A method for implementing an identification-based authentication mechanism

Abstract

The application belongs to the technical field of information security, and discloses a kind of based on identification authentication mechanism implementation method, including: after multi-dimensional identification server receives device authentication request, parsing device identification and calculating device public key, then interact with authentication center, carry out identity verification, after authentication center receives authentication request, the public key of device is calculated and the signature in request is verified using the public key, pass the verification, and the authorization code is generated and returned to the authentication server, and the server further forwards it to the device, and the returned signature information is verified by the device to ensure the validity of the authorization code.The application not only simplifies the management process of traditional public key infrastructure, but also improves the efficiency of the authentication process, each device only needs to generate a public-private key pair through its unique identification (EID), avoiding the complexity in traditional key distribution and certificate management, making device authentication more flexible and easy to expand.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method for implementing an identifier-based authentication mechanism. Background Technology

[0002] In modern information society, authentication technology is one of the core technologies for ensuring information security and stable system operation. With the rapid development of emerging technologies such as the Internet of Things (IoT) and Vehicle-to-Everything (V2X), the number of devices in distributed systems is exploding. The authentication needs of these devices have become more complex, and traditional centralized authentication algorithms are gradually revealing their limitations, making it difficult to meet the efficiency, security, and flexibility requirements of device authentication in future distributed networks.

[0003] Traditional authentication algorithms typically rely on centralized authentication servers or authentication centers, a design that was reasonable in early network environments. Centralized authentication architectures manage device authentication and access control through a trusted central node, offering advantages such as unified management, ease of implementation, and centralized access control. However, as networks expand and application scenarios diversify, the limitations of centralized authentication become increasingly apparent.

[0004] First, traditional authentication algorithms face performance bottlenecks. Centralized authentication centers need to handle authentication requests from all devices, which can overload the center, especially in scenarios with frequent device access or high concurrency. For example, in IoT scenarios, millions of sensors and terminal devices may attempt to access the network simultaneously, placing extremely high demands on the processing capacity of the authentication center. If the authentication center cannot respond to these requests in a timely manner, it will lead to access delays, and may even result in devices failing to authenticate, thus severely impacting system efficiency and user experience.

[0005] Secondly, centralized authentication faces the risk of a single point of failure. Since all authentication requests must be processed through the authentication center, if the center fails or is attacked (such as by a DDoS attack), the entire system's authentication capabilities will be paralyzed. For critical application scenarios, such as emergency response in the Industrial Internet of Things (IIoT) or the Internet of Vehicles (IoV), this risk is unacceptable. Furthermore, the authentication center's storage and computing resources can become prime targets for attackers; if compromised, the security of the entire system will be severely threatened.

[0006] Furthermore, centralized authentication lacks scalability. Traditional authentication architectures are typically optimized for a fixed number of devices and cannot flexibly adapt to rapid increases in the number of devices or changes in geographical distribution. For example, in a distributed IoT environment, devices may be widely distributed globally, and the physical location of a centralized authentication center may cause network latency issues for devices in certain regions. This latency directly affects the efficiency of device authentication, especially in scenarios with high real-time requirements.

[0007] In distributed scenarios, traditional authentication algorithms suffer from rigidity in permission management. After initial authentication, a device's permissions are typically statically assigned. However, in practice, device access permissions may dynamically adjust due to changes in geographical location, time, or task. Traditional authentication architectures struggle to efficiently handle these dynamic permission requirements, potentially leading to devices receiving excessive permissions or failing to obtain the necessary temporary permissions in a timely manner, thus increasing security risks.

[0008] On the other hand, traditional authentication algorithms also face challenges in security and privacy protection. In centralized authentication, device identity information and authentication data are stored centrally in the authentication center. Once the authentication center is compromised, attackers can not only forge device identities but also potentially steal a large amount of sensitive information. Furthermore, traditional authentication methods have limited protection against man-in-the-middle attacks and replay attacks, making it difficult to meet the high security requirements of modern networks.

