Authentication method, device, apparatus, storage medium and product

Abstract

The application discloses an authentication method, device, equipment, storage medium and product, relates to the computer technical field, and the authentication method is applied to an ADB device, and the method comprises the following steps: obtaining a unique identification of the ADB device and an authentication password input by a user; verifying the validity of a preset public key through a preset authentication application, and encrypting the unique identification and the authentication password by using the preset public key that passes the verification to obtain encrypted authentication data; calling a preset execution environment to verify the device login of the encrypted authentication data to obtain an authentication result. Since the unique identification of the ADB device and the authentication password are encrypted by the preset public key of the ADB device to obtain the encrypted authentication data, and then the preset execution environment is called to verify the device login of the encrypted authentication data to obtain the authentication result, compared with the existing login authentication mode through an account password, the above mode can improve the login authentication security of the ADB device.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to authentication methods, apparatus, devices, storage media and products. Background Technology

[0002] Maintenance and operation (O&M) is an indispensable task for every device manufacturer. After each device product leaves the factory, if a malfunction occurs, O&M tools are needed to locate and debug the cause of the fault. ADB (Android Debug Bridge) is a general-purpose debugging tool provided by Android, which includes various debugging operations such as capturing logs, installing and uninstalling applications, remotely connecting to Android devices, and copying files to devices. Android device manufacturers can achieve many O&M purposes for Android devices through ADB.

[0003] Existing ADB devices generally use account and password authentication for login, which has low security, high management difficulty, and poor user experience. Therefore, how to improve the authentication security and efficiency of ADB devices has become an urgent technical problem to be solved. Summary of the Invention

[0004] The main purpose of this application is to provide an authentication method, apparatus, device, storage medium, and product, which aims to solve the technical problem of low authentication security of existing ADB devices.

[0005] To achieve the above objectives, this application proposes an authentication method for use in ADB devices, the authentication method comprising the following steps:

[0006] Obtain the unique identifier of the ADB device and the authentication password entered by the user;

[0007] The preset public key is validated by a preset authentication application, and the unique identifier and the authentication password are encrypted using the validated preset public key to obtain encrypted authentication data.

[0008] The preset execution environment is invoked to perform device login verification on the encrypted authentication data, and the authentication result is obtained.

[0009] Optionally, the step of calling a preset execution environment to perform device login verification on the encrypted authentication data and obtain an authentication result includes:

[0010] The encrypted authentication data is decrypted by calling a preset execution environment to obtain authentication information;

[0011] The target authentication password is determined using the authentication information within a preset execution environment.

[0012] The authentication result is determined based on the target authentication password and the authentication password in the authentication information.

[0013] Optionally, the step of determining the target authentication password using the authentication information through a preset execution environment includes:

[0014] A message authentication code is generated by using the unique identifier and customized factors in the authentication information within a preset execution environment;

[0015] The message authentication code is encrypted using a preset encryption algorithm to obtain ciphertext;

[0016] The target authentication password is determined based on the ciphertext and the customized factor.

[0017] Optionally, the step of verifying the validity of the preset public key through a preset authentication application, and encrypting the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data, includes:

[0018] The preset public key is validated by a preset authentication application to obtain the preset public key verification result.

[0019] If the preset public key verification result is successful, the signature information is verified based on the preset public key to obtain the signature information verification result.

[0020] If the signature information verification result is successful, the unique identifier and the authentication password are encrypted using the verified preset public key to obtain encrypted authentication data.

[0021] Optionally, the step of verifying the signature information based on the preset public key to obtain the signature information verification result when the preset public key verification result is successful includes:

[0022] If the preset public key verification result is successful, the signature information is verified based on the preset public key to obtain the verification result.

[0023] The signature information verification result is determined based on the verification result.

