Equipment authentication method and related device

Abstract

The invention discloses an equipment authentication method and a related device, and relates to the technical field of computers, and the method comprises the steps: obtaining first data information and second data information of hardware features under the condition that a hardware fingerprint is changed; performing similarity matching on the first data information and the second data information to obtain a matching result; based on the matching result and the importance degree of the hardware features, calculating the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change to obtain the hardware fingerprint similarity; and under the condition that the hardware fingerprint similarity is higher than a threshold value, the equipment is allowed to pass authentication. When the hardware equipment is partially changed, the authentication passing possibility of the equipment can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a device authentication method and related apparatus. Background Art

[0002] Hardware fingerprint is a unique identifier generated by identifying and utilizing the characteristic information of hardware devices. Hardware fingerprint can be used for device authentication to ensure that only authorized devices can access specific resources or services. When a hardware component in a device is replaced, the hardware fingerprint changes, causing the system to deny legitimate access to the device, affecting user experience and system availability. Summary of the invention

[0003] In view of the above problems, this application provides a device authentication method and related apparatus, which can improve the possibility of the device passing the authentication when some hardware devices are changed. The specific scheme is as follows:

[0004] The first aspect of the present application provides a device authentication method, comprising:

[0005] When the hardware fingerprint is changed, first data information and second data information of the hardware characteristics are obtained; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change;

[0006] Performing similarity matching on the first data information and the second data information to obtain a matching result;

[0007] Based on the matching result and the importance of the hardware feature, calculating the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change to obtain the hardware fingerprint similarity;

[0008] When the hardware fingerprint similarity is higher than a threshold, the device is allowed to pass the authentication.

[0009] In a possible implementation, before the hardware fingerprint is changed, the method further includes:

[0010] Get data information on a variety of different hardware characteristics;

[0011] Performing hash calculation on the data information of each of the hardware features to obtain multiple feature hash values;

[0012] Concatenate the plurality of characteristic hash values ​​to obtain a concatenation result;

[0013] A hash calculation is performed on the splicing result to obtain the hardware fingerprint.

[0014] In a possible implementation, the calculating, based on the matching result and the importance of the hardware feature, the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change to obtain the hardware fingerprint similarity includes:

[0015] Obtaining a weight of each of the hardware features; wherein the weight is determined based on the importance of the hardware features;

[0016] The product of the weight of each of the hardware features and the matching result corresponding to the hardware feature is calculated, and the products are added to obtain the hardware fingerprint similarity.

[0017] In a possible implementation, performing similarity matching on the first data information and the second data information to obtain a matching result includes:

[0018] When the first data information and the second data information are the same, obtaining a first matching value;

[0019] When the first data information and the second data information are not completely the same, obtaining a second matching value;

[0020] When the first data information and the second data information are completely different, obtaining a third matching value;

[0021] The first matching value is greater than the second matching value, and the second matching value is greater than the third matching value.

[0022] In a possible implementation, the method further includes:

[0023] In the case that the hardware fingerprint similarity is not higher than the threshold, the device is not allowed to pass the authentication, and re-verification of hardware fingerprint information and / or authentication failure information is sent.

[0024] In a possible implementation, the method further includes:

[0025] When the hardware fingerprint similarity is higher than the threshold, a hardware fingerprint update operation is performed based on the changed hardware fingerprint, and the updated hardware fingerprint is stored.

[0026] A second aspect of the present application provides a device authentication system, comprising:

[0027] A data acquisition module, used to acquire first data information and second data information of hardware characteristics when the hardware fingerprint changes; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change;

[0028] A matching module, used for performing similarity matching between the first data information and the second data information to obtain a matching result;

[0029] A similarity calculation module, configured to calculate the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change based on the matching result and the importance of the hardware feature, so as to obtain the hardware fingerprint similarity;

[0030] The authentication module is used to allow the device to pass the authentication if the hardware fingerprint similarity is higher than a threshold.

[0031] A third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the device authentication method of the first aspect or any implementation of the first aspect.

[0032] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0033] The memory is used to store computer programs;

[0034] The processor is used to execute the computer program so that the electronic device can implement the device authentication method of the first aspect or any implementation manner of the first aspect.

