Packet-based identity authentication method, system and device, and electronic equipment

Abstract

The application discloses a message-based identity authentication method, system and device and electronic equipment. It relates to the field of network security. The method comprises the following steps: controlling a first device to send a first message containing a first random number to a second device and obtaining a second random number; determining a first digital signature based on the first random number and the second random number, splicing the first digital signature with the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature, controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature and obtaining a verification result, and sending a fourth message containing the verification result to the first device; and determining that the identity authentication is successful in the case that the second digital signature passes the verification as indicated in the verification result. The application solves the problem of low efficiency of identity authentication in the process of network communication in the related art.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to a message-based identity authentication method, system, device and electronic equipment. BACKGROUND

[0002] In the related art, network security communication uses TLS (Transport Layer Security) or SSL (Secure Sockets Layer) protocol based on TCP (Transmission Control Protocol), or DTLS (Datagram Transport Layer Security) protocol based on UDP (User Datagram Protocol).

[0003] However, the identity authentication using the above protocols in the related art is based on PKI (Public Key Infrastructure) system, and a certificate needs to be applied to CA (Certificate Authority) in the use process, which is cumbersome. In addition, the above protocols will transmit certificate data and negotiation data in the negotiation process, which consumes a lot of network resources.

[0004] At present, there is no effective solution to the problem of low efficiency of identity authentication in the process of network communication in the related art. SUMMARY

[0005] The main purpose of the present application is to provide a message-based identity authentication method, system, device and electronic equipment to solve the problem of low efficiency of identity authentication in the process of network communication in the related art.

[0006] In order to achieve the above object, according to one aspect of the present application, a message-based identity authentication method is provided. The method comprises: controlling a first device to send a first message containing a first random number to a second device, and obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature to obtain a verification result, and sending a fourth message containing the verification result to the first device; and determining that identity authentication between the first device and the second device is successful in a case where the verification result in the fourth message indicates that the second digital signature passes verification.

[0007] Optionally, determining the first digital signature of the second device based on the first random number and the second random number comprises: splicing the second random number and the first random number to obtain a third random number; and generating the first digital signature of the third random number through a preset identity cryptography algorithm.

[0008] Optionally, obtaining the second digital signature determined by the first device based on the second message comprises: controlling the first device to verify the first digital signature; determining that identity authentication between the first device and the second device fails in a case where the first digital signature fails verification; and extracting the target data from the second message and generating the second digital signature of the target data through a preset identity cryptography algorithm in a case where the first digital signature passes verification.

[0009] Optionally, before controlling the first device to send the first message containing the first random number to the second device, the method further comprises: obtaining a first private key and a second private key from an identity key management system, wherein the first private key is a private key distributed to the first device by the identity key management system, and the second private key is a private key distributed to the second device by the identity key management system; and generating the first digital signature of the third random number through a preset identity cryptography algorithm comprises: encrypting the third random number based on the second private key to obtain the first digital signature; and generating the second digital signature of the target data through a preset identity cryptography algorithm comprises: encrypting the target data based on the first private key to obtain the second digital signature.

[0010] Optionally, the controlling the first device to verify the first digital signature comprises: obtaining a system parameter from the identity key management system, obtaining a first device number of the second device, generating a first public key based on the first device number and the system parameter; in a case that the first public key matches the second private key, determining that the first digital signature is verified; in a case that the first public key does not match the second private key, determining that the first digital signature is not verified; and the controlling the second device to verify the second digital signature comprises: obtaining a second device number of the first device, generating a second public key based on the second device number and the system parameter; in a case that the second public key matches the first private key, determining that the second digital signature is verified; in a case that the second public key does not match the first private key, determining that the second digital signature is not verified.

[0011] Optionally, before the obtaining the second random number generated by the second device, the method further comprises: extracting a second device number of the first device from the first message; judging whether the second device number belongs to a device list of the second device; in a case that the second device number belongs to the device list, determining that the identity authentication between the first device and the second device is successful; in a case that the second device number does not belong to the device list, performing the step of obtaining the second random number generated by the second device.

[0012] Optionally, the first message, the second message, the third message and the fourth message are messages using user datagram protocol, and the first message, the second message, the third message and the fourth message comprise a plurality of bytes, wherein the plurality of bytes comprise at least one of a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0013] According to another aspect of the present application, a message-based identity authentication system is provided. The system comprises: a first device, the first device being configured to send a first message comprising a first random number and a third message comprising a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; the second device, the second device being configured to receive the first message and the third message, and send a second message comprising target data and a fourth message comprising a verification result to the first device, wherein the target data is obtained by splicing a first digital signature and a second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is a result of verifying the second digital signature; and a control module, configured to control the first device and the second device to send the messages, and control the second device to verify the second digital signature to obtain the verification result.

