Network access verification method and device, electronic equipment and computer readable storage medium

Abstract

The invention discloses a network access verification method for a client, and the method comprises the steps: extracting a client key when a network access request needs to be initiated; generating a one-time password of the network access request according to the key and based on a preset password generation mode; sending network access verification information including the one-time password; when the network access request is put forward, the network access verification information comprises the one-time password. Correspondingly, the network access verification method applied to the password server comprises the following steps: receiving network access verification information sent by a client; and a server side one-time password is generated by using a secret key corresponding to the client side in a password generation mode and a password generation condition which are the same as those of the client side, the server side one-time password is compared with the one-time password in the network access verification information, and whether the network access request is passed or not is notified according to a comparison result. According to the scheme, the data security of the intranet can be improved. The invention further provides a network access verification device, electronic equipment and a computer readable storage medium.

Description

Technical Field

[0001] This application relates to the field of Internet technology, specifically to a network access verification method, device, electronic device, and computer-readable storage medium. Background Technology

[0002] With the rapid development of wireless networks, network security is receiving increasing attention, especially in certain professional network environments, such as joining an enterprise's internal wireless network, which places higher demands on the authentication of users.

[0003] When performing wireless network access verification, related technologies typically use authentication certificates to verify the security of devices entering the network. Specifically, the user terminal pre-stores the authentication certificate for network access verification. When the user terminal needs to connect to the network, it sends the authentication certificate to the server. When the server verifies that the authentication certificate sent by the user terminal is valid, it controls the user terminal to connect to the network.

[0004] However, since authentication certificates can be stolen by attackers, and once stolen, attackers can store the authentication certificates on other devices, they can successfully access the intranet from other devices that are not under the control of the attacker, making it easy for data in the intranet to be stolen and resulting in low data security. Summary of the Invention

[0005] This application provides a network access authentication method, system, device, electronic device, and computer-readable storage medium, which can better prevent attackers from successfully connecting to the network and accessing the intranet on an uncontrolled device after stealing authentication certificates, thereby better preventing the theft of data within the intranet and improving data security. The specific solution is as follows:

[0006] Firstly, this application provides a network access verification method applied to a terminal device, the method comprising:

[0007] When a network access request needs to be initiated to the target network, the client key of the terminal device itself is extracted;

[0008] Based on the client key and a preset password generation method, a one-time password corresponding to this network access request is generated;

[0009] Send network access verification information, including a one-time password;

[0010] When submitting the network access request, the network access verification information includes the one-time password.

[0011] Optionally, before sending the network access verification information, including a one-time password, the method further includes:

[0012] Obtain the digital certificate corresponding to the target network stored in the terminal device itself;

[0013] When submitting the network access request, the network access verification information also includes the digital certificate.

[0014] Optionally, before sending the network access verification information, including a one-time password, the method further includes:

[0015] Obtain the user information corresponding to the target network;

[0016] Update the user information with the one-time password to obtain the updated user information;

[0017] The one-time password in the network access verification information is represented by the updated user information.

[0018] Optionally, generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes:

[0019] Obtain the time information corresponding to the network access request;

[0020] Based on the time information and the client key, and using the first preset password generation method, a one-time password corresponding to this network access request is generated.

[0021] Optionally, the time information is the time interval position corresponding to when the network access request is initiated.

[0022] Optionally, generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes:

[0023] Obtain the password generation count stored in the terminal device;

[0024] Based on the password generation count and the client key, and using the second preset password generation method, a one-time password corresponding to this network access request is generated;

[0025] The method further includes:

[0026] After the terminal device generates a one-time password each time, the password generation count stored in the terminal device is incremented by 1;

[0027] Send the latest password generation count stored in the terminal device.

[0028] Optionally, the client key is stored in the security processor of the terminal device, and the data stored in the security processor cannot be exported.

[0029] Optionally, the step of extracting the client key stored in the terminal device itself includes: the security processor of the terminal device extracting the client key stored in the security processor itself;

[0030] The step of generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes: the security processor generating a one-time password corresponding to this network access request based on the client key and a preset password generation method.

[0031] Optionally, obtaining the time information corresponding to the network access request includes: obtaining the time information corresponding to the network access request by preset security software installed in the terminal device, and sending the time information to the security processor.

[0032] Optionally, the digital certificate and the user information are stored in the certificate database of the terminal device;

[0033] The step of updating the user information to the one-time password to obtain the updated user information includes:

[0034] The security processor sends the generated one-time password to the certificate database;

[0035] The certificate database updates the user information with the one-time password to obtain the updated user information;

[0036] Sending network access verification information, including a one-time password, includes:

[0037] The certificate database sends network access verification information, including a one-time password and updated user information, to the verification client.

[0038] The verification client sends the network access verification information to the password server.

[0039] Secondly, this application provides a network access verification method applied to a cryptographic server, the method comprising:

[0040] The password server receives network access verification information sent by the client and stores the client keys of each client it manages.

[0041] Using the client key corresponding to the client that initiated the network access request, and based on the same password generation method and conditions as the client, a one-time password is generated on the password server.

[0042] The server-side one-time password is compared with the one-time password in the network access verification information, and the gateway is notified whether the network access request is approved based on the comparison result.

[0043] Optionally, the cryptographic server also stores the digital certificates of each client it manages;

[0044] Based on the comparison results, the gateway is notified whether the network access request is approved, including:

[0045] When the one-time password on the server side is the same as the one-time password in the network access verification information, and the target digital certificate is consistent with the digital certificate in the network access verification information, the gateway is notified to approve the network access request. The target digital certificate is the digital certificate that corresponds to the digital certificate that sent the network access request among the various digital certificates stored in the password server.