[0009] To address these challenges, distributed authentication has become a hot research topic in recent years. By distributing authentication responsibilities across multiple nodes, distributed authentication not only improves system fault tolerance and scalability but also effectively reduces the risk of single points of failure. However, existing distributed authentication schemes often require significant inter-node communication and synchronization, which places an additional burden on resource-constrained devices such as low-power sensors. Furthermore, in multi-dimensional scenarios such as connected vehicles, the dynamic nature of devices makes efficient authentication difficult through inter-node collaboration, further limiting the application scope of distributed authentication.

[0010] In summary, traditional authentication algorithms face bottlenecks in modern distributed scenarios in terms of performance, security, and scalability. Summary of the Invention

[0011] To address the aforementioned technical problems, this invention provides an identification-based authentication mechanism implementation method. This method offers a novel approach to solving these problems by combining identification and encryption technologies to design an efficient, secure, and flexible authentication mechanism, providing a solid foundation for future distributed networks.

[0012] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0013] This invention discloses an identifier-based authentication mechanism implementation method. The method is implemented through an authentication system comprising an authentication client, an authentication server, and an authentication center (AUC). The authentication client and the authentication server interact with each other. The AUC performs identity verification and authorization distribution, and dynamic verification of authentication and authorization requests and responses. When a device requests authentication, it first sends an authentication request message through the authentication client. The message contains key information such as the device's identifier (EID) and the client type. Upon receiving the authentication request, the authentication server determines whether the device is registered. If the device is registered, the authentication server directly returns the device's authentication and authorization information. If the device is not registered, the authentication server forwards the authentication request to the AUC for further verification and authorization. The specific authentication mechanism is implemented through the following steps:

[0014] Step 1: Obtain the device identifier (EID), and generate a key pair through the authentication center based on the obtained device identifier (EID);

[0015] Step 2: The device sends authentication request messages to multiple authentication servers. After receiving the authentication request messages from the device, the authentication server extracts the device identifier (EID) and queries its local authentication list based on the extracted device identifier (EID).

[0016] Step 3: If the authentication server does not find the device identifier (EID) in the local authentication list, the authentication server forwards the authentication request to the authentication center (AUC). This step is to ensure the final verification of the device identity and the generation of the authorization code. The authentication server sends the request information containing the device identifier (EID) and digital signature to the authentication center. The authentication center needs to further verify the device identity and generate the authorization code.

[0017] Step 4: After receiving the authentication request, the certification authority uses the device's Equipment Identifier (EID) to calculate the device's public key Pk. a Using public key Pk a Verify the digital signature in the authentication request; if the digital signature Si a Verification passed; the certification center confirmed the device's valid identity and digital signature. a The verification formula is:

[0018] Verify(M|Timestamp, Si) a , Pk a =True

[0019] Step 5: The certification center generates an authorization code, which is a unique identifier for the device, ensuring that the device has the corresponding access permissions;

[0020] Step 6: After the authentication center completes the digital signature authentication and generates the authorization code, the authentication server directly returns the device's authentication information and authorization code. The authentication server processes the returned authorization code and authentication information and uses the authentication server's private key to digitally sign the authentication information.

[0021] Step 7: The device receives the authorization code and the signature S generated by the authentication server. r Then, use the public key of the authentication server to verify the signature S generated by the authentication server. r Verification is performed to ensure the authenticity of the response;

[0022] Step 8: After completing the above authentication process, the communication between the device and the authentication center is encrypted using a session key (Ksession);

[0023] Step 9: The device initiates a resource access request to the authentication system using an authorization code (Token). Each time it accesses the resource, the device carries the authorization code. The authentication system verifies the authorization code to determine if the device has the necessary permissions. If it does not have permissions, it requests an authorization code (Token) from the authentication authority (AUC) using the session key (Ksession). The authorization code not only ensures that the device has permission to access the resource but also prevents unauthorized access or abuse of resources.

[0024] A further improvement of the present invention is that step 1, generating the key pair, specifically includes the following steps:

[0025] Step 1.1: Obtain the unique identifier (EID) of device a. a ;

[0026] Step 1.2: Record the unique identifier (EID) of device a. a The data is input into the hash function H1 to calculate the unique identifier EID. a Hash value H1(EID) a ):

[0027] H1(EID a ) = SHA-256(EID) a )

[0028] Step 1.3: Obtain the hash value H1 (EID) from Step 2. a The public and private keys of the computing device are used to form a key pair, which specifically includes the following steps:

[0029] Step 1.3.1: Generate public key Pk a : Hash value H1(EID) a The coefficient is used to perform a scalar multiplication with the generator G of the fixed elliptic curve to obtain the device's public key point Pk. a :

[0030] Pk a =H1(EID) a )×G

[0031] G is the generator of the elliptic curve; it is a fixed, known point that ensures the uniqueness and unpredictability of public key generation. In this way, each device's public key Pk... a It is uniquely identified by its identifier (EID) and has secure encryption properties.

