Authentication method, robot controller and storage medium
By collecting and matching the current device feature information of IoT devices, the problem of the authentication method in the prior art is easily stolen or counterfeited, and higher authentication reliability and security are achieved.
Patent Information
- Application Number
- CN202411842753.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-11
AI Technical Summary
The authentication methods of existing IoT devices are easily stolen or counterfeit, which poses security risks.
By collecting the robot's current device feature information, the current digest value is calculated, and matched with the original digest value in the preset signature file. If it matches, the authentication will be confirmed to be passed.
It improves the reliability and accuracy of authentication, enhances security, and makes hardware and software feature information difficult to counterfeit, reducing the risk of forgery.
Smart Images
Figure CN119814320A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of Internet of Things communication technology, and in particular to an authentication method, a robot controller and a storage medium. Background Art
[0002] With the development of IoT devices, more and more IoT devices are connected to the network. It becomes more and more important to ensure the security and authenticity of these IoT devices. The authentication method for IoT devices has also become a research hotspot.
[0003] In the related art, when authenticating a device, it usually relies on a user name, password or digital certificate. However, in the related art, information such as a user name, password or digital certificate is easy to steal or forge, which poses a security risk. Summary of the invention
[0004] The purpose of this application is to provide an authentication method, a robot controller and a storage medium to address the deficiencies in the above-mentioned prior art, so as to solve the above-mentioned technical problems existing in the related technology.
[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:
[0006] In a first aspect, an embodiment of the present application provides an authentication method, which is applied to a controller of a robot, comprising:
[0007] Collecting current device feature information of the robot, wherein the current device feature information includes: current hardware feature information and current software feature information of the robot;
[0008] Calculating a current summary value for the robot according to the current device feature information;
[0009] Determine whether the current digest value of the robot matches the original digest value in the preset signature file of the robot;
[0010] If they match, it is determined that the robot's authentication has passed.
[0011] Optionally, the determining whether the current digest value of the robot matches the original digest value in the preset signature file of the robot includes:
[0012] The preset public key is used to decrypt the preset signature file. If the decryption is successful, the preset signature file is determined to be valid, and the original digest value is obtained by decryption. The preset public key is the public key corresponding to the preset private key, and the preset signature file is a signature file that is pre-signed based on the preset private key.
[0013] Optionally, before determining whether the current digest value of the robot matches the original digest value in the preset signature file of the robot, the method further includes:
[0014] According to a collection request sent by a client of the robot, original device feature information of the robot is collected, wherein the original device feature information includes: original hardware feature information and original software feature information of the robot;
[0015] The preset signature file is obtained through the client according to the original device characteristic information.
[0016] Optionally, the acquiring the preset signature file through the client according to the original device feature information includes:
[0017] Calculating the original summary value according to the original device characteristic information;
[0018] Sending the original digest value to the cloud server through the client, so that the cloud server signs the original digest value with a preset private key to obtain the preset signature file, and sending the preset signature file to the client;
[0019] The preset signature file is received through the client.
[0020] Optionally, before collecting the original device feature information of the robot according to the collection request sent by the client of the robot, the method further includes:
[0021] Obtaining user account information and user password information sent by the client;
[0022] Matching the user account information, the user password information and preset information; wherein the preset information includes: a plurality of preset account information and preset password information corresponding to each of the preset account information;
[0023] If the match is successful, it is confirmed that the user account information has logged in successfully.
[0024] Optionally, collecting original device feature information of the robot according to a collection request sent by a client of the robot includes:
[0025] Determine whether the user account information that successfully logged in is the administrator account information;
[0026] If yes, collecting original device feature information of the robot according to the collection request sent by the client of the robot;
[0027] If not, the client is prohibited from obtaining administrator privileges.
[0028] Optionally, obtaining the user account information and user password information sent by the client includes:
[0029] Obtaining user account information and encrypted user password information sent by the client using a temporary key; wherein the temporary key is a key determined by negotiation between the client and the controller of the robot;
[0030] The encrypted user account information and the encrypted user password information are decrypted using the temporary key to obtain the user account information and the user password information.
[0031] Optionally, the current hardware feature information includes at least one of the following: the model and capacity of the current memory, the model and capacity of the current storage device, the serial number of the current processor, and the current media access control MAC address; the current software feature information includes at least one of the following: the current operating system version and the current kernel configuration.