[0014] To achieve the above object, according to another aspect of the present application, a message-based identity authentication device is provided. The device comprises: a first control unit configured to control a first device to send a first message containing a first random number to a second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device; a first determination unit configured to determine a first digital signature of the second device based on the first random number and the second random number, splice the first digital signature with the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device; an obtaining unit configured to obtain a second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device; a second control unit configured to control the second device to verify the second digital signature to obtain a verification result, and send a fourth message containing the verification result to the first device; and a second determination unit configured to determine that identity authentication between the first device and the second device is successful in a case where the verification result of the fourth message indicates that the second digital signature passes verification.

[0015] To achieve the above object, according to another aspect of the present application, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the steps of the message-based identity authentication method described in various embodiments of the present application.

[0016] By the present application, the following steps are adopted: a first device is controlled to send a first message containing a first random number to a second device, and a second random number generated by the second device is obtained, wherein the first device or the second device is a network device; a first digital signature of the second device is determined based on the first random number and the second random number, the first digital signature is spliced with the second random number to obtain target data, and the second device is controlled to send a second message containing the target data to the first device; a second digital signature determined by the first device based on the second message is obtained, and the first device is controlled to send a third message containing the second digital signature to the second device; the second device is controlled to verify the second digital signature to obtain a verification result, and a fourth message containing the verification result is sent to the first device; and in a case where the verification result of the fourth message indicates that the second digital signature passes verification, it is determined that identity authentication between the first device and the second device is successful, thereby solving the problem of low efficiency of identity authentication in the process of network communication in the related art. Based on message transmission between the first device and the second device, identity authentication is performed by combining identity-based cryptography technology to generate a digital signature, thereby reducing the process of applying for a certificate, and thus the efficiency of identity authentication is improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the illustrative embodiments of the present application and their descriptions, and do not constitute improper limitations on the present application. In the drawings:

[0018] Figure 1 is a flowchart of a message-based identity authentication method according to an embodiment of the present application;

[0019] Figure 2 is a structural diagram of a data packet of a message according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a message-based identity authentication system according to an embodiment of the present application;

[0021] Figure 4 is a schematic diagram of a message transmission flow according to an embodiment of the present application;

[0022] Figure 5 is a schematic diagram of a message-based identity authentication apparatus according to an embodiment of the present application;

[0023] Figure 6 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] It should be noted that the embodiments and features of the embodiments in the present application can be combined with each other without conflict. The technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0027] The present application will be described below in combination with preferred implementation steps, Figure 1is a flowchart of a message-based identity authentication method according to an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0028] In step S101, the first device sends a first message containing a first random number to the second device, and obtains a second random number generated by the second device, wherein the first device or the second device is a network device.

[0029] In step S101, the first device can be a network device, and the first device can generate an 8-bit random number, i.e., the first random number. The first random number is temporary, unique, and different in each communication attempt between network devices. Then, the first device encapsulates the first random number in the first message and sends it to the second device through the network.

[0030] When the second device receives the first message sent by the first device, it extracts the first random number and generates a second 8-bit random number, i.e., the second random number.

[0031] In step S102, the first digital signature of the second device is determined based on the first random number and the second random number, the first digital signature is spliced with the second random number to obtain target data, and the second device sends a second message containing the target data to the first device.

[0032] In step S102, when the second device receives the first message sent by the first device, it extracts the first random number in the first message. Then, the first random number is spliced with the second random number to obtain a third random number. Based on identity-based cryptography, such as SM9 algorithm (Commercial Secret No. 9 algorithm), a digital signature, i.e., the first digital signature, is generated for the third random number.

[0033] After generating the first digital signature, the first digital signature is spliced with the second random number to form the target data. The splicing operation is to ensure that the subsequent verification can confirm the integrity of the random number and the correctness of the signature at the same time. This splicing can be a simple string connection, or a more complex data structure reorganization. The second device encapsulates the target data in the second message and sends it to the first device through the network.

[0034] In step S103, the second digital signature determined by the first device based on the second message is obtained, and the first device sends a third message containing the second digital signature to the second device.

[0035] In step S103, after the first device receives the second message, the second message is parsed, and the first device uses the identity of the second device (i.e., the first device number) as a public key and system parameters to verify the first digital signature. By verifying the first digital signature, the first device confirms the identity of the second device and the confirmation of the first random number and the second random number by the second device. The first device continues to the next step; if the first digital signature verification fails, it indicates that the identity of the second device is suspicious or the data is tampered during transmission, at which time the first device needs to take security measures, such as reinitiating the authentication process or refusing further communication.

[0036] If the first digital signature verification passes, a second digital signature is generated based on the target data. The first device encapsulates the second digital signature in a third message and sends it to the second device through the network.

[0037] In step S104, the second device verifies the second digital signature and obtains a verification result, and sends a fourth message containing the verification result to the first device.

