Equipment voucher generation method and device, equipment and storage medium

Abstract

The invention discloses an equipment voucher generation method and device, equipment and a storage medium, is applied to an equipment manager, and relates to the technical field of network security, and the method comprises the steps: generating an equipment model based on a model attribute corresponding to target equipment of an equipment manager, and inputting equipment information corresponding to the target equipment according to a registration template corresponding to the equipment model; generating a device code based on the device information, if a code acquisition request sent by the device side is received, verifying the code acquisition request, and if the code acquisition request passes the verification, sending the device code to the device side; receiving a voucher application request fed back by the device side, verifying the voucher application request, if the voucher application request passes the verification, sending a voucher making application to a voucher system, and sending a target voucher fed back by the voucher system to the device side; the target credential comprises a digital certificate or an identification key. Therefore, the authentication mechanism can be flexibly selected, and the authenticity of the identity of the equipment and the communication security are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a device credential generation method, apparatus, device, and storage medium. Background Art

[0002] In the era of the Internet of Things (IoT), digital identity has expanded to objects, devices, and systems. With the interconnection of various devices and sensors, it is necessary to ensure that only legitimate users and devices can access and use specific resources and services. This process presents challenges in identity ambiguity, security, and privacy. Therefore, establishing strong authentication and authorization mechanisms has become essential.

[0003] For existing devices with ample resources, access authentication is typically performed using universal digital certificates, but this approach is unsuitable for resource-constrained scenarios. For devices with very limited resources, access authentication is typically performed using device serial numbers or various addresses. This scenario lacks cryptographic technology and presents security risks. Furthermore, existing device digital identity management is fragmented, lacking a unified management and control mechanism. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a device credential generation method, apparatus, device, and storage medium that can flexibly select authentication mechanisms to ensure the authenticity of device identity and communication security. The specific solution is as follows:

[0005] In a first aspect, the present application discloses a method for generating a device credential, which is applied to a device manager, comprising:

[0006] Configuring model attributes corresponding to the target device on the device side, generating a device model based on the model attributes, generating a device registration template according to the device model, and entering device information corresponding to the target device according to the device registration template;

[0007] generating a device code based on the device information, and if a code acquisition request sent by the device party is received, verifying the code acquisition request, and if the code acquisition request passes the verification, sending the device code to the device party;

[0008] Receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, send a credential production application to the credential system and send the target credential fed back by the credential system to the device party; the target credential includes a digital certificate or an identification key.

[0009] Optionally, configuring the model attributes corresponding to the target device of the device party and generating the device model based on the model attributes includes:

[0010] Determine the current target device of the device party, and configure model attributes based on the device type of the target device; the model attributes include static attributes, dynamic attributes, and behavioral attributes;

[0011] A device model corresponding to the target device is generated based on the static attributes, the dynamic attributes, and the behavioral attributes; the device model is an operation framework corresponding to the target device.

[0012] Optionally, generating a device registration template according to the device model, and entering device information corresponding to the target device according to the device registration template, includes:

[0013] generating a device registration template according to the device model, and after receiving device information corresponding to the target device, classifying the device information based on the device registration template to obtain classified device information;

[0014] Enter the classified device information and save the classified device information to a local database.

[0015] Optionally, generating a device code based on the device information, and if a code acquisition request sent by the device party is received, verifying the code acquisition request, and if the code acquisition request passes the verification, sending the device code to the device party, includes:

[0016] Generate a device code based on the device information, and determine whether a code acquisition request is received;

[0017] If a code acquisition request is received from the device, verify the device information to be verified contained in the code acquisition request to determine whether the device information to be verified corresponds to the device information;

[0018] If the device information to be verified corresponds to the device information, the device code is used as the target device code corresponding to the target device, and the target device code is sent to the device party.

[0019] Optionally, the receiving of the credential application request fed back by the device party and verifying the credential application request, and if the credential application request passes the verification, sending a credential production application to a credential system, and sending the target credential fed back by the credential system to the device party, includes:

[0020] receiving a credential application request fed back by the device party; the credential application request is an application request including the latest device code of the device party;

[0021] Parsing the credential application request to determine the device code to be verified contained in the credential application request, and performing matching verification on the device code to be verified and the device code;

[0022] If the device code to be verified is completely consistent with the device code, it indicates that the credential application request has passed the verification, and the credential production application is sent to the credential system;

[0023] If the target credential fed back by the credential system is received, the target credential is bound to the device code and fed back to the device party.