[0032] In a second aspect, an embodiment of the present application further provides a robot controller, comprising: a memory and a processor, wherein the memory stores a computer program executable by the processor, and when the processor executes the computer program, the authentication method described in any one of the first aspects above is implemented.
[0033] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is read and executed, the authentication method described in any one of the first aspects above is implemented.
[0034] In a fourth aspect, an embodiment of the present application further provides an authentication device, which is applied to a controller of a robot, comprising:
[0035] A first acquisition module is used to acquire current device feature information of the robot, wherein the current device feature information includes: current hardware feature information and current software feature information of the robot;
[0036] A calculation module, used for calculating a current summary value for the robot according to the current device feature information;
[0037] A judgment module, used to judge whether the current digest value of the robot matches the original digest value in the preset signature file of the robot;
[0038] The determination module is used to determine whether the robot's authentication is passed if there is a match.
[0039] Optionally, the judgment module is specifically used to use a preset public key to decrypt the preset signature file. If the decryption is successful, it is determined that the preset signature file is valid, and the original summary value is obtained by decryption. The preset public key is the public key corresponding to the preset private key, and the preset signature file is a signature file that is pre-signed based on the preset private key.
[0040] Optionally, the device further comprises:
[0041] A second collection module is used to collect original device feature information of the robot according to a collection request sent by the client of the robot, wherein the original device feature information includes: original hardware feature information and original software feature information in the robot;
[0042] The first acquisition module is used to acquire the preset signature file through the client according to the original device feature information.
[0043] Optionally, the first acquisition module is specifically used to calculate the original summary value based on the original device characteristic information; send the original summary value to the cloud server through the client, so that the cloud server uses a preset private key to sign the original summary value to obtain the preset signature file, and send the preset signature file to the client; receive the preset signature file through the client.
[0044] Optionally, the device further comprises:
[0045] The second acquisition module is used to obtain the user account information and user password information sent by the client;
[0046] A matching module, used to match the user account information, the user password information and preset information; wherein the preset information includes: a plurality of preset account information and preset password information corresponding to each of the preset account information;
[0047] The confirmation module is used to confirm that the user account information has logged in successfully if the match is successful.
[0048] Optionally, the second acquisition module is specifically used to determine whether the user account information of the successful login is the administrator account information; if so, the original device feature information of the robot is collected according to the acquisition request sent by the client of the robot; if not, the client is prohibited from obtaining administrator permissions.
[0049] Optionally, the second acquisition module is specifically used to obtain user account information encrypted by a temporary key and encrypted user password information sent by the client; wherein the temporary key is a key negotiated and determined by the client and the controller of the robot; the encrypted user account information and the encrypted user password information are decrypted using the temporary key to obtain the user account information and the user password information.
[0050] Optionally, the current hardware feature information includes at least one of the following: the model and capacity of the current memory, the model and capacity of the current storage device, the serial number of the current processor, and the current media access control MAC address; the current software feature information includes at least one of the following: the current operating system version and the current kernel configuration.
[0051] The beneficial effect of the present application is that the embodiment of the present application provides an authentication method, which includes: collecting the current device feature information of the robot, the current device feature information includes: the current hardware feature information and the current software feature information in the robot; calculating the current summary value for the robot according to the current device feature information; judging whether the current summary value of the robot matches the original summary value in the preset signature file of the robot; if they match, determining that the robot's authentication is passed. The current summary value of the robot is calculated according to the current hardware feature information and the current software feature information in the robot. The hardware feature information and the software feature information are difficult to counterfeit and cannot be easily forged. Authentication is performed based on the calculated current summary value and the original summary, which can improve the reliability and accuracy of authentication and improve security. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0053] Figure 1 A schematic diagram of the structure of an authentication system provided in an embodiment of the present application;
[0054] Figure 2 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 1 ;
[0055] Figure 3 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 2 ;
[0056] Figure 4A schematic diagram of an authentication method provided in an embodiment of the present application Figure 3 ;
[0057] Figure 5 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 4 ;
[0058] Figure 6 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 5 ;
[0059] Figure 7 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 6 ;
[0060] Figure 8 A schematic diagram of the structure of an authentication device provided in an embodiment of the present application;
[0061] Fig. 9 A schematic diagram of the structure of a robot controller provided in an embodiment of the present application. DETAILED DESCRIPTION
[0062] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.