[0046] Thirdly, this application provides a network access verification device applied to a terminal device, the device comprising:

[0047] The acquisition unit is used to extract the client key stored in the terminal device itself when it is necessary to initiate a network access request to the target network;

[0048] The generation unit is used to generate a one-time password corresponding to this network access request based on the client key and a preset password generation method;

[0049] A sending unit is configured to send network access verification information, including a one-time password, when submitting the network access request; the network access verification information includes the one-time password.

[0050] Fourthly, this application provides a network access verification device for use in a cryptographic server, the device comprising:

[0051] The receiving unit is used to receive network access verification information sent by the client, and the cryptographic server stores the client keys of each client it manages;

[0052] The lookup unit is used to look up the user key corresponding to the client from the stored user keys corresponding to each user;

[0053] The verification unit is used to generate a server-side one-time password on the password server using the client key corresponding to the client that initiated the network access request, according to the same password generation method and under the same conditions as the client; compare the server-side one-time password with the one-time password in the network access verification information, and notify the gateway whether the network access request is approved based on the comparison result.

[0054] Fifthly, this application also provides an electronic device, comprising: a processor, a memory, and computer program instructions stored in the memory and executable on the processor; wherein the processor executes the computer program instructions to implement the method as described in any one of the first or second aspects.

[0055] In a sixth aspect, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in any one of the first or second aspects.

[0056] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method as described in any one of the first or second aspects.

[0057] Compared with the prior art, this application has the following advantages:

[0058] The network access verification method provided in this application embodiment involves the terminal device extracting its own stored client key when it needs to initiate a network access request to a target network. The client key is the key corresponding to the target network. After obtaining the client key corresponding to the target network, the client generates a one-time password corresponding to this network access request based on the client key and a preset password generation method. Since the one-time password generated by the terminal device is different each time, it is only used by the terminal device for this connection to the target network. The next time it needs to connect to the target network, the terminal device will regenerate a new one-time password based on the preset password generation method and send the newly generated one-time password to the password server. The password server is used to verify the network access of each client connecting to the target network. After receiving the one-time password from the client, the password server, since it stores the client keys of each client it manages, will use the client key corresponding to the client that initiated the network access request and generate a server-side one-time password based on the same password generation method and conditions as the client. The server-side one-time password is then compared with the one-time password sent by the client to determine whether to notify the gateway of the target network to approve the client's network access request.

[0059] As can be seen, the solution provided in this application requires the terminal device to generate a one-time password based on the client key corresponding to the target network stored in its own memory and a preset password generation method each time it needs to connect to the target network. Since the generated one-time password is different each time, the client needs to send a new one-time password for network access verification each time it connects to the network. The generation of a new one-time password requires the preset password generation method, which can only be implemented by installing the verification software corresponding to the target network. Not every device can obtain the preset password generation method. In this way, even if an attacker steals the client key, they will not know how to generate the one-time password and will not be able to connect to the target network. This makes it difficult for attackers to steal data in the target network and improves data security. Attached Figure Description

[0060] Figure 1 This is a schematic diagram illustrating the application scenario of the network access verification method provided in this application;

[0061] Figure 2 This is a flowchart illustrating an example of the network access verification method provided in this application embodiment;

[0062] Figure 3 This is an example diagram of an authentication interface in an embodiment of this application;

[0063] Figure 4 This is an example diagram of another instance of the authentication interface in the embodiments of this application;

[0064] Figure 5 This is a flowchart illustrating another example of the network access verification method provided in this application embodiment;

[0065] Figure 6 This is a timing interaction diagram of an example of the network access verification method provided in the embodiments of this application;

[0066] Figure 7 This is a timing interaction diagram of another example of the network access verification method provided in the embodiments of this application;

[0067] Figure 8 This is a schematic diagram of another example of the network access verification method provided in this application;

[0068] Figure 9 This is a structural block diagram of the electronic device provided in this application. Detailed Implementation

[0069] To enable those skilled in the art to better understand the technical solutions of this application, the application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. However, this application can be implemented in many other ways different from those described below. Therefore, based on the embodiments provided in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0070] It should be noted that the terms "first," "second," "third," etc., in the claims, specification, and drawings of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. Such data are interchangeable where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that shown or described in this application. Furthermore, the terms "comprising," "having," and their variations are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0071] It should be understood that in the embodiments of this application, "at least one" means one or more, and "more than one" means two or more. "And / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the related objects before and after it are in an "or" relationship. "Contains A, B and / or C" means containing any one, two, or three of A, B, and C.

[0072] It should be understood that in the embodiments of this application, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A, and B can be determined based on A. Determining B based on A does not mean that B is determined solely based on A; B can also be determined based on A and / or other information.

[0073] To facilitate understanding of the various embodiments of this application, the application background of the embodiments will be explained.

[0074] With the rapid development of wireless networks, network security is receiving increasing attention, especially in professional network environments such as joining an enterprise's internal wireless network, where higher requirements are placed on user authentication. Related technologies typically use authentication certificates to verify the security of devices accessing the network. Specifically, the user terminal pre-stores the authentication certificate for network access verification. When the user terminal needs to connect to the network, it sends the authentication certificate to the server. If the server verifies the authentication certificate sent by the user terminal and it passes the verification, the user terminal is allowed to connect to the network. However, because authentication certificates can be stolen by attackers, and if a certificate is stolen, an attacker can store the authentication certificate on other devices, allowing them to successfully access the internal network from any device, making data within the internal network vulnerable to theft and resulting in low data security.

[0075] To address the above issues, embodiments of this application provide a network access verification method, apparatus, electronic device, and computer-readable storage medium. The aim is to better prevent attackers from stealing authentication certificates and successfully connecting to the network on other devices to access the internal network, thereby better preventing data theft within the internal network and improving data security.

[0076] The network access verification method provided in this application is applied to scenarios where terminal devices apply to connect to a target network. Specifically, the target network can be a wireless network, an internal local area network, etc. The internal network can be an enterprise internal network, a school internal network, etc., or an internal network of other organizations. This application does not specifically limit the network.

