Device security authentication method, device, and storage medium

Abstract

The application discloses a device security authentication method, device and storage medium, comprising: decrypting the received client clock-in information through the pre-stored platform private key; verifying the decrypted clock-in information, and generating identity authentication information based on the device public key corresponding to the client when it is determined that the clock-in information is correct; issuing the identity authentication information to the client, so that the client initiates the next clock-in information after decrypting the identity authentication information based on the pre-stored device private key; wherein the management and control platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to a project based on a current new project, determines a client according to the project certificate, and issues identity authentication information to the client. Through the two-way security authentication based on dynamic certificate management between the management and control platform and the client, the technical effects of improving the anti-counterfeiting capability in the offline environment and the cross-device compatibility are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security authentication, in particular to a device security authentication method, device and storage medium. BACKGROUND

[0002] In the field of identity authentication of offline application systems, user information security has always been facing severe challenges. The current various system solutions are generally defective in that user sensitive information is easy to be eavesdropped, counterfeited and non-authorizedly acquired by hackers, resulting in major risks such as user data leakage and economic loss. Some systems still directly transmit user passwords in plaintext, so that the attacker can easily intercept valid credentials; some systems use MD5 and other hash algorithms to process passwords, but cannot prevent replay attacks - the attacker does not need to decrypt the ciphertext, but only needs to retransmit the encrypted data to pass the verification. In addition, when the authentication platform calls the user database, the database itself often becomes the target of intrusion, and once it is attacked, it will cause large-scale information leakage.

[0003] To improve security, some solutions use asymmetric cryptography mechanism to complete offline authentication, generate and save an asymmetric key pair by the authentication platform, distribute the public key to the user device and the database, and keep the private key by the platform. The user device sends the authentication information encrypted by the public key, and the platform verifies it by decrypting with the private key. Although this operation avoids part of the risk of plaintext transmission, the security of the system is highly dependent on the secrecy of the private key, and once the private key is leaked, the entire authentication system will collapse; and this solution can only solve the communication security problem between a single device and the platform, and is difficult to support cross-device identity synchronization and mutual authentication scenarios, and lacks the ability to adapt to complex trust relationships in distributed environments. Therefore, the current technology still cannot guarantee the security of offline authentication while considering the feasibility of system implementation and cross-device collaboration ability, and a more perfect identity authentication solution is urgently needed.

[0004] The above content is only used to assist in understanding the technical solutions of the present application, and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide a device security authentication method, device and storage medium, which aims to solve the technical problems of security and cross-device compatibility of existing offline identity authentication.

[0006] To achieve the above purpose, the present application provides a device security authentication method applied to a management and control platform, which comprises:

[0007] The received client punch card information is decrypted by the pre-stored platform private key, wherein the client sends the punch card information to the management and control platform through the pre-integrated platform public key;

[0008] verify the decrypted punch information, and generate identity authentication information based on the device public key corresponding to the client when it is determined that the punch information is correct;

[0009] issue the identity authentication information to the client, so that the client initiates the next punch information after decrypting the identity authentication information based on the pre-stored device private key; wherein the management and control platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to the project based on the current new project, determines the client according to the project certificate, and issues the identity authentication information to the client, so that the client obtains a user identity credential by decrypting the identity authentication information through the device private key, and initiates the punch information by encrypting the user identity credential through the pre-integrated platform public key.

[0010] In an embodiment, the step of verifying the decrypted punch information, and generating identity authentication information based on the device public key corresponding to the client when it is determined that the punch information is correct, comprises:

[0011] verifying the user identity credential and the time limit information in the punch information;

[0012] determining whether the punch information is overdue based on the current time and the time limit information when it is determined that the user identity credential is valid;

[0013] if the punch information is not overdue, it is determined that the punch information is correct.

[0014] In an embodiment, the step of verifying the decrypted punch information, and generating identity authentication information based on the device public key corresponding to the client when it is determined that the punch information is correct, comprises:

[0015] extracting a user identity credential in the punch information, and generating time limit information based on the user identity credential;

[0016] combining the user identity credential and the time limit information to generate a security token;

[0017] encrypting the security token through the device public key corresponding to the client, and generating the identity authentication information based on the encrypted security token.

[0018] In an embodiment, the step of extracting a user identity credential in the punch information, and generating time limit information based on the user identity credential, comprises:

[0019] obtaining the user authority corresponding to the user identity credential, and determining the number of token uses according to the user authority;

[0020] obtaining the corresponding verification parameter according to the current geographic location information of the client;

[0021] generating the time limit information based on the current time, the token usage times and the verification parameter.

[0022] In an embodiment, the step of generating the secure token based on the user identity credential and the time limit information comprises:

[0023] collecting a hardware fingerprint of a device where the client is located and a hash value of a currently running software environment, and generating an additional parameter based on the hardware fingerprint and the hash value of the software environment;

[0024] updating a token generation algorithm based on the additional parameter, and generating the secure token based on the user identity credential and the time limit information through the token generation algorithm.

[0025] In an embodiment, the management platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to a newly created project based on the current project, determines a client based on the project certificate, and issues identity authentication information to the client.

[0026] generating a unique asymmetric key pair for the project, and embedding a device private key of the asymmetric key pair into the project certificate;

[0027] encrypting the project certificate through an encryption key generated by a symmetric encryption algorithm, and issuing the encrypted project certificate to the client corresponding to the project.

[0028] To achieve the above object, the present application further provides a device security authentication method applied to a client, which comprises the following steps:

[0029] receiving identity authentication information issued by a management platform, and decrypting the identity authentication information through a pre-stored device private key to obtain a user identity credential;

[0030] encrypting the user identity credential through a pre-integrated platform public key to generate punch card information, and sending the punch card information to the management platform for verification;

[0031] entering a project control page after the verification of the management platform is passed;

[0032] wherein the management platform reissues identity authentication information after the verification is passed, and initiates next punch card information to the management platform by decrypting the identity authentication information.