[0038] In step S104, after the second device receives the third message, the second device extracts the second digital signature from the third message, uses the identity of the first device (i.e., the second device number) as a public key and system parameters, and performs digital signature verification. The verification process ensures that the second digital signature is created by the first device using its private key, and that the message content has not been tampered with during transmission. After the second device completes the verification of the second digital signature, it will obtain a verification result indicating whether the second digital signature is valid. The second device encapsulates the verification result into the fourth message, and the second device then sends the fourth message to the first device through the network.

[0039] In step S105, when the fourth message sent by the second device is received, the first device first parses the message and extracts the verification result. The verification result directly indicates whether the second device successfully verified the second digital signature sent by the first device.

[0040] In step S105, when the fourth message sent by the second device is received, the first device first parses the message and extracts the verification result. The verification result directly indicates whether the second device successfully verified the second digital signature sent by the first device.

[0041] If the verification result in the fourth message indicates that the second digital signature verification passes, it means that the second device confirms the integrity of the second digital signature and the identity of the first device. The two-way identity verification between the first device and the second device is successful, indicating that both parties have confirmed the authenticity of each other's identity, and the integrity and confidentiality of the data during communication are guaranteed.

[0042] After the two-way identity authentication is successful, the first device and the second device can determine or derive a shared session key based on the previously negotiated information, such as the first and second random numbers. This session key will be used for subsequent communication encryption to ensure the confidentiality and integrity of data transmission. Once the session key is determined, the two parties can start secure communication using an encryption protocol.

[0043] The message-based identity authentication method provided by the embodiments of the present application includes the following steps: sending, by a first device, a first message containing a first random number to a second device, obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, sending, by the second device, a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, sending, by the first device, a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature to obtain a verification result, and sending, by the second device, a fourth message containing the verification result to the first device; and determining that the identity authentication between the first device and the second device is successful when the verification result in the fourth message indicates that the second digital signature passes the verification, thereby solving the problem of low efficiency of identity authentication in the process of network communication in the related art. The message transmission between the first device and the second device and the generation of the digital signature based on the identity password technology for identity authentication reduce the process of applying for a certificate, thereby achieving the effect of improving the efficiency of identity authentication.

[0044] After obtaining the first random number and the second random number, the first digital signature is generated based on the spliced first random number and second random number. In the message-based identity authentication method provided by the embodiments of the present application, the determination of the first digital signature of the second device based on the first random number and the second random number includes: splicing the second random number and the first random number to obtain a third random number; and generating the first digital signature of the third random number by using a preset identity password algorithm.

[0045] In some examples, when the second device receives the first random number sent by the first device, the second device generates its own second random number. In order to generate a digital signature subsequently, the second device splices the two sets of random numbers (the first random number and the second random number) to form a longer sequence, that is, a third random number. This splicing can be a simple string connection, or can be performed in a specific order or structure, depending on the algorithm or protocol requirements used. The splicing operation ensures that the digital signature will reflect the information of both random numbers, enhancing the verification process of the signature.

[0046] The preset identity cryptography algorithm can be an SM9 algorithm. The second device generates a first digital signature based on the identity cryptography mechanism, using the preset identity cryptography algorithm and a private key of the second device. The SM9 algorithm allows the use of identity information of the device (such as a mobile phone number, an email address, etc.) to directly generate a public key, and the private key and the signature process can be closely bound to the identity. When generating the first digital signature, the second device uses the second private key and system parameters (such as elliptic curve parameters) of the identity key management system to perform a signature operation on the third random number. For example, a hash value based on the second private key and the third random number is calculated, and then the second private key is used to encrypt the hash value to generate a digital signature, that is, the first digital signature. The first digital signature is then sent to the first device for identity verification.

[0047] The embodiment provides identity verification of both the first device and the second device by generating the first digital signature, and lays a foundation for subsequent encrypted communication. In UDP-based communication, since UDP is a stateless and unreliable transmission protocol, the generation and verification of the first digital signature can effectively enhance the security of communication. Using the identity cryptography mechanism, the entire identity verification process can be more convenient and efficient, while ensuring the privacy and data security of the two communicating parties.

[0048] The first digital signature needs to be verified before the second digital signature is determined. Optionally, in the message-based identity authentication method provided in the embodiment of the present application, obtaining the second digital signature determined by the first device based on the second message includes: controlling the first device to verify the first digital signature; in the case where the first digital signature verification fails, determining that the identity authentication between the first device and the second device fails; and in the case where the first digital signature verification passes, extracting target data from the second message, and generating a second digital signature for the target data by using a preset identity cryptography algorithm.

[0049] In some examples, when the first device receives the second message sent by the second device, it first needs to verify the first digital signature contained in the message. The first digital signature is generated by the second device based on the splicing (i.e., the third random number) of the first random number sent by the first device and the second random number generated by the second device. The first device uses the preset identity cryptography algorithm and the identity (as a public key) of the second device to verify whether the first digital signature is valid. The verification process checks whether the first digital signature is indeed generated by the second device using its private key, and whether the third random number has been tampered with in the transmission process.