[0032] Step 1.3.2, Device private key Sk a Using the global master key s and the unique identifier EID a The private key Sk was calculated together. a The generation process is as follows:

[0033] Sk a =s×H1(EID) a )

[0034] The key pair is as follows:

[0035] Pk a =H1(EID) a )×G

[0036] Sk a =s×H1(EID) a ).

[0037] A further improvement of the present invention is that the device identifier (EID) in step 1 consists of multiple fields, including manufacturer, device type, hardware ID (HDID), and user group ID, which determines the uniqueness of the device identity.

[0038] A further improvement of the present invention is that the request message includes a device identifier (EID), i.e., the device manufacturer, device type, hardware ID (HDID), user group ID, client type (i.e., geographical location information), load status and battery level information, and a digital signature Si. a The device uses the private key Sk a The message M and timestamp in the authentication request are hashed, and then a digital signature Si is generated. a To ensure the integrity of requested data and prevent replay attacks, digital signatures (Si) a The process is as follows:

[0039] Si a =Sk a [Hash(M∣Timestamp)].

[0040] A further improvement of the present invention is that, in step 5, the authorization code is calculated using the device identifier and application type information, and the formula for generating the authorization code is:

[0041] Token=[Hash(applicationType1)∣Hash(applicationType2)∣...]

[0042] If the verification is successful, the device can confirm the validity of the authorization code and store the authorization code (Token) locally for subsequent access control.

[0043] A further improvement of the present invention is that: in step 6, the signature S generated by the authentication server r Used for two-way authentication to ensure the authenticity and reliability of both parties' identities; the signature S generated by the authentication server. r The signature formula is returned to the device along with the authorization code:

[0044] S r =Sk r [Hash(Token∣Timestamp)].

[0045] A further improvement of the present invention is that, in step 8, the session key (Ksession) is the device's public key Pk. a With private key Sk a The session key (Ksession) is jointly generated and used for subsequent secure communication between the two parties to ensure the confidentiality and integrity of the data. The specific calculation method is as follows:

[0046] Ksession = f(Pk) a Sk a )

[0047] Here, f is a key generation function that combines the device's public and private keys to generate a session key. Through the session key, communication between the device and the authentication center is encrypted, ensuring the security of data transmission.

[0048] The beneficial effects of this invention are:

[0049] This invention combines Device Identifier (EID) with an asymmetric encryption algorithm and utilizes a distributed network architecture for authentication. This avoids the performance bottlenecks and single-point-of-failure risks associated with traditional centralized authentication schemes that rely on a centralized authentication center. In particular, when the number of devices connected or the network scales up, the authentication process may experience delays and system crashes.

[0050] Each device in this invention generates a public-private key pair based on its unique identifier, and the authentication process can be distributed across multiple authentication nodes, thereby improving the scalability and fault tolerance of the authentication system.

[0051] This invention employs a distributed authentication method, which can select appropriate authentication nodes as needed in different network areas or device distribution environments, ensuring that the device authentication process is efficient and fast. This distributed network architecture not only improves authentication processing capabilities but also enhances system security and flexibility, making it particularly suitable for applications with large-scale device access and complex distributed environments. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of the device identifier EID format of the present invention.

[0053] Figure 2 This is a schematic diagram of the finite state machine of the device of the present invention.

[0054] Figure 3 This is a flowchart of the authentication mechanism implementation method of the present invention.

[0055] Figure 4 This is a schematic diagram of the process by which the device of the present invention obtains a key pair.

[0056] Figure 5 This is a schematic diagram illustrating the process of selecting a server node using the device of this invention.

[0057] Figure 6 This is a schematic diagram of the signature verification process of the certification center of this invention.