[0063] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.
[0064] In the description of the present application, it should be noted that if the terms "upper", "lower", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the application is usually placed when used. It is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.
[0065] In addition, the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0066] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.
[0067] Figure 1 A schematic diagram of the structure of an authentication system provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the authentication system may include: a cloud server 101, a robot client device 102 and a robot controller 103.
[0068] The cloud server 101 is connected to the client device 102 of the robot by communication, and the client device 102 of the robot is connected to the controller 103 of the robot by communication. Optionally, the cloud server 101 and the client device 102 of the robot can be connected to each other by wireless communication via the Internet, and the client device 102 of the robot can be connected to the controller 103 of the robot by wireless communication via a local area network.
[0069] In addition, a robot client is running on the robot client device 102 .
[0070] An embodiment of the present application provides an authentication method, which is applied to the controller 103 of the robot in the authentication system. The following explains an authentication method provided by an embodiment of the present application.
[0071] Figure 2 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the method may include:
[0072] S101. Collect current device feature information of the robot.
[0073] The current device feature information may include: current hardware feature information and current software feature information in the robot.
[0074] In the embodiment of the present application, the robot is integrated with multiple hardware devices, and the feature information of at least one of the multiple hardware devices can be used as the current hardware feature information of the robot at the current moment. The robot is also deployed with multiple types of software feature information, and at least one type of software feature information of the multiple types of software feature information can be collected at the current moment as the current software feature information.
[0075] In actual applications, the robot's client can send a control request to the robot's controller. If the robot's controller determines that the control operation corresponding to the control request is a control operation corresponding to the system administrator's authority, it is necessary to collect the robot's current device feature information for a higher level of security verification.
[0076] It should be noted that the current hardware feature information and the current software feature information may be collected simultaneously, or may be collected sequentially, or may be collected in other orders, and the embodiments of the present application do not impose any specific restrictions on this.
[0077] S102: Calculate the current summary value for the robot according to the current device feature information.
[0078] In some implementations, a preset summary algorithm is used to perform an overall summary calculation on the current hardware feature information and the current software feature information in the current device feature information to obtain a current summary value for the robot.
[0079] Optionally, the preset digest algorithm may be a hash algorithm, for example, the hash algorithm may be sha256+salt (a method for storing and verifying passwords, the salt technology is used to enhance the security of passwords), sha256 (a secure hash algorithm).
[0080] S103: Determine whether the current digest value of the robot matches the original digest value in the preset signature file of the robot.
[0081] The preset signature file of the robot includes a verified signature, and the verified signature includes an original digest value.
[0082] In some implementations, the current digest value of the robot may be compared with the original digest value in the preset signature file of the robot to determine whether the two match.
[0083] S104: If they match, it is determined that the robot's authentication has passed.
[0084] In the embodiment of the present application, if the current digest value of the robot matches the original digest value in the preset signature file of the robot, it means that the current device feature information of the robot is the same as the original device feature information of the robot, that is, the hardware information and software information of the robot are consistent in the signature application stage and the current stage, and the security is high, so it can be determined that the robot has passed the authentication. After the authentication is passed, the control operation of the system administrator authority can be performed on the robot.
[0085] In addition, if the current digest value of the robot does not match the original digest value in the preset signature file of the robot, it means that the current device feature information of the robot is different from the original device feature information of the robot, that is, the hardware information and software information of the robot are inconsistent in the signature application stage and the current stage, and the security is poor, so it can be determined that the robot authentication fails. After the authentication fails, it is forbidden to perform control operations with system administrator privileges on the robot.
[0086] The original device characteristic information of the robot is the device characteristic information of the robot when applying for a preset signature file.
[0087] In summary, the embodiment of the present application provides an authentication method, which includes: collecting the current device feature information of the robot, the current device feature information includes: the current hardware feature information and the current software feature information in the robot; calculating the current summary value for the robot according to the current device feature information; judging whether the current summary value of the robot matches the original summary value in the preset signature file of the robot; if they match, determining that the robot's authentication is passed. The current summary value of the robot is calculated according to the current hardware feature information and the current software feature information in the robot. The hardware feature information and the software feature information are difficult to counterfeit and cannot be easily forged. Authentication is performed based on the calculated current summary value and the original summary, which can improve the reliability and accuracy of authentication and improve security.