[0035] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the device authentication method of the first aspect or any implementation of the first aspect.

[0036] By means of the above technical scheme, the device authentication method and related devices provided by the present application obtain the first data information and the second data information of the hardware feature when the hardware fingerprint changes; wherein the first data information is the hardware feature data used to generate the hardware fingerprint before the change, and the second data information is the hardware feature data used to generate the hardware fingerprint after the change; the first data information and the second data information are matched for similarity to obtain a matching result; based on the matching result and the importance of the hardware feature, the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change is calculated to obtain the hardware fingerprint similarity; when the hardware fingerprint similarity is higher than the threshold, the device is allowed to pass the authentication. The present application performs similarity matching on the hardware feature data used when generating the hardware fingerprint before and after the change, and multiplies the matching result by the importance of the hardware feature to obtain the hardware fingerprint similarity, which can avoid the problem of failing to pass the authentication as long as the hardware fingerprint changes. When the hardware device is partially changed, the possibility of passing the authentication of the device can be increased, and the situation where the user cannot use the device due to hardware replacement can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0038] Figure 1 A flow chart of a device authentication method provided for this application;

[0039] Figure 2 A structural diagram of a device authentication system provided for this application;

[0040] Figure 3 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0041] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0042] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0043] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0044] The present application embodiment provides a device authentication method. The device authentication method of the present application embodiment is described in detail below with reference to the accompanying drawings.

[0045] The present application provides a device authentication method, such as Figure 1 As shown, the method comprises:

[0046] Step 101: when a hardware fingerprint is changed, first data information and second data information of hardware characteristics are obtained; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change.

[0047] Obtain the hardware fingerprint, compare the obtained hardware fingerprint with the stored hardware fingerprint, and determine whether the two hardware fingerprints are consistent. If the two hardware fingerprints are inconsistent, it is determined that the hardware fingerprint has changed. If the two hardware fingerprints are consistent, it is determined that the hardware fingerprint has not changed. If the hardware fingerprint has changed, the stored hardware fingerprint is the hardware fingerprint before the change, and the obtained hardware fingerprint is the hardware fingerprint after the change.

[0048] When generating a hardware fingerprint, it can be generated by data information of one or more hardware features. Compared with a hardware fingerprint generated by a single hardware feature, a hardware fingerprint generated by multiple hardware features can improve the uniqueness and security of the device.

[0049] Optionally, the hardware features may include, but are not limited to: CPU (Central Processing Unit) serial number, motherboard serial number, hard disk serial number, BIOS (Basic Input Output System) information, memory module serial number, MAC address of the network interface, etc. Among them, the CPU serial number is the unique serial number of the central processing unit; the motherboard serial number is the unique serial number of the device motherboard; the hard disk serial number is the serial number of the main storage medium; the BIOS information is the version number and serial number of the device BIOS; the memory module serial number is the serial number of the random access memory (RAM); the MAC address of the network interface is the physical address of the network interface controller.

[0050] The data information of the hardware feature is the specific data content of the hardware feature. If the hardware feature is the CPU serial number, the data information of the hardware feature is the specific value of the CPU serial number. If the hardware feature is the MAC address of the network interface, the data information of the hardware feature is the specific address content of the MAC address.

[0051] When the hardware fingerprint is changed, the first data information and the second data information of the hardware feature are obtained, that is, the hardware feature data used to generate the hardware fingerprint before the change and the hardware feature data used to generate the hardware fingerprint after the change are obtained.

[0052] In a possible implementation, before the hardware fingerprint is changed, the device authentication method provided by the embodiment of the present application further includes:

[0053] Get data information on a variety of different hardware characteristics;

[0054] Perform hash calculation on the data information of each hardware feature to obtain multiple feature hash values;

[0055] Concatenate multiple feature hash values ​​to obtain a concatenation result;

[0056] Perform hash calculation on the splicing result to obtain the hardware fingerprint.

[0057] When performing hash calculation on the data information of the hardware features, the SHA-256 method can be used to obtain the feature hash value; when splicing multiple feature hash values, all feature hash values ​​can be spliced ​​into a string in a predetermined order; the splicing result is hashed, that is, the spliced ​​string is hashed again to generate a unique hardware fingerprint of the device.

