Device-based identity authentication method and system

Abstract

The present invention is applicable to the technical field of device identification methods, and provides a device-based identity authentication method and system, which obtains unique identification information of a target device; performs hash calculation on the unique identification information of the device to generate an identity feature value, sends an identity authentication request to a server, obtains registered device data, and matches the registered device data with the identity authentication request; obtains the device public key stored in the server according to the matching result, calculates the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determines whether the identity of the target device is legal according to the comparison result; compares the access request mode with the basic mode, determines the abnormal situation according to the comparison result, determines the abnormal situation according to the abnormal situation, and determines the abnormal score according to the abnormal situation. If the abnormal score is higher than a threshold, a temporary identity authentication factor is sent to the target device, which solves the problem that the current device identity authentication mechanism is mostly a one-time static comparison and lacks dynamic analysis capabilities at the behavioral level.

Description

Technical Field

[0001] The present invention belongs to the technical field of device identification methods, and in particular relates to a device-based identity authentication method and system. Background Art

[0002] With the widespread deployment of IoT devices, large-scale edge devices, and industrial intelligent terminals, device access authentication has become a core component in ensuring system security, network trust, and data reliability. In practical applications, a device's unique identification information is widely used for device registration and identification. However, with the increasing complexity of device usage environments and the advancement of attack techniques, relying solely on static unique identifiers for identity authentication has gradually exposed problems such as insufficient security, poor tamper resistance, and limited recognition accuracy.

[0003] In the prior art, device identity authentication mainly relies on identity feature values ​​generated locally on the device. After calculating the device identification information through an encrypted hash algorithm, an identity authentication request is generated, which is then compared and verified by the identity authentication server.

[0004] However, existing methods have the problem that the current device identity authentication mechanism is mostly a one-time static comparison, lacking dynamic analysis capabilities at the behavioral level. After authentication fails, a "direct rejection" strategy is generally adopted, and no in-depth analysis of the device's access behavior pattern is conducted. Summary of the Invention

[0005] The purpose of the embodiment of the present invention is to provide a device-based identity authentication method, aiming to solve the problem raised in the third part of the background technology.

[0006] The embodiment of the present invention is implemented as follows: a device-based identity authentication method, the method comprising:

[0007] Obtain the unique identification information of the target device, which includes the device's hardware serial number, MAC address, and firmware version information;

[0008] Perform hash calculation on the device's unique identification information to generate an identity feature value, send an identity authentication request to the server, obtain the registered device data, and match the registered device data with the identity authentication request;

[0009] Obtain the device public key stored in the server based on the matching result, calculate the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determine whether the target device identity is legitimate based on the comparison result;

[0010] Compare the access request pattern with the basic pattern, determine the abnormal situation based on the comparison result, determine the abnormal situation based on the abnormal situation, and if the abnormal score is higher than the threshold, send the temporary identity authentication factor to the target device.

[0011] Preferably, the steps of performing hash calculation on the unique identification information of the device to generate an identity feature value, sending an identity authentication request to the server, obtaining registered device data, and matching the registered device data with the identity authentication request specifically include:

[0012] Generate an identity authentication request based on the unique identification information, using the SHA-256 cryptographic hash algorithm to perform a hash calculation on the device's unique identification information;

[0013] Generate an identity feature value, the identity authentication request including unique identification information and a current timestamp, and send the identity authentication request to a server, the server being configured to parse the identity authentication request and extract the unique identification information of the target device;

[0014] Obtain registered device data, which is used to provide a credible basis for device identity authentication and serves as a benchmark reference for subsequent behavior monitoring, anomaly identification, and security audits, matching registered device data with identity authentication requests.

[0015] Preferably, the steps of obtaining the device public key stored in the server according to the matching result, calculating the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, and determining whether the target device identity is legitimate according to the comparison result specifically include:

[0016] Obtaining a matching result, wherein the matching result includes retrieving matching registered device data, and obtaining a device public key stored in the server according to the matching result;

[0017] Calculate the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request to obtain a first hash value and a second hash value respectively, and compare the first hash value and the second hash value;

[0018] Obtain the comparison result and determine whether the target device identity is legal based on the comparison result. If it is determined to be legal, send an identity authentication success message to the target device.

[0019] Preferably, the step of comparing the access request pattern with the basic pattern, determining an abnormality based on the comparison result, determining an abnormality score based on the abnormality, and sending a temporary identity authentication factor to the target device if the abnormality score is higher than a threshold, specifically includes:

[0020] If it is determined to be illegal, the access request pattern of the target device is obtained, which includes the historical access IP, device operating environment, access time interval and access request type;

[0021] Comparing the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtaining a comparison result, determining an abnormality based on the comparison result, and determining an abnormality score based on the abnormality;

[0022] Compare the anomaly score with the threshold. If the anomaly score is higher than the threshold, send the temporary identity authentication factor to the target device and receive confirmation information from the target device.

[0023] Preferably, the temporary identity authentication factor includes a security verification code.