[0024] Optionally, the device credential generation method further includes:

[0025] If a credential authentication request is received from the device, the credential authentication request is analyzed to determine the credentials to be verified and the signature to be verified contained in the credential authentication request;

[0026] Parsing the credential to be verified to determine whether the credential format of the credential to be verified conforms to a preset credential format;

[0027] If the credential format does not conform to the preset credential format, the credential authentication request is returned and a suspicious alarm is issued;

[0028] If the certificate format conforms to the preset certificate format, verifying the signature to be verified by using the local preset public key to determine whether the signature to be verified is legal;

[0029] If the signature to be verified is illegal, a misappropriation warning is generated; if the signature to be verified is legal, a communication connection is established with the target device.

[0030] Optionally, if the signature to be verified is illegal, generating a misappropriation warning reminder includes:

[0031] If the signature to be verified is illegal, a misuse warning email is generated and sent to the target mailbox bound to the device.

[0032] In a second aspect, the present application discloses a device credential generation apparatus, which is applied to a device manager, comprising:

[0033] A device information entry module, configured to configure the model attributes corresponding to the target device of the device side, generate a device model based on the model attributes, generate a device registration template according to the device model, and enter the device information corresponding to the target device according to the device registration template;

[0034] a device code sending module, configured to generate a device code based on the device information, and upon receiving a code acquisition request sent by the device party, verify the code acquisition request, and if the code acquisition request passes the verification, send the device code to the device party;

[0035] The credential generation module is used to receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, the credential production application is sent to the credential system, and the target credential fed back by the credential system is sent to the device party.

[0036] In a third aspect, the present application discloses an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] The processor is configured to execute the computer program to implement the aforementioned device credential generation method.

[0039] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the device credential generation method as described above.

[0040] In this embodiment, the model attributes corresponding to the target device of the device party can be configured, and a device model can be generated based on the model attributes, and a device registration template can be generated according to the device model to enter the device information corresponding to the target device according to the device registration template; a device code can be generated based on the device information, and if a code acquisition request sent by the device party is received, the code acquisition request is verified, and if the code acquisition request passes the verification, the device code is sent to the device party; a credential application request fed back by the device party is received, and the credential application request is verified, and if the credential application request passes the verification, a credential production application is sent to the credential system, and the target credential fed back by the credential system is sent to the device party.

[0041] As can be seen, the method of this application can configure corresponding model attributes according to different types of device parties, then generate a device model based on the model attributes, and enter the corresponding device information according to the device registration template corresponding to the device model. After generating the device code based on the device information, if a code acquisition request is received, the code acquisition request is verified, and it is determined whether the device information in the code acquisition request corresponds to the registered device information. If so, the verification is successful, and the device code is sent to the device party. After receiving the credential application request, the device code is verified for matching. If a match is found, a credential creation application is sent to the credential system, and the target credential feedback from the credential system is sent to the device party. In this way, the authentication mechanism can be flexibly selected according to the device function, resource constraints, and application scenario, ensuring the authenticity of the device identity and communication security, meeting the needs of different devices, and assigning a unique identifier to the device to ensure the independence and traceability of the device, prevent authentication conflicts and impersonation, and support the introduction of new authentication methods and the access of more device types in the future. The device manager can also be used as a centralized management platform that supports cross-device and cross-authentication methods to achieve unified authentication and management of device credentials. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a device credential generation method disclosed in this application;

[0044] Figure 2 A schematic diagram of a device certificate issuance system disclosed in this application;

[0045] Figure 3 A schematic diagram of device credential verification disclosed in this application;

[0046] Figure 4 This is a signaling diagram of a device credential generation method disclosed in this application;

[0047] Figure 5 This is a schematic diagram of the structure of a device credential generation apparatus disclosed in this application;

[0048] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0050] In existing technologies, access authentication for devices with ample resources is typically performed using universal digital certificates, but this approach is unsuitable for resource-constrained scenarios. For devices with very limited resources, access authentication is typically performed using device serial numbers or various addresses. This scenario lacks cryptographic technology and presents security risks. Furthermore, existing device digital identity management is fragmented, lacking a unified management and control mechanism.