[0077] To facilitate understanding of the method embodiments of this application, their application scenarios are described. Please refer to... Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of the solution provided in the embodiments of this application. This application scenario is merely an illustrative example and is not intended to limit the specific application scenario. Figure 1 As shown, a cryptographic server 102 and a terminal device 101 are provided in this application scenario. In this embodiment, the terminal device 101 and the cryptographic server 102 establish a connection through network communication to perform data transmission.

[0078] Terminal device 101 can be an electronic device with data processing capabilities, such as a mobile phone, tablet computer, smartwatch, desktop computer, smart TV, VR device, in-vehicle device, wearable device, or laptop computer. Terminal device 101 is used to send network access verification information to the password server corresponding to the target network for verification when it needs to connect to the target network. When the verification is successful, terminal device 101 can connect to the target network.

[0079] The cryptographic server 102 possesses high computing power. It can be a server with high-speed central processing unit (CPU) computing power, long-term reliable operation, strong input / output (I / O) external data throughput, and better scalability. The cryptographic server 102 can be a single server or a server cluster, where each server in the cluster can be used to perform different steps of network access authentication. The cryptographic server 102 receives and verifies the network access authentication information sent by the terminal device 101, and upon successful verification, notifies the gateway of the target network to connect to the target network through the terminal device 101.

[0080] The client 101 and the cryptographic server 102 can communicate using various communication systems, such as wired or wireless communication systems. Wireless communication systems can include, for example, Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), General Packet Radio Service (GPRS), Long Term Evolution (LTE), LTE Frequency Division Duplex (FDD), LTE Time Division Duplex (TDD), Universal Mobile Telecommunications System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), future 5th generation (5G) systems or new radio (NR), and satellite communication systems.

[0081] Example 1

[0082] The first embodiment of this application provides a network access verification method. This method is applied to a terminal device, which can be an electronic device with data processing capabilities, such as a mobile phone, tablet computer, smartwatch, desktop computer, smart TV, VR device, in-vehicle device, wearable device, or laptop computer.

[0083] Please refer to Figure 2 As shown, the network access verification method provided in the first embodiment of this application includes the following steps S110 to S130.

[0084] Step S110: When it is necessary to initiate a network access request to the target network, extract the client key stored in the terminal device itself.

[0085] The terminal device stores the client key corresponding to the target network.

[0086] Specifically, in response to receiving a network access request for the target network, it can be determined that a network access request needs to be initiated for the target network. This network access request is used to request access to the target network. The target network can be a wireless local area network (WLAN), a virtual private network (VPN), a wired local area network (VPN), or other types of communication networks; this application does not specifically limit this. Among them, the wireless local area network can be a Wireless Fidelity (Wi-Fi) network, and the virtual private network (VPN) is used to enable remote users to securely access the internal network resources of an enterprise or other organization via the public internet.

[0087] The target network mentioned above can also be a target service, which can be a virtual desktop service, cloud service, office application service, etc., but is not limited to these.

[0088] In this embodiment, the need to initiate a network access request to the target network can be determined when the user triggers a network access operation on the terminal device, or the terminal device can determine the need to initiate a network access request to the target network when it detects that the network access timing has arrived. The network access timing may be that the terminal device is within the coverage area of ​​the target network, or that the terminal device is running the target service, etc., and this application does not specifically limit it. The following mainly uses a wireless communication network as an example to introduce the network access verification scheme of this application.

[0089] The terminal device pre-stores the client key corresponding to the target network. When the terminal device needs to initiate a network access request to the target network, it retrieves the client key corresponding to the target network from its own storage. The client key refers to the client key corresponding to the client used for network access verification on the terminal device. The client used for network access verification can be the verification client mentioned later.

[0090] In this embodiment, the cryptographic server can pre-allocate corresponding client keys to each client and send the client keys to the corresponding clients, so that the clients can save the client keys corresponding to the target network on their corresponding terminal devices. The cryptographic server corresponding to the target network also stores the client keys corresponding to each user for subsequent client network access verification.

[0091] In one specific embodiment, the client key can be stored in the security processor on the server side. That is, the security processor stores the client key corresponding to each client. The data stored in the security processor cannot be exported, so the client key stored in the security processor cannot be exported. As a result, attackers cannot steal the client key, which better prevents attackers from generating one-time passwords and further improves data security.

[0092] The aforementioned security processor can be a processing chip in a server. The security processor can resist side-channel attacks, physical probes, or fault injections, so that the stored data cannot be exported to the external environment. The security processor can be isolated from the client's main processor (such as CPU), so that the security processor can still ensure data security when the host system is compromised.

[0093] Step S120: Based on the client key and a preset password generation method, generate a one-time password corresponding to this network access request.

[0094] After each client sets its corresponding client key, the client's identity information can be verified through the client key. The one-time password generated based on the client key can better ensure the uniqueness of the one-time password generated by different clients.

[0095] The preset password generation method is a password generation program written on the terminal device. The preset password generation method is obtained by the terminal device from the password server or other servers corresponding to the target network when the terminal device meets the preset verification conditions corresponding to the target network. The preset verification conditions may include at least one of the following: the terminal device runs preset security software, or the terminal device completes the preset security operation corresponding to the target network.

[0096] The aforementioned pre-installed security software can detect operational behaviors on terminal devices and restrict unauthorized actions. It can also block the execution of software not certified as security software, block suspicious data downloads, and delete suspicious data. Furthermore, it can perform other security protection operations, which are not specifically limited in this application. The pre-installed security software can also provide a network access interface, through which users can trigger network access commands.

[0097] When a terminal device runs pre-installed security software, it indicates that the terminal device's operating environment is relatively secure. In this case, if the terminal device connects to the target network, it can operate on the content within the target network under the detection of the pre-installed security software, thus effectively ensuring the security of data within the target network. Therefore, a program corresponding to the password generation method can be installed on the client.