[0058] Figure 7 This is a diagram comparing the request processing time of the three authentication mechanisms as the number of connected devices increases. Detailed Implementation

[0059] The embodiments of the present invention will be disclosed below with reference to the drawings. For clarity, many practical details will be described in the following description. However, it should be understood that these practical details are not intended to limit the invention. That is, in some embodiments of the invention, these practical details are not essential.

[0060] Example: Large-scale IoT device certification

[0061] In the Internet of Things (IoT) environment, the number of devices is enormous and their types are diverse. These devices may be widely distributed globally, often requiring frequent and concurrent device access. Traditional centralized authentication schemes may be unable to meet the authentication needs of large-scale devices due to excessive load and performance bottlenecks, especially in scenarios such as smart homes, industrial control, and environmental monitoring, where device access is frequent and authentication latency is critical. The distributed authentication mechanism based on device identifiers (EIDs) to generate public-private key pairs, as described in this invention, can effectively reduce authentication latency, improve authentication efficiency, and ensure the security of each device's identity.

[0062] In this embodiment, multiple devices in the Internet of Things (such as sensors, smart home devices, industrial equipment, etc.) connect to the Internet of Things platform through a gateway. The authentication process for device A is detailed below:

[0063] like Figure 3 As shown, this invention is an identification-based authentication mechanism implementation method. This method is implemented through an authentication system, which includes an authentication client, an authentication server, and an authentication center (AUC). The authentication client and the authentication server interact with each other. The AUC performs identity verification and authorization distribution, and dynamic verification of authentication and authorization requests and responses. When a device requests authentication, it first sends an authentication request message through the authentication client. The message contains key information such as the device's identifier (EID) and the client type. After receiving the authentication request, the authentication server determines whether the device has registered. If the device has registered, the authentication server directly returns the device's authentication and authorization information; if the device has not registered, the authentication server forwards the authentication request to the AUC for further verification and authorization.

[0064] In this invention, the Device Identifier (EID) is a unique identifier for the device, formatted as follows: Figure 2 As shown, the Device Identifier (EID) consists of multiple fields, each carrying different information about the device, such as manufacturer, device type, Hardware ID (HDID), and user group ID. This information is combined to form the device's complete identifier, providing necessary identity protection for subsequent authentication processes. The EID format comprises several parts, including manufacturer identifier, device type, Hardware ID (HDID), user organization, and reserved fields, ensuring the device's uniqueness within the network. Each device's EID is 128 bits long, strictly guaranteeing its uniqueness and thus achieving secure and reliable authentication.

[0065] Step 1: Obtain the Device Identifier (EID). Based on the obtained Device Identifier (EID), a key pair is generated through the authentication center. To ensure the authenticity of the device identity, this system uses a hash function and an elliptic curve cryptography (ECC) algorithm to generate the device's public and private keys. Specifically, the hash function H1 is used to map the Device Identifier (EID) to a point on an elliptic curve, generating the device's public key Pk. a And the device's private key Sk a It is calculated using the global master key s and the device identifier (EID).

[0066] like Figure 4 As shown, when device A connects for the first time, it initiates a key acquisition request to the authentication center through the authentication client. The device sends its unique identifier (EID) to the authentication center, and the authentication center generates the device's public and private keys based on the device's EID. The generation process of the public and private keys is as follows:

[0067] Specifically, the steps include the following:

[0068] Step 1.1: Obtain the unique identifier (EID) of device a. a ;

[0069] Step 1.2: Record the unique identifier (EID) of device a. a The data is input into the hash function H1 to calculate the unique identifier EID. a Hash value H1(EID) a ):

[0070] H1(EID a ) = SHA-256(EID) a )

[0071] The hash function uses the SHA-256 algorithm, which is a widely used hash function in the current encryption field, possessing strong collision resistance and a wide range of applications. Using this function, the device identifier (EID) can be effectively... a It is converted into a fixed-length hash value to ensure the uniqueness and unpredictability of the device identifier.

[0072] Step 1.3: Obtain the hash value H1 (EID) from Step 2. a The public and private keys of the computing device are used to form a key pair. First, the public key Pk is generated. a : Hash value H1(EID) a The coefficient is used to perform a scalar multiplication with the generator G of the fixed elliptic curve to obtain the device's public key point Pk. a :

[0073] Pk a =H1(EID) a)×G

[0074] G is the generator of the elliptic curve; it is a fixed, known point that ensures the uniqueness and unpredictability of public key generation. In this way, each device's public key Pk... a It is uniquely identified by its identifier (EID) and has secure encryption properties.