[0033] In addition, to achieve the above object, the present application further provides a device security authentication device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the device security authentication method as described above.

[0034] In addition, to achieve the above object, the application further provides a storage medium, which is a computer readable storage medium, and a computer program is stored on the storage medium, and the computer program is executed by a processor to implement the steps of the device security authentication method.

[0035] The one or more technical solutions provided by the application have at least the following technical effects:

[0036] The received client punch card information is decrypted by the pre-stored platform private key, wherein the client sends the punch card information to the management and control platform through the pre-integrated platform public key; the decrypted punch card information is verified, and identity authentication information is generated based on the device public key corresponding to the client when it is determined that the punch card information is correct; the identity authentication information is issued to the client, so that the client initiates the next punch card information after decrypting the identity authentication information based on the pre-stored device private key; wherein the management and control platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to the project based on the current new project, determines a client according to the project certificate, and issues identity authentication information to the client, so that the client obtains a user identity credential by decrypting the identity authentication information through a device private key, and initiates the punch card information by encrypting the user identity credential through a pre-integrated platform public key. Therefore, the technical effect of improving the anti-counterfeiting capability and cross-device compatibility in an offline environment is achieved through the dynamic certificate management based two-way security authentication between the management and control platform and the client. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the application and, together with the specification, serve to explain the principles of the application.

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor.

[0039] Figure 1 Flowchart of the first embodiment of the device security authentication method of the application;

[0040] Figure 2 Flowchart of another embodiment of the device security authentication method of the application;

[0041] Figure 3 Schematic diagram of the user device sending punch card information to the management and control platform;

[0042] Figure 4 Fig. 1 is a schematic diagram of a device management system based on a management and control platform;

[0043] Figure 5 Fig. 4 is a schematic diagram of a device structure of a hardware operating environment involved in a device security authentication method in an embodiment of the present application.

[0044] The object implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and are not intended to limit the present application.

[0046] In order to better understand the technical solutions of the present application, the specific embodiments will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] The main solution of the embodiment of the present application is that the received client punch card information is decrypted by a pre-stored platform private key, wherein the client sends the punch card information to the management and control platform through a pre-integrated platform public key; the decrypted punch card information is verified, and identity authentication information is generated based on the device public key corresponding to the client when it is determined that the punch card information is correct; the identity authentication information is issued to the client, so that the client initiates the next punch card information after decrypting the identity authentication information based on the pre-stored device private key; wherein the management and control platform pre-stores the platform private key and the platform public key, generates the project certificate corresponding to the project based on the current new project, determines the client according to the project certificate, and issues the identity authentication information to the client, so that the client obtains the user identity certificate by decrypting the identity authentication information through the device private key, and initiates the punch card information by encrypting the user identity certificate through the pre-integrated platform public key.

[0048] Since the existing scheme uses asymmetric cryptography mechanism to complete offline authentication, the asymmetric key pair is generated and saved by the authentication platform, the public key is distributed to the user device and the database, and the private key is kept by the platform. The user device sends the encrypted authentication information after using the public key, and the platform verifies it by decrypting with the private key. Although this operation avoids part of the risk of plaintext transmission, the system security highly depends on the secrecy of the private key, and once the private key is leaked, the entire authentication system will collapse; and this scheme can only solve the communication security problem between a single device and the platform, and is difficult to support cross-device identity synchronization and mutual authentication scenarios, and lacks the adaptability to complex trust relationships in distributed environments. Therefore, the current technology still cannot guarantee the security of offline authentication while taking into account the feasibility of system implementation and cross-device collaboration ability, and a more perfect identity authentication scheme is urgently needed.

[0049] The application provides a solution, through dynamic certificate management-based two-way security authentication between a management and control platform and a client, to achieve the technical effects of improving anti-counterfeiting capability and cross-device compatibility in an offline environment.

[0050] Based on this, the application embodiment provides a device security authentication method, applied to a management and control platform, with reference to Figure 1 , Figure 1 The figure is a flowchart of the first embodiment of the device security authentication method of the application. In this embodiment, the device security authentication method comprises steps S10-S30:

[0051] Step S10, decrypt the received client punch card information through a pre-stored platform private key, wherein the client sends the punch card information to the management and control platform through a pre-integrated platform public key;

[0052] In this embodiment, the management and control platform decrypts the received client punch card information through a pre-stored platform private key. The platform private key is generated by using an asymmetric encryption algorithm, pre-stored in a hardware security module of the management and control platform, and can be accessed through a multi-factor authentication mechanism. Specifically, the management of the platform private key adopts a hierarchical deterministic key derivation system, supports key rotation and update without affecting the existing authentication process, thereby significantly improving the long-term security of the system.

[0053] When decrypting the client punch card information based on the platform private key, based on this decryption process, first, the data packet of the received client punch card information is verified in format, and the data packet length, identifier and integrity check value are comprehensively checked. After the format verification passes, the decryption service of the hardware security module is called, that is, the pre-stored platform private key is used to perform asymmetric decryption operation on the client punch card information. To ensure the security of the key, all decryption operations are performed in a secure isolation environment, which fundamentally prevents the private key from being exposed to the system main memory and effectively resists memory grabbing attacks.

[0054] The decrypted client punch card information adopts a multi-layer encryption structure, the outer layer uses an asymmetric encryption algorithm for protection, and the inner layer uses a symmetric encryption algorithm to ensure data confidentiality. The management and control platform first uses the platform private key to open the outer layer encryption of the client punch card information, and uses a dynamically generated session key to decrypt the inner layer data of the client punch card information, and finally restores the plaintext punch card information content of the client punch card information. This double encryption mechanism not only guarantees transmission security, but also improves encryption and decryption efficiency, and is especially suitable for high-concurrency scenarios.