[0098] The terminal device completes the preset security operations required by the target network. This can include preset registration, preset real-name authentication, or other operations that ensure the security of the terminal device. This application does not specifically limit this. When the terminal device completes the preset security operations required by the target network, it indicates that the terminal device is in a secure environment, and a program corresponding to the preset password generation method can be installed on the terminal device.

[0099] Specifically, step S120 can generate the corresponding one-time password through the following step S121.

[0100] Step S121: Obtain the time information corresponding to the network access request, and generate a one-time password corresponding to this network access request based on the time information and the client key, and based on the first preset password generation method.

[0101] The time information corresponding to the network access request is the time information when the network access request is triggered. When generating the one-time password corresponding to the client based on the above time information and the above client key, the above client key and the above time information can be combined to generate the one-time password corresponding to the client. This makes it simple and convenient to generate the one-time password, and also makes it easier and more convenient for the password server to verify the one-time password subsequently, improving the ease of verification. Alternatively, the above time information and the above client key can be pre-encoded according to a preset encoding method to obtain the encoded information as the one-time password. The specific method of generating the one-time password is not limited in this application.

[0102] This embodiment generates a one-time password based on the time information corresponding to the network access request and the client key. Since the client key can distinguish different users, and the same user can usually only send one network access request at the same time, the one-time password generated by the combination of the client key and the time information can simply and reliably guarantee the uniqueness of the one-time password generated for different users and for the same user at different times.

[0103] The time information corresponding to the network access request can be the moment the network access request is generated. In order to better avoid the time delay between the client generating the network access request and the password server receiving the network access request, the time information corresponding to the network access request can be the time interval position corresponding to the initiation of the network access request, that is, the time is divided into various time intervals, such as dividing the time into 30-second time intervals. The time interval position is which time interval the network access request corresponds to, such as the first 30-second time interval, the second 30-second time interval, etc. Each time interval position can be marked by an identifier to facilitate the generation of a one-time password with the client key.

[0104] In this embodiment, after the terminal device needs to initiate a network access request, it will send the network access request to the cryptographic server, so that the cryptographic server can obtain the time of receiving the network access request. The cryptographic server can determine the time information of receiving the network access request as the time information of generating the network access request, so as to facilitate the subsequent network access verification of the client.

[0105] In an optional embodiment, the terminal device may also send the generation time of the network access request to the cryptographic server, thereby enabling the cryptographic server to more easily and accurately obtain the time information of the time when the terminal device sent the network access request, so as to facilitate subsequent network access verification of the client.

[0106] Optionally, step S120 can also generate a one-time password for the client using the preset password generation method of step S122.

[0107] Step S122: Obtain the password generation count stored in the terminal device, and generate a one-time password corresponding to this network access request based on the password generation count and the client key, and based on the second preset password generation method.

[0108] The password generation count represents the number of times the server has generated a one-time password so far. When generating a one-time password for the terminal device based on the password generation count and the client key, the client key and the current password generation count can be combined to generate the one-time password for the terminal device. This simplifies the generation of one-time passwords and makes it easier for the password server to verify them, improving verification convenience. Alternatively, the encoded information obtained by encoding the password generation count and the client key according to a preset encoding method can be used as the one-time password. The specific method of generating the one-time password is not limited in this application.

[0109] In this embodiment, when a one-time password corresponding to the terminal device is generated based on the above-mentioned password generation count and the above-mentioned client key, this application may further include the following steps a to b.

[0110] Step a: After each one-time password is generated by the terminal device, increment the password generation count stored on the terminal device by 1.

[0111] Step a ensures that the password generation count matches the total number of one-time passwords generated by the terminal device.

[0112] Step b: Send the latest password generation count stored in the terminal device.

[0113] Step b involves sending the latest password generation count stored on the terminal device to the password server. This allows the password server to determine the password generation count corresponding to the current network access request based on the one-time password most recently obtained from the client, and then verify the client's one-time password based on the determined password generation count.

[0114] This embodiment generates one-time passwords based on password generation counts. Compared to generating one-time passwords based on time information, this embodiment can effectively solve the problem of inconsistent system times, making it easier for the password server to generate passwords and perform subsequent verification.

[0115] Step S130: Send network access verification information including a one-time password.

[0116] Specifically, the terminal device can generate network access verification information containing the one-time password based on the one-time password, and send the network access verification information to the password server corresponding to the target network, so that the password server can verify the terminal device based on the network access verification information, and determine whether to notify the gateway of the target network to approve the network access request of the terminal device based on the verification result.

[0117] Specifically, the one-time password can be directly used as the network access verification information, or other information can be added to combine the one-time password with other information as the network access verification information.

[0118] When submitting the network access request, the network access verification information includes the one-time password.

[0119] In one embodiment, prior to step S130, the method may further include the following step S130a.

[0120] Step S130a: Obtain the digital certificate corresponding to the target network stored in the terminal device itself.

[0121] The terminal device also stores the digital certificate corresponding to the target network.

[0122] The aforementioned digital certificate is used to verify a user's identity. The digital certificate may include user information, such as user identifier, information about the device the user logged into, the user's affiliated organization or institution, and the user's location, but is not limited to these. The digital certificate may also include authentication keys, certificate validity period, signature, and other information. Those skilled in the art can flexibly configure the content included in the digital certificate according to actual needs.

[0123] The target network's cryptographic server stores the digital certificates of each client it manages, in order to verify the digital certificates of each client.

[0124] Correspondingly, when submitting the network access request, the network access verification information may also include the digital certificate.

[0125] Specifically, the terminal device can generate network access verification information containing the digital certificate and the one-time password based on the digital certificate and the one-time password.

[0126] Specifically, the aforementioned digital certificate and one-time password can be used as network access verification information, or other information can be added to generate network access verification information; this application does not specifically limit this.