[0075] Then, the device's private key Sk a Using the global master key s and the unique identifier EID a The private key Sk was calculated together. a The generation process is as follows:

[0076] Sk a =s×H1(EID) a )

[0077] The global master key *s* is a secret value generated and securely stored by the Certification Authority (AUC), and it forms the basis for generating the device's private key. Through the calculations described above, the private key *Sk* is... a This is generated and transmitted to the device via a secure channel. The private key and the device's public key Pk are then used. a Correspondingly, it is used by the device to sign authentication requests, ensuring the authenticity of the device's identity.

[0078] The final key pair is as follows:

[0079] Pk a =H1(EID) a )×G

[0080] Sk a =s×H1(EID) a ).

[0081] This public-private key pair generation process simplifies the complex certificate management and key distribution processes in traditional public key infrastructures by combining the device identifier (EID) and the global master key. Each device can generate a public-private key pair using its unique identifier (EID), while the use of the global master key further enhances system security and avoids the problems of public key storage and management.

[0082] Step 2, as follows Figure 5As shown, when device A first connects, it broadcasts its geographical location information and other relevant information, such as load and battery level, to multiple servers. The device's multidimensional identification client sends a broadcast message containing information such as the device's geographical location, network load, and current device status, requesting assistance from the authentication server to determine the optimal authentication node. Upon receiving the request, each authentication server evaluates its compatibility with the device based on its own geographical location, frequency band, version number, load, and other factors, calculating the optimal conditions for responding to the device's request. Based on these evaluation results, the authentication server returns data to the device including the server's geographical location, supported frequency bands, current version number, and other relevant parameters. This data helps the device determine which authentication server is best suited to handle its authentication request and selects the authentication node with the fastest response speed and lightest load. The device then forwards the authentication request to the selected authentication server to begin the authentication process. During this process, the device ensures that the authentication request is processed via the optimal path through information exchange with the authentication server via broadcast, thereby improving system efficiency and response speed.

[0083] Specifically, the device sends authentication request messages to multiple authentication servers. These request messages include the Device Identifier (EID), which indicates the device's manufacturer, device type, Hardware ID (HDID), user group ID, client type (geographical location information), load status and battery level, and the digital signature Si. a The device uses the private key Sk a The message M and timestamp in the authentication request are hashed, and then a digital signature Si is generated. a To ensure the integrity of requested data and prevent replay attacks, digital signatures (Si) a The process is as follows:

[0084] Si a =Sk a [Hash(M∣Timestamp)].

[0085] After receiving the authentication request message from the device, the authentication server extracts the device identifier (EID) and then queries the local authentication list based on the extracted device identifier (EID).

[0086] Step 3: If the authentication server does not find the device identifier (EID) in its local authentication list, it forwards the authentication request to the Authentication Center (AUC). This step ensures final verification of the device's identity and the generation of the authorization code. The authentication server sends a request containing the device identifier (EID) and digital signature to the AUC. The AUC needs to further verify the device's identity and generate the authorization code. During this process, the authentication server checks its local authentication list to see if device A's unique identifier (EID) has been registered and confirms its authentication status. If device A is not found in the authentication list, the authentication server considers device A to have not completed authentication or its authentication information to be invalid. Therefore, authentication through the AUC is required.

[0087] Step 4: After receiving the authentication request, the certification authority uses the device's Equipment Identifier (EID) to calculate the device's public key Pk. a Using public key Pk a Verify the digital signature in the authentication request; if the digital signature Si a Verification passed; the certification center confirmed the device's valid identity and digital signature. a The verification formula is:

[0088] Verify(M|Timestamp, Si) a ,Pka)=True

[0089] Here, M represents information such as device identifier, device type, and hardware ID in the authentication request, and Timestamp is a timestamp used to prevent replay attacks. If the digital signature verification is successful, the authentication center confirms the authenticity of device A's identity and then generates an authorization code Token.