[0024] Another object of an embodiment of the present invention is to provide a device-based identity authentication system, the system comprising:

[0025] A unique identification information module is used to obtain the unique identification information of the target device, including the hardware serial number, MAC address, and firmware version information of the device;

[0026] The identity authentication module performs hash calculation on the device's unique identification information to generate an identity feature value, sends an identity authentication request to the server, obtains the registered device data, and matches the registered device data with the identity authentication request;

[0027] The target device identity confirmation module obtains the device public key stored in the server based on the matching result, calculates the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, and determines whether the target device identity is legal based on the comparison result;

[0028] The temporary identity authentication factor module compares the access request pattern with the basic pattern, determines an abnormality based on the comparison result, determines an abnormality score based on the abnormality, and sends the temporary identity authentication factor to the target device if the abnormality score is higher than a threshold.

[0029] Preferably, the identity authentication module includes:

[0030] A hash calculation unit generates an identity authentication request based on the unique identification information, wherein the identity authentication generation method uses the SHA-256 encrypted hash algorithm to perform a hash calculation on the unique identification information of the device;

[0031] An identity feature value unit generates an identity feature value, wherein the identity authentication request includes unique identification information and a current timestamp, and sends the identity authentication request to a server, wherein the server is configured to parse the identity authentication request and extract the unique identification information of the target device;

[0032] The identity authentication unit obtains registered device data, which is used to provide a reliable basis for device identity authentication and serves as a benchmark reference for subsequent behavior monitoring, anomaly identification and security auditing, matching registered device data with identity authentication requests.

[0033] Preferably, the target device identity confirmation module includes:

[0034] a matching unit, which obtains a matching result, wherein the matching result includes retrieving matching registered device data, and obtains a device public key stored in the server according to the matching result;

[0035] a hash value comparison unit, calculating a characteristic hash value of the registered device data and a characteristic hash value in the identity authentication request, obtaining a first hash value and a second hash value respectively, and comparing the first hash value and the second hash value;

[0036] The target device identity confirmation unit obtains the comparison result and determines whether the target device identity is legal based on the comparison result. If it is determined to be legal, an identity authentication success message is sent to the target device.

[0037] Preferably, the temporary identity authentication factor module includes:

[0038] The access request unit obtains the access request pattern of the target device if it is determined to be illegal, wherein the access request pattern includes the historical access IP address, the device operating environment, the access time interval, and the access request type;

[0039] an anomaly scoring unit, comparing the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtaining a comparison result, determining an anomaly based on the comparison result, and determining an anomaly score based on the anomaly;

[0040] The temporary identity authentication factor unit compares the anomaly score with the threshold. If the anomaly score is higher than the threshold, the temporary identity authentication factor is sent to the target device and confirmation information is received from the target device.

[0041] Preferably, the temporary identity authentication factor includes a security verification code.

[0042] An embodiment of the present invention provides a device-based identity authentication method, which obtains unique identification information of a target device, the unique identification information including the device's hardware serial number, MAC address, and firmware version information; generates an identity authentication request based on the unique identification information; performs a hash calculation on the device's unique identification information to generate an identity feature value; sends the identity authentication request to a server; obtains registered device data; matches the registered device data with the identity authentication request to obtain a matching result; obtains a device public key stored in the server based on the matching result; calculates a feature hash value of the registered device data and a feature hash value in the identity authentication request to obtain a first hash value and a second hash value, respectively; compares the first hash value and the second hash value to obtain a comparison result; determines whether the target device's identity is legitimate based on the comparison result; if it is determined to be illegitimate, obtains an access request mode of the target device; compares the access request mode with a basic mode; determines an abnormality based on the comparison result; determines an abnormality score based on the abnormality; compares the abnormality score with a threshold; and if the abnormality score is higher than the threshold, sends a temporary identity authentication factor to the target device; and receives confirmation information from the target device. This method solves the problem that existing device authentication processes cannot perform multiple comparisons on the device's identity and cannot provide timely warnings when abnormalities occur. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flow chart of a device-based identity authentication method provided by an embodiment of the present invention;

[0044] Figure 2 A flowchart of the steps of performing a hash calculation on the unique identification information of a device, sending an identity authentication request to a server, and matching the registered device data with the identity authentication request, provided by an embodiment of the present invention;

[0045] Figure 3 A flowchart of the steps of calculating the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, and determining whether the target device identity is legitimate based on the comparison result, provided by an embodiment of the present invention;

[0046] Figure 4 A flowchart of the steps of comparing an access request pattern with a basic pattern and determining an anomaly score based on an anomaly provided by an embodiment of the present invention;

[0047] Figure 5 An architecture diagram of a device-based identity authentication system provided by an embodiment of the present invention;

[0048] Figure 6 An architectural diagram of an identity authentication module provided in an embodiment of the present invention;

[0049] Figure 7 This is an architectural diagram of a target device identity confirmation module provided by an embodiment of the present invention;

[0050] Figure 8 This is an architectural diagram of the temporary identity authentication factor module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0052] It is understood that the terms "first," "second," etc., used herein may be used to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script without departing from the scope of this application.

[0053] like Figure 1 As shown, an embodiment of the present invention provides a device-based identity authentication method, the method comprising:

[0054] S100, obtaining unique identification information of a target device, wherein the unique identification information includes the hardware serial number, MAC address, and firmware version information of the device.

[0055] In this step, the unique identification information of the target device is obtained. Obtaining the unique identification information of the target device is a basic step in achieving device identity authentication. The unique identification information includes but is not limited to the device's hardware serial number, MAC address, and firmware version information. Different types of unique identification information reflect the different attributes of the device at the physical layer, network layer, and system layer, helping to accurately identify the device from multiple dimensions.

