A dynamic encryption authentication method for data communication equipment and related device

Abstract

The application discloses a dynamic encryption authentication method of digital communication equipment and related devices, and relates to the technical field of network security. The method comprises the following steps: an authentication server establishes an encrypted communication channel based on a transmission layer security protocol between a user terminal and digital communication equipment. On the channel, the authentication server receives a static identity certificate of the user terminal for first verification. After the verification, the authentication server sends a dynamic password to the user terminal through a short message gateway and performs second verification on the dynamic password submitted by the user terminal. When the user terminal initiates a control instruction, the authentication server sends a challenge value to the user terminal. The user terminal calculates the challenge value by using a pre-shared key, generates a response code and returns the response code to the authentication server. The authentication server verifies the validity of the response code, and after the verification, forwards the control instruction to the target digital communication equipment. The digital communication equipment executes the instruction and records the execution event to a security audit log. The application can effectively improve the data transmission security and authentication efficiency of the digital communication equipment in different network environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a dynamic encryption authentication method for data communication equipment and a related device. BACKGROUND

[0002] Under the background of accelerating digital transformation, the remote operation and maintenance security of data communication equipment (such as routers, switches, firewalls, etc.) is facing severe challenges. Traditional authentication methods (such as static passwords, SSH-RSA certificates, SMS verification codes, etc.) have been unable to cope with the increasingly complex network attacks. In recent years, data communication equipment has frequently suffered from security threats such as man-in-the-middle attacks (MITM), credential leakage, and session hijacking, resulting in large-scale network paralysis, data leakage, and other security incidents. However, traditional solutions still rely on static certificates and fixed verification codes, which cannot resist advanced persistent threats. SUMMARY

[0003] The purpose of the present application is to provide a dynamic encryption authentication method for data communication equipment and a related device, which can dynamically authenticate the encryption authentication of device login, randomly enhance the SMS of device login, and real-time instruction interaction verification of the encryption authentication of device control instruction execution. Three major innovative technical points, systematically improving the security of data communication equipment management, filling the gap of traditional technology in the compliance and attack resistance of data communication equipment login and instruction control.

[0004] To achieve the above purpose, the present application provides the following solutions:

[0005] In a first aspect, the present application provides a dynamic encryption authentication method for data communication equipment, comprising:

[0006] S1. An encrypted communication channel based on a transport layer security protocol is established between a user terminal and a data communication equipment through an authentication server.

[0007] S2. The authentication server receives a static identity credential submitted by the user terminal on the encrypted communication channel for first verification. When the verification is passed, a dynamic password is sent to the user terminal through an SMS gateway, and a dynamic password submitted by the user terminal is subjected to second verification.

[0008] S3. After the second verification is passed, when the user terminal initiates a control instruction, a challenge value is sent to the user terminal through the authentication server. The user terminal calculates the challenge value using a pre-shared key to generate a response code and returns the response code to the authentication server. The authentication server is used to verify the validity of the response code, and after the verification is passed, the control instruction is forwarded to the target data communication equipment.

[0009] S4. The data communication equipment executes the received control instruction and records the instruction execution event to a security audit log.

[0010] Optionally, the encrypted communication channel adopts a TLS 1.3 protocol.

[0011] The encrypted communication channel uses a cipher suite supporting forward secrecy.

[0012] Optionally, the dynamic password is a one-time password; when the number of consecutive authentication failures reaches a preset threshold, the authentication server starts a fuse mechanism to lock the login mode of the dynamic password.

[0013] Optionally, the challenge value includes a monotonically increasing sequence number and a nanosecond-level timestamp; and the response code is generated by a hash-based message authentication code algorithm.

[0014] Optionally, the validity of the response code is verified, specifically including:

[0015] When the nanosecond-level timestamp and the server time have a tolerance within ±2 seconds, the response code is a valid response code.

[0016] Optionally, after step S2 and before step S3, further comprising:

[0017] A session binding step, specifically including:

[0018] Establishing a trusted context based on the authentication server; the trusted context is used to triple-bind the user terminal identifier, the number communication device identifier, and the current session identifier.

