Equipment authentication method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an equipment authentication method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: collecting multi-dimensional attribute information of to-be-authenticated equipment, wherein the dimensions comprise at least two of physical address data, an equipment serial number, geographical location information, an equipment type and an operator; processing based on the multi-dimensional attribute information and a preset encryption algorithm to generate authentication identification data; sending authentication identification data of the to-be-authenticated device to a second device through a preset secure communication protocol, so that the second device performs device authentication to obtain an authentication result; and receiving an authentication result, and executing a communication access strategy corresponding to the authentication result. Through adoption of the method, standardized unified management and analysis of the device identifier are realized based on the multi-dimensional attribute information of the device, the uniqueness and security of the authentication identifier are improved, an automatic authentication process of the to-be-authenticated device is realized, and the intelligent degree and security degree of a network are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a device authentication method and device, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] With the development of optical fiber communication technology and all-optical network, FTTR-B (Fiber To The Room for Business), PON (Passive Optical Network) and other network architectures are widely deployed in government and enterprise parks, industrial Internet, smart cities and other fields. The main device such as OLT (Optical Line Terminal) or all-optical gateway serves as the network access control core and is responsible for managing hundreds of subordinate devices (such as optical network units ONU).

[0003] In related technologies, the identity authentication of the device mainly depends on the verification of static fields such as LOID, SN and MAC, but these fields are relatively easy to be forged and imitated, and the possibility of illegal device accessing the network is relatively high, resulting in poor network security. SUMMARY

[0004] Therefore, it is necessary to provide a device authentication method, device, computer equipment, computer readable storage medium and computer program product capable of generating a high-security authentication identifier based on multi-level information to improve network security.

[0005] In a first aspect, the present application provides a device authentication method applied to a first device, the method comprising:

[0006] Collecting multi-dimensional attribute information of a device to be authenticated, the dimensions including at least two of physical address data, device serial number, geographic location information, device type and operator;

[0007] Generating authentication identifier data of the device to be authenticated based on the multi-dimensional attribute information and a preset encryption algorithm;

[0008] Sending the authentication identifier data of the device to be authenticated to a second device through a preset secure communication protocol, so that the second device performs device authentication to obtain an authentication result;

[0009] Receiving the authentication result and executing a communication access strategy corresponding to the authentication result.

[0010] In one embodiment, the geographic location information includes target area information and sub-area information of the target area; the step of processing based on the multi-dimensional attribute information and a preset encryption algorithm to generate authentication identifier data for the device to be authenticated includes:

[0011] The attribute information of each dimension in the multi-dimensional attribute information is encoded according to the field arrangement order to generate a field string to be verified; the field string to be verified is processed by a preset encryption algorithm to generate the security digest field of the device to be authenticated.

[0012] Based on the field string to be verified and the security digest field, the authentication identifier data of the device to be authenticated is generated.

[0013] In one embodiment, the method further includes:

[0014] If the authentication result is successful, then the communication access policy is determined to allow communication between the device to be authenticated and any other device.

[0015] If the authentication result is authentication failure, then the communication access policy is determined to allow the local communication to be authenticated and to prohibit communication between the device to be authenticated and other external network devices.

[0016] In one embodiment, the method further includes:

[0017] If the preset triggering conditions are met, the step of collecting multi-dimensional attribute information of the device to be authenticated is re-executed. The preset triggering conditions include, but are not limited to, a preset interval or the device to be authenticated being in a device restart state.

[0018] In one embodiment, the method further includes:

[0019] If the second device is unavailable, device authentication is performed on the authentication identifier data of the device to be authenticated based on the local cache data of the first device to obtain the authentication result.

[0020] Secondly, this application provides a device authentication method applied to a second device, the method comprising:

[0021] The authentication identifier data of the device to be authenticated is received from the first device through a preset secure communication protocol. The authentication identifier data is obtained based on the multi-dimensional attribute information of the device to be authenticated and a preset encryption algorithm. The dimensions include at least two of the following: physical address data, device serial number, geographical location information, device type, and operator.

[0022] The authentication identifier data is authenticated to obtain an authentication result; the authentication result is then returned to the first device so that the first device can execute the communication access policy corresponding to the authentication result on the device to be authenticated.

[0023] In one embodiment, authenticating the authentication identifier data to obtain an authentication result includes:

[0024] The field format of the authentication identifier data is validated. After the validation is passed, the authentication identifier data is matched with a preset whitelist to determine the legality of the authentication identifier data.

[0025] If the authentication identifier data is determined to be valid, a digest to be verified is calculated based on the authentication identifier data and a preset encryption algorithm; and the digest to be verified is matched with the security digest field carried by the authentication identifier data to obtain a consistency matching result.

[0026] The authentication result is determined based on the consistency matching result.

[0027] In one embodiment, the method further includes:

[0028] Add the authentication results and authentication logs of the device to be authenticated to a preset database;

[0029] If an anomaly is detected in the authentication log, an anomaly message will be output.

[0030] In one embodiment, the first device is the master device, and the second device is the authentication platform.

[0031] Thirdly, this application also provides a device authentication apparatus for use in a first device, the apparatus comprising:

[0032] The data acquisition module is used to collect multi-dimensional attribute information of the device to be authenticated. The dimensions include physical address data, device serial number, geographical location information, device type, and at least two of the following: operator.

[0033] An encryption module is used to process the multi-dimensional attribute information and a preset encryption algorithm to generate authentication identifier data for the device to be authenticated.