[0055] Specifically, the client punch information contains key fields such as user identity credentials, high-precision timestamps, encrypted random numbers, and digital signatures. After decryption, the client punch information is subjected to deep syntax parsing and semantic analysis, and the values of each key field are accurately extracted and subjected to multi-dimensional verification. Specifically, the timestamp verification mechanism can effectively prevent replay attacks, the encrypted random number ensures the uniqueness of each transmission, and the digital signature provides complete data source authentication and integrity protection.

[0056] The platform maintains detailed key usage records and access logs, recording information such as timestamps, client identifiers, operation results, and system states for each decryption operation. The access logs are stored using tamper-proofing techniques, including blockchain storage and digital signature mechanisms, providing reliable evidence for security audits and troubleshooting. The system also implements real-time key usage monitoring, detects abnormal decryption behavior through intelligent algorithms, and promptly issues security alerts, forming a complete security protection loop.

[0057] In addition, the management platform introduces transparent data encryption technology (TDE) to encrypt log files in real time at the storage level, ensuring that even if data files are illegally obtained, attackers cannot read the plaintext content. At the same time, the management platform adopts a key lifecycle management scheme, including security controls for key generation, storage, use, rotation, and destruction, meeting relevant specification requirements.

[0058] To enhance the system's resistance to attacks, the management platform also deploys multiple defense mechanisms, including deep packet inspection to prevent injection attacks, frequency limits to prevent brute force attempts, and a two-way authentication mechanism to ensure the legitimacy of both communication parties. For specific details, please refer to Figure 3 , Figure 3 Schematic diagram of a user device sending punch information to the management platform.

[0059] Step S20, verify the decrypted punch information, and generate identity authentication information based on the device public key corresponding to the client when it is determined that the punch information is correct;

[0060] Based on the above, after decrypting the received client punch information using the pre-stored platform private key, the decryption result is verified using a pre-created verification strategy. Specifically, this verification strategy is based on related fields in the decryption result, including but not limited to identity credential verification and timeliness verification.

[0061] The identity credential verification includes checking the user authority scope, certificate validity period and use restriction conditions. In this verification process, the identity management system is retrieved based on the decrypted user identity information, and the user identification in the credential is compared with the record in the authorization database according to the retrieval result, to ensure that the user is in an activated state and has corresponding operation authority. At the same time, the issuer of the credential and the digital certificate chain are verified to prevent counterfeit credentials. The timeliness verification ensures that the request is within the allowed time window, i.e. within the effective clock-in time range, by comparing the current time with the timestamp in the credential. In this process, a reasonable time tolerance is set to take into account network transmission delay and clock synchronization error. Therefore, when the timestamp of the client clock-in information is within the time window, the client clock-in is determined to be valid, and when the timestamp fails to be within the time window, the clock-in is determined to be overtime, the abnormal event of the overtime clock-in is recorded and the security management platform is notified, and the corresponding security response mechanism is triggered.

[0062] After the client clock-in information is verified, new identity authentication information is generated based on the device public key corresponding to the client. The authentication information adopts a structured data format, including fields such as user identification, session identification, authority list, effective time, expiration time and use range. Each field is standardized to ensure data consistency and interoperability between systems.

[0063] Specifically, a dynamic policy mechanism is used to generate the identity authentication information, which dynamically adjusts the content composition and effective period length according to the client type, network environment characteristics and security level requirements. For high-risk environments, the system uses a short effective period and a multi-factor authentication strategy; for low-risk environments, the effective period is appropriately extended to improve user experience. In addition, based on the identity authentication information, custom fields can be extended to meet the special needs of specific projects.

[0064] According to the generated identity authentication information, the authentication information is signed by the recorded device private key of the management platform, to ensure the integrity and non-repudiation of the information. When signing the identity authentication information based on the device private key, a standardized asymmetric encryption scheme is used to provide sufficient security strength for the signature. In addition, the value of the signature is attached to the tail of the authentication information in a standardized format, forming a complete authentication token structure.

[0065] Further, the step of verifying the decrypted clock-in information and generating identity authentication information based on the device public key corresponding to the client when it is determined that the clock-in information is correct, includes:

[0066] Verifying the user identity credential and timeliness information in the clock-in information;

[0067] determining whether the clock-in information is overdue based on a current time and the time limit information when it is determined that the user identity credential is valid;

[0068] if the clock-in information is not overdue, determining that the clock-in information is correct.

[0069] In this embodiment, the decrypted clock-in information is verified, specifically to verify the user identity credential and the time limit information in the clock-in information. The verification of the user identity credential includes permission level matching and digital signature verification to ensure the legality and validity of the credential. The verification of the time limit information specifically determines that the time limit information at least includes a timestamp and an effective period parameter. Specifically, based on the setting of the user identity credential and the time limit information, the client type and the security requirement can be dynamically configured.

[0070] After determining that the user identity credential is valid, it is determined whether the clock-in information is overdue based on a current time and the time limit information. The comparison of the current time and the time limit information obtains an accurate time reference through a time synchronization service to ensure the accuracy of the time judgment. The time window mechanism is used for the time-out determination, the difference between the timestamp and the current time is calculated, and compared with the preset effective period threshold.

[0071] If the clock-in information is not overdue, it is determined that the clock-in information is correct. The effective period threshold is dynamically adjusted according to the network environment and the security level. Further, the user identity credential and the time limit information are generated into a composite verification object by using a joint signature mechanism to ensure the integrity and tamper resistance of the data. Through this double verification mechanism, the system not only ensures the legality of the user identity, but also effectively prevents the risk of replay attack and credential reuse.

[0072] Further, the step of verifying the decrypted clock-in information and generating identity authentication information based on the device public key corresponding to the client when it is determined that the clock-in information is correct comprises:

[0073] extracting the user identity credential from the clock-in information, and generating the time limit information based on the user identity credential;

[0074] combining the user identity credential and the time limit information to generate a security token;

[0075] encrypting the security token through the device public key corresponding to the client to generate the identity authentication information.