[0058] By generating hardware fingerprints based on a variety of different hardware features, it is possible to solve the problem that existing device authentication usually relies on a single hardware feature, such as the MAC address of a network interface. However, MAC addresses are easy to be tampered with and forged, and multiple virtual network cards or multiple internal and external network cards are also prone to confusion, resulting in an authorization code that can be used by multiple devices through simple operations, or even used simultaneously. In addition, a single feature cannot fully reflect the uniqueness of a device, such as a MAC address that cannot uniquely identify a device, especially in scenarios such as virtualization and network device cloning, and a single feature is easy to be counterfeited, resulting in the risk of spoofing attacks on device authentication mechanisms. This application can improve the security and stability of device authentication by combining multiple hardware features to generate a unique fingerprint for a device.

[0059] Step 102: Perform similarity matching on the first data information and the second data information to obtain a matching result.

[0060] By performing similarity matching on the first data information and the second data information, it can be determined whether the data information of the current hardware feature is consistent with the data information of the previous hardware feature. If not, the degree of similarity between the first data information and the second data information is determined, thereby obtaining a matching result.

[0061] In a possible implementation, the first data information and the second data information are matched for similarity to obtain a matching result, including:

[0062] When the first data information and the second data information are the same, obtaining a first matching value;

[0063] When the first data information and the second data information are not completely the same, obtaining a second matching value;

[0064] When the first data information and the second data information are completely different, a third matching value is obtained;

[0065] The first matching value is greater than the second matching value, and the second matching value is greater than the third matching value.

[0066] When the first data information and the second data information are the same, a first matching value is obtained, and the first matching value may be 1; when the first data information and the second data information are not completely the same, a second matching value is obtained, and the second matching value may be 0.5; when the first data information and the second data information are completely different, a third matching value is obtained, and the third matching value may be 0.

[0067] In practical applications, the determination of the first matching value, the second matching value and the third matching value can be adjusted according to actual conditions so that after adjustment, the first matching value is greater than the second matching value and the second matching value is greater than the third matching value.

[0068] Of course, when the first data information and the second data information are not exactly the same, a second matching value is obtained. For example, the hardware model is the same, but the serial number is different. At this time, the size of the second matching value can be determined according to the size of the serial number change range. For example, if the serial number changes greatly, the second matching value is small, and if the serial number changes slightly, the second matching value is large.

[0069] Step 103: Based on the matching result and the importance of the hardware feature, the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change is calculated to obtain the hardware fingerprint similarity.

[0070] Since the importance of different hardware features is different, the importance of the hardware features can be considered when calculating the hardware fingerprint similarity, that is, based on the matching results and the importance of the hardware features, the similarity of the hardware fingerprint before and after the change is calculated to obtain the hardware fingerprint similarity.

[0071] If the hardware fingerprint is generated by data information of a hardware feature, when calculating the hardware fingerprint similarity, the matching result obtained in step 102 and the importance of the hardware feature can be directly multiplied to obtain the hardware fingerprint similarity.

[0072] In a possible implementation, based on the matching result and the importance of the hardware feature, the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change is calculated to obtain the hardware fingerprint similarity, including:

[0073] Obtaining a weight for each hardware feature; wherein the weight is determined based on the importance of the hardware feature;

[0074] The product of the weight of each hardware feature and the matching result corresponding to the hardware feature is calculated, and the products are added together to obtain the hardware fingerprint similarity.

[0075] If the hardware fingerprint is generated through data information of multiple hardware features, it is necessary to calculate the matching result of the first data information and the second data information of each hardware feature, determine the importance of each hardware feature, and then determine the weight of the hardware feature based on the importance; wherein, the higher the importance of the hardware feature, the greater the weight of the assigned hardware feature. Multiply the matching result of the corresponding hardware feature and the weight of the hardware feature, and add up the multiple multiplied results. Thus, the hardware fingerprint similarity is obtained.

