Message-based identity authentication method, system and device and electronic equipment

Abstract

The invention discloses a message-based identity authentication method, system and device and electronic equipment. The method comprises the following steps: controlling a first device to send a first message containing a first random number to a second device, and obtaining a second random number; determining a first digital signature based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; acquiring a second digital signature, and controlling the first equipment to send a third message containing the second digital signature to the second equipment; controlling the second equipment to verify the second digital signature to obtain a verification result, and sending a fourth message containing the verification result to the first equipment; and determining that the identity authentication is successful under the condition that the verification result represents that the second digital signature passes the verification. Through the method and the device, the problem of relatively low identity authentication efficiency in a network communication process in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a message-based identity authentication method, system, device and electronic device. Background Art

[0002] In the related technology, network security communication uses TLS (Transport Layer Security) or SSL (Secure Sockets Layer) protocol based on TCP (Transmission Control Protocol), or DTLS (Datagram Transport Layer Security) protocol based on UDP (User Datagram Protocol).

[0003] However, the above protocols used in related technologies for identity authentication are all based on the PKI (Public Key Infrastructure) system, and during use, it is necessary to apply for a certificate from the CA (Certificate Authority), which is a cumbersome process. In addition, the above protocols will transmit certificate data and negotiation data during the negotiation process, which consumes a lot of network resources.

[0004] With regard to the problem of low efficiency of identity authentication during network communication in related technologies, no effective solution has been proposed so far. Summary of the invention

[0005] The main purpose of the present application is to provide a message-based identity authentication method, system, device and electronic device to solve the problem of low efficiency of identity authentication during network communication in related technologies.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a message-based identity authentication method is provided. The method includes: controlling a first device to send a first message containing a first random number to a second device, obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature with the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature, obtain a verification result, and send a fourth message containing the verification result to the first device; when the verification result of the fourth message indicates that the second digital signature has been verified, it is determined that the identity authentication between the first device and the second device is successful.

[0007] Optionally, determining the first digital signature of the second device based on the first random number and the second random number includes: concatenating the second random number with the first random number to obtain a third random number; and generating the first digital signature for the third random number using a preset identification cryptographic algorithm.

[0008] Optionally, obtaining a second digital signature determined by the first device based on the second message includes: controlling the first device to verify the first digital signature; if the first digital signature verification fails, determining that the identity authentication between the first device and the second device has failed; if the first digital signature verification passes, extracting target data from the second message, and generating a second digital signature for the target data through a preset identification cryptographic algorithm.

[0009] Optionally, before controlling the first device to send a first message containing a first random number to the second device, the method also includes: obtaining a first private key and a second private key from an identification key management system, wherein the first private key is a private key distributed to the first device by the identification key management system, and the second private key is a private key distributed to the second device by the identification key management system; generating a first digital signature for a third random number through a preset identification cryptographic algorithm includes: encrypting the third random number based on the second private key to obtain a first digital signature; generating a second digital signature for target data through a preset identification cryptographic algorithm includes: encrypting the target data based on the first private key to obtain a second digital signature.

[0010] Optionally, controlling the first device to verify the first digital signature includes: obtaining system parameters from an identification key management system, obtaining the first device number of the second device, and generating a first public key based on the first device number and the system parameters; when the first public key matches the second private key, determining that the first digital signature verification is successful; when the first public key does not match the second private key, determining that the first digital signature verification is unsuccessful; controlling the second device to verify the second digital signature includes: obtaining the second device number of the first device, generating a second public key based on the second device number and the system parameters; when the second public key matches the first private key, determining that the second digital signature verification is successful; when the second public key does not match the first private key, determining that the second digital signature verification is unsuccessful.

[0011] Optionally, before obtaining the second random number generated by the second device, the method also includes: extracting the second device number of the first device from the first message; determining whether the second device number belongs to a device list of the second device; if the second device number belongs to the device list, determining that the identity authentication between the first device and the second device is successful; if the second device number does not belong to the device list, executing the step of obtaining the second random number generated by the second device.

