′, proceed with the next steps; otherwise, static authentication fails and terminal device interaction is not allowed.

[0211] Static authentication successful, allowing terminal device interaction.

[0212] The authentication method based on terminal device identifier provided in this application can be executed by an authentication device based on terminal device identifier. This application uses an authentication device based on terminal device identifier executing the authentication method as an example to illustrate the authentication device based on terminal device identifier provided in this application.

[0213] This application also provides an authentication device based on a terminal device identifier.

[0214] like Figure 5 As shown, the authentication device based on the terminal device identifier includes:

[0215] The acquisition module 510 is used to acquire static attribute information and dynamic behavior information of the terminal device;

[0216] The fingerprint generation module 520 is used to generate a current device fingerprint for identifying the terminal device based on static attribute information.

[0217] The static authentication module 530 is used to perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint database.

[0218] The dynamic authentication module 540 is used to perform dynamic authentication on the terminal device based on dynamic behavior information after static authentication has passed.

[0219] According to the authentication device based on terminal device identifier of this application, and the authentication method based on terminal device identifier of this application, static attribute information and dynamic behavior information of the terminal device are collected; a current device fingerprint for identifying the terminal device is generated based on the static attribute information; static authentication of the terminal device is performed based on the current device fingerprint and the original device fingerprint in the fingerprint database; and if the static authentication is successful, dynamic authentication of the terminal device is performed based on the dynamic behavior information. This embodiment of the application performs static authentication of the terminal device through static attributes, and if the static authentication is successful, it analyzes the dynamic operation of the terminal device to determine whether the behavior pattern of the terminal device during the operation process meets expectations. This multi-dimensional authentication mechanism combining static and dynamic methods can not only resist traditional identity spoofing attacks, but also effectively prevent complex network threats, improving the reliability and security of the authentication process.

[0220] In some embodiments, the acquisition module 510 is further configured to:

[0221] Static attribute information is collected based on hardware drivers and / or API calls.

[0222] In some embodiments, the acquisition module 510 is further configured to:

[0223] By actively sending probe messages to the terminal device, the terminal device collects dynamic behavior information based on the feedback of the probe messages and / or collects dynamic behavior information through passive traffic monitoring.

[0224] In some embodiments, the fingerprint generation module 520 is further configured to:

[0225] Extracting feature components of the terminal device from static attribute information;

[0226] Perform a hash operation on the feature components and use the resulting hash value as the fingerprint of the current device.

[0227] In some embodiments, the fingerprint generation module 520 is further configured to:

[0228] According to the formula

[0229] ID = Hash(f1||f2||…||f n ||timetmp)

[0230] Perform hash operations on the feature components;

[0231] Where ID represents the current device fingerprint, and Hash() represents performing a hash operation on the content within the parentheses, {f1, f2, ..., f n} represents the feature component, and timstmp represents the timestamp.

[0232] In some embodiments, the static authentication module 530 is further configured to:

[0233] The current device fingerprint is compared with the original device fingerprint. If the current device fingerprint and the original device fingerprint are the same, the match is considered successful.

[0234] In some embodiments, the static authentication module 530 is further configured to:

[0235] The similarity between the current device fingerprint and the original device fingerprint is calculated to obtain a similarity value representing the current device fingerprint and the original device fingerprint; if the similarity value is greater than or equal to the matching threshold, the match is determined to be successful.

[0236] In some embodiments, the static authentication module 530 is further configured to:

[0237] If a match is successful, the encryption algorithm will be authenticated without a certificate.

[0238] Certificate-free authentication of encryption algorithms includes:

[0239] Obtain information sent by the terminal device, including a digital signature generated by the terminal device using an encryption algorithm;

[0240] The public key of the terminal device is calculated based on the declared public key of the terminal device; the declared public key is generated by the key generation center based on the temporary public-private key pair of the terminal device.

[0241] Use the public key to verify the signature value of the digital signature.