[0127] In one specific embodiment, the digital certificate may be stored in a certificate database.

[0128] In the embodiments of this application, each step can be executed by different processing modules of the server. Those skilled in the art can flexibly configure which module executes the steps, and this application does not specifically limit the specific steps.

[0129] This embodiment improves the reliability of device verification and further enhances data security by adding a digital certificate to the network access verification information, enabling simultaneous verification of whether the digital certificate and one-time password match when verifying the client's identity.

[0130] In one specific embodiment, the terminal device may also have preset security software installed. The relevant content of the preset security software can be referred to the description above, and will not be repeated here. When the one-time password is generated by the security processor, the security processor can send the one-time password to the preset security software, and the preset security software installed in the terminal device will send the one-time password to the password server.

[0131] In this embodiment, the one-time password is forwarded to the network access verification information generation server through the server corresponding to the security software, so that the one-time password can be sent under the protection of the security software, thereby improving data security.

[0132] In one specific implementation, when the security processor generates the one-time password, the preset security software installed in the terminal device can obtain the time information corresponding to the network access request and send the time information to the security processor so that the security processor can generate the one-time password according to the time information.

[0133] In one specific embodiment, before step S130, the above method may further include the following steps S130b to S130c.

[0134] Step S130b: Obtain user information corresponding to the target network.

[0135] Step S130c: Update the user information corresponding to the target network to the one-time password mentioned above, and obtain the updated user information.

[0136] Correspondingly, the one-time password in the network access verification information is represented by the updated user information.

[0137] The user information corresponding to the target network can be filled in by the user or stored by the terminal device itself.

[0138] The user information corresponding to the target network can be a username, password, or other user information. In this embodiment, since the user information will be updated to a one-time password, the original user information will not be used for subsequent device verification. Therefore, the user information can be initial information or default information, so users do not need to set corresponding user information, making user operation more convenient.

[0139] Step S130c can update the username or password corresponding to the target network to the one-time password mentioned above, that is, write the one-time password into the username field or the password field. This makes it easier to verify the one-time password by verifying user information later. Since verifying user information is a relatively simple and convenient verification method in related technologies, writing the one-time password into the user information field can make the verification process simpler and more efficient.

[0140] In one specific embodiment, network access verification information containing the updated user information and the updated user information can be generated based on the updated user information and the digital certificate.

[0141] Specifically, the updated user information and the digital certificate mentioned above can be used as the network access verification information for the terminal device. Alternatively, other information can be added to generate network access verification information that includes the digital certificate and the updated user information.

[0142] Terminal devices can directly send network access verification information to the password server, or, to improve user interactivity and increase user engagement during the verification process, such as... Figure 3 As shown, the terminal device can display an authentication interface, which includes a user information display area. This user information display area shows the updated user information from the network access verification information, specifically the aforementioned one-time password. Figure 3 The updated user information is "152375", which allows users to better understand the authentication process.

[0143] like Figure 4As shown, the authentication interface also displays a certificate entry area and a user information entry area. Since the terminal device stores a digital certificate, the user can select or enter the digital certificate corresponding to the target network in the certificate entry area. For example, the user can select the digital certificate corresponding to the target network from the drop-down list. After the client generates the updated user information (i.e., the one-time password), it can display the updated user information. After viewing the displayed updated user information, the user can enter the displayed updated user information in the user information entry area. Alternatively, the terminal device can automatically enter the generated updated user information in the user information entry area. After the user has entered the digital certificate and confirmed that the updated user information (i.e., the one-time password) has been entered, a confirmation verification command can be triggered. For example, a confirmation verification command can be triggered... Figure 4 The "OK" control allows the terminal device to send network access verification information to the password server after detecting that the user has triggered a confirmation verification command. This enables the terminal device to send more complete and accurate network access verification information, reduces the sending of many invalid network access verification messages, improves verification efficiency, and reduces resource consumption caused by invalid verification.

[0144] This embodiment uses dual network access verification information, including a one-time password and a digital certificate, to better ensure the network security of terminal devices, thereby improving the security of internal data.

[0145] In one specific embodiment, when the client key is stored in the security processor, in step S110, the security processor of the terminal device can extract the client key stored in the security processor itself. In step S120, the security processor can generate a one-time password corresponding to this network access request based on the client key and a preset password generation method. Generating a one-time password for this network access request through the security processor can better ensure data security.

[0146] In one specific embodiment, the digital certificate and the user information may be stored in the certificate database of the terminal device.

[0147] In step S130c, the security processor can send the generated one-time password to the certificate database, and the certificate database can update the user information with the one-time password to obtain the updated user information. In step S130, the certificate database can send network access verification information including the one-time password and the updated user information to the verification client, and the verification client can send the network access verification information to the password server.

[0148] This embodiment manages authentication certificates and user information through a certificate database and sends them to the verification client for network access verification. The verification client then sends the verification information to the password server, making the network access verification of terminal devices smoother and more reasonable.

[0149] In one specific embodiment, the verification client can send the network access verification information to the gateway of the target network, and the gateway can then send the network access verification information to the password server.

[0150] The network access verification method provided in this application embodiment involves the terminal device extracting its own stored client key when it needs to initiate a network access request to a target network. The client key is the key corresponding to the target network. After obtaining the client key corresponding to the target network, the client generates a one-time password corresponding to this network access request based on the client key and a preset password generation method. Since the one-time password generated by the terminal device is different each time, it is only used by the terminal device for this connection to the target network. The next time it needs to connect to the target network, the terminal device will regenerate a new one-time password based on the preset password generation method and send the newly generated one-time password to the password server. The password server is used to verify the network access of each client connecting to the target network. After receiving the one-time password from the client, the password server, since it stores the client keys of each client it manages, will use the client key corresponding to the client that initiated the network access request and generate a server-side one-time password based on the same password generation method and conditions as the client. The server-side one-time password is then compared with the one-time password sent by the client to determine whether to notify the gateway of the target network to approve the client's network access request.