[0056] The hardware serial number is a unique identifier burned into the device hardware by the device manufacturer during the production process. It is generally stored in the read-only area of ​​the device motherboard or memory chip and cannot be modified at will. It is highly unique and cannot be forged.

[0057] The MAC address is a unique address burned into the network card when it leaves the factory. It is used to identify the device during network communication and is globally unique.

[0058] Firmware version information refers to the version number of the system firmware currently running on the device, and is usually used to identify the integrity and consistency of the device's operating environment.

[0059] S200, performing hash calculation on the device unique identification information to generate an identity feature value, sending an identity authentication request to the server, obtaining registered device data, and matching the registered device data with the identity authentication request.

[0060] In this step, the device's unique identification information is hashed. To achieve secure device identity authentication, the target device's unique identification information is hashed to generate an identity feature value. An identity authentication request is constructed and sent to the identity authentication server. The server obtains the registered device data and compares it to confirm the legitimacy of the device's identity. This process involves multiple technical details.

[0061] To avoid plaintext transmission and improve data consistency and security, an encrypted hash algorithm is used to generate an identity feature value. After the identity feature value is generated, the device constructs an authentication request packet and sends it to the authentication server through a secure channel.

[0062] After receiving the authentication request, the identity authentication server searches its registered device database to see if there is corresponding registered device data. The key field of the registered device data is the pre-stored device identity hash value.

[0063] S300, obtaining the device public key stored in the server according to the matching result, calculating the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determining whether the target device identity is legal according to the comparison result.

[0064] In this step, the device public key stored in the server is obtained based on the matching result. After receiving the identity authentication request sent by the target device and successfully matching the registered device data, the identity authentication server needs to further obtain the device public key stored in the server and verify the identity feature value in the authentication request to determine whether the target device identity is correct;

[0065] This is accomplished by calculating the characteristic hash value of the registered device data and comparing it with the characteristic hash value carried in the request, ensuring that the authentication result is authentic, tamper-proof, and anti-forgery.

[0066] S400 , comparing the access request pattern with the basic pattern, determining an abnormality based on the comparison result, determining an abnormality score based on the abnormality, and sending a temporary identity authentication factor to the target device if the abnormality score is higher than a threshold.

[0067] In this step, the access request pattern is compared with the basic pattern. The device identity authentication process not only relies on static identification information (such as hash values ​​and signatures), but also introduces an access request behavior pattern comparison mechanism to improve the system's ability to identify device disguises, cloning, and abnormal behavior.

[0068] By comparing the current access request pattern of the target device with the "basic behavior pattern" extracted from its registration phase or historical behavior, an analysis is performed and an anomaly score is calculated based on the degree of deviation. If the score is higher than the set threshold, a security response measure is triggered, which is to send a temporary identity authentication factor to initiate multiple rounds of interactive authentication processes to further confirm the identity of the device.

[0069] like Figure 2 As shown, as a preferred embodiment of the present invention, the steps of performing hash calculation on the device unique identification information, generating an identity feature value, sending an identity authentication request to the server, obtaining registered device data, and matching the registered device data with the identity authentication request specifically include:

[0070] S201, generating an identity authentication request based on the unique identification information, wherein the identity authentication generation method adopts the SHA-256 encryption hash algorithm to perform hash calculation on the unique identification information of the device.

[0071] In this step, an authentication request is generated based on the unique identification information. This authentication request relies on hashing the target device's unique identification information to construct the device's identity feature value. This process is accomplished using the SHA-256 cryptographic hash algorithm. SHA-256 is a secure, irreversible cryptographic hash algorithm that is collision-resistant and tamper-resistant, ensuring the integrity and confidentiality of device identity data during transmission and verification.

[0072] The unique identification information of a device consists of multiple dimensions. To ensure structured processing, each field must be concatenated into a uniformly formatted raw identity data string. The field order and separators must be consistent during concatenation to avoid inconsistent hash results due to format inconsistencies. SHA-256 is used to encrypt the data. SHA-256 performs multiple rounds of bitwise operations and data expansion on the input string, outputting a 256-bit (64-bit hexadecimal) irreversible hash value.

[0073] Based on the calculated device identity feature value, combined with the current timestamp and digital signature, the identity authentication request structure is constructed. Assuming the current timestamp is 2025-03-26T15:30:20Z, the device uses the private key to sign device_hash || timestamp, generating a signature of ab3f...91c8.

[0074] S202, generating an identity feature value, wherein the identity authentication request includes unique identification information and a current timestamp, and sending the identity authentication request to a server, wherein the server is configured to parse the identity authentication request and extract the unique identification information of the target device.

[0075] In this step, an identity feature value is generated. To ensure trusted authentication of the device's identity, the identity feature value is first generated based on the target device's unique identification information. An authentication request is then constructed, including the device's unique identification information and the current timestamp. Upon receiving the authentication request, the server parses it, extracts the device's identification information, and performs a matching verification process to confirm the legitimacy of the device's identity.

[0076] Send an authentication request to the server. This request is initiated by the device to identify itself to the server and request authentication permission. The request includes the identity signature value and the current timestamp. The device sends this request to the authentication server's designated interface address using a pre-defined secure communication protocol (such as HTTPS or TLS).