[0034] The first transmission module is used to send the authentication identifier data of the device to be authenticated to the second device through a preset secure communication protocol, so that the second device can perform device authentication and obtain the authentication result;

[0035] The first receiving module is used to receive the authentication result and execute the communication access policy corresponding to the authentication result.

[0036] Fourthly, this application also provides a device authentication apparatus for use in a second device, the apparatus comprising:

[0037] The second receiving module is used to receive authentication identifier data of the device to be authenticated sent by the first device through a preset secure communication protocol; the authentication identifier data is obtained based on the multi-dimensional attribute information of the device to be authenticated and a preset encryption algorithm; the dimensions include at least two of the following: physical address data, device serial number, geographical location information, device type, and operator;

[0038] The authentication module is used to authenticate the authentication identifier data, obtain an authentication result, and return the authentication result to the first device, so that the first device can execute the communication access policy corresponding to the authentication result on the device to be authenticated.

[0039] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps provided in this embodiment.

[0040] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps provided in this embodiment.

[0041] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps provided in this embodiment.

[0042] The aforementioned device authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product, wherein the method includes: collecting multi-dimensional attribute information of the device to be authenticated, including at least two of the following dimensions: physical address data, device serial number, geographical location information, device type, and operator; processing the multi-dimensional attribute information and a preset encryption algorithm to generate authentication identifier data of the device to be authenticated; sending the authentication identifier data of the device to be authenticated to a second device through a preset secure communication protocol, so that the second device performs device authentication and obtains an authentication result; receiving the authentication result and executing the communication access policy corresponding to the authentication result. By adopting this method, standardized and unified management and parsing of device identifiers are achieved based on the multi-dimensional attribute information of the device, improving the uniqueness and security of the authentication identifier. Automated acquisition of attribute data to generate authentication identifiers and obtain authentication results enables an automated authentication process for the device to be authenticated, improving the intelligence and security of the network. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a diagram illustrating the application environment of a device authentication method in one embodiment;

[0045] Figure 2 This is a flowchart illustrating a device authentication method in one embodiment;

[0046] Figure 3 This is a flowchart illustrating the device authentication method in another embodiment;

[0047] Figure 4 This is a flowchart illustrating the device authentication method in another embodiment;

[0048] Figure 5 This is a structural block diagram of a device authentication device in one embodiment;

[0049] Figure 6 This is a structural block diagram of a device authentication device in one embodiment;

[0050] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0052] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0053] The device authentication method provided in this application embodiment can be applied to, for example, Figure 1The application environment shown includes a first device 100, a second device 200, and multiple devices 300 to be authenticated. The first device 100 can be a master device, such as an OLT or an all-optical gateway, serving as the core device for network control access and managing a large number of devices to be authenticated / slave devices (e.g., ONUs or terminal devices). The second device 200 can be a network device, i.e., an authentication platform, such as a new network architecture like an enterprise all-optical network or a wide area access network. Each device 300 to be authenticated can be a network unit (ONU) or other slave network device to access the authentication platform. The first device 100 can collect multi-dimensional attribute information from each device to be accessed, arrange the attribute information according to its order, and process the attribute information using a preset encryption algorithm to obtain the authentication identifier data of the device 300 to be authenticated, i.e., the authentication ID corresponding one-to-one with the device 300. In this way, the first device 100 can send the authentication ID to the second device 200 through a preset communication protocol. The second device 200 can perform security authentication of device access based on the authentication identifier data and obtain the authentication result. After receiving the authentication result, the first device 100 can execute the communication access policy corresponding to the authentication result on the device 300 to be authenticated.

[0054] The terminals can be, but are not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted displays, etc. Head-mounted displays can include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0055] In one exemplary embodiment, such as Figure 2 As shown, a device authentication method is provided, which is applied to... Figure 1 Taking the first device as an example, the explanation includes the following steps 202 to 208. Wherein:

[0056] Step 202: Collect multi-dimensional attribute information of the device to be certified.

[0057] The dimensions include physical address data, device serial number, geographical location information, device type, and at least two of the following: carrier. The first device can be the master device, such as an OLT or all-optical gateway, etc. This first device is the core device for network control and access, used to manage / control whether the device to be authenticated / slave device can access the network; the second device can be a network architecture such as FTTR-B or PON; the device to be authenticated can be an optical network unit or a network slave device, that is, a device that needs to access the network architecture.

[0058] Optionally, the physical address data can be an Organization Unique Identifier (OUI), which is identification data indicating the device manufacturer or equipment vendor corresponding to each device to be certified. This physical address data can be obtained based on the physical / logical address of the device to be certified, for example, by extracting the first target number of bytes of the physical address, such as 3 bytes. The physical address data is associated with the device's vendor attributes, providing support for vendor traceability. In other words, based on this physical address data, the unique manufacturer that produced the device to be certified can be determined.

[0059] The device serial number is the factory serial number of the device to be certified. The device serial number is unique to each device, meaning that the device serial number of each device to be certified is different from the device serial numbers of other devices. This disclosure does not limit the length or format of the device serial number, which may include alphanumeric data.

[0060] Geographic location information includes target area information and sub-area information of the target area. Target area information may refer to the highest-level administrative division information of the region where the device to be certified is located, while sub-area information may refer to the specific location information of the region where the device to be certified is located.

[0061] Device type refers to the type of device to be authenticated, which may include optical device type and terminal device, where the optical device type may be an ONU. The operator may be the operator to which the device to be authenticated belongs. The device authentication method provided in this embodiment can be applied to unified authentication in multi-operator scenarios.