[0151] As can be seen, the solution provided in this application requires the terminal device to generate a one-time password based on the client key corresponding to the target network stored in its own memory and a preset password generation method each time it needs to connect to the target network. Since the generated one-time password is different each time, the client needs to send a new one-time password for network access verification each time it connects to the network. The generation of a new one-time password requires the preset password generation method, which can only be implemented by installing the verification software corresponding to the target network. Not every device can obtain the preset password generation method. In this way, even if an attacker steals the client key, they will not know how to generate the one-time password and will not be able to connect to the target network. This makes it difficult for attackers to steal data in the target network and improves data security.

[0152] The following example illustrates the network access verification method provided in this application. Figure 5As shown, the network access verification method in this example includes the following steps 11 to 17.

[0153] Step 11: When a network access request needs to be initiated to the target network, the security processor of the terminal device generates a one-time password corresponding to this network access request based on the client key and the time information corresponding to the network access request, and sends the one-time password to the preset security software installed on the terminal device.

[0154] Step 12: The preset security software sends the received one-time password to the certificate database on the terminal device. The certificate database updates the user information corresponding to the terminal device with the one-time password, thus obtaining the updated user information.

[0155] Step 13: The certificate database sends the updated user information and the digital certificate stored in the terminal device as network access verification information to the verification client.

[0156] The verification client is the client software on the terminal device used for network access verification.

[0157] Step 14: The client verifies that it sends the network access verification information, which includes the digital certificate and updated user information, to the password server corresponding to the target network via the WiFi access point.

[0158] Step 15: The cryptographic server corresponding to the target network verifies whether the digital certificate in the verification information matches the target digital certificate.

[0159] The target digital certificate is the digital certificate that corresponds to the one used to send the network access request, which is stored in the cryptographic server. The cryptographic server stores the digital certificates of each client it manages.

[0160] Step 16: The password server corresponding to the target network verifies whether the user information in the above network access verification information is consistent with the one-time password on the server.

[0161] Step 17: If the verification results of Step 15 and Step 16 are consistent, then notify the gateway of the target network to approve the network access request.

[0162] The specific execution process of each step in this example can be found in the text above, and will not be described in detail here.

[0163] The following example illustrates the process of the network access verification method provided in this application. Figure 6 As shown, the network access verification method in this example includes the following steps S1 to S8.

[0164] Step S1: When a network access request needs to be initiated to the target network, the preset security software installed on the terminal device sends the time information corresponding to the network access request to the security processor of the terminal device.

[0165] The security processor stores the client key corresponding to the target network.

[0166] Step S2: The security processor generates a one-time password based on the client key and the time information corresponding to the network access request, and sends the one-time password to the preset security software.

[0167] Step S3: The preset security software sends the one-time password to the certificate database on the terminal device.

[0168] Step S4: The certificate database updates the stored user information for the target network with the aforementioned one-time password to obtain the updated user information.

[0169] The certificate database stores user information and digital certificates for the target network.

[0170] Step S5: The certificate database sends the stored digital certificates and updated user information to the verification terminal device.

[0171] Step S6: The verification client sends the received digital certificate and updated user information to the password server corresponding to the target network through the WiFi access point.

[0172] Step S7: The password server verifies whether the received user information is consistent with the one-time password generated for the terminal device in the database, and verifies whether the received digital certificate is consistent with the digital certificate corresponding to the network access request stored in the database.

[0173] Step S8: If both consistency verifications in step S7 are consistent, then notify the gateway corresponding to the target network to approve the network access request.

[0174] The following example illustrates the process of the network access verification method provided in this application. Figure 7 As shown, the network access verification method in this example includes the following steps A to I.

[0175] Step A: When a network access request needs to be initiated to the target network, the preset security software installed on the terminal device sends a password generation instruction to the security processor of the terminal device.

[0176] The security processor stores the client key corresponding to the target network and the password generation count.

[0177] Step B: The security processor generates a one-time password based on the client key and the password generation count, sends the one-time password to the preset security software, and increments the current password generation count by 1.

[0178] Step C: The default security software sends a one-time password to the terminal device's certificate database.

[0179] Step D: The certificate database updates the stored user information for the target network with a one-time password, thus obtaining the updated user information.

[0180] The certificate database stores user information and digital certificates for the target network.

[0181] Step E: The certificate database sends the stored digital certificates for the target network and the updated user information to the verification client.

[0182] Step F: The verification client sends the received digital certificate and updated user information to the password server corresponding to the target network via the WiFi access point.

[0183] Step G: The password server verifies whether the received user information matches the one-time password generated for the client in the database, and verifies whether the received digital certificate matches the digital certificate corresponding to the network access request stored in the database.

[0184] Step H: If both consistency verifications in step G are consistent, then notify the gateway corresponding to the target network to approve the network access request.

[0185] Example 2

[0186] The second embodiment of this application also provides a network access verification method applied to a cryptographic server, which is a server corresponding to the target network. Since the relevant execution process of the cryptographic server-side embodiment has been described in detail in the terminal device-side method embodiment of the first embodiment, this embodiment is described relatively simply. For details of the relevant technical features and their effects, please refer to the corresponding description of the network access verification method embodiment provided in the first embodiment above. Figure 8 As shown, the network access verification method provided in this embodiment includes the following steps S210 to S230.

[0187] Step S210: Receive network access verification information sent by the client.

[0188] The cryptographic server stores client keys for each client it manages. The network access verification information sent by the client includes a one-time password. The client sends the network access verification information using the network access verification method described in any one of the first embodiments. The aforementioned client can be a terminal device, specifically a verification client installed on the terminal device.

[0189] Step S220: Using the client key corresponding to the client that initiated the network access request, generate a one-time password on the password server according to the same password generation method and under the same conditions as the client.