[0077] S203, obtaining registered device data, which is used to provide a reliable basis for device identity authentication and serve as a benchmark reference for subsequent behavior monitoring, anomaly identification and security auditing, and to match the registered device data with the identity authentication request.

[0078] In this step, the registered device data is obtained. Obtaining the registered device data is an important step in achieving device identity authentication. The registered device data is a collection of trusted data submitted by the target device when it first accesses the platform or system and stored by the identity authentication server. It is used for identity comparison and behavior verification during the subsequent authentication process. The registered device data is not only used to verify the legitimacy of the device identity, but also serves as a reference for subsequent behavior monitoring, anomaly identification, and security audits.

[0079] After receiving the authentication request, the server first extracts the identity feature value from the request as a query condition and searches the registered device database. If the hash value matches, the device is considered successfully registered. If no match exists, the device is considered illegal or unregistered. After the authentication request arrives, the server performs an identity hash comparison and device status verification process.

[0080] like Figure 3 As shown, as a preferred embodiment of the present invention, the steps of obtaining the device public key stored in the server according to the matching result, calculating the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determining whether the target device identity is legitimate according to the comparison result specifically include:

[0081] S301, obtaining a matching result, wherein the matching result includes retrieving matching registered device data, and obtaining a device public key stored in a server according to the matching result.

[0082] In this step, the matching result is obtained. After receiving the authentication request from the target device, the authentication server first parses the device identity feature value contained in the request and searches the registered device database. The core goal of the search process is to determine whether there is registered device data that fully matches the identity feature value.

[0083] If it exists, it is considered a "successful match"; the matching result not only includes the retrieved complete registered device data, but also provides the basic conditions for subsequent operations such as obtaining the device public key and verifying the legitimacy of the identity.

[0084] S302 , calculating a characteristic hash value of the registered device data and a characteristic hash value in the identity authentication request to obtain a first hash value and a second hash value respectively, and comparing the first hash value and the second hash value.

[0085] In this step, the characteristic hash value of the registered device data is calculated and the characteristic hash value in the identity authentication request is used to further verify the authenticity of the target device's identity. After the identity authentication request successfully matches the registered device data, the server needs to recalculate a set of identity characteristic hash values ​​(i.e., the first hash value) based on the registered device data and compare them one by one with the device characteristic hash value (i.e., the second hash value) carried in the identity authentication request. This process ensures that the unique identification information provided by the device when requesting authentication has not been forged or tampered with, providing strong anti-counterfeiting and anti-tampering capabilities.

[0086] The core technical step in ensuring the authenticity, integrity, and consistency of device identities is to hash the unique identification information in the registered device data (generating a first hash value) and compare it with the device characteristic hash value (second hash value) carried in the authentication request. This process constitutes a key line of defense for the identity authentication system in this invention, combining technical rigor with security defense capabilities.

[0087] S303, obtaining a comparison result, and determining whether the target device identity is legal based on the comparison result. If it is determined to be legal, an identity authentication success message is sent to the target device.

[0088] In this step, the server obtains the comparison results. After completing the comparison between the first and second hash values, it can determine whether the target device identity is legitimate based on the comparison results. If the comparison results show that the identity feature value provided by the device is consistent with the identity feature value calculated from the registered device data, and there are no abnormalities in the timestamp verification and signature verification, the target device identity can be determined to be legitimate.

[0089] The server will return the authentication success information to the target device and record the authentication event for audit and behavior tracking. By comparing the first hash value and the second hash value, and combining signature verification and timestamp verification, it can accurately determine whether the target device identity is legal, and send the authentication result to the device in a timely and standardized manner after the authentication is successful.

[0090] like Figure 4 As shown in FIG. , as a preferred embodiment of the present invention, the steps of comparing the access request pattern with the basic pattern, determining an abnormality based on the comparison result, determining an abnormality score based on the abnormality, and sending a temporary identity authentication factor to the target device if the abnormality score is higher than a threshold, specifically include:

[0091] S401: If it is determined to be illegal, the access request pattern of the target device is obtained, where the access request pattern includes historical access IP, device operating environment, access time interval and access request type.

[0092] In this step, if the target device is judged to be illegal, when there are anomalies in the target device identity authentication process, such as hash value mismatch, signature verification failure, invalid timestamp or serious deviation in behavior pattern, which causes the server to determine that the target device identity is illegal, the system will further obtain the access request pattern of the target device;

[0093] In order to analyze whether its access behavior has the risk of forgery, simulation, cloning or attack. The access request pattern includes but is not limited to: historical access IP, device operating environment, access time interval and access request type and other multi-dimensional behavior information;

[0094] After the device identity authentication fails, the access request pattern is obtained, including parameters such as historical access IP, operating environment, time interval and request type. This helps the system determine whether there is a spoofing attack, script simulation or illegal cloning behavior from a behavioral level, and provides technical support for dynamic security response and risk control mechanisms.

[0095] S402 , comparing the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtaining a comparison result, determining an abnormality based on the comparison result, and determining an abnormality score based on the abnormality.

[0096] In this step, the access request pattern is compared with the basic pattern. To further enhance the intelligence and security of device authentication, an access behavior pattern comparison mechanism is introduced. When there are doubts about the device identity (for example, authentication failure or signature anomaly), authentication does not rely solely on static identifiers (such as device ID or hash value).