[0062] For example, the first device can monitor in real time whether there are any newly online devices and determine that the device is a device to be authenticated. In this way, the first device can collect multi-dimensional attribute information of the device to be authenticated. Optionally, the first device can collect physical address data, device serial number, geographical location information, device type, and operator attribute information. The first device can be configured with an authentication generation module, through which the first device can collect multi-dimensional attribute information of each device to be authenticated.

[0063] Step 204: Process the multi-dimensional attribute information and preset encryption algorithm to generate authentication identifier data for the device to be authenticated.

[0064] The preset encryption algorithm can be an algorithm with digest generation function, such as a hash algorithm. This disclosure does not limit the specific type of the preset encryption algorithm; for example, it can be SHA-1 or SHA-256 algorithms, etc. The authentication identifier data of the device to be authenticated is used as the authentication ID for security authentication of the device.

[0065] For example, after obtaining the multi-dimensional attribute information of the device to be authenticated, the first device can determine the encoded data corresponding to the attribute information of each dimension, and combine the encoded data of each attribute to obtain the field string to be verified. The first device can encrypt the field string to be verified using a preset encryption algorithm to obtain the security digest field corresponding to the field string to be verified. In this way, the first device can combine the field string to be verified and the security digest field to obtain the authentication identifier data of the device to be authenticated.

[0066] Step 206: The authentication identifier data of the device to be authenticated is sent to the second device through a preset secure communication protocol, so that the second device can perform device authentication and obtain the authentication result.

[0067] The preset secure communication protocol can be a data transmission protocol with security features, such as the TLS encrypted channel communication protocol. The authentication result includes both successful and failed authentication results.

[0068] For example, after obtaining the authentication identifier data of the device to be authenticated, the first device can generate a first message based on a preset secure communication protocol and send the first message to the second device through the communication channel corresponding to the preset secure communication protocol. After receiving the first message carrying the authentication identifier data of the device to be authenticated, the second device can perform device authentication on the device to be authenticated based on the authentication identifier data, obtain the authentication result, and return a second message carrying the authentication result to the first device.

[0069] Step 208: Receive the authentication result and execute the communication access policy corresponding to the authentication result.

[0070] The communication access policy is a policy used to instruct the device to be authenticated to communicate with the network. For example, it may include the communication access policy corresponding to the authentication success result and the communication access policy corresponding to the authentication failure result.

[0071] For example, the first device receives the authentication result of the device to be authenticated returned by the second device, and determines the communication access policy corresponding to the authentication result based on the specific content of the authentication result. Based on the communication method indicated by the communication access policy, the first device opens the corresponding communication channel for the device to be authenticated, that is, based on the communication method indicated by the communication access policy, instructs the device to be authenticated to communicate with the network.

[0072] The aforementioned device authentication method collects multi-dimensional attribute information of the device to be authenticated, including physical address data, device serial number, geographical location information, device type, and at least two of the following: carrier. Based on the multi-dimensional attribute information and a preset encryption algorithm, authentication identifier data of the device to be authenticated is generated. The authentication identifier data is sent to a second device via a preset secure communication protocol, enabling the second device to perform device authentication and obtain an authentication result. The authentication result is received, and the corresponding communication access policy is executed. By adopting this method, standardized and unified management and parsing of device identifiers are achieved based on the device's multi-dimensional attribute information, improving the uniqueness and security of authentication identifiers. Automated acquisition of attribute data, generation of authentication identifiers, and obtaining authentication results enable an automated authentication process for the device to be authenticated, enhancing the intelligence and security of the network.

[0073] In one embodiment, the geographic location information includes target area information and sub-area information of the target area. The specific processing steps for "processing based on multi-dimensional attribute information and a preset encryption algorithm to generate authentication identifier data for the device to be authenticated" include:

[0074] Following the field arrangement order, the attribute information of each dimension in the multi-dimensional attribute information is encoded to generate a string of fields to be verified. This string is then processed using a preset encryption algorithm to generate a security digest field for the device to be authenticated. Based on the string of fields to be verified and the security digest field, authentication identifier data for the device to be authenticated is generated.

[0075] The security digest field can serve as a security verification code for the authentication identifier data of the device to be authenticated; the field arrangement order can be a pre-configured order in which the encoded data corresponding to each attribute information is arranged.

[0076] For example, after collecting multi-dimensional attribute information of the device to be authenticated, the first device can encode each attribute information to obtain encoded data corresponding to each attribute information. For example, the encoded data corresponding to the physical address data can be the device itself, i.e., OUI; the encoded data corresponding to the device serial number can be the device itself; the encoded data corresponding to the target area information can be the encoded data corresponding to the province and city information, the encoded data corresponding to the sub-area information can be the encoded data corresponding to the district, county, and street information, etc. Optionally, the first device can pre-configure the encoded data corresponding to each province and city (e.g., a pre-unified unified standard province and city code) and the encoded data corresponding to each district, county, and street; the first device can determine the encoded data corresponding to the device type based on the device type, and the correspondence between the device type and the encoded data can also be pre-configured, for example, 01 represents an optical network unit, 02 represents a terminal device, etc.; the first device can also determine the corresponding operator encoded data based on the operator to which the device to be authenticated belongs.

[0077] In this way, after obtaining the encoded data corresponding to the attribute information of each dimension, the first device can arrange and combine the encoded data corresponding to each attribute information according to the pre-configured field arrangement order, and determine the arrangement result as the field string to be verified; this field string to be verified can be in plaintext form; the first device can perform a hash operation on the field string to be verified using a preset encryption algorithm, and determine the hash calculation result as the security digest field. Then, the first device can concatenate the field string to be verified with the security digest field to generate the authentication identifier data of the device to be authenticated.