[0019] In a second aspect, the application provides a number communication device dynamic encryption authentication device for implementing the number communication device dynamic encryption authentication method, comprising:

[0020] A user terminal for initiating a connection request, submitting an authentication credential, receiving a dynamic password, and sending a control instruction and a challenge value.

[0021] An authentication server for establishing and managing a TLS encrypted communication channel, verifying a static identity credential and a dynamic password, generating and verifying a challenge value, forwarding a control instruction, and recording a security audit log.

[0022] A number communication device for receiving and executing a control instruction sent by the authentication server.

[0023] A short message gateway in communication with the authentication server for sending a dynamic password to the user terminal.

[0024] Optionally, the authentication server is integrated with a security chip for accelerating cryptographic operations and securely storing a pre-shared key.

[0025] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the dynamic encryption authentication method of the number communication device according to any one of the preceding aspects.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the dynamic encryption authentication method of the number communication device according to any one of the preceding aspects.

[0027] According to the embodiments provided in the present application, the following technical effects are disclosed:

[0028] The present application provides a dynamic encryption authentication method of a number communication device and related devices. The method first establishes an encrypted communication channel based on the transmission layer security protocol between the user terminal and the number communication device with the help of the authentication server, thereby ensuring the confidentiality and integrity of the communication data in the transmission process, effectively preventing data from being stolen or tampered with, and greatly improving the communication security level. Then the authentication server receives the static identity credential submitted by the user terminal on the encrypted channel for first verification, which is a preliminary identity confirmation link and can judge the legality of the user based on the pre-set identity information. After the static identity credential verification is passed, the dynamic password is sent to the user terminal by means of the short message gateway, and the dynamic password submitted by the user terminal is subjected to second verification. The use of dynamic password increases the randomness and timeliness of identity verification, so that even if the static identity credential information is inadvertently leaked, the attacker cannot pass the verification due to the lack of real-time dynamic password, further enhancing the security of identity verification. After the second verification is passed, when the user terminal initiates a control instruction, the authentication server sends a challenge value to the user terminal, the user terminal calculates the challenge value using the pre-shared key to generate a response code, and the authentication server verifies the validity of the response code. This mechanism further confirms the legality of the user terminal by dynamically generating challenge values and response codes, prevents malicious behaviors such as man-in-the-middle attacks, and ensures the authenticity and security of the source of the control instruction. The number communication device executes the received control instruction and records the instruction execution event to the security audit log. This ensures the traceability of the device operation, facilitates the backtracking of the entire operation process when problems occur, helps fault diagnosis and security event analysis, and maintains the security and stability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0030] Figure 1 An application environment diagram of a dynamic encryption authentication method of a data communication device according to an embodiment of the present application.

[0031] Figure 2 A flowchart of a dynamic encryption authentication method of a data communication device according to an embodiment of the present application.

[0032] Figure 3 A structural diagram of a structural relationship device according to an embodiment of the present application.

[0033] Figure 4 A structural diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0035] In the existing field of unmanned aerial vehicles, the related technical patents in the technical field of “multi-agent cooperation”, “dynamic defense mechanism” and “high-concurrency instruction control” are mainly used in various fields and various application scenarios, and there is a lack of special technical patents for unmanned aerial vehicle control management, especially high-concurrency instruction control and network defense dynamic strategy optimization adjustment.

[0036] After querying the existing technical patents in the related direction, the technical patents in the direction of unmanned aerial vehicle, network defense strategy dynamic optimization and high-concurrency instruction control management can provide multi-agent cooperative task formation optimization, can provide agent task strategy cooperation optimization and effect evaluation, can provide network attack surface evaluation and dynamic defense mechanism effectiveness judgment, can accurately distinguish business behavior, improve modeling and defense effect and solve the problem of abnormal alarm analysis in the dynamic defense mechanism management of terminal business, can provide management of high-synchronization and high-concurrency task instruction group control, and can provide multi-person and multi-task cooperative interactive operation, but cannot solve the problems of “dynamic defense mechanism” generation and execution and “high-concurrency instruction control” management and instruction execution. The specific technical problems are as follows:

[0037] 1. Encryption authentication of device login (query login and encryption authentication related technical patents):

[0038] 1.1. Patent name: “User login authentication method and related device”.

