Authentication method and device, equipment, storage medium and product

Abstract

The invention discloses an authentication method and device, equipment, a storage medium and a product, and relates to the technical field of computers, the authentication method is applied to ADB equipment, and comprises the following steps: obtaining a unique identification identifier of the ADB equipment and an authentication password input by a user; verifying the validity of the preset public key through a preset authentication application, and encrypting the unique identification identifier and the authentication password by using the verified preset public key to obtain encrypted authentication data; and calling a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. The unique identification identifier and the authentication password of the ADB equipment are encrypted through the preset public key of the ADB equipment to obtain the encrypted authentication data, and then the preset execution environment is called to perform equipment login verification on the encrypted authentication data to obtain the authentication result. Compared with an existing mode of carrying out login authentication through an account password, the mode provided by the invention can improve the login authentication security of the ADB equipment.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to authentication methods, devices, equipment, storage media and products. Background Art

[0002] Operation and maintenance is an indispensable task for every device manufacturer. After each device product leaves the factory, if the device fails, an operation and maintenance tool is needed to locate and debug the cause of the failure. ADB device (androidd debugbridge) is a general debugging tool provided by Android, including various debugging operations such as capturing logs, installing and uninstalling applications, remotely connecting to Android devices, copying files to devices, etc. Android device manufacturers can achieve many goals of operation and maintenance of Android devices through ADB devices.

[0003] Existing ADB devices generally use an account and password for login authentication, which has low security, high management difficulty, and poor user experience. Therefore, how to improve the authentication security and efficiency of ADB devices has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The main purpose of this application is to provide an authentication method, device, equipment, storage medium and product, aiming to solve the technical problem of low security of existing ADB device authentication.

[0005] To achieve the above purpose, the present application proposes an authentication method, which is applied to an ADB device. The authentication method comprises the following steps:

[0006] Obtaining a unique identification code of the ADB device and an authentication password input by a user;

[0007] Verifying the validity of a preset public key through a preset authentication application, and encrypting the unique identification and the authentication password using the verified preset public key to obtain encrypted authentication data;

[0008] The preset execution environment is called to perform device login verification on the encrypted authentication data to obtain an authentication result.

[0009] Optionally, the step of calling a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result includes:

[0010] Calling a preset execution environment to decrypt the encrypted authentication data to obtain authentication information;

[0011] Determine a target authentication password using the authentication information through a preset execution environment;

[0012] An authentication result is determined according to the target authentication password and the authentication password in the authentication information.

[0013] Optionally, the step of determining the target authentication password by using the authentication information through a preset execution environment includes:

[0014] Generate a message authentication code using the unique identification identifier and the custom factor in the authentication information through a preset execution environment;

[0015] Encrypt the message authentication code using a preset encryption algorithm to obtain a ciphertext;

[0016] A target authentication password is determined according to the ciphertext and the custom factor.

[0017] Optionally, the step of verifying the validity of a preset public key by a preset authentication application, and encrypting the unique identification and the authentication password by using the verified preset public key to obtain encrypted authentication data includes:

[0018] Verify the validity of the preset public key through the preset authentication application to obtain the preset public key verification result;

[0019] If the preset public key verification result is verification passed, performing signature information verification according to the preset public key to obtain a signature information verification result;

[0020] When the signature information verification result is that the verification is passed, the unique identification mark and the authentication password are encrypted using the preset public key that has been verified to obtain encrypted authentication data.

[0021] Optionally, when the preset public key verification result is a verification pass, the step of performing signature information verification according to the preset public key to obtain the signature information verification result includes:

[0022] If the preset public key verification result is that the verification is passed, the signature information is verified according to the preset public key to obtain a verification result;

[0023] The signature information verification result is determined according to the signature verification result.