[0012] Optionally, the first message, the second message, the third message and the fourth message are messages applying the user datagram protocol, and the first message, the second message, the third message and the fourth message contain multiple bytes, wherein the multiple bytes include at least one of the following: a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0013] According to another aspect of the present application, a message-based identity authentication system is provided. The system includes: a first device, the first device is used to send a first message containing a first random number and a third message containing a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; a second device, the second device is used to receive the first message and the third message, and send a second message containing target data and a fourth message containing a verification result to the first device, wherein the target data is obtained by concatenating the first digital signature and the second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is the result of verifying the second digital signature; a control module is used to control the first device and the second device to send messages, and control the second device to verify the second digital signature to obtain a verification result.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a message-based identity authentication device is provided. The device includes: a first control unit, used to control the first device to send a first message containing a first random number to the second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device; a first determination unit, used to determine the first digital signature of the second device based on the first random number and the second random number, splice the first digital signature with the second random number to obtain the target data, and control the second device to send a second message containing the target data to the first device; an acquisition unit, used to obtain the second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device; a second control unit, used to control the second device to verify the second digital signature, obtain a verification result, and send a fourth message containing the verification result to the first device; a second determination unit, used to determine that the identity authentication between the first device and the second device is successful when the verification result of the fourth message indicates that the second digital signature is verified.

[0015] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of the message-based identity authentication method described in each embodiment of the present application.

[0016] Through this application, the following steps are adopted: control the first device to send a first message containing a first random number to the second device, obtain the second random number generated by the second device, wherein the first device or the second device is a network device; determine the first digital signature of the second device based on the first random number and the second random number, splice the first digital signature with the second random number to obtain the target data, and control the second device to send a second message containing the target data to the first device; obtain the second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device; control the second device to verify the second digital signature, obtain the verification result, and send a fourth message containing the verification result to the first device; when the verification result of the fourth message indicates that the second digital signature verification is passed, it is determined that the identity authentication between the first device and the second device is successful, which solves the problem of low efficiency of identity authentication in the process of network communication in the related technology. Based on the message transmission between the first device and the second device, the digital signature is generated in combination with the identification password technology to perform identity authentication, which reduces the process of applying for a certificate, thereby achieving the effect of improving the efficiency of identity authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flow chart of a message-based identity authentication method provided according to an embodiment of the present application;

[0019] Figure 2 It is a schematic diagram of the structure of a data packet of a message provided in an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a message-based identity authentication system provided according to an embodiment of the present application;

[0021] Figure 4 It is a schematic diagram of a message transmission process provided according to an embodiment of the present application;

[0022] Figure 5 is a schematic diagram of a message-based identity authentication device provided according to an embodiment of the present application;

[0023] Figure 6 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] The present invention is described below in conjunction with preferred implementation steps. Figure 1is a flow chart of a message-based identity authentication method provided in an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0028] Step S101, controlling a first device to send a first message including a first random number to a second device, and obtaining a second random number generated by the second device, wherein the first device or the second device is a network device.

[0029] In step S101, the first device may be a network device, and the first device may generate an 8-bit random number, namely, a first random number. The first random number is temporary and unique, and will be different in each communication attempt between network devices. Then, the first device will encapsulate the first random number in a first message and send it to the second device through the network.

[0030] When the second device receives the first message sent by the first device, it extracts the first random number and generates a second 8-bit random number, namely, the second random number.

[0031] Step S102, determining a first digital signature of the second device based on the first random number and the second random number, concatenating the first digital signature with the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device.

[0032] In step S102, when the second device receives the first message sent by the first device, it extracts the first random number in the first message. Then the first random number is concatenated with the second random number to obtain a third random number. Based on identification cryptography, such as the SM9 algorithm (Commercial Secret Algorithm No. 9), a digital signature is generated for the third random number, which is also the first digital signature.

[0033] After the first digital signature is generated, the first digital signature is concatenated with the second random number to form the target data. The concatenation operation is to ensure that the subsequent verification can simultaneously confirm the integrity of the random number and the correctness of the signature. This concatenation can be a simple string concatenation or a more complex data structure reorganization. The second device encapsulates the target data in the second message and then sends it to the first device through the network.

[0034] Step S103: Obtain a second digital signature determined by the first device based on the second message, and control the first device to send a third message including the second digital signature to the second device.

[0035] In step S103, after receiving the second message, the first device parses the second message. After parsing the second message, the first device uses the identifier of the second device (that is, the first device number) as the public key and system parameters to verify the first digital signature. By verifying the first digital signature, the first device confirms the identity of the second device, as well as the second device's confirmation of the first random number and the second random number. The first device proceeds to the next step; if the first digital signature verification fails, it indicates that the identity of the second device is suspicious or the data has been tampered with during transmission. At this time, the first device needs to take security measures, such as re-initiating the authentication process or refusing further communication.

[0036] If the first digital signature is verified successfully, a second digital signature is generated based on the target data. The first device encapsulates the second digital signature in a third message and sends it to the second device through the network.