[0024] Optionally, the step of determining the signature information verification result based on the signature verification result includes:

[0025] Verify the validity of the authentication application authentication information and the logic script authentication information based on the signature verification results;

[0026] If both the authentication application authentication information and the logic script authentication information are valid, the authentication application is signed and verified based on the authentication application authentication information and the preset public key to obtain the authentication application authentication information verification result.

[0027] Based on the logic script authentication information and the preset public key, the logic script is signed and verified to obtain the logic script authentication information verification result.

[0028] The signature information verification result is determined based on the verification result of the logic script authentication information and the verification result of the authentication application authentication information.

[0029] Furthermore, to achieve the above objectives, this application also proposes an authentication device, which includes:

[0030] The acquisition module is used to acquire the unique identifier of the ADB device and the authentication password entered by the user;

[0031] The validity verification module is used to verify the validity of the preset public key through a preset authentication application, and to encrypt the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data.

[0032] The authentication module is used to call a preset execution environment to verify the device login of the encrypted authentication data and obtain the authentication result.

[0033] In addition, to achieve the above objectives, this application also proposes an authentication device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the authentication method described above.

[0034] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the authentication method described above.

[0035] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the authentication method described above.

[0036] This application obtains the unique identifier of the ADB device and the authentication password entered by the user; it verifies the validity of a preset public key using a preset authentication application, and then encrypts the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data; finally, it calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result. Because this application encrypts the unique identifier and authentication password of the ADB device using the ADB device's preset public key to obtain encrypted authentication data, and then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result, compared to existing login authentication methods using account passwords, the above method of this application can improve the login authentication security of ADB devices. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart illustrating the first embodiment of the authentication method for this application.

[0040] Figure 2 This is a schematic diagram illustrating the generation of authentication passwords provided in Embodiment 1 of the authentication method of this application;

[0041] Figure 3 This is a schematic diagram of the authentication relationship provided in Embodiment 1 of the authentication method of this application;

[0042] Figure 4 This is a schematic diagram of the authentication process provided in Embodiment 1 of the authentication method of this application;

[0043] Figure 5 This is a flowchart illustrating Embodiment 2 of the authentication method for this application;

[0044] Figure 6 This is a schematic diagram of the device login verification process provided in Embodiment 2 of the authentication method of this application;

[0045] Figure 7 This is a flowchart illustrating Embodiment 3 of the authentication method for this application;

[0046] Figure 8 This is a schematic diagram of the preset public key verification provided in Embodiment 3 of the authentication method of this application;

[0047] Figure 9 This is a schematic diagram of the overall authentication process provided in Embodiment 3 of the authentication method of this application;

[0048] Figure 10 This is a schematic diagram of the module structure of the authentication device according to an embodiment of this application;

[0049] Figure 11 This is a schematic diagram of the device structure of the hardware operating environment involved in the authentication method in the embodiments of this application.

[0050] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0051] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0052] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of this application embodiment is as follows: Obtain the unique identifier of the ADB device and the authentication password entered by the user; verify the validity of the preset public key through a preset authentication application, and encrypt the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data; call a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result. Since this application encrypts the unique identifier and authentication password of the ADB device using the preset public key of the ADB device to obtain encrypted authentication data, and then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result, compared to the existing login authentication method using account and password, the above method of this application can improve the login authentication security of ADB devices.

[0054] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or ADB device capable of performing the above functions. The following description uses the ADB device as an example to illustrate this embodiment and the subsequent embodiments.

[0055] Based on this, the embodiments of this application provide an authentication method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the authentication method for this application.

[0056] In this embodiment, the authentication method includes the following steps:

[0057] Step S10: Obtain the unique identifier of the ADB device and the authentication password entered by the user;

[0058] It should be noted that when users debug Android devices using ADB devices, they need to first authenticate the ADB device login. In this embodiment, during the production of ADB devices, an authentication password for the ADB device is generated in the secure environment of the production line. Each ADB device's authentication password corresponds one-to-one with its own ADB device. Specifically, this is generated using the ADB device's unique identifier and pre-set custom factors through production line tools. The secure environment can be a secure space isolated on the production line, and the production line tools can be tools used to generate the ADB device's authentication password, which is generated using algorithms such as SM3, SMS, PBKDF2, SM3-HMAC, and Base64. The unique identifier for the ADB device can be its Device ID or IMEI number, or other unique identifiers. Generally, the generated authentication password can be attached to the ADB device. When using the ADB device, the user enters the authentication password to trigger the ADB device's authentication process.