[0050] The result of verifying the first digital signature will determine whether the identity authentication between the first device and the second device is successful or not. If the verification of the first digital signature fails, the first device considers that the identity of the second device is suspicious or the communication process may have suffered a man-in-the-middle attack, at which time the first device determines that the identity authentication between the first device and the second device fails, and needs to take security measures, such as reinitiating the authentication process, recording the exception, rejecting the subsequent communication, and the like.

[0051] If the verification of the first digital signature passes, the first device confirms the identity of the second device, and the security of the communication process is preliminarily confirmed. Next, the first device extracts the target data, i.e., the splicing of the first digital signature and the second random number, from the second message. The first device also uses the preset identity cryptographic algorithm to sign the target data in combination with its own private key to generate a second digital signature. This second digital signature will be used as the response of the first device to the second device to prove the identity of the first device and confirm the operation of the second device before.

[0052] The embodiment provides strong identity authentication of both parties by generating the second digital signature, and reduces the network resource consumption of the identity authentication and improves the identity authentication efficiency by using a lightweight signature algorithm (such as SM9) and a random number.

[0053] In order to generate the first digital signature and the second digital signature, the first private key and the second private key need to be obtained. Optionally, in the message-based identity authentication method provided in the embodiment of the application, before the first device sends the first message containing the first random number to the second device, the method further comprises: obtaining the first private key and the second private key from an identity key management system, wherein the first private key is a private key distributed to the first device by the identity key management system, and the second private key is a private key distributed to the second device by the identity key management system; generating the first digital signature for the third random number by using the preset identity cryptographic algorithm comprises: encrypting the third random number based on the second private key to obtain the first digital signature; and generating the second digital signature for the target data by using the preset identity cryptographic algorithm comprises: encrypting the target data based on the first private key to obtain the second digital signature.

[0054] In some examples, the first device and the second device each obtain a private key from an identity key management system, i.e., the first device obtains the first private key, and the second device obtains the second private key. These private keys are calculated based on the identity (such as a mobile phone number) of the device through system parameters (such as elliptic curve parameters, identity identifiers, and the like), and only the identity key management system can generate and distribute the correct private key.

[0055] When the second device needs to generate the first digital signature, it encrypts the third random number based on the second private key. The third random number here is generated by the second device in the identity confirmation process, and is spliced from the first random number sent by the first device and the second random number automatically generated by the second device. The second device uses a preset identity cryptographic algorithm (such as SM9) and the second private key to perform a signature operation on the third random number, thereby obtaining the first digital signature. After verifying the first digital signature of the second device, the first device will encrypt the target data based on the first private key in response, and generate the second digital signature.

[0056] The private key-based digital signature generation and verification process of the embodiment avoids the application and distribution of certificates in the traditional PKI system, and reduces the consumption of network resources. In an actual communication system, such as an IP phone or a real-time communication application, this process can be used as a fast and lightweight identity verification method to ensure that the two parties of communication can securely connect and communicate without significantly affecting the performance. In UDP-based communication, this mechanism reduces communication delay and bandwidth requirements while still maintaining the security level of communication, simplifies the complexity of key management and certificate distribution, and improves the security and efficiency of the entire communication system.

[0057] Verifying the digital signature requires the device number and system parameters as public keys to match. Optionally, in the message-based identity authentication method provided in the embodiments of the present application, controlling the first device to verify the first digital signature includes: obtaining system parameters from an identity key management system, obtaining the first device number of the second device, generating a first public key based on the first device number and the system parameters; in the case where the first public key matches the second private key, it is determined that the first digital signature verification is passed; in the case where the first public key does not match the second private key, it is determined that the first digital signature verification is not passed; controlling the second device to verify the second digital signature includes: obtaining the second device number of the first device, generating a second public key based on the second device number and the system parameters; in the case where the second public key matches the first private key, it is determined that the second digital signature verification is passed; in the case where the second public key does not match the first private key, it is determined that the second digital signature verification is not passed.

[0058] In some examples, the system parameters are obtained from the identity key management system. The system parameters can include mathematical foundations for identity cryptographic algorithms (such as parameters of elliptic curves), basic algorithm configuration parameters, etc. These parameters are the basis that all devices in the entire identity key system comply with when generating key pairs, and are maintained and distributed by the identity key management system.

[0059] In the process of verifying the first digital signature, the first device obtains the identification information of the second device, i.e. the first device number. This number can be the mobile phone number, email address or any other string uniquely identifying the second device. The first device uses the system parameters and the first device number of the second device to generate the corresponding public key in combination with the identification cryptography algorithm (e.g. SM9). This public key is calculated from the identification information of the second device through the system parameters. If the first device successfully verifies the first digital signature using the first public key of the second device, it means that the first digital signature is indeed generated by the second device using its private key (second private key), and the data has not been tampered with during transmission. In this case, the first device determines that the first digital signature verification is passed, further confirming the identity of the second device.