[0078] Optionally, the first device can append the security digest field to the end of the string to be verified to obtain complete authentication identifier data, i.e., the complete authentication identifier encoding data of the device to be authenticated.

[0079] In this embodiment, by utilizing different levels of geographic location information, rapid location of devices can be achieved when devices are deployed across regions, further improving device management efficiency. Detailed address location information enhances the accuracy of device location attribution, thereby improving the accuracy of device authentication and the security performance of the network architecture. Authentication identifier data is generated by arranging fields in a specific order. The unified and structured encoding format of the authentication identifier data allows for flexible combination of multiple dimensions of attribute information fields, achieving comprehensive coverage of device attribute information. The introduction of multi-level attribute information further ensures the uniqueness of devices. A secure digest field is obtained through encryption algorithms, guaranteeing the overall integrity of the authentication identifier data and enhancing its tamper-proof capabilities.

[0080] In one embodiment, the device authentication method further includes:

[0081] If the authentication result is successful, the communication access policy is set to allow communication between the device to be authenticated and any other device.

[0082] If the authentication result is authentication failure, the communication access policy is set to allow local communication of the device to be authenticated, and prohibit communication between the device to be authenticated and other external network devices.

[0083] For example, if the first device determines that the authentication result of the device to be authenticated is a successful authentication result, the first device can determine that the communication access policy of the device to be authenticated can be a policy that allows normal communication with any other device; the first device can open a business communication channel for the device to be authenticated, allowing data flow in various directions between the device to be authenticated and other communication devices, such as allowing north-south data flow and east-west data flow, etc.

[0084] If the first device determines that the authentication result of the device to be authenticated is an authentication failure, the first device can determine that the communication access policy of the device to be authenticated is a communication policy used to prohibit the device to be authenticated from illegally spreading. For example, the communication access policy may only allow the device to be authenticated to conduct local communication and prohibit communication with other devices in the network; it may also be a communication policy that only allows the device to be authenticated to conduct east-west local communication and prohibits or blocks the device to be authenticated to conduct north-south data flow, etc.

[0085] In this way, the first device can configure the device to be authenticated based on the communication access policy corresponding to the authentication result, and the device to be authenticated can communicate based on the communication access policy.

[0086] In this embodiment, the authentication result is transmitted through the real-time interface between the second device and the first device, which can ensure the timeliness of the authentication result transmission. The access strategy can be flexibly selected based on the different contents of the authentication result, ensuring that the authenticated device can access the network in a timely manner, and promptly notifying the existence of abnormal devices that fail to authenticate.

[0087] In one embodiment, the device authentication method further includes:

[0088] If the preset triggering conditions are met, the step of collecting multi-dimensional attribute information of the device to be authenticated will be executed again.

[0089] The preset trigger conditions include, but are not limited to, a preset interval or the device to be certified being in a device restart state; the preset interval can be a pre-configured interval for re-certifying a device that has already been certified, and this disclosure does not limit the specific value of the interval; the device to be certified being in a device restart state can be the device being in a power-off restart state, and the preset trigger conditions can also include the device to be certified being a newly launched device.

[0090] For example, the first device can obtain the authentication time of each device, and if it is determined that the authentication time exceeds the interval, it can re-execute the step of collecting the multi-dimensional attribute information of the device to be authenticated for that device to achieve re-authentication of the device; alternatively, the first device can obtain the authentication time of a device that failed to authenticate, and if it is determined that the authentication time exceeds the interval, it can re-execute the step of collecting the multi-dimensional attribute information of the device to be authenticated for that device to achieve re-authentication of the device.

[0091] Optionally, the first device can also detect the status of each device. If it is determined that the status of the device is a newly online device or a power outage and restart state, the first device can re-execute the step of collecting the multi-dimensional attribute information of the device to be authenticated for that device, so as to realize the re-authentication of the device.

[0092] In this embodiment, by collecting data information when preset trigger conditions are met, it can support the automatic generation, automatic reporting, automatic verification and dynamic feedback of authentication IDs, realize plug-and-play recognition of devices and block illegal access; automatic polling re-authentication and local caching strategies ensure the high availability and business continuity of the authentication mechanism, improve the intelligence level of the system and reduce operation and maintenance costs.

[0093] In one embodiment, the device authentication method further includes:

[0094] If the second device is unavailable, device authentication is performed based on the authentication identifier data of the device to be authenticated, using the local cached data of the first device, and the authentication result is obtained.

[0095] The situation where the second device is unavailable could be due to the first device being unable to communicate with the second device, or it could be determined that the second device is offline.

[0096] For example, after generating the authentication identifier data of the device to be authenticated, if the first device determines that the second device is in an unavailable state, the first device can match the authentication identifier data with the locally cached whitelist data. If they match, the device to be authenticated is determined to be authenticated successfully; if they do not match, the device to be authenticated is determined to be authenticated unsuccessfully.

[0097] Optionally, after receiving the authentication success result, the first device can add the authentication identifier data of the successful authentication result to its local cache data. In this way, when the first device performs device authentication based on the authentication identifier data of the device to be authenticated using its local cache data, it can query the authentication identifier data of the device to be authenticated in its local cache data; if the data is found, the device to be authenticated is determined to have passed authentication; if the data is not found, the device to be authenticated is determined to have failed authentication.