[0059] In specific implementation, it can be referred to Figure 2 , Figure 2 This diagram illustrates the generation of the authentication password provided in Embodiment 1 of the authentication method of this application. The authentication password is generated in a secure production line environment. In this secure environment, the authentication password for the ADB device can be generated using pre-set custom factors and the unique identifier of the ADB device through production line tools. Figure 2 The unique identifier for the ADB device used is a unique serial number.

[0060] Step S20: Verify the validity of the preset public key through a preset authentication application, and use the verified preset public key to encrypt the unique identifier and the authentication password to obtain encrypted authentication data;

[0061] It should be noted that the preset public key can be an asymmetric algorithm public key pre-installed in the preset authentication application of the ADB device during ADB device manufacturing. The preset authentication application can be an application used for device authentication pre-installed in the read-only file system of the ADB device during ADB device manufacturing. To ensure that the ADB device authentication process is conducted entirely within the device's secure environment, the key pair corresponding to the preset public key is pre-installed in the Trusted Execution Environment (TEE) within the ADB device. Specifically, the authentication method in this embodiment includes an ADB authentication password generation stage, which is performed on the device's production line. The production line must be a secure environment to ensure that production data is not leaked. The production line completes the pre-installation of the ADB authentication APP (i.e., the pre-installation of the preset authentication application), the pre-installation of the device key pair (including the preset public key pre-installed in the device authentication application in the read-only file system of the ADB device and the key pair corresponding to the preset public key pre-installed in the Trusted Execution Environment (TEE), and the generation of the device ADB authentication password. The ADB authentication app comes pre-loaded with an ADB authentication logic shell script (sh), a preset authentication application, and a signature file (verify). These three files are burned to a read-only file system along with the system image file, ensuring their integrity through the read-only attribute. The signature file (verify) contains authentication information from the authentication logic script and the preset authentication application, along with signature information. The authentication information for the preset authentication application is the SM3 digest value of the ADB authentication application. The authentication information for the authentication logic script is the SM3 digest value of the ADB authentication logic script itself. The signature information is a signature of the authentication information from the authentication logic script and the preset authentication application. This signature can be obtained by signing the authentication information from the authentication logic script and the preset authentication application using a private key pre-installed in the TEE environment, thus validating the authentication information. See details for further information. Figure 3 , Figure 3 This is a schematic diagram of the authentication relationship provided in Embodiment 1 of the authentication method of this application. In this embodiment, the asymmetric algorithm pre-set in the TEE environment can be an SM2 algorithm key pair. The public key in the SM2 algorithm key pair is also pre-set in the preset authentication application in the read-only file system of the ADB device (i.e., Figure 3 In the ADB authentication application (see [reference]). Figure 3The read-only file system of the ADB device includes a pre-installed ADB authentication logic script and a preset authentication application. The preset authentication application also contains a preset public key. By performing SM3 digest calculation on the ADB authentication logic script, the app authentication information in the authentication information signature file is obtained; by performing SM3 digest calculation on the preset authentication application, the auth_sh authentication information in the authentication information signature file is obtained, which is the authentication information of the preset authentication application; then, the app authentication information and the auth_sh authentication information are signed using the private key preset in the TEE environment to obtain the signature in the authentication information signature file, which is the signature information of the authentication logic script and the preset authentication application.