[0039] (1) Disclosure number: CN115150154A:

[0040] (2) Problem solving: The application provides a user login authentication method and related device, the method includes: the first server verifies the authenticity and validity of the target account information according to the login authentication request from the electronic device, and if the authenticity and validity of the target account information are authenticated, it is determined whether the first database of the first server contains the authorization credentials of the second server for GUID, if the first database contains the authorization credentials of the second server, a target authorization credential is selected from the authorization credentials, and the target authorization credential in the first database is deleted, and the target authorization credential is sent to the second server through the electronic device, so that the second server determines that the login authentication of the target account is passed when the target authorization credential exists in the second database of the second server, otherwise, it is determined that the login authentication of the target account is not passed. The application embodiment can improve the security of user login.

[0041] (3) Technical features: Based on the deployment of multiple verification servers, the authenticity and validity of the target account information are verified according to the login authentication request, and if the authenticity and validity of the target account information are authenticated, it is determined whether the first database of the first server contains the authorization credentials of the second server for GUID, if the authorization credentials exist, a target authorization credential is selected from the authorization credentials, and the target authorization credential in the first database is deleted; through the electronic device, the target authorization credential is sent to the second server, so that the second server determines that the login authentication of the target account is passed when the target authorization credential exists in the second database of the second server, otherwise, it is determined that the login authentication of the target account is not passed. The application embodiment can improve the security of user login.

[0042] (4) Development status: The application patent published on May 26, 2023, applies multiple servers in the application scenario of user login authentication, carries out multiple rounds of mutual verification and authorization authentication result checking, and solves the problem of improving the security of user login.

[0043] (5) Technical problem: The application provides security support for user login, but does not provide "device login encryption authentication" and "device login SMS authentication", and does not handle the problem of "device control instruction execution encryption authentication", and cannot provide the above dynamic encryption authentication capability for digital communication equipment.

[0044] 1.2. Patent name: "Login authentication method based on wireless communication and related equipment".

[0045] (1) Disclosure number: CN112332992A.

[0046] (2) The problem is solved: the patent based on wireless communication login authentication method is used to limit the physical login area of the account.

[0047] (3) Technical features: the application embodiment is characterized in that the wireless authenticator receives the authentication challenge sent by the authentication device through wireless communication, the authentication challenge is used to authenticate the login validity of the target account, the authentication challenge is generated by the server and sent to the computer device, and the computer device connected with the authentication device by hardware or software sends the authentication challenge to the authentication device; the wireless authenticator generates an authentication response according to the authentication challenge; the wireless authenticator broadcasts the authentication response to the external space, so that the authentication device in the external space receives the authentication response, and the authentication device returns the authentication response to the server through the computer device.

[0048] (4) Development status: the application patent published on January 3, 2025 discloses a login authentication method based on wireless communication, which is used to limit the physical login area of the account. When the method is applied to the wireless authenticator, it includes: the wireless authenticator receives the authentication challenge sent by the authentication device through wireless communication, the authentication challenge is used to authenticate the login validity of the target account; the wireless authenticator generates an authentication response according to the authentication challenge; the wireless authenticator broadcasts the authentication response to the external space, so that the authentication device in the external space receives the authentication response. When the method is applied to the authentication device, it includes: the authentication device is connected with the computer device; the authentication device receives the authentication challenge, which is used to authenticate the login validity of the target account; the authentication device sends the authentication challenge to the wireless authenticator in the external space through wireless communication; the authentication device receives the authentication response returned by the wireless authenticator.

[0049] (5) Technical problem: the application provides a login authentication method based on wireless communication, which is used to limit the physical login area of the account, but does not provide the application of "encrypted authentication of device login" and "SMS authentication of device login", does not handle the problem of "encrypted authentication of device control instruction execution", and cannot provide the above dynamic encryption authentication capability for the number of devices.