[0076] In this embodiment, the security token is generated by the user identity credential and the time limit information, and the identity authentication information is generated by encryption. In the process of generating the security token, if the device hardware features and the running environment information of the client are not combined, the token generation parameter may be single, which is easy to be forged by the attacker through simulating the device environment, and then causes the risk of identity fraud.

[0077] The time-to-live information is generated by combining the check parameter corresponding to the geographical location information of the client and the current time, based on the number of times the token corresponding to the user's authority is to be acquired. The additional parameter is generated by collecting the hardware fingerprint and the software environment hash value of the client, and the token generation algorithm is updated. The user identity certificate and the time-to-live information are combined to generate a secure token by using the updated token generation algorithm. The hardware fingerprint can include a device serial number or a processor identifier, and the software environment hash value is generated by scanning the binary file of the current running process. In addition, the additional parameter, when combined with the token generation algorithm, can introduce dynamic device characteristics in the generation process of the secure token, so that each generated token has uniqueness.

[0078] Specifically, after the client initiates a clock-in request, the management and control platform extracts the user identity certificate, and determines the upper limit of the number of times the token is allowed according to the user's authority. At the same time, the geographical location information reported by the client is obtained, and the corresponding check parameter is matched according to the preset regional security level mapping table. The time-to-live information containing the validity period is generated by combining the current timestamp, the upper limit of the number of times the token is used, and the check parameter. Then, the management and control platform collects the hardware fingerprint of the client, and calculates the software process environment characteristic value of the current running software process by using a hash algorithm. The hardware fingerprint and the software environment hash value are spliced as an additional parameter, which is input into the token generation algorithm to update the initialization vector of the algorithm. The user identity certificate and the time-to-live information are fused by using the updated algorithm to generate a secure token containing dynamic device characteristics. The token is encrypted by a device public key and then sent to the client, and the client decrypts the token to verify whether the hardware fingerprint and the current software environment match, so as to ensure that the token cannot be copied and used by other devices.

[0079] The secure token is encrypted by the device public key corresponding to the client to generate identity authentication information. Further, the RSA asymmetric encryption algorithm is used to encrypt the secure token by using a 2048-bit device public key to generate encrypted identity authentication information. Thus, the identity authentication information can only be decrypted by the client holding the corresponding private key, which ensures the security of the authentication process.

[0080] The embodiment realizes a secure token generation mechanism based on user identity certificates and time-to-live information, and an identity authentication mechanism using device public key encryption transmission. This mechanism avoids the transmission of sensitive information in plaintext, enhances the security of the authentication process. At the same time, the time-to-live information limits the validity period of the token, effectively preventing replay attacks. In addition, the use of device public key encryption ensures that the legal client can decrypt the authentication information, improving the reliability and security of the entire authentication system.

[0081] In addition, the step of extracting the user identity credential from the clock-in information and generating the time limit information based on the user identity credential comprises:

[0082] obtaining the user authority corresponding to the user identity credential, and determining the token use times according to the user authority;

[0083] obtaining the corresponding verification parameter according to the current geographic location information of the client;

[0084] generating the time limit information based on the current time, the token use times and the verification parameter.

[0085] In this embodiment, it is considered that in the case of only relying on the user identity credential when generating the time limit information, the token may be maliciously repeatedly used or misused in different geographic locations, which cannot effectively limit the applicable range and use times of the token, and there is a security risk.

[0086] Therefore, the corresponding token use times are set by limiting the user authority, and the verification parameter is set based on the token use times and the geographic location information, so as to generate the time limit information based on the current time, the token use times and the verification parameter. The user authority is mapped to the upper limit value of the token use times, for example, the administrator authority allows to generate a single valid token, and the ordinary user authority allows to generate three valid tokens. The geographic location information of the client is obtained in real time through the GPS module, and the verification parameter includes the area code and the network access point identifier. The current time is recorded in the coordinated universal time format, and the time limit information is generated in combination with the use times and the verification parameter, for example, the hash value of the splicing of the three is calculated as the time limit information.

[0087] Specifically, the token use times corresponding to the user authority are written into the time limit information, and when the client initiates a request, the management platform verifies whether the remaining times are legal by decrementing the counter. The geographic location verification parameter is embedded in the time limit information, and after receiving the request, the management platform compares the real-time location reported by the client with the area code in the time limit information, and if it is detected that the token is used across regions, it is determined that the token is invalid. The current time and the time stamp in the time limit information are calculated by difference, and when the preset threshold is exceeded, the token is automatically invalidated. Through the dynamic combination of multiple parameters, the time limit information generated each time has uniqueness and scene limitation, which prevents the token from being intercepted and used for illegal equipment or replay attacks in different places.

[0088] In the specific implementation process, after extracting the user identity credential from the clock-in information, first, the user authority level corresponding to the user identity credential is obtained. And the token use times are determined according to the authority level.

[0089] According to the current geographical position information of the client, a corresponding verification parameter is obtained. Specifically, the system can pre-divide a plurality of geographical areas, and each area corresponds to a unique verification parameter. When the client is located in a certain area, the system obtains the verification parameter corresponding to the area.

[0090] The system generates time-limited information based on the current time, the number of token uses, and the verification parameter. The generation process can use the following algorithm: multiply the current timestamp by the number of token uses, and then perform XOR operation with the verification parameter. The result obtained is the time-limited information.

[0091] The embodiment realizes a multi-dynamic verification mechanism based on user permissions, geographical positions, and time. This improves the security and accuracy of identity authentication and effectively prevents identity impersonation and illegal access. At the same time, by introducing geographical position information, the system's ability to identify abnormal login behavior is enhanced. In addition, dynamically adjusting the number of token uses not only guarantees the convenience of high-privilege users but also limits the potential risks of low-privilege users.

[0092] Specifically, the step of generating a security token from the user identity credential and the time-limited information includes:

[0093] Collecting the hardware fingerprint of the device where the client is located and the hash value of the currently running software environment, and generating an additional parameter based on the hardware fingerprint and the software environment hash value;

[0094] Updating the token generation algorithm based on the additional parameter, and generating the security token from the user identity credential and the time-limited information through the token generation algorithm.