[0062] It should be noted that the validity verification of the preset public key through the preset authentication application can be achieved by the preset authentication application calling the TEE environment and then comparing whether the public key preset in the TEE environment is consistent with the preset public key preset in the preset authentication application. If they are consistent, the validity verification result of the preset public key is determined to be successful. At this time, the unique identifier and the authentication password are encrypted using the verified preset public key to obtain encrypted authentication data, and the subsequent authentication process begins. Otherwise, the validity verification result of the preset public key is determined to be unsuccessful, and the authentication result of the ADB device is authentication failure.

[0063] Step S30: Call the preset execution environment to perform device login verification on the encrypted authentication data and obtain the authentication result.

[0064] It should be noted that the preset execution environment is the Trusted Execution Environment (TEE) mentioned above. The step of calling the preset execution environment to verify the encrypted authentication data for device login and obtain the authentication result can be achieved by calling the preset execution environment, using the private key in the key pair corresponding to the preset public key in the preset execution environment to decrypt the encrypted authentication data, obtaining a decrypted unique identifier and authentication password, and using the decrypted unique identifier and customized factor (which can be preset in the preset execution environment or packaged in the encrypted authentication data and sent to the preset execution environment) to reconstruct the steps of generating the authentication password based on the ADB device's unique identifier and customized factor, thus obtaining a verification password (i.e., generating the verification password using the same process as generating the authentication password using production line tools). The verification password is then compared with the decrypted authentication password; if they match, the authentication result is successful.

[0065] In specific implementation, it can be referred to Figure 4 , Figure 4This is a schematic diagram of the authentication process provided in Embodiment 1 of the authentication method of this application. When the user enters the authentication password of the ADB device, the ADBD daemon process of the ADB device calls the ADB authentication logic script to start authentication. The ADB authentication logic script does not have authentication logic; all authentication logic is in the preset authentication application (i.e., Figure 4 This is completed within the ADB authentication application. The preset authentication application calls the TEE to complete the verification of the validity of the preset public key built into the preset authentication application and the verification of the authenticity of the preset authentication application (verification). Figure 3 The authentication process includes verifying the validity of the authentication information signature file and performing ADB login password authentication. These operations are completed within a TEE trusted execution environment. Finally, the authentication result is returned to the ADB authentication logic script, which then performs login or denial according to a fixed authentication logic.

[0066] This embodiment obtains the unique identifier of the ADB device and the authentication password entered by the user; it verifies the validity of the preset public key through a preset authentication application, and then encrypts the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data; it then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result. Because this embodiment encrypts the unique identifier and authentication password of the ADB device using the ADB device's preset public key to obtain encrypted authentication data, and then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result, compared to the existing login authentication method using account and password, the above method in this embodiment can improve the login authentication security of the ADB device.

[0067] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 5 , Figure 5 This is a flowchart illustrating Embodiment 2 of the authentication method for this application. Step S30 further includes the following steps:

[0068] Step S301: Decrypt the encrypted authentication data using a preset execution environment to obtain authentication information;

[0069] It should be noted that the step of calling the preset execution environment to decrypt the encrypted authentication data and obtain authentication information can be achieved by using the private key in the key pair corresponding to the preset public key in the preset execution environment to decrypt the encrypted authentication data and obtain authentication information. The authentication information may include the decrypted unique identifier, the authentication password, and the customized factor used when generating the authentication password of the ADB device through the production line tool.

[0070] Step S302: Determine the target authentication password using the authentication information through a preset execution environment;

[0071] It should be noted that the step of determining the target authentication password using the authentication information through a preset execution environment can be achieved by generating the target authentication password using the same generation process as the ADB device's factory-issued authentication password. That is, the target authentication password is generated based on the decrypted ADB device's unique identifier and customized factors.

[0072] Furthermore, to improve authentication security, step S302 may include:

[0073] A message authentication code is generated by using the unique identifier and customized factors in the authentication information within a preset execution environment;

[0074] The message authentication code is encrypted using a preset encryption algorithm to obtain ciphertext;

[0075] The target authentication password is determined based on the ciphertext and the customized factor.