[0037] Step S104: Control the second device to verify the second digital signature, obtain a verification result, and send a fourth message including the verification result to the first device.

[0038] In step S104, after the second device receives the third message, the second device extracts the second digital signature from the third message, and uses the identifier of the first device (i.e., the second device number) as the public key and system parameters to perform digital signature verification. The verification process ensures that the second digital signature is created by the first device using its private key, and that the message content has not been tampered with during transmission. After the second device completes the verification of the second digital signature, it will obtain a verification result indicating whether the second digital signature is valid. The second device encapsulates the verification result into a fourth message, and the second device then sends the fourth message to the first device via the network.

[0039] Step S105: When the verification result of the fourth message indicates that the second digital signature verification has passed, it is determined that the identity authentication between the first device and the second device has succeeded.

[0040] In step S105, when the first device receives the fourth message sent by the second device, the first device first parses the message and extracts a verification result. The verification result directly indicates whether the second device successfully verifies the second digital signature sent by the first device.

[0041] If the verification result in the fourth message indicates that the second digital signature has been verified, this means that the second device has confirmed the integrity of the second digital signature and the identity of the first device. The two-way identity authentication between the first device and the second device is successful, indicating that both parties have confirmed the authenticity of the other party's identity, and the integrity and confidentiality of the data during the communication process are guaranteed.

[0042] After the two-way authentication is successful, the first device and the second device can determine or derive a shared session key based on the previously negotiated information (such as the first and second random numbers). This session key will be used for subsequent communication encryption to ensure the confidentiality and integrity of data transmission. Once the session key is determined, the two parties can begin to use encryption protocols for secure communication.

[0043] The message-based identity authentication method provided in the embodiment of the present application controls the first device to send a first message containing a first random number to the second device, obtains the second random number generated by the second device, wherein the first device or the second device is a network device; determines the first digital signature of the second device based on the first random number and the second random number, splices the first digital signature with the second random number to obtain the target data, controls the second device to send the second message containing the target data to the first device; obtains the second digital signature determined by the first device based on the second message, controls the first device to send the third message containing the second digital signature to the second device; controls the second device to verify the second digital signature, obtains the verification result, and sends the fourth message containing the verification result to the first device; when the verification result of the fourth message indicates that the second digital signature has been verified, it is determined that the identity authentication between the first device and the second device is successful, which solves the problem of low efficiency of identity authentication in the process of network communication in the related technology. Based on the message transmission between the first device and the second device, the digital signature is generated in combination with the identification password technology to perform identity authentication, which reduces the process of applying for certificates, thereby achieving the effect of improving the efficiency of identity authentication.

[0044] After obtaining the first random number and the second random number, a first digital signature is generated based on the concatenated first random number and the second random number. Optionally, in the message-based identity authentication method provided in an embodiment of the present application, determining the first digital signature of the second device based on the first random number and the second random number includes: concatenating the second random number with the first random number to obtain a third random number; and generating a first digital signature for the third random number by using a preset identification cryptographic algorithm.

[0045] In some examples, after the second device receives the first random number sent by the first device, the second device generates its own second random number. In order to subsequently generate a digital signature, the second device concatenates the two sets of random numbers (the first random number and the second random number) to form a longer sequence, namely the third random number. This concatenation can be a simple string concatenation or it can be performed in a specific order or structure, depending on the algorithm or protocol requirements used. The concatenation operation ensures that the digital signature will reflect the information of the two random numbers at the same time, enhancing the signature verification process.

[0046] The preset identification cryptographic algorithm can be an SM9 algorithm. The second device uses the preset identification cryptographic algorithm and its own private key to generate a first digital signature for the third random number based on the identification cryptography mechanism. The SM9 algorithm allows the public key to be directly generated using the device's identification information (such as mobile phone number, email address, etc.), and the private key and signature process can be tightly bound to the identification. When generating the first digital signature, the second device uses its second private key and the system parameters of the identification key management system (such as elliptic curve parameters) to sign the third random number. For example, a hash value based on the second private key and the third random number is calculated, and then the hash value is encrypted using the second private key to generate a digital signature, which is the first digital signature. The first digital signature is then sent to the first device for identity authentication.

[0047] This embodiment provides identity authentication of both the first device and the second device by generating a first digital signature, and also lays a foundation for subsequent encrypted communication. In UDP-based communication, since UDP is a stateless and unreliable transmission protocol, the generation and verification of the first digital signature can effectively enhance the security of communication. The use of the identification cryptography mechanism can make the entire identity authentication process more portable and efficient, while ensuring the privacy and data security of both parties in communication.