[0095] In this embodiment, the user identity credential is extracted from the punch-in information, and the time-limited information is generated based on the user identity credential. The hardware fingerprint of the device where the client is located and the hash value of the currently running software environment are collected, and the additional parameter is generated based on the hardware fingerprint and the software environment hash value. The token generation algorithm is updated based on the additional parameter, and the security token is generated from the user identity credential and the time-limited information through the token generation algorithm.

[0096] The hardware fingerprint includes a unique identifier such as a device serial number, a network card MAC address, or a motherboard chipset encoding. The software environment hash value is generated by calculating the current running process list, system service configuration, and dynamic link library version information. The additional parameter is generated by performing bitwise XOR operation on the hash digest of the hardware fingerprint and the software environment hash value to generate a binary sequence. This binary sequence serves as the initialization vector of the token generation algorithm. Moreover, the token generation algorithm uses a HMAC-SHA256 function that is dynamically adjusted based on the additional parameter. Based on this function, the salt value of the hash operation is modified by the additional parameter each time a security token is generated.

[0097] Specifically, when the client device initiates the punch-in process, it first calls a system interface to obtain device fingerprint information, including reading the hardware identification code in the baseboard management controller, while scanning the current running process to generate a hash tree. After receiving the client information, the management platform inputs the hardware fingerprint and software environment hash value into a preset obfuscation function to generate a 128-bit additional parameter. The token generation algorithm adjusts the number of hash iterations and the padding rule through the additional parameter, and performs multiple rounds of hash operations on the user identity credential, time-limited information, and additional parameter, finally outputting a secure token containing the characteristics of the three. Since the additional parameter is derived from the device physical characteristics and real-time environment state, even if the attacker obtains the user identity credential and time-limited information, it is also impossible to generate the same token on an unauthorized device, thereby achieving strong binding of the secure token and the device running environment.

[0098] In the specific implementation process, the hardware fingerprint of the device where the client is located and the hash value of the current running software environment are collected. The hardware fingerprint can be generated by obtaining the CPU serial number, MAC address, hard disk serial number, etc. of the device. The software environment hash value can be obtained by performing hash calculation on the current running operating system version, installed application list, etc.

[0099] An additional parameter is generated based on the hardware fingerprint and the software environment hash value. Specifically, the hardware fingerprint and the software environment hash value are spliced, and then the spliced result is subjected to SHA-256 hash operation to obtain a 32-byte additional parameter. The token generation algorithm is updated based on the additional parameter.

[0100] The user identity credential and the time-limited information are generated into a secure token through the updated token generation algorithm. Specifically, the user identity credential and the time-limited information are spliced first, then the spliced result is encrypted using the updated AES encryption step, and finally the encrypted result is Base64 encoded to obtain the final secure token.

[0101] This embodiment can effectively improve the uniqueness and unpredictability of the secure token. Since the latest hardware fingerprint and software environment information are collected every time the secure token is generated, even under the same user identity credential and time-limited information, the secure tokens generated by different devices or at different times will be different. This increases the difficulty for attackers to guess or forge valid tokens based on known information, thereby improving the security of the entire authentication system. At the same time, by dynamically updating the token generation algorithm, the anti-attack ability of the system is further enhanced, even if the token generation process is known by the attacker, it will not affect the security of the subsequent tokens. In addition, this scheme can also prevent device cloning and software environment tampering attacks to some extent, because any change in hardware or software environment will cause the generated secure token to change, thereby detecting potential security risks by the system.

[0102] Step S30, the identity authentication information is issued to the client, so that the client initiates the next clock-in information based on the pre-stored device private key to decrypt the identity authentication information; wherein, the management and control platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to the project based on the current newly-built project, determines a client according to the project certificate, and issues the identity authentication information to the client, so that the client obtains a user identity credential by decrypting the identity authentication information through the device private key, and initiates the clock-in information by encrypting the user identity credential through the pre-integrated platform public key.

[0103] In the embodiment, the management and control platform issues the generated identity authentication information to the target client through a secure channel. The transmission protocol used in this issuance process is reliable, which ensures that the identity authentication information can be delivered to the target client completely and accurately. Specifically, an end-to-end encryption mechanism is used to prevent intermediate nodes from eavesdropping or tampering with data content. Moreover, multiple transmission methods are supported to adapt to different network environments and device capabilities, including persistent connection, message queue, and asynchronous callback mechanisms, to ensure reliable data transmission under various network conditions.

[0104] The client receiving module performs preliminary inspection on the issued identity authentication information, and the preliminary inspection is mainly used to verify the data packet format and transmission integrity. After verification, the identity authentication information is forwarded to the decryption processing unit for decryption processing. The decryption operation is performed in the hardware security environment of the client, and the device private key stored in advance is used to decrypt the outer layer encryption, and then the inner layer data is decrypted after the symmetric encryption key is obtained.

[0105] The decrypted identity authentication information is parsed to extract the field values. Moreover, the validity of the digital signature is verified to confirm that the identity authentication information comes from a trusted management and control platform. The timestamp and validity period are checked to ensure the timeliness and applicability of the identity authentication information. When the identity authentication information fails to be verified, error information is recorded and a retry or alarm mechanism is triggered to prevent invalid or expired authentication information from being used.

[0106] According to the decrypted identity authentication information, the user identity credential is extracted from the identity authentication information and stored in a secure storage area for subsequent clock-in operations. The intelligent credential caching mechanism is executed according to the stored user identity credential, which realizes time offline operation and fast authentication through the credential caching mechanism. Moreover, the use record of the user identity credential is recorded and stored through the log, which provides complete data support for security audit and fault recovery.

[0107] Further, the above content is based on the fact that the management and control platform pre-stores a platform private key and a platform public key, and generates a project certificate corresponding to a current newly created project. The project certificate serves as a carrier of secure trust, and the corresponding client is securely associated with the project certificate. According to the project certificate, the management and control platform determines a target client, and accurately issues the generated identity authentication information to the corresponding device.