[0076] It should be noted that the step of generating a message authentication code using the unique identifier and customized factor in the authentication information through a preset execution environment can be achieved by encrypting the unique identifier and customized factor using an encryption algorithm built into the preset execution environment. The step of encrypting the message authentication code using a preset encryption algorithm to obtain ciphertext can be achieved by using an SM4 key, with the first 16 bytes of the message authentication code as the IV and the last 16 bytes as the data. Determining the target authentication password based on the ciphertext and the customized factor can be achieved by using the ciphertext as the password and the customized factor as the Salt, performing iterative calculations to derive a 16-byte key, and then performing PBKDF2 password derivation calculations based on the SM3 and SM4 algorithms to obtain the target authentication password.

[0077] In specific implementation, it can be referred to Figure 6 , Figure 6This is a schematic diagram of the device login verification process provided in Embodiment 2 of the authentication method of this application. After the ADB authentication application completes the application's built-in preset public key and its own trusted authentication, it encrypts the ADB device's device_id (or other unique identifier of the ADB device), authentication password pwd, and custom factor using the preset public key to obtain authentication data cipher_auth_data. The authentication data cipher_auth_data is then sent to the TEE for login authentication. The TEE decrypts cipher_auth_data using its built-in device private key to obtain device_id, pwd, and custom factor a. Using device_id as the key, it calculates SM3-HMAC on custom factor a to obtain a 32-byte HMAC value. Using the SM4 key pre-set in the production stage, the first 16 bytes of the HMAC are used as the IV, and the last 16 bytes as data a, resulting in ciphertext P. P is used as the password, and custom factor a is used as the Salt. The iteration count is 1000 (a custom value), and the derived key length is 16 bytes. PBKD based on the SM3 and SM4 algorithms is then performed. The F2 password is derived and calculated to obtain password_a. Password_a and pwd are then checked to see if they match. If they match, the authentication result is successful; otherwise, the authentication result is unsuccessful.

[0078] Step S303: Determine the authentication result based on the target authentication password and the authentication password in the authentication information.

[0079] It should be noted that determining the authentication result based on the target authentication password and the authentication password in the authentication information can be done by comparing whether the target authentication password and the decrypted authentication password in the authentication information are consistent. If the comparison results are consistent, the authentication result is determined to be successful; otherwise, the authentication result is determined to be unsuccessful.

[0080] This embodiment calls a preset execution environment to decrypt the encrypted authentication data to obtain authentication information; it then uses the authentication information to determine the target authentication password through the preset execution environment; and finally, it determines the authentication result based on the target authentication password and the authentication password in the authentication information. This embodiment performs device login verification through a preset execution environment, ensuring that the verification process is entirely within the device's secure environment, preventing unauthorized tampering with the verification logic, and thus improving authentication security.

[0081] Based on the above embodiments of this application, in the third embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 7 , Figure 7 This is a flowchart illustrating Embodiment 3 of the authentication method for this application. Step S20 further includes the following steps:

[0082] Step S201: Verify the validity of the preset public key through the preset authentication application to obtain the preset public key verification result;

[0083] It should be noted that the verification of the preset public key by the preset authentication application to obtain the preset public key verification result can be achieved by the preset authentication application calling the preset execution environment. The preset execution environment compares the preset public key with the public key in the key pair built into the preset execution environment itself. If they match, the preset public key verification result is determined to be successful, and the preset public key verification result is returned to the preset authentication application.

[0084] Furthermore, to enhance the security of authentication data, step S201 may include: initiating a public key verification request to a preset execution environment through a preset authentication application; receiving a verification random number fed back by the preset execution environment based on the public key verification request; encrypting the verification random number according to a preset public key to obtain a random number encryption result, and sending the random number encryption result to the preset execution environment; and receiving a preset public key verification result fed back by the preset execution environment based on the random number encryption result.