[0048] The first digital signature needs to be verified before determining the second digital signature. Optionally, in the message-based identity authentication method provided in the embodiment of the present application, obtaining the second digital signature determined by the first device based on the second message includes: controlling the first device to verify the first digital signature; if the first digital signature verification fails, determining that the identity authentication between the first device and the second device has failed; if the first digital signature verification passes, extracting the target data from the second message, and generating a second digital signature for the target data through a preset identification cryptographic algorithm.

[0049] In some examples, when the first device receives the second message sent by the second device, it first needs to verify the first digital signature contained in the message. This first digital signature is generated by the second device based on the concatenation of the first random number sent by the first device and the second random number automatically generated by the second device (i.e., the third random number). The first device uses a preset identification cryptographic algorithm and the identification of the second device (as a public key) to verify whether the first digital signature is valid. The verification process checks whether the first digital signature is indeed generated by the second device using its private key and that the third random number has not been tampered with during transmission.

[0050] The result of verifying the first digital signature will determine whether the identity authentication between the first device and the second device is successful or not. If the verification of the first digital signature fails, the first device will consider that the identity of the second device is suspicious or the communication process may be subject to a man-in-the-middle attack. At this time, the first device determines that the identity authentication between the first device and the second device has failed, and needs to take security measures, such as re-initiating the authentication process, recording the exception, and refusing subsequent communications.

[0051] If the verification of the first digital signature is successful, the first device confirms the identity of the second device, and the security of the communication process is preliminarily confirmed. Next, the first device extracts the target data from the second message, which is the concatenation of the first digital signature and the second random number. The first device also uses the preset identification cryptographic algorithm and its own private key to sign the target data and generate a second digital signature. This second digital signature will be used as the first device's response to the second device, proving the identity of the first device and confirming the previous operation of the second device.

[0052] This embodiment provides strong identity authentication for both parties by generating a second digital signature, and at the same time reduces network resource consumption for identity authentication and improves identity authentication efficiency by using a lightweight signature algorithm (such as SM9) and random numbers.

[0053] In order to generate the first digital signature and the second digital signature, it is necessary to obtain the first private key and the second private key. Optionally, in the message-based identity authentication method provided in an embodiment of the present application, before controlling the first device to send the first message containing the first random number to the second device, the method also includes: obtaining the first private key and the second private key from the identification key management system, wherein the first private key is the private key distributed to the first device by the identification key management system, and the second private key is the private key distributed to the second device by the identification key management system; generating the first digital signature for the third random number through a preset identification cryptographic algorithm includes: encrypting the third random number based on the second private key to obtain the first digital signature; generating the second digital signature for the target data through the preset identification cryptographic algorithm includes: encrypting the target data based on the first private key to obtain the second digital signature.

[0054] In some examples, the first device and the second device each obtain a private key from the identity key management system, that is, the first device obtains the first private key, and the second device obtains the second private key. These private keys are calculated based on the device's identity (such as a mobile phone number) through system parameters (such as elliptic curve parameters, identity identifiers, etc.), and only the identity key management system can generate and distribute the correct private keys.

[0055] When the second device needs to generate the first digital signature, it will encrypt the third random number based on the second private key. The third random number here is generated by the second device in the identity confirmation process, and is composed of the first random number sent by the first device and the second random number automatically generated by the second device. The second device uses a preset identification cryptographic algorithm (such as SM9) and the second private key to sign the third random number to obtain the first digital signature. After verifying the first digital signature of the second device, the first device will, in response, encrypt the target data based on the first private key to generate a second digital signature.

[0056] This embodiment uses a private key-based digital signature generation and verification process to avoid the application and distribution of certificates in the traditional PKI system and reduce the consumption of network resources. In actual communication systems, such as IP phones or real-time communication applications, this process can be used as a fast and lightweight means of identity authentication, ensuring that both parties can connect and communicate securely without significantly affecting performance. In UDP-based communications, this mechanism reduces communication delays and bandwidth requirements while still maintaining the security level of communication. Using private keys to generate digital signatures and using identifiers as public keys for verification simplifies the complexity of key management and certificate distribution, and also improves the security and efficiency of the entire communication system.