[0024] Optionally, the step of determining a signature information verification result according to the signature verification result includes:

[0025] Verify the validity of the authentication application authentication information and the logic script authentication information according to the signature verification result;

[0026] When both the authentication application authentication information and the logic script authentication information are valid, the authentication application is signature-verified according to the authentication application authentication information and the preset public key to obtain an authentication application authentication information verification result;

[0027] Perform signature verification on the logic script based on the logic script authentication information and the preset public key to obtain a logic script authentication information verification result;

[0028] The signature information verification result is determined according to the logic script authentication information verification result and the authentication application authentication information verification result.

[0029] In addition, to achieve the above purpose, the present application also proposes an authentication device, the authentication device comprising:

[0030] An acquisition module, used to acquire a unique identification mark of the ADB device and an authentication password input by a user;

[0031] A validity verification module, used to verify the validity of a preset public key through a preset authentication application, and to encrypt the unique identification mark and the authentication password using the verified preset public key to obtain encrypted authentication data;

[0032] The authentication module is used to call a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result.

[0033] In addition, to achieve the above objectives, the present application also proposes an authentication device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the authentication method described above.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the authentication method described above are implemented.

[0035] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the authentication method described above are implemented.

[0036] This application obtains the unique identification of the ADB device and the authentication password input by the user; verifies the validity of the preset public key through a preset authentication application, and uses the verified preset public key to encrypt the unique identification and the authentication password to obtain encrypted authentication data; calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Since this application encrypts the unique identification and authentication password of the ADB device through the preset public key of the ADB device to obtain encrypted authentication data, and then calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Compared with the existing method of performing login authentication through an account number and password, the above method of this application can improve the login authentication security of the ADB device. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 A flowchart of the first embodiment of the authentication method of this application is provided;

[0040] Figure 2 A schematic diagram of generating an authentication password provided in Example 1 of the authentication method of this application;

[0041] Figure 3 A schematic diagram of the authentication relationship provided for the first embodiment of the authentication method of this application;

[0042] Figure 4 A schematic diagram of the authentication process provided in Example 1 of the authentication method of this application;

[0043] Figure 5 A flowchart of the second embodiment of the authentication method of this application is provided;

[0044] Figure 6 A schematic diagram of a device login verification process provided in Example 2 of the authentication method of this application;

[0045] Figure 7 A flowchart of the third embodiment of the authentication method of this application is provided;

[0046] Figure 8 A schematic diagram of a preset public key verification provided in Example 3 of the authentication method of this application;

[0047] Fig. 9 A schematic diagram of the overall authentication process provided for the third embodiment of the authentication method of this application;

[0048] Fig.10 This is a schematic diagram of the module structure of the authentication device according to an embodiment of the present application;

[0049] Fig.11 Schematic diagram of the device structure of the hardware operating environment involved in the authentication method in the embodiment of the present application.

[0050] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of the embodiment of the present application is: obtain the unique identification of the ADB device and the authentication password input by the user; verify the validity of the preset public key through the preset authentication application, and use the preset public key that has passed the verification to encrypt the unique identification and the authentication password to obtain encrypted authentication data; call the preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result. Since the present application encrypts the unique identification and authentication password of the ADB device through the preset public key of the ADB device to obtain encrypted authentication data, and then calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result. Compared with the existing method of performing login authentication through account number and password, the above method of the present application can improve the login authentication security of the ADB device.

[0054] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an ADB device, etc. The following takes the ADB device as an example to illustrate this embodiment and the following embodiments.

[0055] Based on this, the present application embodiment provides an authentication method, referring to Figure 1 , Figure 1 A flowchart of the first embodiment of the authentication method of this application is provided.