[0242] In some embodiments, the dynamic authentication module 540 is further configured to:

[0243] Establish a trust assessment model;

[0244] Calculate the security trust value corresponding to dynamic behavioral information based on the trust assessment model;

[0245] If the security trust value is greater than or equal to the preset threshold, the authentication is confirmed.

[0246] The authentication device based on the terminal device identifier in this application embodiment can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the scope of the device.

[0247] The authentication device based on the terminal device identifier in this application embodiment can be a device with an operating system. This operating system can be a Microsoft (Windows) operating system, an Android operating system, an iOS operating system, or other possible operating systems; this application embodiment does not specifically limit it.

[0248] In some embodiments, such as Figure 6 As shown, this application embodiment also provides an electronic device 600, including a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the program is executed by the processor 601, it implements the various processes of the above-described authentication method embodiment based on terminal device identifier and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0249] It should be noted that the electronic devices in the embodiments of this application include the aforementioned mobile electronic devices and non-mobile electronic devices.

[0250] This application also provides a non-transitory computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described authentication method embodiment based on terminal device identifier and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0251] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0252] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described authentication method based on a terminal device identifier.

[0253] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0254] This application also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described authentication method embodiments based on terminal device identifiers, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0255] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0256] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0257] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0258] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

[0259] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0260] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

Claims

1. An authentication method based on terminal device identifier, characterized in that, include: Collect static attribute information and dynamic behavior information of terminal devices; Generate a current device fingerprint to identify the terminal device based on the static attribute information; Static authentication is performed on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint database; The static authentication includes fingerprint matching, and if the matching is successful, the encryption algorithm performs certificateless authentication. The certificate-free authentication of the encryption algorithm includes: acquiring information sent by the terminal device, the information including a digital signature generated by the terminal device using the encryption algorithm; calculating the public key of the terminal device based on the declared public key of the terminal device; the declared public key is generated by a key generation center based on the temporary public-private key pair of the terminal device; and verifying the signature value of the digital signature using the public key; including: calculating... and ,in, in, The encoding format of the message. Indicates a message summary. Indicates the current device fingerprint Length, Represents the public key point X coordinate, Represents the public key point Y coordinate, m Indicates the original message. This represents a value composed of the hash values ​​of multiple parameters. H Represents a hash function. H 256 This indicates that the hash function is SHA-256. This represents the parameters used in elliptic curve cryptography to define the equation of an elliptic curve. Represents the generator of an elliptic curve G of X coordinate, Represents the generator of an elliptic curve. Y coordinate, Points representing an elliptic curve P of X coordinate, Points representing an elliptic curve P of Y Coordinates, point P It is a public key point on an elliptic curve; calculate , , ;in, Represents the public key of the terminal device The coordinates of the corresponding point on the elliptic curve This represents a value calculated temporarily. R This represents the signature verification parameters. n It is a prime number. and This represents the signature value of the digital signature; comparison R and Check if they are equal; if they are equal, the verification passes. If static authentication is successful, dynamic authentication is performed on the terminal device based on the dynamic behavior information.

2. The method according to claim 1, characterized in that, The static attribute information includes at least one of the following: basic information of the terminal device, operating system information, chip architecture information, and communication information.

3. The method according to claim 1, characterized in that, The dynamic behavior information includes at least one of the following: the communication protocol type of the terminal device, uplink and downlink communication ports, communication behavior information, maximum value of the data field, minimum value of the data field, and standard deviation of the data field.

4. The method according to claim 1, characterized in that, The static attribute information of the collected terminal devices includes: The static attribute information is collected based on hardware drivers and / or API calls.

5. The method according to claim 1, characterized in that, The dynamic behavior information of the collected terminal devices includes: By actively sending probe messages to the terminal device, the terminal device collects the dynamic behavior information based on the feedback of the probe messages and / or collects the dynamic behavior information through passive traffic monitoring.

6. The method according to claim 1, characterized in that, The step of generating a current device fingerprint for identifying the terminal device based on the static attribute information includes: Extract the feature components of the terminal device from the static attribute information; Perform a hash operation on the feature components and use the resulting hash value as the fingerprint of the current device.