[0090] Step 5: The certification center generates an authorization code. The authorization code is a unique identifier for the device, ensuring that the device has the corresponding access permissions. The authorization code is calculated using the device's identifier and application type information. The formula for generating the authorization code is:

[0091] Token=[Hash(applicationType1)∣Hash(applicationType2)∣...]

[0092] If the verification is successful, the device can confirm the validity of the authorization code and store the authorization code (Token) locally for subsequent access control.

[0093] The authorization code is generated by combining device A's EID, timestamp, and access permission level. The authorization code ensures that device A can obtain appropriate permissions during subsequent authentication processes and guarantees the timeliness and validity of those permissions. Finally, the authentication center returns the generated authorization code token and related information to the authentication server, which then forwards the authorization code to device A, thus completing the entire authentication process.

[0094] Step 6: After the authentication center completes identity verification and generates the authorization code, the authentication server directly returns the device's authentication information and authorization code. The authentication server processes the returned authorization code and authentication information, and digitally signs the authentication information using its private key. The signature Sr generated by the authentication server is used for two-way authentication to ensure the authenticity and reliability of both parties' identities. r The signature formula is returned to the device along with the authorization code:

[0095] S r =Sk r [Hash(Token∣Timestamp)].

[0096] Among them, Sk r This is the authentication server's private key, the token is the authorization code generated by the authentication center, and the timestamp is a timestamp to ensure the validity of the authorization code. After receiving the signature from the authentication server, device A uses the authentication server's public key to verify the signature, ensuring its validity and thus confirming the authentication server's identity and the integrity of the information.

[0097] Step 7: The device receives the authorization code and the signature S generated by the authentication server. r Then, use the public key of the authentication server to verify the signature S generated by the authentication server. r Verification is performed to ensure the authenticity of the response;

[0098] Step 8: After completing the above authentication process, communication between the device and the authentication center is encrypted using a session key (Ksession); the session key (Ksession) is derived from the device's public key Pk. a With private key Sk a The session key (Ksession) is jointly generated and used for subsequent secure communication between the two parties to ensure the confidentiality and integrity of the data. The specific calculation method is as follows:

[0099] Ksession = f(Pk) a Sk a )

[0100] Here, f is a key generation function that combines the device's public and private keys to generate a session key. Through the session key, communication between the device and the authentication center is encrypted, ensuring the security of data transmission.

[0101] Step 9: The device initiates a resource access request to the authentication system using an authorization code (Token). Each time it accesses the resource, the device carries the authorization code. The authentication system verifies the authorization code to determine if the device has the necessary permissions. If it does not have permissions, it requests an authorization code (Token) from the authentication authority (AUC) using the session key (Ksession). The authorization code not only ensures that the device has permission to access the resource but also prevents unauthorized access or abuse of resources.

[0102] Figure 7 This paper compares the request processing time of three authentication mechanisms as the number of connected devices increases: the EID-based authentication mechanism of this application, traditional centralized authentication, and PKI authentication. The horizontal axis represents the number of connected devices, and the vertical axis represents the processing time of authentication requests; both are measured logarithmically. Figure 7 As can be seen, the EID-based authentication mechanism, i.e., this invention, demonstrates significant advantages with the increase in the number of connected devices, especially with large-scale device access, where the increase in authentication time is relatively gradual, maintaining low latency. This is because the EID-based authentication mechanism distributes the authentication load through a distributed architecture, avoiding the performance bottleneck of centralized authentication. In contrast, traditional centralized authentication exhibits an exponential increase in authentication time with the number of devices, showing a clear performance bottleneck, mainly because all authentication requests must be processed through a single authentication center, leading to excessive server load. Although PKI authentication performs well initially, the processing time for authentication requests increases sharply with the increase in the number of connected devices, because key management and certificate distribution incur additional overhead with large-scale device access. Overall, this invention performs better in large-scale distributed networks, efficiently supporting the access of a large number of devices, reducing authentication latency, and providing better scalability.