[0056] In this embodiment, the authentication method includes the following steps:

[0057] Step S10, obtaining the unique identification of the ADB device and the authentication password input by the user;

[0058] It should be noted that when the user uses the ADB device to debug the Android device, the user needs to first perform the login authentication of the ADB device. In this embodiment, when the ADB device is produced, the authentication password of the ADB device will be generated in the security environment of the device production line, and the authentication password of the ADB device corresponds to the ADB device one by one. Specifically, it is generated by the production line tool through the unique identification of the ADB device and the pre-set custom factors. Among them, the security environment can be a secure space isolated on the production line, and the production line tool can be a tool for generating the authentication password of the ADB device, wherein the authentication password of the ADB device is generated by algorithms such as SM3, SMS, PBKDF2, SM3-HMAC, and Base64. The unique identification of the ADB device can be an identification that uniquely identifies the ADB device, such as the Device id of the ADB device or the IMEI number. In general, the generated authentication password can be attached to the ADB device. When the user uses the ADB device, he enters the authentication password of the ADB device to trigger the authentication process of the ADB device.

[0059] In the specific implementation, please refer to Figure 2 , Figure 2 The schematic diagram of generating an authentication password provided in the first embodiment of the authentication method of the present application is provided. The generation of the authentication password is performed in a safe environment of a device production line. In the safe environment of the production line, the authentication password of the ADB device can be generated by using a pre-set custom factor and a unique identification of the ADB device through a production line tool. Figure 2 The unique identifier of the ADB device used in is the unique serial number.

[0060] Step S20, verifying the validity of the preset public key through a preset authentication application, and encrypting the unique identification and the authentication password using the verified preset public key to obtain encrypted authentication data;

[0061] It should be noted that the preset public key may be an asymmetric algorithm public key preset in the preset authentication application of the ADB device when the ADB device is produced. The preset authentication application may be an application for device authentication preset in the read-only file system of the ADB device when the ADB device is produced. In order to ensure that the ADB device authentication process is completely carried out in the device security world, the key pair corresponding to the preset public key is preset in the trusted execution environment (TEE) in the ADB device. Specifically, the authentication method in this embodiment includes an ADB authentication password generation stage, which is carried out in the production line of the device. The device production line must be a secure environment to ensure that the production data is not leaked. The production line completes the ADB authentication APP preset (i.e., the preset authentication application), the device key pair preset (including the preset public key preset in the device authentication application of the ADB device read-only file system and the key pair corresponding to the preset public key preset in the trusted execution environment TEE), and the device ADB authentication password generation. The ADB authentication APP preset includes an ADB authentication logic shell script sh, a preset authentication application, and a signature file verify. These three files will be burned into the read-only file system together with the system image file, and the read-only attribute of the file system will ensure that the files are not tampered with. The authentication information signature file verify contains the authentication information and signature information of the authentication logic script and the preset authentication application. The authentication information of the preset authentication application is the SM3 digest value of the ADB authentication application. The authentication information of the authentication logic script is the SM3 digest value of the ADB authentication logic script. The signature information is the signature of the authentication logic script and the preset authentication application. The authentication information of the authentication logic script and the preset authentication application can be signed by the private key preset in the TEE environment to obtain the signature information, the validity of the authentication logic script and the authentication information of the preset authentication application. For details, please refer to Figure 3 , Figure 3 This is a schematic diagram of the authentication relationship provided in the first embodiment of the authentication method of the present application. In this embodiment, the asymmetric algorithm preset in the TEE environment may be an SM2 algorithm key pair, and the public key in the SM2 algorithm key pair is also preset in the preset authentication application (i.e. Figure 3 ADB authentication application in . Figure 3The read-only file system of the ADB device includes a preset ADB authentication logic script and a preset authentication application. The preset authentication application also presets a preset public key. By performing SM3 digest calculation on the ADB authentication logic script, the app authentication information in the authentication information signature file is obtained; by performing SM3 digest calculation on the preset authentication application, the auth_sh authentication information in the authentication information signature file is obtained, that is, the authentication information of the preset authentication application; then, the app authentication information and the auth_sh authentication information are signed by the private key preset in the TEE environment, and the signature in the authentication information signature file is obtained, that is, the signature information of the authentication logic script and the authentication information of the preset authentication application.