7. The method according to claim 6, characterized in that, According to the formula Perform a hash operation on the feature components; in, Indicates the current device fingerprint. This indicates that a hash operation will be performed on the content within the parentheses. Representing characteristic components, Represents a timestamp.

8. The method according to claim 6, characterized in that, The fingerprint matching includes: comparing the current device fingerprint with the original device fingerprint, and determining a successful match if the current device fingerprint and the original device fingerprint are the same.

9. The method according to claim 1, characterized in that, The fingerprint matching includes: calculating the similarity between the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; and determining that the match is successful if the similarity value is greater than or equal to a matching threshold.

10. The method according to claim 1, characterized in that, The step of dynamically authenticating the terminal device based on the dynamic behavior information includes: Establish a trust assessment model; Calculate the security trust value corresponding to the dynamic behavior information based on the trust assessment model; If the security trust value is greater than or equal to a preset threshold, authentication is confirmed.

11. An authentication device based on a terminal device identifier, characterized in that, include: The data acquisition module is used to collect static attribute information and dynamic behavior information of terminal devices; The fingerprint generation module is used to generate a current device fingerprint for identifying the terminal device based on the static attribute information; The static authentication module is used to perform static authentication on the terminal device based on the current device fingerprint and the original device fingerprint in the fingerprint database; The static authentication includes fingerprint matching, and if the matching is successful, the encryption algorithm performs certificateless authentication. The certificate-free authentication of the encryption algorithm includes: acquiring information sent by the terminal device, the information including a digital signature generated by the terminal device using the encryption algorithm; calculating the public key of the terminal device based on the declared public key of the terminal device; the declared public key is generated by a key generation center based on the temporary public-private key pair of the terminal device; and verifying the signature value of the digital signature using the public key; including: calculating... and ,in, in, The encoding format of the message. Indicates a message summary. Indicates the current device fingerprint Length, Represents the public key point X coordinate, Represents the public key point Y coordinate, m Indicates the original message. This represents a value composed of the hash values ​​of multiple parameters. H Represents a hash function. H 256 This indicates that the hash function is SHA-256. This represents the parameters used in elliptic curve cryptography to define the equation of an elliptic curve. Represents the generator of an elliptic curve G of X coordinate, Represents the generator of an elliptic curve. Y coordinate, Points representing an elliptic curve P of X coordinate, Points representing an elliptic curve P of Y Coordinates, point P It is a public key point on an elliptic curve; calculate , , ;in, Represents the public key of the terminal device The coordinates of the corresponding point on the elliptic curve This represents a value calculated temporarily. R This represents the signature verification parameters. n It is a prime number. and This represents the signature value of the digital signature; comparison R and Check if they are equal; if they are equal, the verification passes. The dynamic authentication module is used to perform dynamic authentication on the terminal device based on the dynamic behavior information, provided that static authentication has passed.

12. The apparatus according to claim 11, characterized in that, The fingerprint generation module is also used for: Extract the feature components of the terminal device from the static attribute information; Perform a hash operation on the feature components and use the resulting hash value as the fingerprint of the current device.

13. The apparatus according to claim 11, characterized in that, The static authentication module is also used for: The current device fingerprint and the original device fingerprint are matched and compared. If the current device fingerprint and the original device fingerprint are the same, the match is determined to be successful.

14. The apparatus according to claim 11, characterized in that, The static authentication module is also used for: A similarity calculation is performed on the current device fingerprint and the original device fingerprint to obtain a similarity value representing the current device fingerprint and the original device fingerprint; if the similarity value is greater than or equal to the matching threshold, a successful match is determined.

15. The apparatus according to claim 11, characterized in that, The dynamic authentication module is also used for: Establish a trust assessment model; Calculate the security trust value corresponding to the dynamic behavior information based on the trust assessment model; If the security trust value is greater than or equal to a preset threshold, authentication is confirmed.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-10.

17. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-10.

18. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-10.

Images