[0085] It should be noted that the public key verification request can be a command requesting the preset execution environment to begin public key verification. Upon receiving the public key verification request, the preset execution environment generates a verification random number and sends it to the preset authentication application of the ADB device. After receiving the verification random number from the preset execution environment based on the public key verification request, the preset authentication application encrypts the verification random number using the preset public key. Then, it sends the encrypted random number to the preset execution environment for preset public key verification. The preset execution environment decrypts the encrypted random number using its built-in private key and compares the decrypted result with the generated verification random number. If the comparison results match, the preset public key verification is successful; otherwise, the preset public key verification fails, and the preset public key verification result is returned.

[0086] In specific implementation, it can be referred to Figure 8 , Figure 8This is a schematic diagram of the preset public key verification provided in Embodiment 3 of the authentication method of this application. In this diagram, GetPublickKeyAuthData is a request initiated by the ADB authentication application (i.e., the preset authentication application) to the TEE to obtain public key authentication data, specifically, to obtain a randomly generated verification random number from the TEE. The TEE generates and saves the authentication random number r, and then sends r to the ADB authentication application. The ADB authentication application encrypts the authentication random number r using the preset public key to obtain r', calls the GetPublickKeyAuthResult interface to send r', and the TEE decrypts r' using its private key and compares it with r. Based on the comparison result, the preset public key verification result is determined. Figure 8 The result of the public key validity.

[0087] Step S202: If the preset public key verification result is successful, the signature information is verified according to the preset public key to obtain the signature information verification result;

[0088] It should be noted that the signature information verification based on the preset public key to obtain the signature information verification result can be performed by verifying the signature information based on the preset public key to obtain the verification result; and the signature information verification result is determined based on the verification result.

[0089] It should be noted that the signature information can be the signature information of the authentication logic script in the read-only file system and the authentication information of the preset authentication application, i.e. Figure 3 The signature information in the document. The determination of the signature verification result based on the verification result can be as follows: if the verification result is successful, the signature verification result is deemed successful; if the verification result is unsuccessful, the signature verification result is deemed unsuccessful.

[0090] Furthermore, to improve the authentication security of the device, the step of determining the signature information verification result based on the signature verification result includes:

[0091] Verify the validity of the authentication application authentication information and the logic script authentication information based on the signature verification results;

[0092] If both the authentication application authentication information and the logic script authentication information are valid, the authentication application is signed and verified based on the authentication application authentication information and the preset public key to obtain the authentication application authentication information verification result.

[0093] Based on the logic script authentication information and the preset public key, the logic script is signed and verified to obtain the logic script authentication information verification result.

[0094] The signature information verification result is determined based on the verification result of the logic script authentication information and the verification result of the authentication application authentication information.

[0095] It should be noted that verifying the validity of the authentication application's authentication information and the logic script's authentication information based on the signature verification result can mean that if the signature verification result is passed, the authentication application's authentication information and the logic script's authentication information are deemed valid, but the authentication application and logic script themselves are not necessarily valid. In this case, the authentication application and the logic script are verified separately based on the authentication application's authentication information and the logic script's authentication information, obtaining their respective verification results. If both the logic script's authentication information verification result and the authentication application's authentication information verification result are passed, the signature information verification result is deemed passed. If either the logic script's authentication information verification result or the authentication application's authentication information verification result is failed, the signature information verification result is deemed failed.

[0096] In specific implementation, it can be referred to Figure 3 First, the validity of the app authentication information and auth_sh authentication information is verified based on the signature verification result. If the app authentication information is valid, the SM3 digest value is calculated for the ADB authentication application. If the auth_sh authentication information is valid, the SM3 digest value is calculated for the ADB authorization logic script. Based on the SM3 digest value of the logic script and the SM3 digest value of the authentication application, the validity of the ADB authentication application and the ADB authorization logic script is determined by comparing them with the app authentication information and auth_sh authentication information.