[0060] If the verification fails, the first device will find that the first public key does not match the second private key, or there are other factors that cause the first digital signature to fail to verify. This indicates that the identity of the second device is suspicious, or there is a security threat in the communication process. The first device will determine that the first digital signature verification is not passed, thereby interrupting the communication or initiating a re-authentication process.

[0061] When the second device needs to verify the second digital signature of the first device, it obtains the identification information of the first device (i.e. the second device number) from the identification key management system. The second device generates the public key of the first device (second public key) using the system parameters and the second device number of the first device. If the second device successfully verifies the second digital signature using the second public key of the first device, it means that the second digital signature is generated by the first device using its private key (first private key), and the verification is passed. This further strengthens the trust between the two parties and confirms the identity of the first device.

[0062] If the verification of the second digital signature fails, the second device will find that the second public key does not match the first private key, or there are other problems that cause the second digital signature to fail to be correctly verified. The second device will determine that the second digital signature verification is not passed, and needs to take appropriate security measures or re-initiate the authentication process.

[0063] This embodiment takes advantage of the characteristics of the identification cryptography algorithm, i.e. the public key can be directly calculated from the identification information through the system parameters, without the need for the transmission of certificates. Through the bidirectional verification of digital signatures, not only the identities of the two communication parties are confirmed, but also the integrity and non-tampering of the data are ensured.

[0064] Optionally, before the step of obtaining the second random number generated by the second device, the method further comprises: extracting the second device number of the first device from the first message; determining whether the second device number belongs to a device list of the second device; in the case that the second device number belongs to the device list, determining that the identity authentication between the first device and the second device succeeds; and in the case that the second device number does not belong to the device list, performing the step of obtaining the second random number generated by the second device.

[0065] In some examples, the second device can set a preset device list, which stores the identification information of other devices allowed to communicate by the second device. The second device needs to determine whether the second device number extracted from the first message is in the device list of the second device. This operation can be part of the security policy of the second device, for controlling communication with which devices. If the second device number is in the device list, it means that the first device is one of the devices allowed to communicate by the second device. At this time, the second device can determine that the identity authentication with the first device succeeds, and the two parties can continue subsequent communication and data exchange.

[0066] If the second device number is not in the device list of the second device, it means that the first device is a device not allowed to communicate by the second device, or an unknown device. In this case, the second device does not immediately confirm the identity authentication success, but performs the flow of the identity authentication method described above.

[0067] The embodiment verifies the identity of the first device through the device list, increases the security of network communication, ensures that the second device only communicates with the preset devices allowed to communicate, and reduces the risk of communication with malicious devices or unauthorized devices. At the same time, the additional verification by the second random number generated by the second device also provides an additional security guarantee, preventing simple attacks based on identification

[0068] Optionally, in the identity authentication method based on messages provided by the embodiment of the present application, the first message, the second message, the third message and the fourth message are messages of the application user datagram protocol, and the first message, the second message, the third message and the fourth message contain a plurality of bytes, wherein the plurality of bytes include at least one of the following: a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0069] In some examples, Figure 2 is a structure diagram of a data packet of a message according to the embodiment of the present application. As shown in Figure 2As shown, the data packet contains a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a checksum byte, and an end byte. The start byte is 1 byte long and indicates the beginning of the message. The message type byte (also known as the type byte) is 2 bytes long and indicates the purpose of the message, whether it's an authentication message or a data message. The device number byte (also known as the device ID byte) is 11 bytes long; the length can be adjusted according to the actual situation, such as using a mobile phone number as the device ID, in which case the length can be 11 bytes. The data length byte (also known as the data packet length) is 2 bytes long and indicates the length of the following data body. The data body byte's length is based on the data packet length and stores the actual data. The checksum byte is 1 byte long and can be used for checksums. The end byte is 1 byte long and indicates the end of the message.

[0070] This embodiment enables both communicating parties to achieve efficient and accurate authentication and session key negotiation by including these keyword bytes in the data packets of the message, while ensuring the integrity and tamper-proof nature of the data.

[0071] According to another aspect of this application, a message-based identity authentication system is provided. Figure 3 This is a schematic diagram of a message-based identity authentication system provided according to an embodiment of this application. For example... Figure 3 As shown, the system includes: a first device, configured to send a first message containing a first random number and a third message containing a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; a second device, configured to receive the first message and the third message, and send a second message containing target data and a fourth message containing a verification result to the first device, wherein the target data is obtained by concatenating the first digital signature and the second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is the result of verifying the second digital signature; and a control module, configured to control the first device and the second device to send messages, and to control the second device to verify the second digital signature to obtain the verification result.