[0076] The hardware fingerprint similarity can be calculated according to the following formula:

[0077]

[0078] Where S is the hardware fingerprint similarity, i is the hardware feature, and n is the total number of hardware features, that is, the total number of hardware features of the computing device fingerprint. If there are six hardware features, namely: CPU serial number, motherboard serial number, hard disk serial number, BIOS information, memory module serial number, and network interface MAC address, then n = 6, w i is the weight of the i-th hardware feature, f i is the matching result corresponding to the i-th hardware feature, indicating whether the hardware feature of the current device matches the original hardware feature. The data information of the two hardware features is consistent. i =1, the data information of the two hardware features is partially consistent, f i = 0.5, the data information of the two hardware features is completely inconsistent, f i = 0, ∑ is the summation symbol, which means adding the similarities of all hardware features together, and the similarity of the i-th hardware feature is w i ×f i ,Since each hardware feature has a similarity, the similarities of all features are summarized to obtain the total similarity, i.e. the hardware fingerprint similarity.

[0079] Hardware fingerprint similarity is a percentage value, S from 0% to 100%, which indicates how similar the hardware features of the current device are to the original device. The higher the hardware fingerprint similarity, the higher the possibility that the device is a legitimate device; the lower the hardware fingerprint similarity, the device may have been replaced or forged, that is, the lower the possibility that the device is a legitimate device.

[0080] For various hardware features, their importance is different. For example, the CPU serial number is more difficult to be tampered with than the MAC address. Therefore, the weight of the CPU serial number can be set higher than the weight of the MAC address. For example, the weight of the CPU is 30%, and the weight of the CPU serial number is 20%. CPU =0.30, the weight of the MAC address is 5%, w MAC =0.05.

[0081] Step 104: When the hardware fingerprint similarity is higher than the threshold, the device is allowed to pass the authentication.

[0082] If the hardware fingerprint similarity is higher than the threshold, it means that the hardware is legal and the device can be allowed to pass authentication. This application uses a hardware change tolerance mechanism to allow the device to pass authentication when part of the hardware has changed, allowing legal hardware changes, reducing the situation where users cannot use the device due to hardware replacement, and improving the flexibility of device authentication. It can solve the problem in the prior art that when a hardware component in the device is replaced, the system denies legal access to the device, affecting the user experience and system availability.

[0083] In a possible implementation, a device authentication method provided in an embodiment of the present application further includes:

[0084] If the hardware fingerprint similarity is not higher than the threshold, the device is not allowed to pass the authentication, and re-verification of the hardware fingerprint information and / or authentication failure information is sent.

[0085] If the hardware fingerprint similarity is not higher than the threshold, the device is not allowed to pass the authentication. By sending re-verification hardware fingerprint information and / or authentication failure information, the user can be required to re-verify the authorization or contact the administrator.

[0086] For example, assume that the device has three hardware features: CPU serial number, motherboard serial number and MAC address. Among them, the weight w1 of the CPU serial number is 30%, the weight w2 of the motherboard serial number is 40%, and the weight w3 of the MAC address is 30%. The hardware fingerprint matching of the current device is as follows: CPU serial number fully matches: f1=1, motherboard serial number partially matches: f2=0.5, MAC address does not match at all: f3=0. The hardware fingerprint similarity is calculated according to the formula:

[0087] S=(w1×f1)+(w2×f2)+(w3×f3)

[0088] =(0.30×1)+(0.40×0.5)+(0.30×0)

[0089] =0.30+0.20+0

[0090] =0.50

[0091] The final hardware fingerprint similarity S=50%. If the set threshold is 80% and the hardware fingerprint similarity is lower than the threshold, the device is judged as illegal and is not allowed to pass the authentication.

[0092] In a possible implementation, a device authentication method provided in an embodiment of the present application further includes:

[0093] When the hardware fingerprint similarity is higher than the threshold, a hardware fingerprint update operation is performed based on the changed hardware fingerprint, and the updated hardware fingerprint is stored.

[0094] If the hardware fingerprint similarity is higher than the threshold, the hardware fingerprint change is considered legitimate, the device's hardware fingerprint can be updated, and the updated hardware fingerprint can be stored. The hardware change operation can be recorded in the security log for auditing.