[0057] Verification of the digital signature requires the device number and system parameters to be matched as a public key. Optionally, in the message-based identity authentication method provided in an embodiment of the present application, controlling the first device to verify the first digital signature includes: obtaining system parameters from an identification key management system, obtaining the first device number of the second device, and generating a first public key based on the first device number and the system parameters; when the first public key matches the second private key, determining that the first digital signature verification has passed; when the first public key does not match the second private key, determining that the first digital signature verification has failed; controlling the second device to verify the second digital signature includes: obtaining the second device number of the first device, generating a second public key based on the second device number and the system parameters; when the second public key matches the first private key, determining that the second digital signature verification has passed; when the second public key does not match the first private key, determining that the second digital signature verification has failed.

[0058] In some examples, system parameters are obtained from the identification key management system, and the system parameters may include the mathematical basis for the identification cryptographic algorithm (such as parameters of elliptic curves), basic algorithm configuration parameters, etc. These parameters are the basis for all devices in the entire identification key system to generate key pairs, and are maintained and distributed by the identification key management system.

[0059] In the process of verifying the first digital signature, the first device obtains the identification information of the second device, that is, the first device number. This number can be the mobile phone number, email address, or any other string that uniquely identifies the second device. The first device uses the system parameters and the first device number of the second device, combined with the identification cryptography algorithm (such as SM9), to generate a corresponding public key. This public key is calculated using the system parameters using the identification information of the second device. If the first device successfully verifies the first digital signature using the first public key of the second device, this means that the first digital signature is indeed generated by the second device using its private key (the second private key), and the data has not been tampered with during transmission. In this case, the first device determines that the first digital signature verification is successful, further confirming the identity of the second device.

[0060] If the verification fails, the first device will find that the first public key does not match the second private key, or there are other factors that make the first digital signature unable to be verified. This indicates that the identity of the second device is suspicious or there is a security threat in the communication process. The first device will determine that the first digital signature verification has failed, and thus interrupt the communication or initiate a re-authentication process.

[0061] When the second device needs to verify the second digital signature of the first device, it obtains the identification information of the first device (i.e., the second device number) from the identification key management system. The second device uses the system parameters and the second device number of the first device to generate the public key of the first device (the second public key). If the second device successfully verifies the second digital signature using the second public key of the first device, it means that the second digital signature is generated by the first device using its private key (the first private key), and the verification is successful. This further strengthens the trust between the two parties and confirms the identity of the first device.

[0062] If the verification of the second digital signature fails, the second device will find that the second public key does not match the first private key, or there are other problems that cause the second digital signature to be unable to be correctly verified. The second device will determine that the second digital signature verification has failed and needs to take corresponding security measures or re-initiate the authentication process.

[0063] This embodiment utilizes the characteristics of the identification cryptography algorithm, that is, the public key can be directly calculated from the identification information through the system parameters without the need for the transmission of the certificate. By bidirectionally verifying the digital signature, not only the identities of the communicating parties are confirmed, but also the integrity and non-tampering of the data are ensured.

[0064] Optionally, in the message-based identity authentication method provided in the embodiment of the present application, before obtaining the second random number generated by the second device, the method also includes: extracting the second device number of the first device from the first message; determining whether the second device number belongs to a device list of the second device; if the second device number belongs to the device list, determining that the identity authentication between the first device and the second device is successful; if the second device number does not belong to the device list, executing the step of obtaining the second random number generated by the second device.

[0065] In some examples, the second device can set a preset device list, which stores the identification information of other devices that the second device is allowed to communicate with. The second device needs to determine whether the second device number extracted from the first message is on its own device list. This operation can be part of the security policy of the second device, used to control which devices to communicate with. If the second device number is in the device list, this means that the first device is one of the devices preset by the second device that is allowed to communicate. At this time, the second device can determine that the identity authentication with the first device is successful, and the two parties can continue with subsequent communications and data exchanges.

[0066] If the second device number is not on the device list of the second device, this means that the first device is a device that the second device does not allow communication with, or is an unknown device. In this case, the second device will not immediately confirm that the identity authentication is successful, but will execute the above-mentioned identity authentication method process.

[0067] This embodiment verifies the identity of the first device through the device list, which increases the security of network communication, ensures that the second device only communicates with the preset devices that are allowed to communicate, and reduces the risk of communicating with malicious devices or unauthorized devices. At the same time, the additional verification through the second random number generated by the second device also provides an additional layer of security to prevent simple attacks based on identification.