[0088] Optionally, the current hardware feature information includes at least one of the following: the model and capacity of the current memory, the model and capacity of the current storage device, the serial number of the current processor, the current media access control MAC address; the current software feature information includes at least one of the following: the current operating system version, the current kernel configuration.
[0089] Optionally, the process of determining whether the current digest value of the robot matches the original digest value in the preset signature file of the robot in S103 may include:
[0090] The preset public key is used to decrypt the preset signature file. If the decryption is successful, the preset signature file is determined to be valid, and the original digest value is decrypted.
[0091] The preset public key is the public key corresponding to the preset private key, and the preset signature file is a signature file generated by signing based on the preset private key in advance. The signature in the preset signature file is the signature of the system administrator authority applied in advance.
[0092] In some embodiments, a preset public key corresponding to a preset private key is pre-saved on the robot's controller, and the robot's controller uses the signature in the preset signature file to decrypt the signature; if the decryption is successful, the validity of the signature in the preset signature file is determined, and the original summary value of the signature in the preset signature file is obtained by decryption.
[0093] It should be noted that the cloud server stores a preset private key, and the cloud server pre-signs the generated signature file based on the preset private key. The cloud server sends the preset signature file to the robot controller through the robot client, and accordingly, the robot controller can obtain the preset signature file.
[0094] Figure 3 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 2 ,like Figure 3 As shown, before determining in the above S103 whether the current digest value of the robot matches the original digest value in the preset signature file of the robot, the method may further include:
[0095] S201. Collect original device feature information of the robot according to a collection request sent by the robot's client.
[0096] The original device feature information includes: original hardware feature information and original software feature information in the robot.
[0097] In actual applications, when a user needs to apply for a signature with system administrator authority, the application can be performed on the robot's client. The robot's client generates a collection request in response to the application. The robot's client can send the collection request to the robot's controller. The robot's controller can receive the collection request and collect the robot's original device feature information based on the collection request.
[0098] S202: Obtain a preset signature file through the client according to the original device feature information.
[0099] In some implementations, the robot controller obtains a preset signature file from a cloud server through a client based on original device feature information.
[0100] It should be noted that the original hardware feature information includes at least one of the following: the model and capacity of the original memory, the model and capacity of the original storage device, the serial number of the original processor, and the original MAC (Media Access Control Address). The original software feature information includes at least one of the following: the original operating system version and the original kernel configuration.
[0101] In an embodiment of the present application, the current hardware feature information and the current software feature information may be collected simultaneously, or may be collected sequentially, or may be collected in other orders, and the embodiment of the present application does not impose any specific restrictions on this.
[0102] Optionally, Figure 4 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 3 ,like Figure 4 As shown, the process of obtaining the preset signature file through the client according to the original device feature information in the above S202 may include:
[0103] S301. Calculate an original summary value according to original device feature information.
[0104] In some implementations, a preset summary algorithm is used to perform an overall summary calculation on the original hardware feature information and the original software feature information in the original device feature information to obtain an original summary value for the robot.
[0105] Optionally, the preset digest algorithm may be a hash algorithm, and by way of example, the hash algorithm may be sha256+salt, sha256.
[0106] S302: Send the original summary value to the cloud server through the client, so that the cloud server signs the original summary value with a preset private key to obtain a preset signature file, and sends the preset signature file to the client.
[0107] In some embodiments, the robot's controller sends an original summary value to the robot's client; the robot's client can receive the original summary value and send the original summary value to the cloud server; the cloud server can receive the original summary value and use a preset private key to sign the original summary value to obtain a preset signature file, and send the preset signature file to the robot's client; accordingly, the robot's client can receive the preset signature file.
[0108] It should be noted that the process of sending the original digest value to the cloud server to obtain the preset signature file can be considered as the process of applying for the system administrator authority signature of the robot.
[0109] S303: Receive a preset signature file through the client.
[0110] The client of the robot sends the preset signature file to the controller of the robot, and the controller of the robot can receive the preset signature file.
[0111] In the embodiment of the present application, after receiving the preset signature file, the controller of the robot can use the preset public key to decrypt the preset signature file to obtain the original digest value, so as to subsequently perform the process of S103.
[0112] Optionally, Figure 5 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 4 ,like Figure 5 As shown, before the process of collecting the original device feature information of the robot according to the collection request sent by the client of the robot in the above S201, the method may further include:
[0113] S401, obtaining user account information and user password information sent by the client.