[0062] It should be noted that the validity verification of the preset public key through the preset authentication application can be to call the TEE environment through the preset authentication application, and then compare whether the public key preset in the TEE environment is consistent with the preset public key preset in the preset authentication application. If they are consistent, the validity verification result of the preset public key is determined to be verified. At this time, the unique identification identifier and the authentication password are encrypted using the preset public key that has been verified to obtain encrypted authentication data, and then enter the subsequent authentication process. Otherwise, the validity verification result of the preset public key is determined to be verification failed, and the authentication result of the ADB device is authentication failure.

[0063] Step S30, calling a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result.

[0064] It should be noted that the preset execution environment is the trusted execution environment (TEE) mentioned above. The calling of the preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result can be to call the preset execution environment, use the private key in the key pair corresponding to the preset public key preset in the preset execution environment to decrypt the encrypted authentication data, obtain the decrypted unique identification and authentication password, and use the decrypted unique identification and custom factors (which can be preset in the preset execution environment or packaged in the encrypted authentication data and sent to the preset execution environment) to restore the steps of generating the authentication password according to the unique identification and custom factors of the ADB device to obtain a verification password (that is, the verification password is generated using the same process as the production line tool to generate the authentication password). Compare whether the verification password is consistent with the decrypted authentication password. If they are consistent, the authentication result is passed.

[0065] In the specific implementation, please refer to Figure 4 , Figure 4The authentication process diagram provided in the first embodiment of the authentication method of the present application is as follows: when the user enters the authentication password of the ADB device, the ADBD daemon process of the ADB device calls the ADB authentication logic script to start authentication. The ADB authentication logic script has no authentication logic. All authentication logic is in the preset authentication application (i.e. Figure 4 The preset authentication application calls TEE to complete the validity verification of the preset public key built into the preset authentication application and the authenticity verification of the preset authentication application (verification Figure 3 The above operations are completed in the TEE trusted execution environment. Finally, the authentication result is returned to the ADB authentication logic script, and the ADB authentication logic script completes or rejects the login according to the fixed authentication logic.

[0066] This embodiment obtains the unique identification of the ADB device and the authentication password input by the user; verifies the validity of the preset public key through the preset authentication application, and uses the verified preset public key to encrypt the unique identification and the authentication password to obtain encrypted authentication data; calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Since this embodiment encrypts the unique identification and authentication password of the ADB device through the preset public key of the ADB device to obtain encrypted authentication data, and then calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Compared with the existing method of performing login authentication through an account number and password, the above method of this embodiment can improve the login authentication security of the ADB device.

[0067] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 5 , Figure 5 The flowchart of the second embodiment of the authentication method of this application is provided, wherein step S30 further includes the following steps:

[0068] Step S301: calling a preset execution environment to decrypt the encrypted authentication data to obtain authentication information;

[0069] It should be noted that the calling of the preset execution environment to decrypt the encrypted authentication data and obtain the authentication information can be performed by decrypting the encrypted authentication data using a private key in a key pair corresponding to a preset public key preset in the preset execution environment to obtain the authentication information, which may include a decrypted unique identification identifier, an authentication password, and a custom factor used when generating the authentication password of the ADB device through a production line tool.

[0070] Step S302: Determine the target authentication password using the authentication information through a preset execution environment;

[0071] It should be noted that the determination of the target authentication password by using the authentication information through the preset execution environment may be that the preset execution environment uses the generation process of the authentication password of the ADB device when it leaves the factory to generate the target authentication password, that is, the target authentication password is generated according to the unique identification and custom factors of the decrypted ADB device.

[0072] Further, in order to improve authentication security, the step S302 may include:

[0073] Generate a message authentication code using the unique identification identifier and the custom factor in the authentication information through a preset execution environment;

[0074] Encrypt the message authentication code using a preset encryption algorithm to obtain a ciphertext;

[0075] A target authentication password is determined according to the ciphertext and the custom factor.