[0098] In this embodiment, the device is authenticated in a timely manner using locally cached whitelist backup data, thereby improving the fault tolerance rate of device authentication.

[0099] In one exemplary embodiment, such as Figure 3 As shown, a device authentication method is provided, which is applied to... Figure 1 The second device in the example is used for illustration, including:

[0100] Step 302: Receive the authentication identifier data of the device to be authenticated sent by the first device through a preset secure communication protocol.

[0101] The authentication identifier data is derived from the multi-dimensional attribute information of the device to be authenticated and a preset encryption algorithm. The dimensions include physical address data, device serial number, geographical location information, device type, and at least two of the following: carrier.

[0102] Step 304: Authenticate the authentication identifier data to obtain the authentication result. Return the authentication result to the first device so that the first device can execute the communication access policy corresponding to the authentication result on the device to be authenticated.

[0103] For example, the first device can monitor in real time whether a new device is currently online and determine that the device is a device to be authenticated. In this way, the first device can collect multi-dimensional attribute information of the device to be authenticated. Optionally, the first device can collect physical address data, device serial number, geographical location information, device type, and operator attribute information. The first device can be configured with an authentication generation module, which can collect multi-dimensional attribute information of each device to be authenticated. After obtaining the multi-dimensional attribute information of the devices to be authenticated, the first device can determine the corresponding encoded data for each dimension of attribute information and combine the encoded data of each attribute to obtain a string of fields to be verified. The first device can encrypt the string of fields to be verified using a preset encryption algorithm to obtain a security digest field corresponding to the string of fields to be verified. Thus, the first device can combine the string of fields to be verified and the security digest field to obtain the authentication identifier data of the device to be authenticated.

[0104] After obtaining the authentication identifier data of the device to be authenticated, the first device can generate a first message based on a preset secure communication protocol and send the first message to the second device through the communication channel corresponding to the preset secure communication protocol. After receiving the first message carrying the authentication identifier data of the device to be authenticated, the second device can perform device authentication based on the authentication identifier data, obtain the authentication result, and return a second message carrying the authentication result to the first device.

[0105] The first device receives the authentication result of the device to be authenticated returned by the second device, and determines the communication access policy corresponding to the authentication result based on the specific content of the authentication result. Based on the communication method indicated by the communication access policy, the first device opens the corresponding communication channel for the device to be authenticated, that is, based on the communication method indicated by the communication access policy, the first device instructs the device to be authenticated to communicate with the network.

[0106] In this embodiment, the standardized and unified management and parsing of device identifiers are achieved based on the multi-dimensional attribute information of the device, which improves the uniqueness and security of the authentication identifier. The automatic acquisition of attribute data to generate authentication identifiers and obtain authentication results can realize the automated authentication process of the device to be authenticated, thereby improving the intelligence and security of the network.

[0107] In one embodiment, the specific processing steps for the step "authenticating the authentication identifier data and obtaining the authentication result" include:

[0108] The field format of the authentication identifier data is validated. If validation is successful, the authentication identifier data is matched against a preset whitelist to determine its legality. If the authentication identifier data is deemed legal, a verification digest is calculated based on the authentication identifier data and a preset encryption algorithm. This verification digest is then matched against the security digest field carried in the authentication identifier data to obtain a consistency matching result. Based on the consistency matching result, the authentication result is determined.

[0109] The preset whitelist can be a database of whitelists of legitimate devices pre-stored by the second device.

[0110] For example, the second device can split the authentication identifier data into multiple fields. The second device can determine the structural integrity and legality of the format of each field to obtain the verification result of the device to be authenticated. For instance, the second device can pre-obtain the attribute information required by the first device to generate the authentication identifier data, and can determine whether each field currently received is complete and whether each field is arranged in a preset field order. If it is determined that each field is complete and arranged in the preset field order, then the device to be authenticated is determined to have passed the verification. If it is determined that the device to be authenticated has failed the verification, then the authentication result of the device to be authenticated is determined to be an authentication failure result.

[0111] In this way, the second device can query the authentication identifier data in the pre-stored whitelist database of legitimate devices. If the authentication identifier data is found in the whitelist database, the device to be authenticated is determined to be legitimate; if the authentication identifier data is not found in the whitelist database, the device to be authenticated is determined to be illegitimate, and the authentication result of the device to be authenticated is determined to be authentication failure.

[0112] In this way, the second device, after determining that the device to be authenticated is legitimate (i.e., the authentication identifier data is legitimate), extracts the field string to be verified from the authentication identifier data and calculates a security digest of the field string based on a preset encryption algorithm, thus obtaining the verification digest. Based on this, the second device can perform a consistency match between the verification digest and the security digest field at the end of the authentication identifier data. If they match, the consistency match result is determined to be a successful match; if they do not match, the consistency match result is determined to be a failed match. The second device can determine the authentication result as successful if a successful match is obtained, and as failed if a failed match is obtained.

[0113] Optionally, the second device can determine the authentication result as successful if the verification digest and the security digest field match; otherwise, it can determine the authentication result as unsuccessful. Based on this, after obtaining the authentication result of the device to be authenticated, the second device can transmit the authentication result through the real-time interface between the first and second devices.

[0114] In this embodiment, real-time communication between the first device and the second device can be realized, supporting automatic generation, automatic reporting, automatic verification and dynamic feedback of authentication ID, improving the authentication accuracy of the device to be authenticated, and realizing real-time authentication after the device to be authenticated goes online, that is, realizing plug-and-play recognition and illegal blocking of the device.