[0097] The system compares the device's current access request pattern with its baseline behavior pattern. The baseline pattern is the "standard behavior profile" exhibited by the device during normal operation, registration, or long-term stable use. This profile, automatically extracted and learned by the system or manually set by the administrator, is unique and stable to each device, identifying potential impersonations, clones, or abnormal operational behavior. Based on the comparison results, the system identifies anomalies and further calculates anomaly scores, providing a basis for triggering dynamic authentication mechanisms or security responses.

[0098] S403 , comparing the anomaly score with a threshold. If the anomaly score is higher than the threshold, sending a temporary identity authentication factor to the target device, the temporary identity authentication factor including a security verification code, and receiving confirmation information from the target device.

[0099] In this step, the anomaly score is compared with the threshold. If the anomaly score obtained by comparing the access request pattern with the basic behavior pattern exceeds the preset threshold, the system does not immediately reject the target device's access request. Instead, it initiates a dynamic identity confirmation operation by sending a temporary identity authentication factor. This process is a multi-round interactive authentication mechanism. The core is to verify whether the device is a registered device with a higher security level to avoid misidentification of the device as an anomaly source due to environmental or network factors.

[0100] The temporary identity authentication factor includes a security verification code. The target device must return correct confirmation information within a specified time, and the system then determines whether to allow the device to continue communicating based on the confirmation response result.

[0101] like Figure 5 As shown, an embodiment of the present invention provides a device-based identity authentication system, the system comprising:

[0102] The unique identification information module 100 is used to obtain the unique identification information of the target device, where the unique identification information includes the hardware serial number, MAC address and firmware version information of the device.

[0103] In this system, the unique identification information module 100 obtains the unique identification information of the target device. Obtaining the unique identification information of the target device is a basic step in achieving device identity authentication. The unique identification information includes but is not limited to the device's hardware serial number, MAC address, and firmware version information. Different types of unique identification information reflect the different attributes of the device at the physical layer, network layer, and system layer, helping to accurately identify the device from multiple dimensions.

[0104] The hardware serial number is a unique identifier burned into the device hardware by the device manufacturer during the production process. It is generally stored in the read-only area of ​​the device motherboard or memory chip and cannot be modified at will. It is highly unique and cannot be forged.

[0105] The MAC address is a unique address burned into the network card when it leaves the factory. It is used to identify the device during network communication and is globally unique.

[0106] Firmware version information refers to the version number of the system firmware currently running on the device, and is usually used to identify the integrity and consistency of the device's operating environment.

[0107] The identity authentication module 200 is used to perform hash calculation on the device's unique identification information, generate an identity feature value, send an identity authentication request to the server, obtain registered device data, and match the registered device data with the identity authentication request.

[0108] In this system, the identity authentication module 200 performs a hash calculation on the device's unique identification information. To achieve secure device identity authentication, the target device's unique identification information is hashed to generate an identity feature value. An identity authentication request is constructed and sent to the identity authentication server. The server obtains the registered device data and performs a comparison to confirm the legitimacy of the device's identity. This process involves multiple technical details.

[0109] To avoid plaintext transmission and improve data consistency and security, an encrypted hash algorithm is used to generate an identity feature value. After the identity feature value is generated, the device constructs an authentication request packet and sends it to the authentication server through a secure channel.

[0110] After receiving the authentication request, the identity authentication server searches its registered device database to see if there is corresponding registered device data. The key field of the registered device data is the pre-stored device identity hash value.

[0111] The target device identity confirmation module 300 is used to obtain the device public key stored in the server according to the matching result, calculate the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determine whether the target device identity is legal based on the comparison result.

[0112] In this system, the target device identity confirmation module 300 obtains the device public key stored in the server according to the matching result. After receiving the identity authentication request sent by the target device and successfully matching the registered device data, the identity authentication server needs to further obtain the device public key stored in the server and verify the identity feature value in the authentication request to determine whether the target device identity is correct;

[0113] This is accomplished by calculating the characteristic hash value of the registered device data and comparing it with the characteristic hash value carried in the request, ensuring that the authentication result is authentic, tamper-proof, and anti-forgery.

[0114] The temporary identity authentication factor module 400 is used to compare the access request pattern with the basic pattern, determine an abnormality based on the comparison result, determine an abnormality score based on the abnormality, and send the temporary identity authentication factor to the target device if the abnormality score is higher than a threshold.

[0115] In this system, the temporary authentication factor module 400 compares the access request pattern with the basic pattern. The device authentication process not only relies on static identification information (such as hash values ​​and signatures), but also introduces an access request behavior pattern comparison mechanism to enhance the system's ability to identify device disguises, cloning, and abnormal behavior.

[0116] By comparing the current access request pattern of the target device with the "basic behavior pattern" extracted from its registration phase or historical behavior, an analysis is performed and an anomaly score is calculated based on the degree of deviation. If the score is higher than the set threshold, a security response measure is triggered, which is to send a temporary identity authentication factor to initiate multiple rounds of interactive authentication processes to further confirm the identity of the device.