[0095] The device authentication method provided by this application can maintain the continuity and security of authentication when the device hardware changes, and can still allow the device to pass authentication when the hardware device partially changes, ensuring the continued access rights of legitimate users. At the same time, multiple device features are used to replace the use of unreliable MAC addresses to generate hardware fingerprints, which can improve the security of the system and avoid security vulnerabilities caused by tampering with a single hardware feature. The device authentication method has broad application prospects and is particularly suitable for industrial control systems, enterprise intranet security authentication, and high-security Internet of Things device authentication. It is also suitable for distributed access and will not cause anomalies in distributed systems. In addition, the hardware features of the device can be regularly detected and compared with the stored hardware features to achieve dynamic updates of the hardware fingerprint and ensure the long-term stability and flexibility of the system.

[0096] The present application further illustrates the device authentication method provided by the present application through the following embodiments.

[0097] 1. Multi-factor hardware fingerprint generation

[0098] 1.1 Selection of Hardware Features

[0099] This application combines multiple device hardware features to generate a unique device hardware fingerprint, including but not limited to the following hardware features:

[0100] CPU Serial Number: The unique serial number of the central processing unit.

[0101] Mainboard Serial Number: The unique serial number of the device mainboard.

[0102] Hard disk serial number: The serial number of the primary storage medium.

[0103] BIOS information: version number and serial number of the device BIOS.

[0104] Memory Module Serial Number: The serial number of the Random Access Memory (RAM).

[0105] MAC address of the network interface: the physical address of the network interface controller.

[0106] 1.2 Generation of hardware fingerprint

[0107] The specific process of generating hardware fingerprint is as follows:

[0108] a. Collect data information of multiple hardware features mentioned above.

[0109] b. Perform hash calculation (such as SHA-256) on the data information of each hardware feature to obtain the feature hash value.

[0110] c. Concatenate all feature hash values ​​into a string in a predetermined order.

[0111] d. Perform a hash operation on the concatenated string again to generate a unique hardware fingerprint for the device.

[0112] 2. Hardware Change Tolerance Mechanism

[0113] In order to improve the flexibility of device authentication, a hardware change tolerance mechanism is introduced to allow the device to pass authentication even when part of the hardware has changed.

[0114] 2.1 Weight distribution of hardware features

[0115] Assign weights to different hardware features to reflect their importance in device fingerprinting:

[0116]

[0117] The weights of the above hardware features are only exemplary and can be adjusted according to business needs.

[0118] 2.2 Similarity Calculation

[0119] When the hardware fingerprint of a device changes, the similarity S between the new and old fingerprints is calculated, and the matching result of each hardware feature is multiplied by its weight, and then added together to obtain the similarity of the new and old hardware fingerprints of the device.

[0120] The formula for calculating hardware fingerprint similarity is:

[0121]

[0122] In the formula,

[0123] S is the hardware fingerprint similarity, which is a percentage value (0% to 100%) that indicates how similar the hardware features of the current device are to the original device. The higher the hardware fingerprint similarity, the more likely the device is a legitimate device; conversely, if the hardware fingerprint similarity is too low, the device may have been replaced or forged.

[0124] ∑ is a summation symbol, which means adding the similarities of all hardware features together. Because each hardware feature has a similarity, this symbol means summing up the similarities of all hardware features to get the total similarity, that is, the hardware fingerprint similarity.

[0125] n is the total number of hardware features, that is, the total number of hardware features used to calculate the device fingerprint. If 6 hardware features are selected, then n=6.

[0126] w i is the weight of the ith hardware feature, indicating the proportion of the hardware feature in the total similarity. Different hardware features have different importances. For example, the CPU serial number is more difficult to tamper with than the MAC address, so the CPU serial number has a higher weight. If the weight of the CPU is 30%, then W CPU =0.30. If the weight of the MAC address is 5%, then W MAC =0.05.

[0127] f i is the matching result corresponding to the i-th hardware feature, indicating whether the hardware feature of the current device matches the original hardware feature. The data information of the two hardware features is consistent. i = 1, the data information of the two hardware features is partially consistent (for example, the hardware model is the same, but the serial number is different, or some features allow slight changes), f i = 0.5, the data information of the two hardware features is completely inconsistent, f i =0.