[0115] In one embodiment, the device authentication method further includes:

[0116] The authentication results and authentication logs of the device to be authenticated are added to the preset database. If an anomaly is detected in the authentication logs, an error message is output.

[0117] For example, the second device can record all authentication process logs of the authentication identifier data of each device to be authenticated. If an abnormality is found in the process log, an alarm message is automatically generated and output, thereby realizing automatic alarm for abnormal situations and supporting secure operation.

[0118] In one embodiment, the first device is the master device, and the second device is the authentication platform.

[0119] With the development of fiber optic communication technology and all-optical networks, network architectures such as FTTR-B and PON are widely deployed in government and enterprise parks, industrial internet, and smart cities. Master equipment, such as OLTs or all-optical gateways, acts as the network access control core, managing hundreds of slave devices (such as ONUs). The identification coding data in device authentication within these technologies is relatively scattered, and the authentication process is cumbersome, resulting in low security and efficiency in device authentication.

[0120] The following, such as Figure 4 As shown, the specific implementation steps of the above-described device authentication method are described in detail with reference to a specific embodiment, including the main device and the authentication platform:

[0121] The main device generates the authentication ID: The main device automatically collects fields, generates security fields through hash operation, and concatenates the fields to report the authentication ID to the authentication platform; specifically, it concatenates 6 plaintext fields in the order of 7 field format to form the string to be verified (the string of fields to be verified).

[0122] The authentication platform parses the authentication ID, compares it with the whitelist database, determines its legitimacy, performs hash verification, and obtains the authentication result.

[0123] The authentication platform records the authentication results in the background, updates the platform status database, and sends the authentication results back to the main device.

[0124] The main device can determine whether the authentication result is legal or illegal. If it is legal, both north-south and east-west services will be enabled; if it is illegal, only east-west services will be enabled.

[0125] Specifically, the structure of the authentication identifier data (authentication identifier code) adopts a 7-segment structured format: [OUI]-[Serial Number]-[Province Code]-[Device Type]-[Region Code]-[Operator Code]-[Security Hash].

[0126] The Organization Unique Identifier (OUI) is extracted from the first three bytes of the device's MAC address, representing the device manufacturer and ensuring global uniqueness. The OUI serves as the starting point for the authentication ID, binding to the manufacturer attribute for easy device traceability. The Serial Number is the device's factory serial number, uniquely identifying each device. It supports alphanumeric combinations, has flexible length, and ensures uniqueness for each device. The Province Code can adopt the nationally unified standard provincial and municipal codes. When deploying across regions, it can quickly locate the device's geographical location, facilitating management.

[0127] Device Type (DCT) identifies the specific type of device. For example, "01" represents an ONU, and "02" represents a terminal device. This DCT supports expansion to meet the authentication requirements of various device types. Region Code (Detailed Deployment Region Code) can be refined to the district, county, or even park level, improving the geographical accuracy of authentication. Operator Code (Operator Code) represents the operator to which the device to be authenticated belongs, supporting unified authentication in multi-operator scenarios.

[0128] A security hash is generated by using a hash algorithm to digest the first six fields, ensuring the integrity of the overall encoding and preventing tampering. This field serves as a security verification code for the authentication ID. Optionally, either SHA-1 or SHA-256 algorithms can be used.

[0129] The main device integrates an authentication generation module, which performs steps such as field collection, field hash verification, and authentication ID reporting.

[0130] In one example, the master device can automatically collect the device's MAC address (to obtain the OUI), serial number, provincial code, device type, region code, and carrier code. It then concatenates six plaintext fields in a seven-segment format to form a string to be verified. A hash algorithm is performed on the concatenated string to generate a security digest field. Finally, the complete authentication ID is assembled by appending the hash digest to the end of the plaintext fields, forming the complete authentication identifier code. The master device can then report the complete authentication ID to the authentication platform via a secure communication protocol (such as a TLS encrypted channel).

[0131] The authentication platform, as the core backend system, includes the following functional modules:

[0132] The parser module is used to receive the authentication ID, break it down into 7 fields, and verify the structural integrity and format validity.

[0133] The whitelist comparison engine is used to match the authentication ID with the preset whitelist of legitimate devices to determine the legitimacy of the device.

[0134] The hash verification module is used to recalculate the hash digest of the first 6 fields and compare it with the uploaded security hash to prevent forgery or tampering.

[0135] The status database stores device authentication history, status changes, and exception logs, supporting subsequent operation and maintenance analysis.

[0136] The feedback module is used to send the authentication result (legal / illegal) back to the master device through a real-time interface, driving the adjustment of the access policy.

[0137] The logging and alarm system records all authentication process logs, automatically alerts in case of anomalies, and supports secure operations.

[0138] In other words, the authentication platform first parses the main device's own code and compares it with the whitelist. Specifically, it matches the authentication ID with the preset legal device whitelist database to determine the device's legitimacy. After determining legitimacy, the authentication platform can provide feedback to the main device and return the authentication result to the main device through a real-time interface, driving the main device to adjust its access policy for the device to be authenticated.

[0139] Based on the authentication result, the master device's internal policy module executes the corresponding actions:

[0140] If authentication is successful, the device's service channel will be opened, allowing normal communication.

[0141] If authentication fails, the device will block north-south data flow and only allow east-west local area communication to prevent unauthorized dissemination.

[0142] In addition, the master device can perform automatic polling re-authentication, that is, trigger device re-authentication at regular intervals, and support automatic resumption of the authentication process after power failure and restart. It also implements a local authentication caching mechanism to enable local cache whitelist backup when the authentication platform is unavailable, achieving authentication fault tolerance.