[0072] In some examples, Figure 4 This is a schematic diagram of the message transmission process provided according to an embodiment of this application. For example... Figure 4As shown, the first device (i.e., device A) initiates the communication, the second device (i.e., device B) verifies the identity of the first device, and proves its own identity to the first device. The first device sends a communication message to the second device according to a preset protocol format of a data packet. At this time, the message type is 0x20, and the data is an 8-bit random number. After the second device receives the message from the first device, it determines whether to perform verification through the ID in the message. If verification is to be performed, the second device generates an 8-bit random number, concatenates the random number with the random number generated by the first device, and performs an SM9 algorithm signature on the concatenated data. Then, the second device concatenates the 8-bit random number generated by device B with the signature value and sends it to the first device. At this time, the message type is 0x21.

[0073] After the first device receives the data from the second device, it first verifies the signature of device B. After successful verification, it also performs a signature on the concatenated random number and transmits the signature to the second device. At this time, the message type is 0x22. After the second device receives the signature value from the first device, it performs verification. After successful verification, it returns the verification result. At this time, the message type is 0x23. Subsequent communication between the first device and the second device can be performed using a message type of 0x24. When the communication ends, a message with a message type of 0x25 is sent to end the communication.

[0074] The embodiment generates a digital signature based on message transmission between the first device and the second device and combines identity-based cryptography to perform identity verification, thereby reducing the process of applying for a certificate and improving the efficiency of identity verification.

[0075] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown.

[0076] The embodiment of the present application also provides a message-based identity verification device. It should be noted that the message-based identity verification device of the embodiment of the present application can be used to execute the message-based identity verification method provided by the embodiment of the present application. The message-based identity verification device provided by the embodiment of the present application is introduced as follows.

[0077] Figure 5 is a schematic diagram of the message-based identity verification device provided by the embodiment of the present application. As shown in the figure, Figure 5 the device comprises:

[0078] a first control unit 501 configured to control a first device to send a first message containing a first random number to a second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device.

[0079] The first determining unit 502 is configured to determine a first digital signature of the second device based on the first random number and the second random number, splice the first digital signature and the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device.

[0080] The obtaining unit 503 is configured to obtain a second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device.

[0081] The second control unit 504 is configured to control the second device to verify the second digital signature to obtain a verification result, and send a fourth message containing the verification result to the first device.

[0082] The second determining unit 505 is configured to determine that the identity authentication between the first device and the second device is successful in a case where the verification result of the fourth message indicates that the second digital signature passes verification.

[0083] The identity authentication device based on a message provided in the embodiments of the present application includes the first control unit 501, the first control unit 501 is configured to control the first device to send a first message containing a first random number to the second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device; the first determining unit 502 is configured to determine a first digital signature of the second device based on the first random number and the second random number, splice the first digital signature and the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device; the obtaining unit 503 is configured to obtain a second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device; the second control unit 504 is configured to control the second device to verify the second digital signature to obtain a verification result, and send a fourth message containing the verification result to the first device; and the second determining unit 505 is configured to determine that the identity authentication between the first device and the second device is successful in a case where the verification result of the fourth message indicates that the second digital signature passes verification. The identity authentication device based on a message provided in the embodiments of the present application solves the problem of low efficiency of identity authentication in the process of network communication in the related art, performs identity authentication based on message transmission between the first device and the second device and in combination with an identification password technology to generate a digital signature, reduces the process of applying for a certificate, and thus improves the efficiency of identity authentication.

[0084] Optionally, in the identity authentication device based on a message provided in the embodiments of the present application, the first determining unit 502 includes a splicing module configured to splice the second random number and the first random number to obtain a third random number; and a first generation module configured to generate a first digital signature for the third random number by using a preset identification password algorithm.

[0085] Optionally, in the message-based identity authentication apparatus provided in the embodiments of the present application, the obtaining unit 503 comprises: a first control module, configured to control the first device to verify the first digital signature; a first determination module, configured to determine that the identity authentication between the first device and the second device fails in a case where the first digital signature verification fails; and a second generation module, configured to extract target data from the second message and generate a second digital signature for the target data by using a preset identity password algorithm in a case where the first digital signature verification succeeds.

[0086] Optionally, in the message-based identity authentication apparatus provided in the embodiments of the present application, the apparatus further comprises: a private key obtaining unit, configured to obtain a first private key and a second private key from an identity key management system, wherein the first private key is a private key distributed to the first device by the identity key management system, and the second private key is a private key distributed to the second device by the identity key management system; the first generation module comprises: a first encryption submodule, configured to encrypt the third random number based on the second private key to obtain the first digital signature; and the second generation module comprises: a second encryption submodule, configured to encrypt the target data based on the first private key to obtain the second digital signature.

[0087] Optionally, in the message-based identity authentication apparatus provided in the embodiments of the present application, the first control module comprises: a first generation submodule, configured to obtain a system parameter from the identity key management system, obtain a first device number of the second device, and generate a first public key based on the first device number and the system parameter; a first determination submodule, configured to determine that the first digital signature verification succeeds in a case where the first public key matches the second private key; and a second determination submodule, configured to determine that the first digital signature verification fails in a case where the first public key does not match the second private key; and the second control unit 504 comprises: a third generation module, configured to obtain a second device number of the first device and generate a second public key based on the second device number and the system parameter; a second determination module, configured to determine that the second digital signature verification succeeds in a case where the second public key matches the first private key; and a third determination module, configured to determine that the second digital signature verification fails in a case where the second public key does not match the first private key.