[0128] 2.3 Implementation of Tolerance Mechanism

[0129] If the hardware fingerprint similarity S is greater than a threshold (such as 80%), it is considered a legitimate hardware change and the device is allowed to pass the authentication. If the hardware fingerprint similarity S is lower than the threshold, the user is required to re-verify the authorization or contact the administrator.

[0130] 3. Dynamic hardware fingerprint update

[0131] To further enhance the flexibility of the system, dynamic hardware fingerprint updates can be performed.

[0132] Hardware change detection: The system periodically detects the hardware characteristics of the device and compares them with the stored original characteristics.

[0133] Change verification: If the change is deemed legitimate (i.e., the hardware fingerprint similarity S is greater than the threshold), the device’s hardware fingerprint is updated.

[0134] Security log recording: Hardware change operations are recorded in the security log for audit purposes.

[0135] The device authentication method provided by the present application can solve the problem that current device authentication usually relies on a single hardware feature, and in scenarios such as virtualization and network device cloning, a single feature (such as the MAC address of the network interface) cannot uniquely identify the device, and a single feature is easy to be counterfeited, resulting in the risk of spoofing attacks on the device authentication mechanism. For example, MAC addresses are easy to be tampered with and forged, and multiple virtual network cards or multiple internal and external network cards are also easy to cause confusion, resulting in an authorization code being used by multiple devices through simple operations, or even used simultaneously. The problem can also be solved by judging whether the entire device is legal based on a single hardware, which will cause a single hardware to become an authentication key, such as using the mac of a USB network card as a device authentication identifier. If the USB is placed on other devices, the other devices will also consider it to be legal. The problem can also be solved by the system denying legal access to the device when a hardware component in the device is replaced, affecting the user experience and system availability, as well as the problem of abnormalities caused by repeated security or hardware identifiers in future distributed deployments.

[0136] The device authentication method provided by this application has the following advantages:

[0137] 1. Multi-factor authentication: Combine multiple hardware features to generate device fingerprints, replacing the current insecure MAC identification, significantly improving device uniqueness and security.

[0138] 2. Strong fault tolerance: Through the hardware change tolerance mechanism, legal hardware changes are allowed, reducing the situation where users cannot use the system due to hardware replacement.

[0139] 3. Dynamic update mechanism (dual fault tolerance): supports dynamic update of hardware fingerprints to ensure long-term stability and flexibility of the system.

[0140] 4. Suitable for distributed access: no exceptions will occur in distributed systems.

[0141] 5. Simple mechanism and wide application: It has broad application prospects, especially suitable for industrial control systems, enterprise intranet security authentication and high-security Internet of Things device authentication.

[0142] A device authentication method provided in an embodiment of the present application is introduced above, and a system for executing the above device authentication method will be introduced below.

[0143] The present application embodiment provides a device authentication system, such as Figure 2 As shown, the system includes:

[0144] The data acquisition module 201 is used to acquire first data information and second data information of hardware characteristics when the hardware fingerprint changes; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change.

[0145] The matching module 202 is used to perform similarity matching between the first data information and the second data information to obtain a matching result.

[0146] The similarity calculation module 203 is used to calculate the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change based on the matching result and the importance of the hardware feature, so as to obtain the hardware fingerprint similarity.

[0147] The authentication module 204 is used to allow the device to pass the authentication when the hardware fingerprint similarity is higher than a threshold.

[0148] In a possible implementation, the embodiment of the present application provides a device authentication system, further comprising:

[0149] The hardware fingerprint generation module is used to obtain a variety of different hardware features; perform hash calculation on each hardware feature to obtain multiple feature hash values; splice the multiple feature hash values ​​to obtain a splicing result; and perform hash calculation on the splicing result to obtain a hardware fingerprint.

[0150] The similarity calculation module 203 is specifically used for:

[0151] Obtaining a weight of each of the hardware features; wherein the weight is determined based on the importance of the hardware features;

[0152] The product of the weight of each of the hardware features and the matching result corresponding to the hardware feature is calculated, and the products are added to obtain the hardware fingerprint similarity.

[0153] The matching module 202 is specifically used for:

[0154] When the first data information and the second data information are the same, obtaining a first matching value;

[0155] When the first data information and the second data information are not completely the same, obtaining a second matching value;

[0156] When the first data information and the second data information are completely different, obtaining a third matching value;

[0157] The first matching value is greater than the second matching value, and the second matching value is greater than the third matching value.