[0050] 2. SMS authentication of device login (query login, SMS authentication related technical patents):

[0051] Patent name: "SMS authentication method, system, SMS gateway device and terminal device":

[0052] (1) Publication number: CN113132925A.

[0053] (2) Solution: The short message authentication method includes: a short message gateway device receiving a short message distribution request, the short message distribution request including a target number and a short message verification code; the short message gateway device randomly allocating an extraction code and establishing a mapping relationship between the extraction code and the short message verification code; the short message gateway device storing the short message verification code in the database of the target application program; the short message gateway device generating an extraction code short message and distributing the extraction code short message to the terminal device according to the target number; the terminal device receiving the extraction code short message; the terminal device completing the login verification of the target application program according to the extraction code and the user input access password; the terminal device obtaining the short message verification code from the database of the target application program according to the mapping relationship; and the terminal device completing the short message authentication according to the short message verification code. The short message authentication method can improve the security of the short message authentication mode.

[0054] (3) Technical features: A short message authentication method, characterized in that the method includes: a short message gateway device receiving a short message distribution request, wherein the short message distribution request includes a target number and a short message verification code; the short message gateway device randomly allocating an extraction code and establishing a mapping relationship between the extraction code and the short message verification code; the short message gateway device storing the short message verification code in the database of the target application program; the short message gateway device generating an extraction code short message using a preset template and distributing the extraction code short message to a terminal device according to the target number, wherein the extraction code short message includes the extraction code; the terminal device receiving the extraction code short message and obtaining the extraction code; the terminal device completing the login verification of the target application program according to the extraction code and the user input access password; the terminal device obtaining the short message verification code from the database of the target application program according to the mapping relationship; and the terminal device completing the short message authentication according to the short message verification code.

[0055] (4) Development status: The application patent published on February 18, 2022 applies a short message authentication method, system, short message gateway device, and terminal device.

[0056] (5) Technical problem: The application provides a short message authentication method, system, short message gateway device, and terminal device, but does not provide the application of "encrypted authentication of device login" and "short message authentication of device login", does not handle the problem of "encrypted authentication of device control instruction execution", and cannot provide the above dynamic encryption authentication capabilities for number communication devices.

[0057] 3. Encryption authentication of device control instruction execution (query control instruction encryption authentication related technology patents):

[0058] Patent name: "Device cluster scheduling method, device and medium based on instruction encryption".

[0059] (1) Publication number: CN117009951A.

[0060] (2) Problem solving: The application relates to a scheduling technology, and discloses a device cluster scheduling method based on instruction encryption, which comprises the following steps: calculating the correlation degree between each target device according to device parameters, and constructing a device cluster according to the correlation degree; sending a device scheduling instruction to the device cluster, performing instruction analysis on the device scheduling instruction, obtaining instruction parameters, encrypting the instruction parameters, and obtaining encrypted instruction parameters; extracting the cluster identifier in the instruction parameters, determining the device cluster corresponding to the device scheduling instruction according to the cluster identifier; decrypting the encrypted instruction parameters by using the built-in chip of each target device in the device cluster to obtain decrypted instruction parameters; performing instruction authentication on the instruction parameters and the decrypted instruction parameters to obtain an instruction authentication result; and when the instruction authentication result is authentication success, scheduling the device cluster. The application also proposes a device cluster scheduling device, a device and a medium based on instruction encryption. The application can improve the device scheduling security.