[0108] In addition, the client decrypts the identity authentication information by using a device private key to obtain a user identity credential, and initiates punch card information by encrypting the user identity credential by using a pre-integrated platform public key. This bidirectional encryption and decryption mechanism forms a closed-loop authentication process, and realizes a secure authentication cycle between the client and the management and control platform.

[0109] In addition, by setting a dynamic policy adjustment mechanism, the validity period and encryption strength of the identity authentication information can be adjusted in real time according to network conditions, security threat levels, and device capabilities. For example, security measures are automatically enhanced in a high-risk environment, and user experience is optimized in a low-risk environment, so as to achieve the best balance between security and efficiency.

[0110] In addition, the management and control platform is provided with a perfect key management mechanism, including key rotation, update, and revocation functions. All key materials are stored in a hardware security module, and access control is performed by using a multi-factor authentication mechanism, so that even if part of the key materials are leaked, the security of the entire system will not be compromised.

[0111] In addition, the management and control platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to the project based on a current newly created project, determines a client according to the project certificate, and issues identity authentication information to the client.

[0112] A unique asymmetric key pair is generated for the project, and a device private key of the asymmetric key pair is embedded in the project certificate;

[0113] The project certificate is encrypted by using an encryption key generated by a symmetric encryption algorithm, and the encrypted project certificate is issued to the client corresponding to the project.

[0114] In this embodiment, a unique asymmetric key pair is generated based on the project, a device private key of the asymmetric key pair is embedded in the project certificate, the project certificate is encrypted by using an encryption key generated by a symmetric encryption algorithm, and the encrypted project certificate is issued to the client corresponding to the project.

[0115] Wherein, when generating a unique asymmetric key pair, RSA or ECC algorithm can be used to generate a public-private key pair, and the device private key is bound to the project certificate to ensure its uniqueness; the symmetric encryption algorithm can select AES-256 or SM4 algorithm to generate an encryption key, and the encryption key is transmitted to the client through a secure channel; after the project certificate is encrypted, the client needs to decrypt it through the pre-stored symmetric key to obtain the device private key. The asymmetric key pair is used to ensure the security of the generation and binding of the device private key, and the symmetric encryption algorithm improves the transmission efficiency of the project certificate. The combination of the two forms a double protection mechanism in the key distribution stage.

[0116] Specifically, the management and control platform first generates an asymmetric key pair, combines the device private key with the metadata of the project certificate to generate a digital signature, and ensures the integrity and source of the project certificate. Then, a one-time encryption key is generated by using a symmetric encryption algorithm, and the project certificate containing the device private key is encrypted. The encrypted data is transmitted to the client through a communication link. After the client receives the encrypted project certificate, it is decrypted by the pre-stored symmetric key, the device private key is extracted and stored in a secure area. In this process, the asymmetric encryption ensures that the binding relationship between the device private key and the project certificate cannot be tampered with, and the symmetric encryption reduces the encryption operation overhead and avoids the risk of man-in-the-middle attack caused by asymmetric encryption. Therefore, the confidentiality and integrity of the project certificate in the transmission stage are effectively protected, and a trusted key foundation is provided for the subsequent identity authentication process.

[0117] Based on the above technical content, in the actual application process, the management and control platform generates a unique asymmetric key pair for a new project, including a device private key and a device public key. The management and control platform embeds the device private key in the project certificate. Then, the management and control platform generates an encryption key by using a symmetric encryption algorithm, and uses the encryption key to encrypt the project certificate. The encrypted project certificate is issued to the client corresponding to the project. After the client receives the encrypted project certificate, it is decrypted using the pre-obtained decryption key, thereby obtaining the project certificate containing the device private key. The client can use the device private key for subsequent identity authentication operations. In addition, whether it is the platform public key and the platform private key of the management and control platform, or the device public key and the device private key based on the client, and the project certificate based on the project, they are all backed up and stored in the user database when generated. Based on the above-mentioned embodiments, it can be seen that Figure 4 , Figure 4 A schematic diagram of a device managed based on a management and control platform.

[0118] The embodiment realizes the secure distribution of project certificates. By generating a unique asymmetric key pair for each project, the isolation between projects is enhanced. Embedding the device private key in the project certificate and transmitting it encrypted avoids the risk of private key leakage during network transmission. Using a symmetric encryption algorithm to encrypt the project certificate improves transmission efficiency. This way not only ensures the security of the key, but also improves the efficiency of certificate distribution, laying a secure foundation for the subsequent identity authentication process.

[0119] Based on this, the embodiment of the present application provides a device security authentication method applied to a client, referring to Figure 2 , Figure 2 The flowchart of another embodiment of the device security authentication method of the present application is shown. In this embodiment, steps S40-S60 are included:

[0120] Step S40, receiving the identity authentication information issued by the management and control platform, and decrypting the identity authentication information through the pre-stored device private key to obtain user identity credentials;

[0121] Step S50, encrypting the user identity credentials using the pre-integrated platform public key to generate punch card information, and sending the punch card information to the management and control platform for verification;

[0122] Step S60, entering the project control page after the verification of the management and control platform; wherein the management and control platform reissues identity authentication information after verification, and initiates the next punch card information by decrypting the identity authentication information to the management and control platform.

[0123] In this embodiment, based on the security risks existing in the transmission of authentication information between the client and the management and control platform, an attacker may perform a replay attack by intercepting encrypted data packets, and a single encryption mechanism cannot adapt to the dynamically changing authentication environment, resulting in difficulty in identity synchronization in cross-device scenarios.

[0124] Based on this, through the device security authentication method applied to the client, identity authentication information issued by the management and control platform is received and decrypted by the pre-stored device private key to obtain user identity credentials, the user identity credentials are encrypted using the platform public key to generate punch card information sent to the management and control platform for verification, and after verification, the project control page is entered, and the management and control platform reissues identity authentication information to initiate the next punch card information.