[0051] To overcome the aforementioned technical issues, this application discloses a device credential generation method, apparatus, device, and storage medium that flexibly select authentication mechanisms to ensure the authenticity of device identities and communication security. Furthermore, the device manager can serve as a centralized management platform that supports cross-device and cross-authentication methods, enabling unified authentication and management of device credentials.

[0052] See also Figure 1 As shown, an embodiment of the present invention discloses a method for generating device credentials, which is applied to a device manager, including:

[0053] Step S11: configuring the model attributes corresponding to the target device of the device side, generating a device model based on the model attributes, generating a device registration template according to the device model, and entering the device information corresponding to the target device according to the device registration template.

[0054] In this embodiment, Figure 2 As shown, in order to realize the generation of device credentials, it is necessary to complete it through the device credential issuance system, and the device credential issuance system mainly includes three parts, namely, certificate credential issuance, identification key credential issuance and device management for unified management of devices.

[0055] First, the device side, that is, the model attributes corresponding to the user's target device, can be configured according to user needs, and the corresponding device model can be generated based on the configured model attributes. Specifically, it is necessary to determine the current target device of the device side and configure the model attributes based on the device type of the target device. The model attributes include static attributes, dynamic attributes, and behavioral attributes. Among them, static attributes include fixed information such as device type, manufacturer, and hardware version; dynamic attributes include sensor data and real-time operating status indicators such as temperature and voltage; behavioral attributes include information such as data reporting protocol, communication frequency, and fault handling strategy. In addition, it is necessary to generate a device model corresponding to the target device based on the above attribute information, and the device model is the operation framework corresponding to the target device.

[0056] Furthermore, it is necessary to generate a corresponding device registration template based on the device model, and after receiving the device information corresponding to the target device, classify the device information based on the device registration template to obtain the classified device information; enter the classified device information, and save the classified device information to the local database. Specifically, after generating the device registration template, the corresponding management personnel can download the device registration template and enter the device information in batches according to the device registration template, and the device management party can classify and save the entered information after receiving the device information. In this way, the corresponding model can be set according to the characteristics of different devices to ensure that the final generated credentials meet the characteristics of different devices.

[0057] Step S12: Generate a device code based on the device information. If a code acquisition request is received from the device party, verify the code acquisition request. If the code acquisition request passes the verification, send the device code to the device party. The device code is a unique code corresponding to the target device.

[0058] In this embodiment, the device information corresponding to the target device needs to be saved to generate a device code, and it is determined whether a code acquisition request is received; if a code acquisition request is received from the device party, the device information to be verified contained in the code acquisition request is verified to determine whether the device information to be verified corresponds to the device information; if the device information to be verified corresponds to the device information, the device code is used as the target device code corresponding to the target device, and the target device code is sent to the device party. Specifically, it is necessary to generate a corresponding device code based on the device information. It should be noted that the device code is the unique identifier of the device, and after receiving the code acquisition request from the device party, it is necessary to obtain the unique code interface by calling the unified management center, and then confirm whether the target device of the user party is registered in the same management center of the device through the unique code interface. It should be noted that it is necessary to determine the device information to be verified contained in the code acquisition request. If the device information to be verified corresponds to the registered device information, it indicates that the device of the current device party is the original device and has not been replaced. The device code can be fed back to the device party as the target device code corresponding to the target device. If the verification device information does not correspond to the registered device information, it indicates that the device of the current device party may be replaced by an unregistered device, or there is a possibility that the request has been intercepted and modified. Therefore, a prompt message needs to be generated and sent to the device party. If the device party receives the message, it can re-register the device information or perform a security check. In this way, by verifying the device code registration, the uniqueness of the device code can be further guaranteed, thereby ensuring the validity of the subsequently generated device credentials.

[0059] Step S13: Receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, send a credential production application to the credential system and send the target credential fed back by the credential system to the device party; the target credential includes a digital certificate or an identification key.

[0060] In this embodiment, after receiving the credential application request from the device party, it is necessary to verify the device code to be verified in the request, thereby ensuring the correctness of the device code contained in the request, and after the verification is passed, send a credential production application to the credential system, and finally send the credential fed back by the credential system to the device party. Specifically, it is necessary to receive the credential application request from the device party, and then parse the credential application request to determine the device code to be verified contained in the credential application request. It should be noted that the device code contained in the credential application request is the latest device code corresponding to the current device of the device party, but it may also be a risky request that has been intercepted and modified by a third party, so it is necessary to verify the device code to be verified contained in the request.