[0114] In some embodiments, when the robot's client applies to log in to the robot's controller, the robot's client responds to the input login operation, obtains user account information and user password information, and then sends the user account information and user password information to the robot's controller; correspondingly, the robot's controller receives the user account information and user password information.
[0115] S402: Match the user account information, user password information and preset information.
[0116] The preset information includes: a plurality of preset account information and preset password information corresponding to each preset account information.
[0117] In some embodiments, a target preset account signal that matches the user account information is searched for from multiple preset account information in the preset information, and the target preset password information corresponding to the target preset account information in the preset information is determined; the target preset password information and the user password information are matched, and if the two match, it is determined that the user account information, user password information and preset information match verification is successful.
[0118] In addition, if there is no target preset account signal matching the user account information among the multiple preset account information in the preset information, or the target preset password information does not match the user password information, it is determined that the matching verification of the user account information, user password information and preset information has failed.
[0119] S403: If the match is successful, confirm that the user account information has logged in successfully.
[0120] In the embodiment of the present application, the user account information and the user password information are verified, and the user account information is logged in, so that the robot client can log in to the robot controller. Among them, both the ordinary user account information and the administrator user account information can be logged in by the account and password.
[0121] Optionally, Figure 6 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 5 ,like Figure 6 As shown, the process of collecting the original device feature information of the robot according to the collection request sent by the robot client in the above S201 may include:
[0122] S501. Determine whether the user account information that has successfully logged in is the administrator account information.
[0123] Among them, the administrator account information is the user-level administrator.
[0124] In the embodiment of the present application, only when the user account information of the successful login is the administrator account information, can the original device feature information of the robot be collected, and then the signature of the system administrator authority, i.e. the preset signature file, can be applied based on the original device feature information. When the user account information of the successful login is not the administrator account information, the process of collecting the original device feature information of the robot will not be started, that is, ordinary account information cannot apply for the signature of the system administrator authority.
[0125] S502: If yes, collect the original device feature information of the robot according to the collection request sent by the robot's client.
[0126] It is worth mentioning that the original device feature information of the robot is collected in order to obtain the preset signature file, so as to match the current summary value of the robot with the original summary value in the preset signature file of the robot, and perform a higher level of authentication on the robot. After the higher level of authentication is passed, the robot's client can obtain the system administrator authority and control the robot with the system administrator authority.
[0127] S503: If not, prohibit the client from obtaining administrator privileges.
[0128] If the user account information of the successful login is not the administrator account information, or the current digest value of the robot does not match the original digest value in the preset signature file of the robot, the robot client is prohibited from obtaining the system administrator privileges, and the robot client cannot control the robot with the system administrator privileges. Only those who obtain the user-level administrator privileges first can obtain the system-level administrator privileges.
[0129] In addition, if the robot's client is prohibited from obtaining system administrator privileges, after successfully logging in with the user account information, the robot's client can only perform basic privilege control on the robot's controller.
[0130] Optionally, Figure 7 A schematic diagram of an authentication method provided in an embodiment of the present application Figure 6 ,like Figure 7 As shown, the process of obtaining the user account information and user password information sent by the client in the above S401 may include:
[0131] S601. Obtain the user account information encrypted by the temporary key and the encrypted user password information sent by the client.
[0132] The temporary key is a key negotiated and determined by the client and the robot's controller.
[0133] In some embodiments, the robot client and the robot controller negotiate a temporary secret key through a private key pre-deployed in the robot controller, and then an encrypted connection is established between the robot client and the robot controller. Both the robot client and the robot controller have a temporary key.
[0134] In an embodiment of the present application, the robot's client uses a temporary key to encrypt the user account information and the user password information respectively, obtains and sends the user account information and the encrypted user password information encrypted with the temporary key to the robot's controller; correspondingly, the robot's controller can obtain the user account information and the encrypted user password information encrypted with the temporary key.
[0135] S602: Decrypt the encrypted user account information and the encrypted user password information using a temporary key to obtain the user account information and the user password information.
[0136] It should be noted that the robot's controller uses a temporary key to decrypt the encrypted user account information and the encrypted user password information at the same time, or to decrypt the encrypted user account information and the encrypted user password information in sequence. The embodiments of the present application do not impose specific restrictions on this.