[0117] like Figure 6 As shown, as a preferred embodiment of the present invention, the identity authentication module 200 includes:

[0118] The hash calculation unit 201 is used to generate an identity authentication request according to the unique identification information. The identity authentication generation method adopts the SHA-256 encrypted hash algorithm to perform hash calculation on the unique identification information of the device.

[0119] In this module, the hash calculation unit 201 generates an authentication request based on the unique identification information. This authentication request is generated by performing a hash calculation on the target device's unique identification information to construct the device's identity feature value. This process is accomplished using the SHA-256 cryptographic hash algorithm. SHA-256 is a secure, irreversible cryptographic hash algorithm that is collision-resistant and tamper-resistant, ensuring the integrity and confidentiality of device identity data during transmission and verification.

[0120] The unique identification information of a device consists of multiple dimensions. To ensure structured processing, each field must be concatenated into a uniformly formatted raw identity data string. The field order and separators must be consistent during concatenation to avoid inconsistent hash results due to format inconsistencies. SHA-256 is used to encrypt the data. SHA-256 performs multiple rounds of bitwise operations and data expansion on the input string, outputting a 256-bit (64-bit hexadecimal) irreversible hash value.

[0121] Based on the calculated device identity feature value, combined with the current timestamp and digital signature, the identity authentication request structure is constructed. Assuming the current timestamp is 2025-03-26T15:30:20Z, the device uses the private key to sign device_hash || timestamp, generating a signature of ab3f...91c8.

[0122] The identity feature value unit 202 is used to generate an identity feature value. The identity authentication request includes unique identification information and a current timestamp. The identity authentication request is sent to a server. The server is used to parse the identity authentication request and extract the unique identification information of the target device.

[0123] In this module, the identity feature value unit 202 generates an identity feature value. To ensure trusted authentication of the device's identity, it first generates an identity feature value based on the target device's unique identification information and constructs an identity authentication request, which includes the device's unique identification information and the current timestamp. Upon receiving the identity authentication request, the server parses it, extracts the device identification information, and performs a matching verification process to confirm the legitimacy of the device's identity.

[0124] Send an authentication request to the server. This request is initiated by the device to identify itself to the server and request authentication permission. The request includes the identity signature value and the current timestamp. The device sends this request to the authentication server's designated interface address using a pre-defined secure communication protocol (such as HTTPS or TLS).

[0125] The identity authentication unit 203 is used to obtain registered device data, which is used to provide a reliable basis for device identity authentication and serve as a reference for subsequent behavior monitoring, anomaly identification and security auditing, and to match the registered device data with the identity authentication request.

[0126] In this module, the identity authentication unit 203 obtains registered device data, which is a crucial step in device identity authentication. The registered device data is a collection of trusted data submitted by the target device when it first accesses the platform or system and stored by the identity authentication server. It is used for identity comparison and behavior verification during subsequent authentication processes. The registered device data is not only used to verify the legitimacy of the device's identity, but also serves as a benchmark for subsequent behavior monitoring, anomaly identification, and security audits.

[0127] After receiving the authentication request, the server first extracts the identity feature value from the request as a query condition and searches the registered device database. If the hash value matches, the device is considered successfully registered. If no match exists, the device is considered illegal or unregistered. After the authentication request arrives, the server performs an identity hash comparison and device status verification process.

[0128] like Figure 7 As shown, as a preferred embodiment of the present invention, the target device identity confirmation module 300 includes:

[0129] The matching unit 301 is configured to obtain a matching result, wherein the matching result includes retrieving matching registered device data, and obtaining a device public key stored in the server according to the matching result.

[0130] In this module, the matching unit 301 obtains the matching result. After receiving the authentication request initiated by the target device, the authentication server first parses the device identity feature value carried in the request and searches the registered device database. The core goal of the search process is to determine whether there is registered device data that fully matches the identity feature value.

[0131] If it exists, it is considered a "successful match"; the matching result not only includes the retrieved complete registered device data, but also provides the basic conditions for subsequent operations such as obtaining the device public key and verifying the legitimacy of the identity.

[0132] The hash value comparison unit 302 is used to calculate the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, obtain a first hash value and a second hash value respectively, and compare the first hash value and the second hash value.

[0133] In this module, the hash value comparison unit 302 calculates the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request to further verify the authenticity of the target device's identity. After the identity authentication request successfully matches the registered device data, the server needs to recalculate a set of identity characteristic hash values ​​(i.e., the first hash value) based on the registered device data and compare them one by one with the device characteristic hash value (i.e., the second hash value) carried in the identity authentication request. This process ensures that the unique identification information provided by the device when requesting authentication has not been forged or tampered with, providing strong anti-counterfeiting and anti-tampering capabilities.

[0134] The core technical step in ensuring the authenticity, integrity, and consistency of device identities is to hash the unique identification information in the registered device data (generating a first hash value) and compare it with the device characteristic hash value (second hash value) carried in the authentication request. This process constitutes a key line of defense for the identity authentication system in this invention, combining technical rigor with security defense capabilities.

[0135] The target device identity confirmation unit 303 is used to obtain the comparison result, determine whether the target device identity is legal according to the comparison result, and send an identity authentication success message to the target device if it is determined to be legal.