[0088] Optionally, in the message-based identity authentication apparatus provided in the embodiments of the present application, the apparatus further comprises: an extraction unit, configured to extract a second device number of the first device from the first message; a judgment unit, configured to judge whether the second device number belongs to a device list of the second device; a third determination unit, configured to determine that the identity authentication between the first device and the second device succeeds in a case where the second device number belongs to the device list; and an execution unit, configured to execute the step of obtaining the second random number generated by the second device in a case where the second device number does not belong to the device list.

[0089] Optionally, in the packet-based identity authentication apparatus provided by the embodiment of the present application, the first packet, the second packet, the third packet and the fourth packet are packets using the user datagram protocol, and the first packet, the second packet, the third packet and the fourth packet contain a plurality of bytes, wherein the plurality of bytes include at least one of the following: a start byte, a packet type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

[0090] The packet-based identity authentication apparatus includes a processor and a memory, and the first control unit 501, the first determination unit 502, the acquisition unit 503, the second control unit 504 and the second determination unit 505 are stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0091] The processor includes a core, and the core calls the corresponding program units from the memory. The core can be one or more, and the efficiency of identity authentication can be improved by adjusting the core parameters.

[0092] The memory can include a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory includes at least one memory chip.

[0093] The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a program, and the program is executed by a processor to realize the packet-based identity authentication method.

[0094] The embodiment of the present application provides a processor, and the processor is used to run a program, and the program is executed to realize the packet-based identity authentication method.

[0095] Figure 6 FIG. 1 is a schematic diagram of an electronic device according to the embodiment of the present application. Figure 6As shown, the electronic device 601 comprises a processor, a memory, and a program stored on the memory and executable on the processor, and the processor implements the following steps when executing the program: controlling a first device to send a first message containing a first random number to a second device, obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature to obtain a verification result, and sending a fourth message containing the verification result to the first device; and in the case that the verification result of the fourth message indicates that the second digital signature passes the verification, determining that the identity authentication between the first device and the second device is successful. The device in this document can be a server, a PC, a PAD, a mobile phone, etc.

[0096] The present application also provides a computer program product adapted to execute the program of the following method steps when executed on a data processing device: controlling a first device to send a first message containing a first random number to a second device, obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature to obtain a verification result, and sending a fourth message containing the verification result to the first device; and in the case that the verification result of the fourth message indicates that the second digital signature passes the verification, determining that the identity authentication between the first device and the second device is successful.

[0097] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0099] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0100] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof. Figure 1 one or more flowcharts and / or blocks in the flowcharts and / or combination thereof.

[0101] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0102] The memory can include non-persistent memory and / or volatile memory, such as a random access memory (RAM) including a cache area for the temporary storage of data. The memory can also include non-volatile memory, such as read only memory (ROM) for storing structural information and / or instruction code to boot an operating system. Access and / or storage of information on the memory can be performed by one or more memory controllers. The memory can also include other volatile memory and / or non-volatile memory, such as flash memory, magnetic computer storage media, optical computer storage media, tape, and / or soft or hard disk drives.

[0103] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0104] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but also other elements not explicitly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0105] Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system or computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0106] The above merely provides embodiments of the present application and is not intended to limit the present application. Various modifications and changes can be made to the present application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the scope of the claims of the present application.

Claims

1. A message-based identity authentication method, characterized by, The method comprises the following steps: controlling a first device to send a first message containing a first random number to a second device, and obtaining a second random number generated by the second device, wherein the first device or the second device is a network device; determining a first digital signature of the second device based on the first random number and the second random number, splicing the first digital signature and the second random number to obtain target data, and controlling the second device to send a second message containing the target data to the first device; obtaining a second digital signature determined by the first device based on the second message, and controlling the first device to send a third message containing the second digital signature to the second device; controlling the second device to verify the second digital signature to obtain a verification result, and sending a fourth message containing the verification result to the first device; in the case that the verification result of the fourth message indicates that the second digital signature is verified, determining that identity authentication between the first device and the second device is successful; wherein the step of controlling the second device to verify the second digital signature comprises: obtaining a system parameter from an identity key management system; obtaining a second device number of the first device, generating a second public key based on the second device number and the system parameter; in the case that the second public key matches a first private key, determining that the second digital signature is verified, wherein the first private key is a private key distributed to the first device by the identity key management system; in the case that the second public key does not match the first private key, determining that the second digital signature is not verified.

2. The method of claim 1, wherein, The step of determining the first digital signature of the second device based on the first random number and the second random number comprises: splicing the second random number and the first random number to obtain a third random number; generating the first digital signature of the third random number through a preset identity cryptography algorithm.