[0076] It should be noted that the method of generating a message authentication code by using the unique identification identifier and the customized factor in the authentication information through the preset execution environment may be to encrypt the unique identification identifier and the customized factor through the encryption algorithm built into the preset execution environment to obtain the message authentication code. The method of encrypting the message authentication code through the preset encryption algorithm to obtain the ciphertext may be to use the SM4 key, take the first 16 bytes of the message authentication code as IV, and the last 16 bytes as data to obtain the ciphertext. Determining the target authentication password based on the ciphertext and the customized factor may be to use the ciphertext as the password and the customized factor as the Salt, perform iterative calculation, derive a key length of 16 bytes, perform PBKDF2 password derivation calculation based on the SM3 algorithm and the SM 4 algorithm, and obtain the target authentication password.

[0077] In the specific implementation, please refer to Figure 6 , Figure 6The device login verification process diagram provided in the second embodiment of the authentication method of the present application is as follows: after the ADB authentication application completes the application's built-in preset public key and its own trusted authentication, the ADB device's device_id (which may also be other unique identifiers of the ADB device), authentication password pwd, and custom factors are encrypted by the preset public key to obtain authentication data cipher_auth_data, and the authentication data cipher_auth_data is sent to TEE for login authentication. TEE decrypts cipher_auth_data by the built-in device private key to obtain device_id, pwd, and custom factor a. Using device_id as the key, SM3-HMAC is calculated for the custom factor a to obtain a 32-byte HMAC value. The SM4 key preset in the production stage is used, and the first 16 bytes of HMAC are used as IV, and the last 16 bytes are used as data to obtain the ciphertext P. P is used as the password, and the custom factor a is used as the Salt. The number of iterations is 1000 (custom value), and the derived key length is 16 bytes. PBKD based on the SM3 algorithm and the SM4 algorithm is performed. F2 derives the password and calculates password_a, and verifies whether password_a and pwd are consistent. If they are consistent, the authentication result is passed, otherwise, the authentication result is failed.

[0078] Step S303: Determine an authentication result according to the target authentication password and the authentication password in the authentication information.

[0079] It should be noted that determining the authentication result based on the target authentication password and the authentication password in the authentication information can be to compare whether the target authentication password and the decrypted authentication password in the authentication information are consistent. If the comparison result is consistent, the authentication result is judged to be passed; otherwise, the authentication result is judged to be failed.

[0080] This embodiment calls the preset execution environment to decrypt the encrypted authentication data to obtain authentication information; determines the target authentication password using the authentication information through the preset execution environment; and determines the authentication result according to the target authentication password and the authentication password in the authentication information. This embodiment performs device login verification through the preset execution environment, ensuring that the verification process is completely carried out in the device security world, and the verification logic cannot be illegally tampered with, thereby improving the authentication security.

[0081] Based on the above embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 7 , Figure 7 The flowchart of the third embodiment of the authentication method of this application is provided, wherein step S20 further includes the following steps:

[0082] Step S201: verifying the validity of a preset public key through a preset authentication application to obtain a preset public key verification result;

[0083] It should be noted that the validity of the preset public key is verified by the preset authentication application, and the preset public key verification result can be obtained by calling the preset execution environment through the preset authentication application, and the preset execution environment compares the preset public key with the public key in the key pair built into the preset execution environment itself to see if they are consistent. If they are consistent, the preset public key verification result is determined to be verified, and the preset public key verification result is returned to the preset authentication application.

[0084] Furthermore, in order to improve the security of authentication data, the step S201 may include: initiating a public key verification request to a preset execution environment through a preset authentication application; receiving a verification random number fed back by the preset execution environment based on the public key verification request; encrypting the verification random number according to a preset public key to obtain a random number encryption result, and sending the random number encryption result to the preset execution environment; receiving a preset public key verification result fed back by the preset execution environment based on the random number encryption result.