[0061] (3) Technical features: the application discloses a device cluster scheduling method based on instruction encryption, and the method has the following characteristics: S1, obtaining the device parameters of each target device, calculating the correlation degree between each target device according to the device parameters by using a preset correlation degree algorithm, and constructing a device cluster according to the correlation degree, wherein the calculation of the correlation degree between each target device according to the device parameters by using the preset correlation degree algorithm comprises the following steps: S11, extracting the device function attribute in the device parameter; S12, determining the device information amount of the device function attribute by using a preset entropy value algorithm; S13, calculating the correlation coefficient of each target device according to the device information amount by using the following correlation degree algorithm: wherein the correlation coefficient of the i-th target device is the device information amount of the i-th target device, the device information amount of all target devices is the average value, the number of target devices is the minimum value function, and the maximum value function is S14, determining the correlation degree between each target device according to the correlation coefficient; S2, sending a device scheduling instruction to the device cluster by using a preset scheduling end, performing instruction analysis on the device scheduling instruction to obtain instruction parameters, and encrypting the instruction parameters by using a preset hybrid encryption algorithm to obtain encrypted instruction parameters; S3, extracting the cluster identifier in the instruction parameters, and determining the device cluster corresponding to the device scheduling instruction according to the cluster identifier; S4, decrypting the encrypted instruction parameters by using the built-in chip of each target device in the device cluster to obtain decrypted instruction parameters; S5, performing instruction authentication on the instruction parameters and the decrypted instruction parameters to obtain an instruction authentication result, and when the instruction authentication result is authentication success, performing scheduling on the device cluster by using a preset balanced scheduling algorithm; wherein the encryption of the instruction parameters by using the preset hybrid encryption algorithm to obtain the encrypted instruction parameters comprises the following steps: performing initial permutation on the instruction parameters to obtain a permutation instruction parameter, dividing the permutation instruction parameter to obtain a left instruction parameter and a right instruction parameter; performing iteration on the left instruction parameter and the right instruction parameter by using a preset iteration formula and a preset public key to obtain an iteration left instruction parameter and an iteration right instruction parameter: wherein the iteration left instruction parameter in the i-th iteration is the iteration right instruction parameter in the i-th iteration, the fixed permutation function is the bit mapping function, the public key is the sub-key in the hybrid encryption algorithm; and performing inverse permutation on the iteration left instruction parameter and the iteration right instruction parameter by using a preset inverse permutation table to obtain the encrypted instruction parameters.

[0062] (4) Development status: The application patent published on December 15, 2023 applies a device cluster scheduling method based on instruction encryption. The correlation degree between each target device is calculated according to the device parameters, and the device cluster is constructed according to the correlation degree. The device scheduling instruction is sent to the device cluster, the instruction parameters are obtained by analyzing the device scheduling instruction, the instruction parameters are encrypted to obtain encrypted instruction parameters; the cluster identifier in the instruction parameters is extracted, and the device cluster corresponding to the device scheduling instruction is determined according to the cluster identifier; the built-in chip of each target device in the device cluster is used to decrypt the encrypted instruction parameters to obtain decrypted instruction parameters; the instruction parameters and the decrypted instruction parameters are authenticated to obtain the instruction authentication result, and when the instruction authentication result is authentication success, the device cluster is scheduled, and the security of the device scheduling is improved.

[0063] (5) Technical problem: The application is based on instruction encryption for device cluster scheduling, but does not solve the application of "device login encryption authentication" and "device login SMS authentication", does not process the "encryption authentication of device control instruction execution" problem, and cannot provide the above dynamic encryption authentication capability for the number of devices.

[0064] The purpose of the application is to provide a number of device dynamic encryption authentication method and related device, which can realize dynamic authentication of device login encryption authentication, random enhancement of device login SMS, and real-time instruction interaction verification of device control instruction execution encryption authentication three major innovation technical points, and systematically improve the security of number device management, and fill the gap of traditional technology in number device login and instruction control compliance and attack resistance.

[0065] In order to make the above-mentioned purposes, characteristics and advantages of the application more obvious and easy to understand, the application will be further described in detail below in combination with the drawings and specific embodiments.

[0066] The number of device dynamic encryption authentication method provided by the embodiment of the application can be applied in the application environment as shown in the figure. Figure 1 The terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be separately arranged, or can be integrated on the server 104, or can be placed on the cloud or other servers.

[0067] The terminal 102 can be, but is not limited to, various desktop computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by a stand-alone server or a server cluster composed of multiple servers, and can also be a cloud server.

[0068] In an exemplary embodiment, as shown in Figure 2 A dynamic encryption authentication method for a data communication device is provided, which is executed by a computer device, specifically by a terminal or a server, or by both a terminal and a server. In the embodiments of the present application, the method is applied to the server 104 in the system 100, and includes the following steps S1-S4. Figure 1

[0069] S1. An encrypted communication channel based on a transport layer security protocol is established between a user terminal and a data communication device via an authentication server.