[0103] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for implementing an identifier-based authentication mechanism, characterized in that: The specific authentication mechanism is implemented through the following steps: Step 1: When the device is first connected, the device initiates a key acquisition request to the authentication center through the authentication client to obtain the device identifier (EID). The device sends the device identifier (EID) to the authentication center, and the authentication center generates the device's public key and private key based on the device's EID. Step 2: When the device first connects, it sends authentication request messages to multiple authentication servers. After receiving the authentication request messages from the device, the authentication server determines which authentication server is most suitable to handle its authentication request. The device then forwards the authentication request to the selected authentication server. Step 3: If the authentication server does not find the device identifier (EID) in the local authentication list, the authentication server forwards the authentication request to the authentication center (AUC). Step 4: After receiving the authentication request, the certification authority uses the device's Equipment Identifier (EID) to calculate the device's public key. Using public keys Verify the digital signature in the authentication request; if the digital signature... Verification passed; the certification center confirmed the device's valid identity and digital signature. The verification formula is: in, For the message, For timestamps; Step 5: The certification center generates an authorization code. It is a unique identifier for the device, ensuring that the device has access permissions; Step 6: After the authentication center completes the digital signature authentication and generates the authorization code, it directly returns the device's authentication information and authorization code to the authentication server. The authentication server processes the returned authorization code and authentication information, that is, it uses the authentication server's private key to digitally sign the authentication information. Step 7: The device receives the authorization code and the signature generated by the authentication server. Then, use the public key of the authentication server to verify the signature generated by the authentication server. Verification is performed to ensure the authenticity of the response; Step 8: After completing the above authentication process, communication between the device and the authentication center will use a session key ( Encryption is performed; Step 9, Device usage authorization code ( The device sends a resource access request to the authentication system. Each time it accesses the device, it carries an authorization code. The authentication system verifies the authorization code to determine whether the device has the necessary permissions. If the device does not have the necessary permissions, it needs to use a session key (…). Request an authorization code from the Certification Authority (AUC). The request message includes a device identifier (EID), which is the manufacturer of the device, the device type, the hardware ID (HDID), the user group ID, the client type (geographical location information), the load status and battery level information, and a digital signature. The device uses a private key. Messages in the authentication request and timestamp Perform a hash operation and then generate a digital signature. Digital signatures ensure the integrity of requested data and prevent replay attacks. The process is as follows: 。 2. The method for implementing an identifier-based authentication mechanism according to claim 1, characterized in that: Step 1, generating the key pair, specifically includes the following steps: Step 1.1: Obtain the equipment Its own unique identifier ; Step 1.2: Place the equipment Unique identifier Input to hash function In the process of calculating a unique identifier hash value : ； Step 1.3: The hash value obtained in Step 2 The public and private keys of a computing device form a key pair.

3. The method for implementing an identifier-based authentication mechanism according to claim 2, characterized in that: Step 1.3, the calculation of the public key and the private key, specifically includes the following steps: Step 1.3.1: Generate public key : Hash value As coefficients, they are related to the generators of the fixed elliptic curve. Perform scalar multiplication to obtain the device's public key point. : Step 1.3.2, Device Private Key via global master key and unique identifier The private key was calculated together. The generation process is as follows: The key pair is as follows: 。 4. The method for implementing an identifier-based authentication mechanism according to claim 1, characterized in that: The Device Identifier (EID) in Step 1 consists of multiple fields, including Manufacturer, Device Type, Hardware ID (HDID), and User Group ID, which uniquely identifies the device.

5. The method for implementing an identifier-based authentication mechanism according to claim 1, characterized in that: In step 5, the authorization code is calculated using the device identifier and application type information. If the verification passes, the device confirms the validity of the authorization code and sends the authorization code ( It is stored locally for subsequent access control.

6. The method for implementing an identifier-based authentication mechanism according to claim 1, characterized in that: In step 6, the signature generated by the authentication server Used for two-way authentication to ensure the authenticity and reliability of both parties' identities; the signature generated by the authentication server. The signature formula is returned to the device along with the authorization code: 。 7. The method for implementing an identifier-based authentication mechanism according to claim 1, characterized in that: In step 8, the session key ( ) by the device's public key With private key A session key is jointly generated and used for subsequent secure communication between the two parties to ensure the confidentiality and integrity of the data. The specific calculation method is as follows: in, It is a key generation function that combines the device's public and private keys to generate a session key. Through the session key, communication between the device and the certification authority is encrypted, ensuring the security of data transmission.

Images