[0085] It should be noted that the public key verification request may be a command requesting the preset execution environment to start public key verification. When the preset execution environment receives the public key verification request, it generates a verification random number and sends the verification random number to the preset authentication application of the ADB device. After the preset authentication application receives the verification random number fed back by the preset execution environment based on the public key verification request, it uses the preset public key to encrypt the verification random number. The encrypted random number encryption result is then sent to the preset execution environment for preset public key verification. The preset execution environment decrypts the random number encryption result using the private key in its own built-in key pair, and compares the decryption result with the generated verification random number. If the comparison result is consistent, it means that the preset public key verification is passed. Otherwise, it is determined that the preset public key verification has failed, and the preset public key verification result is returned.

[0086] In the specific implementation, please refer to Figure 8 , Figure 8The schematic diagram of preset public key verification provided for the third embodiment of the authentication method of the present application, wherein GetPublickKeyAuthData is a request initiated by the ADB authentication application (i.e., the preset authentication application) to the TEE to obtain the public key authentication data, i.e., to obtain the verification random number randomly generated by the TEE. The TEE generates and saves the authentication random number r, and then sends the authentication random number r to the ADB authentication application. The ADB authentication application encrypts the authentication random number r with the preset public key to obtain r', calls the GetPublickKeyAuthResult interface to send r', and the TEE decrypts r' with the private key and compares it with r. The preset public key verification result is determined based on the comparison result, i.e. Figure 8 The public key validity result in .

[0087] Step S202: When the preset public key verification result is verification passed, signature information verification is performed according to the preset public key to obtain a signature information verification result;

[0088] It should be noted that the verifying the signature information according to the preset public key to obtain the signature information verification result may be verifying the signature information according to the preset public key to obtain a verification result; and determining the signature information verification result according to the verification result.

[0089] It should be noted that the signature information may be the signature information of the authentication logic script in the read-only file system and the authentication information of the preset authentication application, that is, Figure 3 The determining of the signature information verification result according to the signature verification result may be that when the signature verification result is a verification pass, the signature information verification result is determined to be a verification pass, and when the signature verification result is a verification fail, the signature information verification result is determined to be a verification fail.

[0090] Furthermore, in order to improve the authentication security of the device, the step of determining the signature information verification result according to the signature verification result includes:

[0091] Verify the validity of the authentication application authentication information and the logic script authentication information according to the signature verification result;

[0092] When both the authentication application authentication information and the logic script authentication information are valid, the authentication application is signature-verified according to the authentication application authentication information and the preset public key to obtain an authentication application authentication information verification result;

[0093] Perform signature verification on the logic script based on the logic script authentication information and the preset public key to obtain a logic script authentication information verification result;

[0094] The signature information verification result is determined according to the logic script authentication information verification result and the authentication application authentication information verification result.

[0095] It should be noted that the verification of the validity of the authentication application authentication information and the logic script authentication information according to the signature verification result can be that when the signature verification result is passed, the authentication application authentication information and the logic script authentication information can be determined to be valid, but the authentication application and the logic script themselves are not determined to be valid. At this time, the authentication application and the logic script are verified according to the authentication application authentication information and the logic script authentication information, respectively, to obtain their respective verification results. When the logic script authentication information verification result and the authentication application authentication information verification result are both passed, the signature information verification result is determined to be passed. When either the logic script authentication information verification result or the authentication application authentication information verification result is failed, the signature information verification result is determined to be failed.

[0096] In the specific implementation, please refer to Figure 3 First, verify the validity of the app authentication information and the auth_sh authentication information according to the signature verification result. If the app authentication information is valid, calculate the SM3 summary value for the ADB authentication application; if the auth_sh authentication information is valid, calculate the SM3 summary value for the ADB authentication logic script; according to the SM3 summary value of the logic script and the SM3 summary value of the authentication application, compare with the app authentication information and the auth_sh authentication information, and determine the validity of the ADB authentication application and the ADB authentication logic script.