[0136] In this module, the target device identity confirmation unit 303 obtains the comparison result. After the server completes the comparison of the first hash value and the second hash value, it can determine whether the target device identity is legitimate based on the comparison result. If the comparison result shows that the identity feature value provided by the device is consistent with the identity feature value calculated from the registered device data, and there are no abnormalities in the timestamp verification and signature verification, the target device identity can be determined to be legitimate;

[0137] The server will return the authentication success information to the target device and record the authentication event for audit and behavior tracking. By comparing the first hash value and the second hash value, and combining signature verification and timestamp verification, it can accurately determine whether the target device identity is legal, and send the authentication result to the device in a timely and standardized manner after the authentication is successful.

[0138] like Figure 8 As shown, as a preferred embodiment of the present invention, the temporary identity authentication factor module 400 includes:

[0139] The access request unit 401 is configured to obtain an access request pattern of the target device if the access is determined to be illegal. The access request pattern includes historical access IP addresses, device operating environment, access time interval, and access request type.

[0140] In this module, if the access request unit 401 determines that the target device is illegal, when there is an anomaly in the target device identity authentication process, such as hash value mismatch, signature verification failure, invalid timestamp, or serious deviation in behavior pattern, which causes the server to determine that the target device identity is illegal, the system will further obtain the access request pattern of the target device;

[0141] In order to analyze whether its access behavior has the risk of forgery, simulation, cloning or attack. The access request pattern includes but is not limited to: historical access IP, device operating environment, access time interval and access request type and other multi-dimensional behavior information;

[0142] After the device identity authentication fails, the access request pattern is obtained, including parameters such as historical access IP, operating environment, time interval and request type. This helps the system determine whether there is a spoofing attack, script simulation or illegal cloning behavior from a behavioral level, and provides technical support for dynamic security response and risk control mechanisms.

[0143] The anomaly scoring unit 402 is configured to compare the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtain a comparison result, determine an anomaly based on the comparison result, and determine an anomaly score based on the anomaly.

[0144] In this module, the anomaly scoring unit 402 compares the access request pattern with the basic pattern. To further enhance the intelligence and security of device identity authentication, an access behavior pattern comparison mechanism is introduced. When there are doubts about the device identity (e.g., identity authentication failure or signature anomaly), authentication does not only rely on static identification (e.g., device ID or hash value);

[0145] The system compares the device's current access request pattern with its baseline behavior pattern. The baseline pattern is the "standard behavior profile" exhibited by the device during normal operation, registration, or long-term stable use. This profile, automatically extracted and learned by the system or manually set by the administrator, is unique and stable to each device, identifying potential impersonations, clones, or abnormal operational behavior. Based on the comparison results, the system identifies anomalies and further calculates anomaly scores, providing a basis for triggering dynamic authentication mechanisms or security responses.

[0146] The temporary identity authentication factor unit 403 is used to compare the anomaly score with a threshold. If the anomaly score is higher than the threshold, the temporary identity authentication factor including the security verification code is sent to the target device, and confirmation information is received from the target device.

[0147] In this module, the temporary identity authentication factor unit 403 compares the anomaly score with a threshold. If the anomaly score obtained by comparing the access request pattern with the basic behavior pattern exceeds the preset threshold, the system does not immediately reject the target device's access request. Instead, it further initiates a dynamic identity confirmation operation by sending the temporary identity authentication factor. This process is a multi-round interactive authentication mechanism. The core is to verify whether the device is a registered device with a higher security level, avoiding the misidentification of the device as an anomaly source due to environmental or network factors.

[0148] The temporary identity authentication factor includes a security verification code. The target device must return correct confirmation information within a specified time, and the system then determines whether to allow the device to continue communicating based on the confirmation response result.

[0149] In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the following steps are performed:

[0150] Obtain the unique identification information of the target device, which includes the device's hardware serial number, MAC address, and firmware version information;

[0151] Perform hash calculation on the device's unique identification information to generate an identity feature value, send an identity authentication request to the server, obtain the registered device data, and match the registered device data with the identity authentication request;

[0152] Obtain the device public key stored in the server based on the matching result, calculate the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determine whether the target device identity is legitimate based on the comparison result;

[0153] Compare the access request pattern with the basic pattern, determine the abnormal situation based on the comparison result, determine the abnormal situation based on the abnormal situation, and if the abnormal score is higher than the threshold, send the temporary identity authentication factor to the target device.

[0154] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the processor performs the following steps:

[0155] Obtain the unique identification information of the target device, which includes the device's hardware serial number, MAC address, and firmware version information;

[0156] Perform hash calculation on the device's unique identification information to generate an identity feature value, send an identity authentication request to the server, obtain the registered device data, and match the registered device data with the identity authentication request;

[0157] Obtain the device public key stored in the server based on the matching result, calculate the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determine whether the target device identity is legitimate based on the comparison result;

[0158] Compare the access request pattern with the basic pattern, determine the abnormal situation based on the comparison result, determine the abnormal situation based on the abnormal situation, and if the abnormal score is higher than the threshold, send the temporary identity authentication factor to the target device.

[0159] It should be understood that, although the various steps in the flow chart of each embodiment of the present invention are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0160] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer-readable storage medium. When executed, the program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the various embodiments provided herein may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM).