[0190] In this embodiment of the application, the password generation method and conditions used by the password server to generate the one-time password are the same as those used by the client that sends the network access request.

[0191] Step S230: Compare the one-time password on the server side with the one-time password in the network access verification information, and notify the gateway to approve the network access request based on the comparison result.

[0192] Optionally, when the one-time password on the server side is the same as the one-time password in the network access verification information, the gateway can be notified to approve the network access request.

[0193] In one specific embodiment, the cryptographic server may also store the digital certificates of each client it manages. Step S230 can be implemented according to the following step S31.

[0194] Step S31: When the one-time password on the server side is the same as the one-time password in the network access verification information, and the target digital certificate is consistent with the digital certificate in the network access verification information, the gateway is notified to approve the network access request. The target digital certificate is the digital certificate that corresponds to the digital certificate that sent the network access request among the various digital certificates stored in the password server.

[0195] Example 3

[0196] The third embodiment of this application also provides a network access verification device corresponding to the network access verification method embodiment provided in the first embodiment, which is applied to a terminal device. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple. For details of the relevant technical features and their effects, please refer to the corresponding descriptions of the network access verification method embodiments provided above. The network access verification device provided in this embodiment includes:

[0197] The acquisition unit is used to extract the client key stored in the terminal device itself when it is necessary to initiate a network access request to the target network;

[0198] The generation unit is used to generate a one-time password corresponding to this network access request based on the client key and a preset password generation method;

[0199] A sending unit is configured to send network access verification information, including a one-time password, when submitting the network access request; the network access verification information includes the one-time password.

[0200] Optionally, the device further includes:

[0201] The acquisition unit is used to acquire the digital certificate corresponding to the target network stored in the terminal device itself;

[0202] When submitting the network access request, the network access verification information also includes the digital certificate.

[0203] Optionally, the acquisition unit is further configured to: acquire user information corresponding to the target network, update the user information to the one-time password, and obtain updated user information;

[0204] The one-time password in the network access verification information is represented by the updated user information.

[0205] Optionally, the generation unit is specifically used for:

[0206] Obtain the time information corresponding to the network access request;

[0207] Based on the time information and the client key, and using the first preset password generation method, a one-time password corresponding to this network access request is generated.

[0208] Optionally, the time information is the time interval position corresponding to when the network access request is initiated.

[0209] Optionally, the generation unit is specifically used for:

[0210] Obtain the password generation count stored in the terminal device;

[0211] Based on the password generation count and the client key, and using the second preset password generation method, a one-time password corresponding to this network access request is generated;

[0212] The device further includes:

[0213] The counting unit is used to increment the password generation count stored in the terminal device by 1 after the terminal device generates a one-time password each time; and to send the latest password generation count stored in the terminal device.

[0214] Optionally, the client key is stored in the security processor of the terminal device, and the data stored in the security processor cannot be exported.

[0215] Optionally, the acquisition unit is specifically used to: extract the client key stored in the security processor itself by the security processor of the terminal device;

[0216] The generation unit is specifically used to: generate a one-time password corresponding to this network access request by the security processor based on the client key and a preset password generation method.

[0217] Optionally, the acquisition unit is specifically used to: acquire the time information corresponding to the network access request by the preset security software installed in the terminal device, and send the time information to the security processor.

[0218] Optionally, the digital certificate and the user information are stored in the certificate database of the terminal device;

[0219] The step of updating the user information to the one-time password to obtain the updated user information includes:

[0220] The security processor sends the generated one-time password to the certificate database;

[0221] The certificate database updates the user information with the one-time password to obtain the updated user information;

[0222] Sending network access verification information, including a one-time password, includes:

[0223] The certificate database sends network access verification information, including a one-time password and updated user information, to the verification client.

[0224] The verification client sends the network access verification information to the password server.

[0225] Example 4

[0226] The fourth embodiment of this application also provides a network access verification device corresponding to the network access verification method embodiment provided in the second embodiment, which is applied to a cryptographic server. Since the device embodiment is basically similar to the method embodiment, it is described simply. For details of the relevant technical features and their effects, please refer to the corresponding descriptions of the network access verification method embodiments provided above. The network access verification device provided in this embodiment includes:

[0227] The receiving unit is used to receive network access verification information sent by the client, and the cryptographic server stores the client keys of each client it manages;

[0228] The verification unit is used to generate a server-side one-time password on the password server using the client key corresponding to the client that initiated the network access request, according to the same password generation method and under the same conditions as the client; compare the server-side one-time password with the one-time password in the network access verification information, and notify the gateway to approve the network access request based on the comparison result.

[0229] Example 5

[0230] The fifth embodiment of this application also provides an electronic device embodiment corresponding to the network access verification method provided in the first embodiment. The following description of the electronic device embodiment is merely illustrative. The electronic device embodiment is as follows:

[0231] Please refer to Figure 9 Understanding the above electronic devices, Figure 9 This is a schematic diagram of an electronic device. The electronic device provided in this embodiment includes: a processor 1001, a memory 1002, a communication bus 1003, and a communication interface 1004;

[0232] The memory 1002 is used to store computer instructions for data processing. When these computer instructions are read and executed by the processor 1001, the following steps are performed:

[0233] When a network access request needs to be initiated to the target network, the client key stored in the terminal device itself is extracted;

[0234] Based on the client key and a preset password generation method, a one-time password corresponding to this network access request is generated;

[0235] Send network access verification information, including a one-time password;

[0236] When submitting the network access request, the network access verification information includes the one-time password.

[0237] The sixth embodiment of this application also provides a computer-readable storage medium for implementing the method described in the first embodiment. The embodiments of the computer-readable storage medium provided in this application are described in a relatively simple manner; relevant parts can be found in the corresponding descriptions of the above method embodiments. The embodiments described below are merely illustrative.