[0143] Optionally, the specific implementation steps of the above-described device authentication method will be described in detail with reference to a specific embodiment.

[0144] Hundreds of ONU devices (devices awaiting authentication) are deployed in the government and enterprise park, covering office buildings, data centers, and access terminals. After the ONU is powered on, the master device automatically reads the first three bytes of the MAC address from the device to extract the OUI (xxxxxx), obtains the device serial number 0001AABB, and combines it with the pre-configured provincial and regional codes of the park (e.g., 31 represents xx province, 10 represents XX district), device type 01 (ONU), and operator code 01 (XX operator), and concatenates them according to the rules to generate the authentication ID: xxxxxx-0001AABB-31-01-10-01-F5A7.

[0145] The ID, along with the first six data segments, is used by the main device's hash engine to generate a secure hash segment (e.g., using the SHA-1 algorithm), forming a complete authentication ID that is then reported to the authentication platform. The platform, based on a whitelist database and hash verification, confirms the device's legitimacy and returns an authentication success message. Upon receiving successful feedback, the main device automatically opens the ONU's service channel, allowing the device to normally access the campus network. The device authentication method provided in this embodiment enables unattended automatic authentication, greatly reducing manual maintenance workload and ensuring campus network security and device controllability.

[0146] Optionally, the specific implementation steps of the above-described device authentication method will be described in detail with reference to a specific embodiment.

[0147] An unauthorized device was found in an industrial park, attempting to gain access by forging an authentication ID. The forged authentication ID is as follows: XX0000-11223344-99-03-20-02-EE12.

[0148] Although the authentication ID field format meets the structural requirements, its provincial code 99 is an invalid code, and the carrier code 02 does not match the expected 01. The platform's verification process revealed that the authentication ID was not on the whitelist and the hash verification failed. The authentication platform immediately returned an authentication failure message.

[0149] Based on the authentication failure policy, the master device quickly executes isolation actions, blocking north-south traffic flow to the device and maintaining only internal local area communication to prevent unauthorized devices from launching attacks or stealing data through this node. Simultaneously, an alarm mechanism is triggered, allowing network administrators to be notified of unauthorized access events in real time and quickly conduct on-site investigations and handling. This effectively verifies the practical value of this embodiment in preventing unauthorized device access and ensuring campus network security.

[0150] The device authentication method provided in this embodiment can unify the standard structure, improve compatibility and scalability. The authentication identifier data is a unified structured authentication ID format of 7 segments, including the device manufacturer identifier (OUI), serial number, provincial code, device type, region code, operator code, and security hash field. This structure has a high degree of standardization, which facilitates cross-platform parsing and management, supports unified authentication for multiple operators, multiple regions, and multiple device types, and effectively improves system compatibility and future scalability.

[0151] The device authentication method provided in this embodiment can achieve multi-dimensional information fusion and differentiated security management. By introducing multi-dimensional information such as province code, device type, operator, and specific region code, the system can achieve fine-grained authentication policy adjustment and access control. Customized security policies can be implemented for different regions, device types, and operators to meet the complex and ever-changing network management needs of government, enterprises, and industrial parks. Furthermore, authentication reliability can be enhanced through a secure hash verification mechanism. Specifically, a hash algorithm is used to digest the first six fields of the authentication identifier to generate a secure verification segment, significantly improving the anti-tampering and anti-forgery capabilities of the authentication ID. This mechanism effectively avoids the risk of MAC addresses or serial numbers being copied or forged, ensuring the authenticity and integrity of device identity and fundamentally improving the security level of the authentication process.

[0152] The device authentication method provided in this embodiment also features automated authentication and dynamic management capabilities. Specifically, combined with real-time communication between the master device and the authentication platform, the system supports automatic generation, automatic reporting, automatic verification, and dynamic feedback of authentication IDs, enabling plug-and-play recognition of devices and immediate blocking of unauthorized access. Automatic polling re-authentication and local caching strategies ensure high availability and business continuity of the authentication mechanism, reducing manual intervention and lowering operation and maintenance costs.

[0153] The device authentication method provided in this embodiment offers a structured authentication identifier encoding format, supporting multi-dimensional field combinations and compatible with various device manufacturers, operators, and regional environments. It introduces multi-level information fields, including device OUI, serial number, region code, device type, operator information, and security hash digest, enhancing the uniqueness and security of authentication. It implements an automatic authentication ID generation and verification process, reducing manual configuration and enabling authentication upon device launch, with real-time isolation of authentication anomalies. It supports unified authentication management across provinces, cities, and operator environments, adapting to the needs of large-scale government and enterprise parks and wide area networks. Working with the authentication platform, it implements dynamic whitelist comparison, hash verification, and policy feedback, ensuring the integrity and security of the authentication process. It possesses strong security mechanisms to prevent device forgery, field tampering, and man-in-the-middle attacks, improving overall network protection capabilities. Combining a unified, structured, and scalable authentication identifier encoding strategy with an automatic legality verification mechanism, it achieves an intelligent authentication closed loop of plug-and-play device recognition and automatic isolation of unauthorized devices, improving network security and operational efficiency.

[0154] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0155] Based on the same inventive concept, this application also provides a device authentication apparatus for implementing the device authentication method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more device authentication apparatus embodiments provided below can be found in the limitations of the device authentication method described above, and will not be repeated here.