[0137] It is worth noting that when the robot is repaired or replaced, such as replacing the robot controller storage device, power control board, and safety control board, the robot's hardware will change, which will cause the current device feature information to not match the original device feature information, and then the current digest value to not match the original digest value. This will result in authentication failure.
[0138] Therefore, the signature in the preset signature file applied for historically will not be usable after the robot's hardware information changes (such as component replacement due to maintenance). It is necessary to re-collect the robot's device feature information to obtain the summary and apply for the signature to obtain a new signature file, which can be used in the authentication process.
[0139] In summary, the embodiment of the present application provides an authentication method, which calculates the current summary value of the robot based on the current hardware feature information and the current software feature information in the robot. The hardware feature information and the software feature information are difficult to counterfeit and cannot be easily forged. Authentication is performed based on the calculated current summary value and the original summary, which can improve the reliability and accuracy of authentication and improve security. Moreover, since the hardware and behavioral characteristics of the device are difficult to counterfeit, even if the network credentials are obtained, it is not easy to forge a legitimate device, which further improves the reliability of authentication.
[0140] Moreover, based on the user account information and user password information login, a combined verification based on the user's current device characteristics is added to improve the security and reliability of authentication. Only basic permissions can be obtained through user account information and user password information, and system-level administrator permissions can only be obtained after further verification based on the current digest value and the original digest value.
[0141] In addition, by replacing plain text with the summary value calculated by TLS (Transport Layer Security Protocol) and hash algorithm, the risks of authentication information leakage, counterfeiting and tampering are eliminated; by designing a multi-layer permission structure, even if the password is leaked, the highest permission, that is, the system-level administrator permission, cannot be obtained, avoiding the risk of privilege escalation. Through the verification of device feature information, even if the user does not manage the preset signature file, the scope of impact is limited to a single device, greatly reducing the risk of proliferation. Moreover, the robot's device feature information can be updated at any time to ensure that the system can still accurately identify the legitimacy of the robot's device when facing changes in the device hardware or software environment.
[0142] Finally, this application can be applied to different types of devices such as Internet of Things devices, smart terminals, industrial control equipment, etc., and has broad application prospects.
[0143] The following describes the authentication device, robot controller and storage medium used to execute the authentication method provided in this application. Its specific implementation process and technical effects can be found in the relevant content of the above-mentioned authentication method, which will not be repeated below.
[0144] Figure 8 A schematic diagram of the structure of an authentication device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the device comprises:
[0145] The first acquisition module 201 is used to acquire the current device feature information of the robot, wherein the current device feature information includes: the current hardware feature information and the current software feature information of the robot;
[0146] A calculation module 202, configured to calculate a current summary value for the robot according to the current device feature information;
[0147] A judgment module 203 is used to judge whether the current digest value of the robot matches the original digest value in the preset signature file of the robot;
[0148] The determination module 204 is used to determine that the robot's authentication is passed if there is a match.
[0149] Optionally, the judgment module 203 is specifically used to use a preset public key to decrypt the preset signature file. If the decryption is successful, it is determined that the preset signature file is valid, and the original summary value is obtained by decryption. The preset public key is the public key corresponding to the preset private key, and the preset signature file is a signature file that is pre-signed based on the preset private key.
[0150] Optionally, the device further comprises:
[0151] A second collection module is used to collect original device feature information of the robot according to a collection request sent by the client of the robot, wherein the original device feature information includes: original hardware feature information and original software feature information in the robot;
[0152] The first acquisition module is used to acquire the preset signature file through the client according to the original device feature information.
[0153] Optionally, the first acquisition module is specifically used to calculate the original summary value based on the original device characteristic information; send the original summary value to the cloud server through the client, so that the cloud server uses a preset private key to sign the original summary value to obtain the preset signature file, and send the preset signature file to the client; receive the preset signature file through the client.
[0154] Optionally, the device further comprises:
[0155] The second acquisition module is used to obtain the user account information and user password information sent by the client;
[0156] A matching module, used to match the user account information, the user password information and preset information; wherein the preset information includes: a plurality of preset account information and preset password information corresponding to each of the preset account information;
[0157] The confirmation module is used to confirm that the user account information has logged in successfully if the match is successful.