[0125] Among them, the device private key and the platform public key form a double encryption link, and the client needs to verify the integrity of the security token when decrypting the identity authentication information, and the encrypted generated punch card information contains dynamic time parameter. The client needs to obtain the latest identity authentication information before initiating the punch card each time, and the management and control platform realizes the dynamic verification mechanism by periodically updating the time information in the security token.

[0126] Specifically, the client receives the encrypted identity authentication information, extracts the security token by decrypting with the device private key, and verifies whether the user identity credential and the time limit information in the token match the current system time and device environment parameters. After verification, the client uses the platform public key to encrypt the user identity credential again to generate the clock-in information, and this encryption process adds a random salt value to prevent replay attacks. After the control platform verifies, it issues a security token containing new time limit information, and the client needs to update the decryption key synchronously when clocking in next time. The decryption process of the update decryption key establishes a closed-loop authentication chain through a two-way asymmetric encryption mechanism, and each clock-in information carries a unique encryption parameter to ensure that the identity credential cannot be copied or tampered with in cross-device scenarios.

[0127] Specifically, the client receives the identity authentication information issued by the control platform. The identity authentication information is an encrypted security token. The client decrypts the identity authentication information asymmetrically through the pre-stored device private key to obtain the security token. Further, the client parses the security token to extract the user identity credential contained therein.

[0128] Moreover, the client uses the pre-integrated platform public key to asymmetrically encrypt the user identity credential to generate the clock-in information. Thus, the client sends the encrypted clock-in information to the control platform for verification. After the control platform verifies, the client obtains authorization to enter the project control page. Specifically, the client receives the verification pass information from the control platform, loads and displays the project control interface, so that the user can perform related operations.

[0129] Further, the control platform reissues new identity authentication information after verification. The client receives the new identity authentication information and decrypts it with the device private key to obtain new user identity credentials. For example, the client can set a timing task to use the new user identity credentials to initiate the next clock-in information to the control platform after a certain time interval.

[0130] The step of receiving the identity authentication information issued by the control platform and decrypting the identity authentication information with the pre-stored device private key to obtain the user identity credential includes:

[0131] Decrypting the identity authentication information with the device private key to obtain a security token;

[0132] When the security token is verified to be correct, parsing the security token to obtain the user identity credential.

[0133] In this embodiment, the client receives the identity authentication information issued by the management platform and directly decrypts the user identity credential through the device private key. However, the decrypted data may contain unverified security tokens, which may be tampered with or forged, resulting in invalid or malicious credentials in the subsequent encrypted check-in information, thereby reducing the security of the authentication process. Therefore, the identity authentication information is decrypted by the device private key to obtain a security token, and the user identity credential is obtained by parsing the security token when the security token is verified.

[0134] The device private key is used to decrypt the identity authentication information to generate a security token, and the security token contains encrypted data combined with user identity credentials and time information. When verifying the security token, the integrity, timeliness and additional parameters of the token need to be checked. For example, the additional parameters can include the hardware fingerprint and software environment hash value of the client device. By comparing the current device fingerprint with the fingerprint parameter embedded in the token, it is determined whether the device environment has been tampered with. In the verification process, the time information of the token can be based on the time difference between the current time and the token generation time for timeout determination, and the time difference threshold is set to be in the range of 5 minutes to 1 hour. When parsing the token, a predefined token parsing algorithm is used to separate the user identity credential and the time information, ensuring the validity of the credential.

[0135] Specifically, after the client receives the encrypted identity authentication information, it first decrypts the security token through the device private key. The security token has embedded user identity credentials, time information and device environment parameters when generated by the management platform. When the client performs integrity verification on the security token, the following steps need to be performed: extract the hardware fingerprint in the token and compare it with the fingerprint data stored in the local device; calculate the hash value of the current software environment and match it with the hash value recorded in the token; check the timestamp in the time information to determine whether it exceeds the preset valid period. If the above verifications are passed, the user identity credential is extracted through the token parsing algorithm. By adding the verification link of the security token, tampered or forged tokens are effectively prevented from entering the subsequent process, and invalid credentials are prevented from being encrypted by the platform public key and sent to the management platform, thereby improving the security of the identity authentication process.

[0136] In a specific implementation process, after the client receives the identity authentication information issued by the management platform, the device private key stored locally is called to perform asymmetric decryption operation on the identity authentication information, to generate a security token containing a digital signature and a timestamp. The verification process of the security token is implemented by verifying the integrity of the digital signature and the validity of the timestamp, and when it is detected that the digital signature is not tampered with and the timestamp is within the preset valid period, a token parsing operation is performed to extract the ciphertext data of the user identity credential. Further, the ciphertext data of the user identity credential is stored in Base64 encoding format, and through decoding operation, it is converted into recognizable user identity identifier and permission level information, to complete the complete parsing process of the identity authentication information.

[0137] The embodiment realizes the security authentication between the client and the management platform. Due to the use of asymmetric encryption technology, the user identity information is effectively prevented from being stolen in the transmission process. By regularly updating the identity authentication information, the security of the system is enhanced, and the risk of illegal access and replay attack is reduced. In addition, the scheme supports offline authentication of the client, improves the usability and user experience of the system.

[0138] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the device security authentication method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0139] The present application provides a device security authentication device, which comprises at least one processor and a memory connected in communication with the at least one processor. The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the device security authentication method in Embodiment I.

[0140] Reference will now be made to the following description Figure 5 which shows a structural schematic diagram of a device security authentication device suitable for implementing the embodiments of the present application. The device security authentication device in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 5 The device security authentication device shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0141] As Figure 5As shown, the device security authentication device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or loaded from a storage device 1003 into a random access memory (RAM) 1004. Various programs and data required for operation of the device security authentication device are also stored in the random access memory 1004. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other by a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the device security authentication device to communicate wirelessly or wired with other devices to exchange data. Although the device security authentication device is shown with various systems, it should be understood that not all of the shown systems are required to be implemented or possessed. More or fewer systems can alternatively be implemented or possessed.