[0158] The authentication module 204 is further configured to:

[0159] In the case that the hardware fingerprint similarity is not higher than the threshold, the device is not allowed to pass the authentication, and re-verification of hardware fingerprint information and / or authentication failure information is sent.

[0160] The authentication module 204 is further configured to:

[0161] When the hardware fingerprint similarity is higher than the threshold, a hardware fingerprint update operation is performed based on the changed hardware fingerprint, and the updated hardware fingerprint is stored.

[0162] The present application also provides an electronic device in an embodiment. Figure 3 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic device in the embodiments of the present application may include but is not limited to fixed terminals such as mobile phones, notebook computers, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0163] like Figure 3 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0164] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a memory card, a hard disk, etc.; and communication devices 309. The communication device 309 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0165] The electronic device can implement the above-mentioned device authentication method.

[0166] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any device authentication method provided in the embodiment of the present application.

[0167] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any device authentication method provided in an embodiment of the present application.

[0168] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0169] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0170] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0171] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A device authentication method, characterized in that: include: When the hardware fingerprint is changed, first data information and second data information of the hardware characteristics are obtained; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change; Performing similarity matching on the first data information and the second data information to obtain a matching result; Based on the matching result and the importance of the hardware feature, calculating the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change to obtain the hardware fingerprint similarity; When the hardware fingerprint similarity is higher than a threshold, the device is allowed to pass the authentication.

2. The device authentication method according to claim 1, characterized in that: Before the hardware fingerprint is changed, the method further includes: Get data information on a variety of different hardware characteristics; Performing hash calculation on the data information of each of the hardware features to obtain multiple feature hash values; Concatenate the plurality of characteristic hash values ​​to obtain a concatenation result; A hash calculation is performed on the splicing result to obtain the hardware fingerprint.

3. The device authentication method according to claim 2, characterized in that: The calculating the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change based on the matching result and the importance of the hardware feature to obtain the hardware fingerprint similarity includes: Obtaining a weight of each of the hardware features; wherein the weight is determined based on the importance of the hardware features; The product of the weight of each of the hardware features and the matching result corresponding to the hardware feature is calculated, and the products are added to obtain the hardware fingerprint similarity.

4. The device authentication method according to claim 1, characterized in that: The performing similarity matching on the first data information and the second data information to obtain a matching result includes: When the first data information and the second data information are the same, obtaining a first matching value; When the first data information and the second data information are not completely the same, obtaining a second matching value; When the first data information and the second data information are completely different, obtaining a third matching value; The first matching value is greater than the second matching value, and the second matching value is greater than the third matching value.

5. The device authentication method according to any one of claims 1 to 4, characterized in that: Also includes: In the case that the hardware fingerprint similarity is not higher than the threshold, the device is not allowed to pass the authentication, and re-verification of hardware fingerprint information and / or authentication failure information is sent.

6. The device authentication method according to any one of claims 1 to 4, characterized in that: Also includes: When the hardware fingerprint similarity is higher than the threshold, a hardware fingerprint update operation is performed based on the changed hardware fingerprint, and the updated hardware fingerprint is stored.

7. A device authentication system, characterized in that: include: A data acquisition module, used to acquire first data information and second data information of hardware characteristics when the hardware fingerprint changes; wherein the first data information is the hardware characteristic data used to generate the hardware fingerprint before the change, and the second data information is the hardware characteristic data used to generate the hardware fingerprint after the change; A matching module, used for performing similarity matching between the first data information and the second data information to obtain a matching result; A similarity calculation module, used to calculate the similarity between the hardware fingerprint before the change and the hardware fingerprint after the change based on the matching result and the importance of the hardware feature, so as to obtain the hardware fingerprint similarity; The authentication module is used to allow the device to pass the authentication if the hardware fingerprint similarity is higher than a threshold.

8. A computer program product, characterized in that The method comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the device authentication method as claimed in any one of claims 1 to 6.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the device authentication method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the device authentication method as described in any one of claims 1 to 6.

Images