[0097] Step S203: When the signature information verification result is verified, the unique identification mark and the authentication password are encrypted using the verified preset public key to obtain encrypted authentication data.

[0098] It should be noted that the use of the verified preset public key to encrypt the unique identification and the authentication password to obtain the encrypted authentication data may be to encrypt the unique identification and the authentication password by the preset public key to obtain the encrypted authentication data. When the preset execution environment performs device login verification, it is also necessary to obtain the customized factor used to generate the authentication password. Therefore, the use of the verified preset public key to encrypt the unique identification and the authentication password to obtain the encrypted authentication data also includes the use of the verified preset public key to encrypt the unique identification, the customized factor and the authentication password to obtain the encrypted authentication data. If the customized factor has been preset in the preset execution environment when the device leaves the factory, the customized factor does not need to be encrypted.

[0099] For details, please refer to Fig. 9 , Fig. 9The schematic diagram of the overall authentication process provided in the third embodiment of the authentication method of this application is that the ADB authentication logic script determines the unique device_id of the ADB device and the authentication password pwd entered by the user, and then sends the device_id and the authentication password pwd entered by the user to the ADB preset authentication application for authentication. The ADB preset authentication application requests the TEE environment to verify the validity of the preset public key. After the verification is passed, the authentication information signature file can be verified according to the preset public key, or it can be verified as follows Fig. 9 As shown in , the TEE environment is called to first verify the signature information in the authentication information signature file (authentication logic script and authentication information of the preset authentication application). After the verification is passed, the authentication logic script and the authentication information of the preset authentication application are verified by SM3 digest according to the preset public key. After the verification is passed, the device_id, the authentication password pwd entered by the user, and the custom factor are sent to the TEE for secure world login authentication, and the authentication result returned by the TEE is sent to the ADB authentication logic script for output.

[0100] This embodiment verifies the validity of the preset public key through a preset authentication application to obtain a preset public key verification result; and uses the preset public key that has passed the verification to encrypt the unique identification mark and the authentication password to obtain encrypted authentication data. This embodiment verifies the preset public key and signature information, which can prevent the preset public key, the preset authentication application, and the authentication logic script from being tampered with, affecting the subsequent authentication results, and improving the accuracy of authentication.

[0101] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the authentication method of the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0102] This application also provides an authentication device, please refer to Fig.10 , the authentication device comprises:

[0103] The acquisition module 10 is used to obtain the unique identification of the ADB device and the authentication password input by the user;

[0104] The validity verification module 20 is used to verify the validity of the preset public key through a preset authentication application, and encrypt the unique identification mark and the authentication password using the verified preset public key to obtain encrypted authentication data;

[0105] The authentication module 30 is used to call a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result.

[0106] This embodiment obtains the unique identification of the ADB device and the authentication password input by the user; verifies the validity of the preset public key through the preset authentication application, and uses the verified preset public key to encrypt the unique identification and the authentication password to obtain encrypted authentication data; calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Since this embodiment encrypts the unique identification and authentication password of the ADB device through the preset public key of the ADB device to obtain encrypted authentication data, and then calls the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Compared with the existing method of performing login authentication through an account number and password, the above method of this embodiment can improve the login authentication security of the ADB device.

[0107] The authentication device provided by the present application adopts the authentication method in the above embodiment, which can solve the technical problem of low security of existing ADB device authentication. Compared with the prior art, the beneficial effects of the authentication device provided by the present application are the same as the beneficial effects of the authentication method provided by the above embodiment, and other technical features in the authentication device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0108] The present application provides an authentication device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the authentication method in the above-mentioned embodiment 1.