[0161] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

[0163] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A device-based identity authentication method, characterized in that: The method comprises: Obtain the unique identification information of the target device, which includes the device's hardware serial number, MAC address, and firmware version information; Perform hash calculation on the device's unique identification information to generate an identity feature value, send an identity authentication request to the server, obtain the registered device data, and match the registered device data with the identity authentication request; Obtain the device public key stored in the server based on the matching result, calculate the feature hash value of the registered device data and the feature hash value in the identity authentication request, and determine whether the target device identity is legitimate based on the comparison result; Compare the access request pattern with the basic pattern, determine anomalies based on the comparison results, determine anomaly scores based on the anomalies, and if the anomaly score is higher than a threshold, send a temporary identity authentication factor to the target device; The steps of performing hash calculation on the unique identification information of the device to generate an identity feature value, sending an identity authentication request to the server, obtaining registered device data, and matching the registered device data with the identity authentication request specifically include: Generate an identity authentication request based on the unique identification information, using the SHA-256 cryptographic hash algorithm to perform a hash calculation on the device's unique identification information; Generate an identity feature value, the identity authentication request including unique identification information and a current timestamp, and send the identity authentication request to a server, the server being configured to parse the identity authentication request and extract the unique identification information of the target device; Obtaining registered device data, which is used to provide a reliable basis for device identity authentication and serves as a benchmark for subsequent behavior monitoring, anomaly identification, and security audits, matching registered device data with identity authentication requests; The steps of obtaining the device public key stored in the server based on the matching result, calculating the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, and determining whether the target device identity is legitimate based on the comparison result specifically include: Obtaining a matching result, wherein the matching result includes retrieving matching registered device data, and obtaining a device public key stored in the server according to the matching result; Calculate the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request to obtain a first hash value and a second hash value respectively, and compare the first hash value and the second hash value; Obtain the comparison result, and determine whether the target device identity is legal based on the comparison result. If it is determined to be legal, send an identity authentication success message to the target device; The step of comparing the access request pattern with the basic pattern, determining an abnormality based on the comparison result, determining an abnormality score based on the abnormality, and sending a temporary identity authentication factor to the target device if the abnormality score is higher than a threshold, specifically includes: If it is determined to be illegal, the access request pattern of the target device is obtained, which includes the historical access IP, device operating environment, access time interval and access request type; Comparing the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtaining a comparison result, determining an abnormality based on the comparison result, and determining an abnormality score based on the abnormality; Compare the anomaly score with the threshold. If the anomaly score is higher than the threshold, send the temporary identity authentication factor to the target device and receive confirmation information from the target device.

2. The device-based identity authentication method according to claim 1, characterized in that: The temporary identity authentication factor includes a security verification code.

3. A device-based identity authentication system, characterized in that: The system comprises: A unique identification information module is used to obtain the unique identification information of the target device, including the hardware serial number, MAC address, and firmware version information of the device; The identity authentication module performs hash calculation on the device's unique identification information to generate an identity feature value, sends an identity authentication request to the server, obtains the registered device data, and matches the registered device data with the identity authentication request; The target device identity confirmation module obtains the device public key stored in the server based on the matching result, calculates the characteristic hash value of the registered device data and the characteristic hash value in the identity authentication request, and determines whether the target device identity is legal based on the comparison result; A temporary identity authentication factor module compares the access request pattern with the basic pattern, determines an anomaly based on the comparison result, determines an anomaly score based on the anomaly, and sends the temporary identity authentication factor to the target device if the anomaly score is higher than a threshold; Wherein, the identity authentication module includes: A hash calculation unit generates an identity authentication request based on the unique identification information, wherein the identity authentication generation method uses the SHA-256 encrypted hash algorithm to perform a hash calculation on the unique identification information of the device; An identity feature value unit generates an identity feature value, wherein the identity authentication request includes unique identification information and a current timestamp, and sends the identity authentication request to a server, wherein the server is configured to parse the identity authentication request and extract the unique identification information of the target device; The identity authentication unit obtains registered device data, which is used to provide a reliable basis for device identity authentication and serves as a reference for subsequent behavior monitoring, anomaly identification, and security audits, matching the registered device data with the identity authentication request; The target device identity confirmation module includes: a matching unit, which obtains a matching result, wherein the matching result includes retrieving matching registered device data, and obtains a device public key stored in the server according to the matching result; a hash value comparison unit, calculating a characteristic hash value of the registered device data and a characteristic hash value in the identity authentication request, obtaining a first hash value and a second hash value respectively, and comparing the first hash value and the second hash value; The target device identity confirmation unit obtains the comparison result and determines whether the target device identity is legal based on the comparison result. If it is determined to be legal, it sends an identity authentication success message to the target device; The temporary identity authentication factor module includes: The access request unit obtains the access request pattern of the target device if it is determined to be illegal, wherein the access request pattern includes the historical access IP address, the device operating environment, the access time interval, and the access request type; an anomaly scoring unit, comparing the access request pattern with a basic pattern, where the basic pattern is a legitimate target device under normal circumstances, obtaining a comparison result, determining an anomaly based on the comparison result, and determining an anomaly score based on the anomaly; The temporary identity authentication factor unit compares the anomaly score with the threshold. If the anomaly score is higher than the threshold, the temporary identity authentication factor is sent to the target device and confirmation information is received from the target device.

4. The device-based identity authentication system according to claim 3, characterized in that: The temporary identity authentication factor includes a security verification code.

Images