[0061] Furthermore, if the code of the device to be verified passes the verification, the credential application request passes the verification, and the credential production application can be sent to the credential system. In addition, the credential system needs to verify the application and generate a target credential corresponding to the credential production application after the verification passes. After receiving the target credential feedback from the credential system, the device manager needs to bind the target credential to the target device on the device side and then feedback the target credential to the device side. The generated credential can be a digital certificate or an identification key. In this way, a unified management mode for devices can be established, and the device manager can establish a connection between the device side and the credential system to solve the identity authentication problem of device certificate issuance and key distribution.

[0062] It needs to be explained that, Figure 3 As shown, if a credential authentication request is received from a device, the request is analyzed to determine the credentials to be verified and the signature to be verified contained in the request. The credentials to be verified are then parsed to determine whether the format of the credentials to be verified complies with the preset format. The preset format is the format used by the credential system to generate credentials. If the format does not comply with the preset format, the credential authentication request is returned. On the other hand, if the format complies with the preset format, the next step is verification. The signature to be verified in the credential authentication request is verified using a local preset public key to determine whether the signature is valid. The signature to be verified is a signature obtained by the device using the private key corresponding to the public key of the device manager. If the signature to be verified is found to be invalid, a suspicious alarm is issued, which is generated by generating an unauthorized misuse alert email and sending it to the target email address bound to the device. If the signature to be verified is valid, a communication connection is established with the target device. In this way, credential and signature verification can ensure data integrity and authenticity, verify identity, prevent repudiation, and ensure the security of data transmission.

[0063] As can be seen from this, in this embodiment, corresponding model attributes can be configured for different types of device parties, and then a device model can be generated based on the model attributes, and the corresponding device information can be entered according to the device registration template corresponding to the device model. After the device code is generated based on the device information, if a code acquisition request is received, the code acquisition request is verified, and after the verification is passed, the device code is sent to the device party. After receiving the credential application request, the device code is verified for matching, and if a match is found, a credential creation application is sent to the credential system, and the target credential fed back by the credential system is sent to the device party. In this way, on the one hand, the authentication mechanism can be flexibly selected according to the device function, resource constraints, and application scenarios to ensure the authenticity of the device identity and communication security, meeting the needs of different devices; on the other hand, a unique identifier can be assigned to the device to ensure the independence and traceability of the device, prevent authentication conflicts and impersonation, and support the introduction of new authentication methods and the access of more device types in the future; on the other hand, the device manager can be used as a centralized management platform that supports cross-device and cross-authentication methods to achieve unified authentication and management of device credentials.

[0064] See also Figure 4 The figure shows the signaling diagram corresponding to the device credential generation method of this application. The device manager first needs to configure the device model attributes according to user requirements, generate a device model based on the configuration, and generate a device registration template based on the device model. The manager downloads the device registration template and enters device information in batches based on the template. The device manager then needs to store the device information and generate a device code based on the device model. The device manager needs to call the device manager's unique code acquisition interface and send a code acquisition request to the device manager. The device manager then confirms whether the device is registered. If the device is registered, it queries the device's unique code and encapsulates the return message. If it is not registered, it feeds the generated device code back to the device manager. The device manager also needs to call the lightweight software module SDK (Software Development Kit) to parse the unique code message and write the device code. The device manager can assemble the device credential application when needed, and the credential information includes the device's unique code. After receiving the application information, the device manager verifies the unique code of the device. After the verification is passed, the device manager initiates an application to the credential system. The credential system then verifies the application. After the verification is passed, the credential system creates a credential and feeds the credential back to the device manager. After receiving the credential, the device manager binds the credential to the target device of the device and feeds the credential back to the device so that the device can save the credential.

[0065] See also Figure 5 As shown, an embodiment of the present invention discloses a device credential generation apparatus, which is applied to a device manager, comprising:

[0066] The device information entry module 11 is used to configure the model attributes corresponding to the target device of the device side, generate a device model based on the model attributes, generate a device registration template according to the device model, and enter the device information corresponding to the target device according to the device registration template;

[0067] a device code sending module 12, configured to generate a device code based on the device information, and upon receiving a code acquisition request sent by the device, verify the code acquisition request, and if the code acquisition request passes the verification, send the device code to the device;

[0068] The credential generation module 13 is used to receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, it sends a credential production application to the credential system and sends the target credential fed back by the credential system to the device party.