[0068] Optionally, in the message-based identity authentication method provided in an embodiment of the present application, the first message, the second message, the third message and the fourth message are messages applying the user datagram protocol, and the first message, the second message, the third message and the fourth message contain multiple bytes, wherein the multiple bytes include at least one of the following: a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0069] In some examples, Figure 2 Schematic diagram of the structure of a data packet of a message provided according to an embodiment of the present application. Figure 2As shown, the data packet contains the start byte, message type byte, device number byte, data length byte, data body byte, check byte and end byte. Start byte: 1 byte in length, indicating the start position of the message; message type byte (also known as type byte): 2 bytes in length, used to indicate the purpose of the message, whether it is an authentication message or a data message; device number byte (also known as device number byte): 11 bytes in length, the length can be adjusted according to actual conditions, such as using a mobile phone number as the device number, the length can be 11 bytes; data length byte (also known as data packet length): 2 bytes in length, indicating the length of the following data body. Data body byte: the length is based on the length of the data packet, storing real data; check byte: 1 byte in length, which can be a checksum; end byte: 1 byte in length, indicating the end position of the message.

[0070] In this embodiment, by including these key bytes in the data packet of the message, the communicating parties can achieve efficient and accurate identity authentication and negotiation of session keys, while ensuring the integrity and non-tampering of the data.

[0071] According to another aspect of the present application, a message-based identity authentication system is provided. Figure 3 Schematic diagram of a message-based identity authentication system provided according to an embodiment of the present application. Figure 3 As shown, the system includes: a first device, the first device is used to send a first message containing a first random number and a third message containing a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; a second device, the second device is used to receive the first message and the third message, and send a second message containing target data and a fourth message containing a verification result to the first device, wherein the target data is obtained by concatenating the first digital signature and the second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is a result of verifying the second digital signature; a control module, used to control the first device and the second device to send messages, and control the second device to verify the second digital signature to obtain a verification result.

[0072] In some examples, Figure 4 Schematic diagram of the message transmission process provided according to the embodiment of the present application. Figure 4As shown, the initiator first device (that is, device A) initiates communication, the receiver second device (that is, device B) verifies the identity of the first device and proves its identity to the first device. The first device sends a communication message to the second device according to the preset data packet protocol format. At this time, the message type is 0x20 and the data is an 8-bit random number. After the second device receives the message from the first device, it determines whether to verify it based on the ID in the message. If verification is required, the second device will generate an 8-bit random number, concatenate it with the random number generated by the first device, and sign the concatenated data using the SM9 algorithm. Then the 8-bit random number generated by device B is concatenated with the signature value and sent to the first device. At this time, the message type is 0x21.

[0073] After the first device receives the data from the second device, it first verifies the signature of device B. After the verification is successful, it also signs the spliced ​​random number and transmits the signature to the second device. At this time, the message type is 0x22; after the second device receives the signature value of the first device, it verifies it. After the verification is successful, it returns the verification result. At this time, the message type is 0x23; the subsequent communication between the first device and the second device can be carried out using the message type of Ox24. When the communication is completed, a message of message type Ox25 is sent to end the communication.

[0074] This embodiment uses a message-based identity authentication system, based on message transmission between the first device and the second device, and combines identification cryptographic technology to generate a digital signature for identity authentication, thereby reducing the certificate application process and improving the efficiency of identity authentication.

[0075] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0076] The embodiment of the present application also provides a message-based identity authentication device. It should be noted that the message-based identity authentication device of the embodiment of the present application can be used to execute the message-based identity authentication method provided by the embodiment of the present application. The message-based identity authentication device provided by the embodiment of the present application is introduced below.

[0077] Figure 5 Schematic diagram of a message-based identity authentication device provided according to an embodiment of the present application. Figure 5 As shown, the device comprises:

[0078] The first control unit 501 is used to control the first device to send a first message including a first random number to the second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device;

[0079] A first determining unit 502 is used to determine a first digital signature of the second device based on the first random number and the second random number, concatenate the first digital signature with the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device;

[0080] An acquiring unit 503 is configured to acquire a second digital signature determined by the first device based on the second message, and control the first device to send a third message including the second digital signature to the second device;

[0081] The second control unit 504 is used to control the second device to verify the second digital signature, obtain a verification result, and send a fourth message including the verification result to the first device;

[0082] The second determining unit 505 is configured to determine that the identity authentication between the first device and the second device is successful when the verification result of the fourth message indicates that the second digital signature verification is successful.