[0158] Optionally, the second acquisition module is specifically used to determine whether the user account information of the successful login is the administrator account information; if so, the original device feature information of the robot is collected according to the acquisition request sent by the client of the robot; if not, the client is prohibited from obtaining administrator permissions.
[0159] Optionally, the second acquisition module is specifically used to obtain user account information encrypted by a temporary key and encrypted user password information sent by the client; wherein the temporary key is a key negotiated and determined by the client and the controller of the robot; the encrypted user account information and the encrypted user password information are decrypted using the temporary key to obtain the user account information and the user password information.
[0160] Optionally, the current hardware feature information includes at least one of the following: the model and capacity of the current memory, the model and capacity of the current storage device, the serial number of the current processor, and the current media access control MAC address; the current software feature information includes at least one of the following: the current operating system version and the current kernel configuration.
[0161] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.
[0162] The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital singnal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).
[0163] Fig. 9 A schematic diagram of the structure of a robot controller provided in an embodiment of the present application, such as Fig. 9As shown, the controller of the robot may include: a processor 301 and a memory 302 .
[0164] The memory 302 is used to store programs, and the processor 301 calls the programs stored in the memory 302 to execute the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.
[0165] Optionally, the present application also provides a program product, such as a computer-readable storage medium, including a program, which is used to execute the above method embodiment when executed by a processor.
[0166] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.
[0167] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0168] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.
[0169] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.
[0170] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. An authentication method, characterized in that: Controllers for robots, including: Collecting current device feature information of the robot, wherein the current device feature information includes: current hardware feature information and current software feature information of the robot; Calculating a current summary value for the robot according to the current device feature information; Determine whether the current digest value of the robot matches the original digest value in the preset signature file of the robot; If they match, it is determined that the robot's authentication has passed.
2. The method according to claim 1, characterized in that The determining whether the current digest value of the robot matches the original digest value in the preset signature file of the robot includes: The preset public key is used to decrypt the preset signature file. If the decryption is successful, the preset signature file is determined to be valid, and the original digest value is obtained by decryption. The preset public key is the public key corresponding to the preset private key, and the preset signature file is a signature file that is pre-signed based on the preset private key.
3. The method according to claim 1, characterized in that Before determining whether the current digest value of the robot matches the original digest value in the preset signature file of the robot, the method further includes: According to a collection request sent by a client of the robot, original device feature information of the robot is collected, wherein the original device feature information includes: original hardware feature information and original software feature information of the robot; The preset signature file is obtained through the client according to the original device characteristic information.
4. The method according to claim 3, characterized in that The step of obtaining the preset signature file through the client according to the original device feature information includes: Calculating the original summary value according to the original device characteristic information; Sending the original digest value to the cloud server through the client, so that the cloud server signs the original digest value with a preset private key to obtain the preset signature file, and sending the preset signature file to the client; The preset signature file is received through the client.
5. The method according to claim 3, characterized in that: Before collecting the original device feature information of the robot according to the collection request sent by the client of the robot, the method further includes: Obtaining user account information and user password information sent by the client; Matching the user account information, the user password information and preset information; wherein the preset information includes: a plurality of preset account information and preset password information corresponding to each of the preset account information; If the match is successful, it is confirmed that the user account information has logged in successfully.
6. The method according to claim 5, characterized in that The collecting of original device feature information of the robot according to the collection request sent by the client of the robot includes: Determine whether the user account information that successfully logged in is the administrator account information; If yes, collecting original device feature information of the robot according to the collection request sent by the client of the robot; If not, the client is prohibited from obtaining administrator privileges.
7. The method according to claim 5, characterized in that The obtaining of the user account information and the user password information sent by the client includes: Obtaining user account information and encrypted user password information sent by the client using a temporary key; wherein the temporary key is a key determined by negotiation between the client and the controller of the robot; The encrypted user account information and the encrypted user password information are decrypted using the temporary key to obtain the user account information and the user password information.
8. The method according to any one of claims 1 to 7, characterized in that: The current hardware feature information includes at least one of the following: the model and capacity of the current memory, the model and capacity of the current storage device, the serial number of the current processor, and the current media access control MAC address; the current software feature information includes at least one of the following: the current operating system version and the current kernel configuration.
9. A robot controller, characterized in that: include: A memory and a processor, wherein the memory stores a computer program executable by the processor, and the processor implements the authentication method described in any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is read and executed, the authentication method described in any one of claims 1 to 7 is implemented.