[0238] The computer-readable storage medium provided in this embodiment stores computer instructions, which, when executed by a processor, perform the following steps:

[0239] The password server receives network access verification information sent by the client and stores the client keys of each client it manages.

[0240] Using the client key corresponding to the client that initiated the network access request, and based on the same password generation method and conditions as the client, a one-time password is generated on the password server.

[0241] The server-side one-time password is compared with the one-time password in the network access verification information, and the gateway is notified to approve the network access request based on the comparison result.

[0242] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0243] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0244] 1. Computer-readable media includes both permanent and non-permanent, removable and non-removable media, which can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined in this application, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0245] 2. Those skilled in the art will understand that embodiments of this application can provide methods, systems, or computer program products. Therefore, embodiments of this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0246] 3. This application embodiment may involve the use of user data. In practical applications, user-specific personal data may be used within the scope permitted by applicable laws and regulations of the country in which the application is located (e.g., with the user's explicit consent and effective notification to the user, etc.). Furthermore, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0247] Although this application discloses preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of this application. Therefore, the scope of protection of this application should be determined by the scope defined in the claims of this application.

Claims

1. A network access verification method, characterized in that, Applied to a terminal device, the method includes: When a network access request needs to be initiated to the target network, the client key of the terminal device itself is extracted; Based on the client key and a preset password generation method, a one-time password corresponding to this network access request is generated; Send network access verification information, including a one-time password; When submitting the network access request, the network access verification information includes the one-time password.

2. The network access verification method according to claim 1, characterized in that, Before sending network access verification information, including a one-time password, the method further includes: Obtain the digital certificate corresponding to the target network stored in the terminal device itself; When submitting the network access request, the network access verification information also includes the digital certificate.

3. The network access verification method according to claim 2, characterized in that, Before sending network access verification information, including a one-time password, the method further includes: Obtain the user information corresponding to the target network; Update the user information with the one-time password to obtain the updated user information; The one-time password in the network access verification information is represented by the updated user information.

4. The network access verification method according to claim 3, characterized in that, The step of generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes: Obtain the time information corresponding to the network access request; Based on the time information and the client key, and using the first preset password generation method, a one-time password corresponding to this network access request is generated.

5. The network access verification method according to claim 4, characterized in that, The time information refers to the time interval position corresponding to when the network access request was initiated.

6. The network access verification method according to claim 4, characterized in that, The step of generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes: Obtain the password generation count stored in the terminal device; Based on the password generation count and the client key, and using the second preset password generation method, a one-time password corresponding to this network access request is generated; The method further includes: After the terminal device generates a one-time password each time, the password generation count stored in the terminal device is incremented by 1; Send the latest password generation count stored in the terminal device.

7. The network access verification method according to claim 3, characterized in that, The client key is stored in the security processor of the terminal device, and the data stored in the security processor cannot be exported.

8. The network access verification method according to claim 7, characterized in that, The step of extracting the client key stored in the terminal device itself includes: the security processor of the terminal device extracting the client key stored in the security processor itself; The step of generating a one-time password corresponding to this network access request based on the client key and a preset password generation method includes: the security processor generating a one-time password corresponding to this network access request based on the client key and a preset password generation method.

9. The network access verification method according to claim 8, characterized in that, The step of obtaining the time information corresponding to the network access request includes: obtaining the time information corresponding to the network access request by the preset security software installed in the terminal device, and sending the time information to the security processor.

10. The network access verification method according to claim 7, characterized in that, The digital certificate and the user information are stored in the certificate database of the terminal device; The step of updating the user information to the one-time password to obtain the updated user information includes: The security processor sends the generated one-time password to the certificate database; The certificate database updates the user information with the one-time password to obtain the updated user information; Sending network access verification information, including a one-time password, includes: The certificate database sends network access verification information, including a one-time password and updated user information, to the verification client. The verification client sends the network access verification information to the password server.

11. A network access verification method, characterized in that, Applied to a cryptographic server, the method includes: The password server receives network access verification information sent by the client and stores the client keys of each client it manages. Using the client key corresponding to the client that initiated the network access request, and based on the same password generation method and conditions as the client, a one-time password is generated on the password server. The server-side one-time password is compared with the one-time password in the network access verification information, and the gateway is notified whether the network access request is approved based on the comparison result.

12. The network access verification method according to claim 11, characterized in that, The cryptographic server also stores the digital certificates of each client it manages; Based on the comparison results, the gateway is notified whether the network access request is approved, including: When the one-time password on the server side is the same as the one-time password in the network access verification information, and the target digital certificate is consistent with the digital certificate in the network access verification information, the gateway is notified to approve the network access request. The target digital certificate is the digital certificate that corresponds to the digital certificate that sent the network access request among the various digital certificates stored in the password server.

13. A network access verification device, characterized in that, Applied to a terminal device, the device includes: The acquisition unit is used to extract the client key stored in the terminal device itself when it is necessary to initiate a network access request to the target network; The generation unit is used to generate a one-time password corresponding to this network access request based on the client key and a preset password generation method; The sending unit is used to send network access verification information, including a one-time password; when the network access request is made, the network access verification information includes the one-time password.

14. A network access verification device, characterized in that, The apparatus, used in a cryptographic server, comprises: The receiving unit is used to receive network access verification information sent by the client, and the cryptographic server stores the client keys of each client it manages; The lookup unit is used to look up the user key corresponding to the client from the stored user keys corresponding to each user; The verification unit is used to generate a server-side one-time password on the password server using the client key corresponding to the client that initiated the network access request, according to the same password generation method and under the same conditions as the client; compare the server-side one-time password with the one-time password in the network access verification information, and notify the gateway whether the network access request is approved based on the comparison result.

15. An electronic device, characterized in that, include: Processor, memory, and computer program instructions stored in said memory and executable on the processor; When the processor executes the computer program instructions, it implements the method as described in any one of claims 1-12.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-12.

Images