[0156] In one exemplary embodiment, such as Figure 5 As shown, a device authentication device 500 is provided, applied to a first device, the device comprising:

[0157] The data acquisition module 502 is used to collect multi-dimensional attribute information of the device to be authenticated. The dimensions include physical address data, device serial number, geographical location information, device type, and at least two of the following: carrier.

[0158] The encryption module 504 is used to process multi-dimensional attribute information and preset encryption algorithms to generate authentication identifier data of the device to be authenticated;

[0159] The first transmission module 506 is used to send the authentication identifier data of the device to be authenticated to the second device through a preset secure communication protocol, so that the second device can perform device authentication and obtain the authentication result;

[0160] The first receiving module 508 is used to receive the authentication result and execute the communication access policy corresponding to the authentication result.

[0161] In one exemplary embodiment, such as Figure 6 As shown, a device authentication apparatus 600 is provided, applied to a second device, the apparatus comprising:

[0162] The second receiving module 602 is used to receive authentication identifier data of the device to be authenticated sent by the first device through a preset secure communication protocol; the authentication identifier data is obtained based on the multi-dimensional attribute information of the device to be authenticated and a preset encryption algorithm; the dimensions include at least two of the following: physical address data, device serial number, geographical location information, device type, and operator.

[0163] The authentication module 604 is used to authenticate the authentication identifier data, obtain an authentication result, and return the authentication result to the first device, so that the first device can execute the communication access policy corresponding to the authentication result on the device to be authenticated.

[0164] Each module in the aforementioned device authentication apparatus can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0165] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores authentication-related data for the device to be authenticated. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a device authentication method.

[0166] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0167] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0168] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0169] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0172] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0173] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A device authentication method, characterized in that, Applied to a first device, the method includes: Collect multi-dimensional attribute information of the device to be authenticated, including physical address data, device serial number, geographical location information, device type, and at least two of the following: carrier. Based on the multi-dimensional attribute information and the preset encryption algorithm, the authentication identifier data of the device to be authenticated is generated. The authentication identifier data of the device to be authenticated is sent to the second device through a preset secure communication protocol, so that the second device can perform device authentication and obtain the authentication result; Receive the authentication result and execute the communication access policy corresponding to the authentication result.

2. The method according to claim 1, characterized in that, The geographic location information includes target area information and sub-area information of the target area; the process of generating authentication identifier data for the device to be authenticated based on the multi-dimensional attribute information and a preset encryption algorithm includes: The attribute information of each dimension in the multi-dimensional attribute information is encoded according to the field arrangement order to generate a field string to be verified; the field string to be verified is processed by a preset encryption algorithm to generate the security digest field of the device to be authenticated. Based on the field string to be verified and the security digest field, the authentication identifier data of the device to be authenticated is generated.

3. The method according to claim 1, characterized in that, The method further includes: If the authentication result is successful, then the communication access policy is determined to allow communication between the device to be authenticated and any other device. If the authentication result is authentication failure, then the communication access policy is determined to allow the local communication to be authenticated and to prohibit communication between the device to be authenticated and other external network devices.

4. The method according to claim 1, characterized in that, The method further includes: If the preset triggering conditions are met, the step of collecting multi-dimensional attribute information of the device to be authenticated is re-executed. The preset triggering conditions include, but are not limited to, a preset interval or the device to be authenticated being in a device restart state.

5. The method according to claim 1, characterized in that, The method further includes: If the second device is unavailable, device authentication is performed on the authentication identifier data of the device to be authenticated based on the local cache data of the first device to obtain the authentication result.

6. A device authentication method, characterized in that, Applied to a second device, the method includes: The authentication identifier data of the device to be authenticated is received from the first device through a preset secure communication protocol. The authentication identifier data is obtained based on the multi-dimensional attribute information of the device to be authenticated and a preset encryption algorithm. The dimensions include at least two of the following: physical address data, device serial number, geographical location information, device type, and operator. The authentication identifier data is authenticated to obtain an authentication result; the authentication result is then returned to the first device so that the first device can execute the communication access policy corresponding to the authentication result on the device to be authenticated.

7. The method according to claim 6, characterized in that, The authentication of the authentication identifier data to obtain the authentication result includes: The field format of the authentication identifier data is validated. After the validation is passed, the authentication identifier data is matched with a preset whitelist to determine the legality of the authentication identifier data. If the authentication identifier data is determined to be valid, a digest to be verified is calculated based on the authentication identifier data and a preset encryption algorithm; and the digest to be verified is matched with the security digest field carried by the authentication identifier data to obtain a consistency matching result. The authentication result is determined based on the consistency matching result.

8. The method according to claim 6, characterized in that, The method further includes: Add the authentication results and authentication logs of the device to be authenticated to a preset database; If an anomaly is detected in the authentication log, an anomaly message will be output.

9. The method according to claim 6, characterized in that, The first device is the master device, and the second device is the authentication platform.

10. A device authentication apparatus, characterized in that, Applied to a first device, the device includes: The data acquisition module is used to collect multi-dimensional attribute information of the device to be authenticated. The dimensions include physical address data, device serial number, geographical location information, device type, and at least two of the following: operator. An encryption module is used to process the multi-dimensional attribute information and a preset encryption algorithm to generate authentication identifier data for the device to be authenticated. The first transmission module is used to send the authentication identifier data of the device to be authenticated to the second device through a preset secure communication protocol, so that the second device can perform device authentication and obtain the authentication result; The first receiving module is used to receive the authentication result and execute the communication access policy corresponding to the authentication result.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images