[0083] The message-based identity authentication device provided in the embodiment of the present application controls the first device to send a first message containing a first random number to the second device through the first control unit 501, and obtains a second random number generated by the second device, wherein the first device or the second device is a network device; the first determination unit 502 determines the first digital signature of the second device based on the first random number and the second random number, concatenates the first digital signature with the second random number to obtain target data, and controls the second device to send a second message containing the target data to the first device; the acquisition unit 503 obtains the second digital signature determined by the first device based on the second message, and controls the first device to send a second message containing the second digital signature. The third message is sent to the second device; the second control unit 504 controls the second device to verify the second digital signature, obtains the verification result, and sends the fourth message containing the verification result to the first device; the second determination unit 505 determines that the identity authentication between the first device and the second device is successful when the verification result of the fourth message indicates that the second digital signature verification has passed, thereby solving the problem of low efficiency of identity authentication in the process of network communication in the related technology, based on the message transmission between the first device and the second device, combining the identification cryptography technology to generate a digital signature for identity authentication, reducing the process of applying for a certificate, thereby achieving the effect of improving the efficiency of identity authentication.

[0084] Optionally, in the message-based identity authentication device provided in an embodiment of the present application, the first determination unit 502 includes: a splicing module, used to splice the second random number with the first random number to obtain a third random number; and a first generation module, used to generate a first digital signature for the third random number through a preset identification cryptographic algorithm.

[0085] Optionally, in the message-based identity authentication device provided in the embodiment of the present application, the acquisition unit 503 includes: a first control module, used to control the first device to verify the first digital signature; a first determination module, used to determine that the identity authentication between the first device and the second device has failed when the first digital signature verification fails; a second generation module, used to extract target data from the second message when the first digital signature verification passes, and generate a second digital signature for the target data by using a preset identification cryptographic algorithm.

[0086] Optionally, in the message-based identity authentication device provided in the embodiment of the present application, the device also includes: a private key acquisition unit, used to obtain a first private key and a second private key from an identification key management system, wherein the first private key is a private key distributed to the first device by the identification key management system, and the second private key is a private key distributed to the second device by the identification key management system; the first generation module includes: a first encryption submodule, used to encrypt a third random number based on the second private key to obtain a first digital signature; the second generation module includes: a second encryption submodule, used to encrypt the target data based on the first private key to obtain a second digital signature.

[0087] Optionally, in the message-based identity authentication device provided in the embodiment of the present application, the first control module includes: a first generation submodule, used to obtain system parameters from the identification key management system, obtain the first device number of the second device, and generate a first public key based on the first device number and the system parameters; a first determination submodule, used to determine that the first digital signature verification is passed when the first public key matches the second private key; a second determination submodule, used to determine that the first digital signature verification fails when the first public key does not match the second private key; the second control unit 504 includes: a third generation module, used to obtain the second device number of the first device, and generate a second public key based on the second device number and the system parameters; a second determination module, used to determine that the second digital signature verification is passed when the second public key matches the first private key; and a third determination module, used to determine that the second digital signature verification fails when the second public key does not match the first private key.

[0088] Optionally, in the message-based identity authentication device provided in the embodiment of the present application, the device also includes: an extraction unit, used to extract the second device number of the first device from the first message; a judgment unit, used to judge whether the second device number belongs to the device list of the second device; a third determination unit, used to determine that the identity authentication between the first device and the second device is successful when the second device number belongs to the device list; and an execution unit, used to execute the step of obtaining a second random number generated by the second device when the second device number does not belong to the device list.

[0089] Optionally, in the message-based identity authentication device provided in an embodiment of the present application, the first message, the second message, the third message and the fourth message are messages applying the user datagram protocol, and the first message, the second message, the third message and the fourth message contain multiple bytes, wherein the multiple bytes include at least one of the following: a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0090] The message-based identity authentication device includes a processor and a memory. The above-mentioned first control unit 501, first determination unit 502, acquisition unit 503, second control unit 504 and second determination unit 505 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0091] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the efficiency of identity authentication can be improved by adjusting kernel parameters.

[0092] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0093] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a message-based identity authentication method is implemented.

[0094] An embodiment of the present invention provides a processor, which is used to run a program, wherein the program executes a message-based identity authentication method when running.

[0095] Figure 6 is a schematic diagram of an electronic device provided according to an embodiment of the present application. Figure 6As shown, the electronic device 601 includes a processor, a memory, and a program stored in the memory and can be run on the processor. When the processor executes the program, the following steps are implemented: control the first device to send a first message containing a first random number to the second device, obtain a second random number generated by the second device, wherein the first device or the second device is a network device; determine the first digital signature of the second device based on the first random number and the second random number, splice the first digital signature with the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device; obtain the second digital signature determined by the first device based on the second message, control the first device to send a third message containing the second digital signature to the second device; control the second device to verify the second digital signature, obtain a verification result, and send a fourth message containing the verification result to the first device; when the verification result of the fourth message indicates that the second digital signature is verified, determine that the identity authentication between the first device and the second device is successful. The device in this article can be a server, PC, PAD, mobile phone, etc.