[0097] Step S203: If the signature information verification result is successful, the unique identifier and the authentication password are encrypted using the verified preset public key to obtain encrypted authentication data.

[0098] It should be noted that the step of encrypting the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data can be achieved by encrypting the unique identifier and the authentication password using the preset public key. When performing device login verification, the preset execution environment also needs to obtain a custom factor used to generate the authentication password. Therefore, encrypting the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data also includes encrypting the unique identifier, the custom factor, and the authentication password using the verified preset public key. If the custom factor is pre-configured in the preset execution environment at the time of device shipment, then encryption of the custom factor is not required.

[0099] For details, please refer to Figure 9 , Figure 9This is a schematic diagram of the overall authentication process provided in Embodiment 3 of the authentication method of this application. The ADB authentication logic script determines the unique device_id of the ADB device and the authentication password pwd entered by the user. Then, it sends the device_id and the authentication password pwd entered by the user to the ADB preset authentication application for authentication. The ADB preset authentication application requests the TEE environment to verify the validity of the preset public key. After successful verification, the authentication information signature file can be verified based on the preset public key, or... Figure 9 As shown, the TEE environment first verifies the signature information (authentication information of the authentication logic script and the preset authentication application) in the authentication information signature file. After successful verification, the authentication information of the authentication logic script and the preset authentication application is verified by SM3 digest according to the preset public key. After successful verification, the device_id, the authentication password pwd entered by the user, and the customized factor are sent to the TEE for secure world login authentication. The authentication result returned by the TEE is sent to the ADB authentication logic script for output.

[0100] This embodiment verifies the validity of a preset public key using a preset authentication application to obtain a preset public key verification result. The verified preset public key is then used to encrypt the unique identifier and the authentication password to obtain encrypted authentication data. This embodiment verifies the preset public key and signature information, preventing tampering with the preset public key, preset authentication application, and authentication logic script, which could affect subsequent authentication results and improve authentication accuracy.

[0101] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the authentication method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0102] This application also provides an authentication device, please refer to... Figure 10 The authentication device includes:

[0103] The acquisition module 10 is used to acquire the unique identifier of the ADB device and the authentication password entered by the user;

[0104] The validity verification module 20 is used to verify the validity of the preset public key through a preset authentication application, and to encrypt the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data.

[0105] The authentication module 30 is used to call a preset execution environment to perform device login verification on the encrypted authentication data and obtain the authentication result.

[0106] This embodiment obtains the unique identifier of the ADB device and the authentication password entered by the user; it verifies the validity of the preset public key through a preset authentication application, and then encrypts the unique identifier and the authentication password using the verified preset public key to obtain encrypted authentication data; it then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result. Because this embodiment encrypts the unique identifier and authentication password of the ADB device using the ADB device's preset public key to obtain encrypted authentication data, and then calls a preset execution environment to perform device login verification on the encrypted authentication data to obtain the authentication result, compared to the existing login authentication method using account and password, the above method in this embodiment can improve the login authentication security of the ADB device.

[0107] The authentication device provided in this application, employing the authentication method described in the above embodiments, can solve the technical problem of low authentication security in existing ADB devices. Compared with the prior art, the beneficial effects of the authentication device provided in this application are the same as those of the authentication method provided in the above embodiments, and other technical features in the authentication device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0108] This application provides an authentication device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the authentication method in the first embodiment described above.

[0109] The following is for reference. Figure 11 The diagram illustrates a structural schematic of an authentication device suitable for implementing embodiments of this application. The authentication device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 11 The authentication device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0110] like Figure 11As shown, the authentication device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the authentication device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the authentication device to communicate wirelessly or wiredly with other devices to exchange data. Although authentication devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0111] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0112] The authentication device provided in this application, employing the authentication method described in the above embodiments, can solve the technical problem of low authentication security in existing ADB devices. Compared with the prior art, the beneficial effects of the authentication device provided in this application are the same as those of the authentication method provided in the above embodiments, and other technical features of this authentication device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0113] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0114] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0115] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the authentication method in the above embodiments.