[0109] Reference below Fig.11 , which shows a schematic diagram of the structure of an authentication device suitable for implementing the embodiment of the present application. The authentication device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.11 The authentication device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0110] like Fig.11As shown, the authentication device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the authentication device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the authentication device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an authentication device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0111] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0112] The authentication device provided by the present application adopts the authentication method in the above embodiment, which can solve the technical problem of low authentication security of existing ADB devices. Compared with the prior art, the beneficial effects of the authentication device provided by the present application are the same as the beneficial effects of the authentication method provided by the above embodiment, and other technical features in the authentication device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0113] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0114] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0115] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the authentication method in the above-mentioned embodiment.

[0116] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0117] The computer-readable storage medium may be included in the authentication device; or may exist independently without being assembled into the authentication device.

[0118] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0121] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned authentication method, and can solve the technical problem that the existing ADB device authentication security is low. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the authentication method provided by the above-mentioned embodiment, and will not be repeated here.

[0122] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned authentication method when executed by a processor.

[0123] The computer program product provided by the present application can solve the technical problem of low security of existing ADB device authentication. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the authentication method provided by the above embodiment, which will not be described in detail here.

[0124] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An authentication method, characterized in that: Applied to ADB equipment, the authentication method comprises the following steps: Obtaining a unique identification code of the ADB device and an authentication password input by a user; Verifying the validity of a preset public key through a preset authentication application, and encrypting the unique identification and the authentication password using the verified preset public key to obtain encrypted authentication data; The preset execution environment is called to perform device login verification on the encrypted authentication data to obtain an authentication result.

2. The authentication method according to claim 1, characterized in that: The step of calling the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result includes: Calling a preset execution environment to decrypt the encrypted authentication data to obtain authentication information; Determine a target authentication password using the authentication information through a preset execution environment; An authentication result is determined according to the target authentication password and the authentication password in the authentication information.

3. The authentication method according to claim 2, characterized in that: The step of determining the target authentication password by using the authentication information through the preset execution environment includes: Generate a message authentication code using the unique identification identifier and the custom factor in the authentication information through a preset execution environment; Encrypt the message authentication code using a preset encryption algorithm to obtain a ciphertext; A target authentication password is determined according to the ciphertext and the custom factor.

4. The authentication method according to any one of claims 1 to 3, characterized in that: The step of verifying the validity of the preset public key by using the preset authentication application, and encrypting the unique identification mark and the authentication password by using the verified preset public key to obtain encrypted authentication data includes: Verify the validity of the preset public key through the preset authentication application to obtain the preset public key verification result; If the preset public key verification result is verification passed, performing signature information verification according to the preset public key to obtain a signature information verification result; When the signature information verification result is that the verification is passed, the unique identification mark and the authentication password are encrypted using the preset public key that has been verified to obtain encrypted authentication data.

5. The authentication method according to claim 4, characterized in that: When the preset public key verification result is a verification pass, the step of performing signature information verification according to the preset public key to obtain the signature information verification result includes: If the preset public key verification result is that the verification is passed, the signature information is verified according to the preset public key to obtain a verification result; The signature information verification result is determined according to the signature verification result.

6. The authentication method according to claim 5, characterized in that: The step of determining the signature information verification result according to the signature verification result comprises: Verify the validity of the authentication application authentication information and the logic script authentication information according to the signature verification result; When both the authentication application authentication information and the logic script authentication information are valid, the authentication application is signature-verified according to the authentication application authentication information and the preset public key to obtain an authentication application authentication information verification result; Perform signature verification on the logic script based on the logic script authentication information and the preset public key to obtain a logic script authentication information verification result; The signature information verification result is determined according to the logic script authentication information verification result and the authentication application authentication information verification result.

7. An authentication device, characterized in that: The authentication device comprises: An acquisition module, used to acquire a unique identification mark of the ADB device and an authentication password input by a user; A validity verification module, used to verify the validity of a preset public key through a preset authentication application, and to encrypt the unique identification mark and the authentication password using the verified preset public key to obtain encrypted authentication data; The authentication module is used to call a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result.

8. An authentication device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the authentication method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the authentication method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the authentication method according to any one of claims 1 to 6 are implemented.

Images