[0142] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of embodiments of the present disclosure are performed.

[0143] The device security authentication device provided by the present disclosure adopts the device security authentication method in the above embodiments, and can solve the technical problems of security and cross-device compatibility of existing offline identity authentication. Compared with the prior art, the device security authentication device provided by the present disclosure has the same beneficial effects as the device security authentication method provided by the above embodiments, and other technical features in the device security authentication device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0144] It should be understood that various parts of the present application can be realized in hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0145] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0146] The present application provides a storage medium, which is a computer readable storage medium, and has computer readable program instructions (i.e. computer programs) stored thereon, the computer readable program instructions being used to execute the device security authentication method in the above embodiments.

[0147] The computer readable storage medium provided by the present application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, system or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), etc., or any suitable combination of the above.

[0148] The above computer readable storage medium can be contained in the device security authentication device; or can exist separately without being assembled into the device security authentication device.

[0149] The above computer readable storage medium carries one or more programs, which, when executed by the device security authentication device, enable the device security authentication device to implement the technical content of the device security authentication method embodiment as shown above.

[0150] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0151] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the block can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0152] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0153] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the device security authentication method described above, and can solve the technical problems of security and cross-device compatibility of the existing offline identity authentication. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the device security authentication method provided by the above embodiments, and will not be described here.

Claims

1. A method for authenticating equipment safety, characterized in that, When applied to a management and control platform, the device security authentication method includes the following steps: The received client attendance information is decrypted using a pre-stored platform private key, wherein the client sends the attendance information to the management platform using a pre-integrated platform public key; Verify the decrypted attendance information, and generate identity authentication information based on the device public key corresponding to the client when the attendance information is confirmed to be correct. The authentication information is sent to the client so that the client can decrypt the authentication information based on the pre-stored device private key and then initiate the next check-in. The management platform pre-stores a platform private key and a platform public key, generates a project certificate corresponding to the currently created project, identifies the client based on the project certificate, and sends the authentication information to the client. The client then decrypts the authentication information using the device private key to obtain the user's identity credential, and encrypts the user's identity credential using the pre-integrated platform public key to initiate the check-in. The step of verifying the decrypted attendance information and generating authentication information based on the device public key corresponding to the client when the attendance information is confirmed to be correct includes: The system extracts user identity credentials from the check-in information and generates time-sensitive information based on the user identity credentials. Specifically, it obtains the user permissions corresponding to the user identity credentials and determines the number of token usages based on the user permissions; it obtains corresponding verification parameters based on the client's current geographical location information; and it generates the time-sensitive information based on the current time, the number of token usages, and the verification parameters. The user identity credentials and the validity period information are combined to generate a security token. The process involves collecting the hardware fingerprint of the device where the client is located and the hash value of the currently running software environment, and generating additional parameters based on the hardware fingerprint and the software environment hash value. The token generation algorithm is updated based on the additional parameters, and the security token is generated from the user identity credentials and the validity period information using the token generation algorithm. The security token is encrypted using the device public key corresponding to the client, and the encrypted security token is used to generate the identity authentication information.

2. The device security authentication method as described in claim 1, characterized in that, The step of verifying the decrypted attendance information and generating authentication information based on the device public key corresponding to the client when the attendance information is confirmed to be correct includes: Verify the user identity credentials and timeliness information in the check-in information; When the user identity credential is confirmed to be valid, it is determined whether the check-in information has expired based on the current time and the timeliness information. If the check-in information has not expired, then the check-in information is deemed to be correct.

3. The device security authentication method as described in claim 1, characterized in that, The management platform pre-stores a platform private key and a platform public key. The steps of generating a project certificate corresponding to the newly created project, determining the client based on the project certificate, and sending authentication information to the client include: Generate a unique asymmetric key pair for the project, and embed the device private key of the asymmetric key pair into the project certificate; The project certificate is encrypted using an encryption key generated by a symmetric encryption algorithm, and the encrypted project certificate is then sent to the client corresponding to the project.

4. A method for certifying equipment safety, characterized in that, When applied to a client, the device security authentication method includes the following steps: Receive identity authentication information issued by the management and control platform, and decrypt the identity authentication information using the pre-stored device private key to obtain the user identity credential; The user identity credential is encrypted using a pre-integrated platform public key to generate attendance information, which is then sent to the management platform for verification. After successful verification on the management platform, you will be taken to the project control page. After successful verification, the management platform reissues the identity authentication information, and after decrypting the identity authentication information, it sends the next check-in information to the management platform. The management platform extracts user identity credentials from the check-in information and generates time-limited information based on the user identity credentials. Specifically, it obtains the user permissions corresponding to the user identity credentials and determines the number of token usages based on the user permissions; it obtains corresponding verification parameters based on the client's current geographical location information; it generates the time-limited information based on the current time, the number of token usages, and the verification parameters; it combines the user identity credentials and the time-limited information to generate a security token, wherein it collects the hardware fingerprint of the client's device and the hash value of the currently running software environment, and generates additional parameters based on the hardware fingerprint and the software environment hash value; it updates the token generation algorithm based on the additional parameters, and generates the security token using the token generation algorithm based on the user identity credentials and the time-limited information; and it encrypts the security token using the device public key corresponding to the client, using the encrypted security token to generate the identity authentication information.

5. The equipment security authentication method as described in claim 4, characterized in that, The step of receiving authentication information from the management platform and decrypting the authentication information using a pre-stored device private key to obtain user identity credentials includes: The security token is obtained by decrypting the authentication information using the device's private key. Upon verifying that the security token is correct, the security token is parsed to obtain the user identity credential.

6. A device safety authentication device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the device security authentication method as described in any one of claims 1 to 5.

7. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the device security authentication method as described in any one of claims 1 to 5.

Images