[0096] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: controlling a first device to send a first message containing a first random number to a second device, and obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, concatenating the first digital signature with the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature, obtain a verification result, and send a fourth message containing the verification result to the first device; when the verification result of the fourth message indicates that the second digital signature verification has passed, determining that the identity authentication between the first device and the second device is successful.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0106] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A message-based identity authentication method, characterized in that: include: Controlling a first device to send a first message including a first random number to a second device, and obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; Determine a first digital signature of the second device based on the first random number and the second random number, concatenate the first digital signature with the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device; Obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message including the second digital signature to the second device; Control the second device to verify the second digital signature, obtain a verification result, and send a fourth message including the verification result to the first device; If the verification result of the fourth message indicates that the second digital signature verification has passed, it is determined that the identity authentication between the first device and the second device has succeeded.

2. The method according to claim 1, characterized in that Determining a first digital signature of the second device based on the first random number and the second random number includes: Concatenate the second random number with the first random number to obtain a third random number; The first digital signature is generated by using a preset identification cryptographic algorithm for the third random number.

3. The method according to claim 1, characterized in that Acquiring a second digital signature determined by the first device based on the second message includes: Controlling the first device to verify the first digital signature; If the first digital signature verification fails, determining that the identity authentication between the first device and the second device fails; When the first digital signature is verified successfully, the target data is extracted from the second message, and the second digital signature is generated for the target data using a preset identification cryptographic algorithm.

4. The method according to claim 2 or 3, characterized in that: Before controlling the first device to send the first message including the first random number to the second device, the method further includes: Acquire a first private key and a second private key from an identification key management system, wherein the first private key is a private key distributed to the first device by the identification key management system, and the second private key is a private key distributed to the second device by the identification key management system; Generating the first digital signature from the third random number by using a preset identification cryptographic algorithm includes: Encrypt the third random number based on the second private key to obtain the first digital signature; Generating the second digital signature for the target data by using a preset identification cryptographic algorithm includes: The target data is encrypted based on the first private key to obtain the second digital signature.

5. The method according to claim 3, characterized in that: Controlling the first device to verify the first digital signature includes: Acquire system parameters from an identification key management system, acquire a first device number of the second device, and generate a first public key based on the first device number and the system parameters; If the first public key matches the second private key, determining that the first digital signature verification passes; If the first public key does not match the second private key, determining that the first digital signature verification fails; Controlling the second device to verify the second digital signature includes: Obtaining a second device number of the first device, and generating a second public key based on the second device number and the system parameters; If the second public key matches the first private key, determining that the second digital signature verification passes; In the case where the second public key does not match the first private key, it is determined that the second digital signature verification has failed.

6. The method according to claim 1, characterized in that Before acquiring the second random number generated by the second device, the method further includes: Extracting a second device number of the first device from the first message; Determine whether the second device number belongs to the device list of the second device; If the second device number belongs to the device list, determining that the identity authentication between the first device and the second device is successful; In a case where the second device number does not belong to the device list, a step of obtaining a second random number generated by the second device is performed.

7. The method according to claim 1, characterized in that The first message, the second message, the third message and the fourth message are messages applying the User Datagram Protocol, and the first message, the second message, the third message and the fourth message contain multiple bytes, wherein the multiple bytes include at least one of the following: a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

8. A message-based identity authentication system, characterized in that: include: A first device, the first device is used to send a first message including a first random number and a third message including a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; The second device is used to receive the first message and the third message, and send the second message containing target data and a fourth message containing a verification result to the first device, wherein the target data is obtained by concatenating a first digital signature and a second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is a result of verifying the second digital signature; A control module is used to control the first device and the second device to send messages, and control the second device to verify the second digital signature to obtain the verification result.

9. A message-based identity authentication device, characterized in that: include: A first control unit, configured to control the first device to send a first message including a first random number to a second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device; a first determining unit, configured to determine a first digital signature of the second device based on the first random number and the second random number, concatenate the first digital signature with the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device; an acquiring unit, configured to acquire a second digital signature determined by the first device based on the second message, and control the first device to send a third message including the second digital signature to the second device; a second control unit, configured to control the second device to verify the second digital signature, obtain a verification result, and send a fourth message including the verification result to the first device; A second determining unit is configured to determine that the identity authentication between the first device and the second device is successful when the verification result of the fourth message indicates that the second digital signature verification is successful.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the message-based identity authentication method described in any one of claims 1 to 7.

Images