[0069] In this embodiment, the corresponding model attributes can be configured for different types of device parties, and then the device model can be generated based on the model attributes, and the corresponding device information can be entered according to the device registration template corresponding to the device model. After the device code is generated based on the device information, if a code acquisition request is received, the code acquisition request is verified, and after the verification is passed, the device code is sent to the device party, and after receiving the credential application request, the matching of the device code is verified, and if it matches, a credential production application is sent to the credential system, and the target credential fed back by the credential system is sent to the device party. In this way, on the one hand, the authentication mechanism can be flexibly selected according to the device function, resource limitations and application scenarios to ensure the authenticity of the device identity and communication security, and meet the needs of different devices; on the other hand, a unique identifier can be assigned to the device to ensure the independence and traceability of the device, prevent authentication conflicts and impersonation, and support the introduction of new authentication methods and the access of more device types in the future; on the other hand, the device manager can be used as a centralized management platform that supports cross-device and cross-authentication methods to achieve unified authentication and management of device credentials.

[0070] In some embodiments, the device information entry module 11 may specifically include:

[0071] An attribute configuration unit, configured to determine the current target device of the device party and configure model attributes based on the device type of the target device; the model attributes include static attributes, dynamic attributes, and behavioral attributes;

[0072] A model generating unit is configured to generate a device model corresponding to the target device based on the static attributes, the dynamic attributes, and the behavioral attributes; the device model is an operation framework corresponding to the target device.

[0073] In some embodiments, the device information entry module 11 may specifically include:

[0074] a device information classification unit, configured to generate a device registration template according to the device model, and after receiving device information corresponding to the target device, classify the device information based on the device registration template to obtain classified device information;

[0075] The data storage unit is used to input the classified device information and save the classified device information to a local database.

[0076] In some embodiments, the device code sending module 12 may specifically include:

[0077] a device code generating unit, configured to generate a device code based on the device information;

[0078] A request reception determination unit, configured to determine whether a code acquisition request has been received;

[0079] a device code verification unit configured to, upon receiving a code acquisition request sent by the device party, verify the device information to be verified contained in the code acquisition request to determine whether the device information to be verified corresponds to the device information;

[0080] A device code sending unit is configured to use the device code as a target device code corresponding to the target device if the device information to be verified corresponds to the device information, and send the target device code to the device party.

[0081] In some embodiments, the credential generation module 13 may specifically include:

[0082] a request receiving unit, configured to receive a credential application request fed back by the device party; the credential application request is an application request including the latest device code of the device party;

[0083] a first request parsing unit, configured to parse the credential application request to determine the device code to be verified contained in the credential application request, and perform matching verification on the device code to be verified and the device code;

[0084] an application sending unit, configured to indicate that the credential application request has passed verification if the device code to be verified and the device code are completely consistent, and to send a credential production application to the credential system;

[0085] The credential feedback unit is configured to bind the target credential with the device code upon receiving the target credential fed back by the credential system, and feed back the target credential to the device party.

[0086] In some embodiments, the device credential generation apparatus may further include:

[0087] a second request parsing unit, configured to, upon receiving a credential authentication request from the device, analyze the credential authentication request to determine the credential to be verified and the signature to be verified contained in the credential authentication request;

[0088] The credential parsing submodule is used to parse the credential to be verified to determine whether the credential format of the credential to be verified conforms to a preset credential format;

[0089] A suspicious alarm submodule, configured to return the credential authentication request and issue a suspicious alarm if the credential format does not conform to the preset credential format;

[0090] A signature verification submodule, configured to verify the signature to be verified by using a local preset public key if the credential format conforms to the preset credential format, so as to determine whether the signature to be verified is legal;

[0091] The verification response submodule is used to generate a misappropriation alarm if the signature to be verified is illegal, and to establish a communication connection with the target device if the signature to be verified is legal.

[0092] In some embodiments, the verification response submodule may include:

[0093] The warning email sending unit is used to generate a misuse warning email if the signature to be verified is illegal, and send the misuse warning email to the target mailbox bound to the device.

[0094] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0095] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the device credential generation method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0096] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0097] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0098] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the device credential generation method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 may further include a computer program capable of implementing other specific tasks.