3. The method of claim 1, wherein, The step of obtaining the second digital signature determined by the first device based on the second message comprises: controlling the first device to verify the first digital signature; in the case that the first digital signature is not verified, determining that identity authentication between the first device and the second device fails; in the case that the first digital signature is verified, extracting the target data from the second message, and generating the second digital signature of the target data through a preset identity cryptography algorithm.

4. The method according to claim 2 or 3, characterized in that, Before the step of controlling the first device to send the first message containing the first random number to the second device, the method further comprises: obtaining a first private key and a second private key from an identity key management system, wherein the first private key is a private key distributed to the first device by the identity key management system, and the second private key is a private key distributed to the second device by the identity key management system; generating the first digital signature of the third random number through a preset identity cryptography algorithm comprises: encrypting the third random number based on the second private key to obtain the first digital signature; generating the second digital signature of the target data through a preset identity cryptography algorithm comprises: encrypt the target data based on the first private key to obtain the second digital signature.

5. The method of claim 3, wherein, The method further comprises: obtaining a system parameter from an identity key management system, obtaining a first device number of the second device, and generating a first public key based on the first device number and the system parameter; in a case where the first public key matches a second private key, determining that the first digital signature is verified, wherein the second private key is a private key distributed to the second device by the identity key management system; in a case where the first public key does not match the second private key, determining that the first digital signature is not verified.

6. The method of claim 1, wherein, Before obtaining the second random number generated by the second device, the method further comprises: extracting a second device number of the first device from the first message; determining whether the second device number belongs to a device list of the second device; in a case where the second device number belongs to the device list, determining that identity authentication between the first device and the second device is successful; in a case where the second device number does not belong to the device list, performing the step of obtaining the second random number generated by the second device.

7. The method of claim 1, wherein, The first message, the second message, the third message and the fourth message are messages using a user datagram protocol, and the first message, the second message, the third message and the fourth message contain a plurality of bytes, wherein the plurality of bytes include at least one of a start byte, a message type byte, a device number byte, a data length byte, a data body byte, a check byte and an end byte.

8. A message-based identity authentication system, characterized by comprising: The method further comprises: a first device configured to send a first message containing a first random number and a third message containing a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; the second device configured to receive the first message and the third message, and send the second message containing target data and the fourth message containing a verification result to the first device, wherein the target data is obtained by splicing a first digital signature and a second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is a result of verifying the second digital signature; a control module configured to control the first device and the second device to send messages, and control the second device to verify the second digital signature to obtain the verification result; and a first device configured to send a first message containing a first random number and a third message containing a second digital signature to a second device, and receive a second message and a fourth message sent by the second device, wherein the second digital signature is a digital signature determined based on the second message; the second device configured to receive the first message and the third message, and send the second message containing target data and the fourth message containing a verification result to the first device, wherein the target data is obtained by splicing a first digital signature and a second random number, the first digital signature is a digital signature determined based on the first random number and the second random number, and the verification result is a result of verifying the second digital signature; a control module configured to control the first device and the second device to send messages, and control the second device to verify the second digital signature to obtain the verification result. The control of the second device on the second digital signature includes: obtaining a system parameter from an identity key management system; obtaining a second device number of the first device, generating a second public key based on the second device number and the system parameter; in the case that the second public key matches a first private key, determining that the second digital signature is verified, wherein the first private key is a private key distributed to the first device by the identity key management system; in the case that the second public key does not match the first private key, determining that the second digital signature is not verified.

9. An apparatus for message-based identity authentication, characterized by comprising: The method comprises: A first control unit is configured to control the first device to send a first message containing a first random number to the second device, and obtain a second random number generated by the second device, wherein the first device or the second device is a network device. A first determination unit is configured to determine a first digital signature of the second device based on the first random number and the second random number, splice the first digital signature and the second random number to obtain target data, and control the second device to send a second message containing the target data to the first device. An obtaining unit is configured to obtain a second digital signature determined by the first device based on the second message, and control the first device to send a third message containing the second digital signature to the second device. A second control unit is configured to control the second device to verify the second digital signature, obtain a verification result, and send a fourth message containing the verification result to the first device. A second determination unit is configured to determine that identity authentication between the first device and the second device is successful in the case that the fourth message indicates that the second digital signature is verified. The second control unit comprises: a first generation submodule configured to obtain a system parameter from an identity key management system; a third generation module configured to obtain a second device number of the first device, and generate a second public key based on the second device number and the system parameter; a second determination module configured to determine that the second digital signature is verified in the case that the second public key matches a first private key, wherein the first private key is a private key distributed to the first device by the identity key management system; and a third determination module configured to determine that the second digital signature is not verified in the case that the second public key does not match the first private key.

10. An electronic device, comprising: The apparatus comprises one or more processors and a memory configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the message-based identity authentication method in any one of claims 1 to 7.

Images