[0116] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0117] The aforementioned computer-readable storage medium may be included in the authentication device; or it may exist independently and not be assembled into the authentication device.

[0118] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0119] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0120] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0121] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described authentication method, which can solve the technical problem of low authentication security in existing ADB devices. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the authentication method provided in the above embodiments, and will not be repeated here.

[0122] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the authentication method described above.

[0123] The computer program product provided in this application can solve the technical problem of low authentication security in existing ADB devices. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the authentication method provided in the above embodiments, and will not be repeated here.

[0124] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. An authentication method characterized by, The authentication method applied to an ADB device comprises the following steps: obtaining a unique identification of the ADB device and an authentication password input by a user; verifying the validity of a preset public key through a preset authentication application, and encrypting the unique identification and the authentication password by using the preset public key that passes the verification to obtain encrypted authentication data; calling a preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result; the step of calling the preset execution environment to perform device login verification on the encrypted authentication data to obtain an authentication result comprises: decrypting the encrypted authentication data by using the preset execution environment to obtain authentication information; generating a message authentication code by using the unique identification and a customized factor in the authentication information through the preset execution environment; encrypting the message authentication code by using a preset encryption algorithm to obtain ciphertext; determining a target authentication password according to the ciphertext and the customized factor; determining an authentication result according to the target authentication password and the authentication password in the authentication information.

2. The authentication method of claim 1, wherein, the step of verifying the validity of the preset public key through the preset authentication application, and encrypting the unique identification and the authentication password by using the preset public key that passes the verification to obtain encrypted authentication data comprises: verifying the validity of the preset public key through the preset authentication application to obtain a preset public key verification result; in the case that the preset public key verification result is verified, performing signature information verification according to the preset public key to obtain a signature information verification result; in the case that the signature information verification result is verified, encrypting the unique identification and the authentication password by using the preset public key that passes the verification to obtain encrypted authentication data.

3. The authentication method of claim 2, wherein, the step of performing signature information verification according to the preset public key in the case that the preset public key verification result is verified to obtain a signature information verification result comprises: in the case that the preset public key verification result is verified, verifying the signature information according to the preset public key to obtain a verification result; determining a signature information verification result according to the verification result.

4. The authentication method of claim 3, wherein, the step of determining a signature information verification result according to the verification result comprises: verifying the validity of authentication application authentication information and logic script authentication information according to the verification result; in the case that the authentication application authentication information and the logic script authentication information are both valid, performing signature verification on an authentication application according to the authentication application authentication information and the preset public key to obtain an authentication application authentication information verification result; performing signature verification on a logic script according to the logic script authentication information and the preset public key to obtain a logic script authentication information verification result; determining a signature information verification result according to the logic script authentication information verification result and the authentication application authentication information verification result.

5. An authentication device, characterized by the authentication device comprises: an obtaining module configured to obtain a unique identification of an ADB device and an authentication password input by a user; The validity verification module is configured to verify the validity of the preset public key by using a preset authentication application, and encrypt the unique identification and the authentication password by using the preset public key that passes the verification, to obtain encrypted authentication data. The authentication module is configured to call a preset execution environment to perform device login verification on the encrypted authentication data, to obtain an authentication result. The authentication module is further configured to call the preset execution environment to decrypt the encrypted authentication data, to obtain authentication information. A message authentication code is generated by using the unique identification and the customization factor in the authentication information by the preset execution environment. The message authentication code is encrypted by using a preset encryption algorithm, to obtain ciphertext. A target authentication password is determined according to the ciphertext and the customization factor. An authentication result is determined according to the target authentication password and the authentication password in the authentication information.

6. An authentication device, characterized by The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the authentication method according to any one of claims 1 to 4.

7. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the authentication method according to any one of claims 1 to 4.

8. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the authentication method according to any one of claims 1 to 4.

Images