[0099] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned method for generating device credentials. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0101] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0102] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0103] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0104] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for generating a device credential, characterized in that: Applicable to device management, including: Configuring model attributes corresponding to the target device on the device side, generating a device model based on the model attributes, generating a device registration template according to the device model, and entering device information corresponding to the target device according to the device registration template; generating a device code based on the device information, and upon receiving a code acquisition request from the device party, verifying the code acquisition request, and sending the device code to the device party if the code acquisition request passes the verification; the device code being a unique code corresponding to the target device; Receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, send a credential production application to the credential system and send the target credential fed back by the credential system to the device party; the target credential includes a digital certificate or an identification key.

2. The device credential generation method according to claim 1, characterized in that: The configuration device side configures the model attributes corresponding to the target device, and generates a device model based on the model attributes, including: Determine the current target device of the device party, and configure model attributes based on the device type of the target device; the model attributes include static attributes, dynamic attributes, and behavioral attributes; A device model corresponding to the target device is generated based on the static attributes, the dynamic attributes, and the behavioral attributes; the device model is an operation framework corresponding to the target device.

3. The device credential generation method according to claim 1, wherein: Generating a device registration template according to the device model, and entering device information corresponding to the target device according to the device registration template, includes: generating a device registration template according to the device model, and after receiving device information corresponding to the target device, classifying the device information based on the device registration template to obtain classified device information; Enter the classified device information and save the classified device information to a local database.

4. The device credential generation method according to claim 1, wherein: The generating of a device code based on the device information, verifying the code acquisition request if a code acquisition request sent by the device party is received, and sending the device code to the device party if the code acquisition request passes the verification, includes: Generate a device code based on the device information, and determine whether a code acquisition request is received; If a code acquisition request is received from the device, verify the device information to be verified contained in the code acquisition request to determine whether the device information to be verified corresponds to the device information; If the device information to be verified corresponds to the device information, the device code is used as the target device code corresponding to the target device, and the target device code is sent to the device party.

5. The device credential generation method according to claim 1, characterized in that: The receiving of the credential application request fed back by the device party and verifying the credential application request, if the credential application request passes the verification, sending a credential production application to the credential system, and sending the target credential fed back by the credential system to the device party, includes: receiving a credential application request fed back by the device party; the credential application request is an application request including the latest device code of the device party; Parsing the credential application request to determine the device code to be verified contained in the credential application request, and performing matching verification on the device code to be verified and the device code; If the device code to be verified is completely consistent with the device code, it indicates that the credential application request has passed the verification, and the credential production application is sent to the credential system; If the target credential fed back by the credential system is received, the target credential is bound to the device code and fed back to the device party.

6. The device credential generation method according to any one of claims 1 to 5, characterized in that: Also includes: If a credential authentication request is received from the device, the credential authentication request is analyzed to determine the credentials to be verified and the signature to be verified contained in the credential authentication request; Parsing the credential to be verified to determine whether the credential format of the credential to be verified conforms to a preset credential format; If the credential format does not conform to the preset credential format, the credential authentication request is returned and a suspicious alarm is issued; If the certificate format conforms to the preset certificate format, verifying the signature to be verified by using the local preset public key to determine whether the signature to be verified is legal; If the signature to be verified is illegal, a misappropriation warning is generated; if the signature to be verified is legal, a communication connection is established with the target device.

7. The device credential generation method according to claim 6, characterized in that: If the signature to be verified is illegal, a misappropriation warning is generated, including: If the signature to be verified is illegal, a misuse warning email is generated and sent to the target mailbox bound to the device.

8. A device credential generation apparatus, characterized in that: Applicable to device management, including: A device information entry module, configured to configure the model attributes corresponding to the target device of the device side, generate a device model based on the model attributes, generate a device registration template according to the device model, and enter the device information corresponding to the target device according to the device registration template; a device code sending module, configured to generate a device code based on the device information, and upon receiving a code acquisition request sent by the device party, verify the code acquisition request, and if the code acquisition request passes the verification, send the device code to the device party; The credential generation module is used to receive the credential application request fed back by the device party and verify the credential application request. If the credential application request passes the verification, the credential production application is sent to the credential system, and the target credential fed back by the credential system is sent to the device party.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the device credential generation method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the device credential generation method according to any one of claims 1 to 7 is implemented.

Images