[0070] S2. The authentication server receives a static identity credential submitted by the user terminal for a first verification on the encrypted communication channel. When the verification is passed, a dynamic password is sent to the user terminal via a short message gateway, and a dynamic password submitted by the user terminal is subjected to a second verification.

[0071] S3. When a control instruction is initiated by the user terminal after the second verification is passed, a challenge value is sent to the user terminal via the authentication server. The user terminal calculates the challenge value using a pre-shared key to generate a response code, and returns the response code to the authentication server. The authentication server verifies the validity of the response code, and forwards the control instruction to a target data communication device after the verification is passed.

[0072] S4. The data communication device executes the received control instruction, and records an instruction execution event to a security audit log.

[0073] In the embodiments, a multi-level dynamic encryption mechanism is used to achieve security protection for the whole process from device login to instruction execution. The system uses a modular design, integrates key technologies such as SSL / TLS encrypted communication, multi-factor identity authentication, dynamic challenge / response mechanism, and builds a security architecture including four core components: user terminal, authentication server, data communication device, and short message gateway. The scheme pays special attention to the cryptographic strength design of each link, significantly improves the authentication security on the premise of ensuring system compatibility, effectively prevents common threats such as man-in-the-middle attacks, replay attacks, and credential cracking, and meets the real-time requirements in industrial environments.

[0074] In the execution of steps S1-S4, the following can be specifically implemented:

[0075] ​A three-stage security model of "channel encryption-identity verification-command protection" is established to build progressive protection at three different levels through cryptographic means. At the communication level, the encryption channel technology based on TLS 1.3 is adopted, and the ECDHE-ECDSA-AES256-GCM-SHA384 cipher suite is selected to realize forward secrecy; at the authentication level, the two-factor authentication of static credentials (account password) and dynamic credentials (SMS OTP) is combined, and the time control is combined to prevent credential reuse; at the instruction level, the challenge / response mechanism based on HMAC-SHA256 is introduced, and an independent security token is attached to each control instruction.

[0076] The system running sequence is divided into two main stages of device login and instruction execution. The three-step authentication method of "SSL tunnel establishment-static authentication-dynamic verification" is adopted in the login stage, and the legality of the login is ensured through two identity verifications. The authentication server plays a key role in this process, which not only serves as an SSL terminal to process encrypted connections, but also serves as an authentication center to manage credential verification, and at the same time coordinates the SMS gateway to complete the delivery of OTP. All authentication events are recorded to the security audit module to form complete logs containing fields such as timestamp, source IP, operation type, etc.

[0077] The session state security concept is introduced in the instruction execution stage, and a trusted context is established through a three-way binding mechanism (device ID-session ID-user ID). Each control instruction needs to obtain the challenge value issued by the server first, and the client calculates the response code using the pre-shared key, and the server verifies it before forwarding the instruction to the target device. The number of devices is configured with a special security chip, which is used to process the TLS terminal function of the MQTT protocol and the instruction signature verification, to ensure that even if the control channel is broken, a single instruction still needs to pass the cryptographic verification.

[0078] The embodiment specially designs an anti-explosion protection mechanism: the PBKDF2-HMAC-SHA512 algorithm is used in the password verification link, and the iteration number is set to 10000 times; the OTP verification sets a 300-second validity period and a 5-time attempt limit; the challenge response value contains a nanosecond-level timestamp, and the time tolerance is only ±2 seconds. In terms of performance optimization, fast reconnection is realized through SSL session tickets, and the RTT time is controlled within 50ms; the instruction channel uses UDP to carry the DTLS protocol, and the time delay is reduced by 40% compared with the traditional scheme.

[0079] Security analysis shows that the embodiment can resist the following attacks:

[0080] 1. Resist man-in-the-middle attack (TLS certificate fixation technology).

[0081] 2. Resist replay attack (challenge value contains monotonic increasing serial number).

[0082] 3. Resist brute force attack (multi-factor authentication + attempt limit).

[0083] 4. Resistance to session hijacking (fresh challenge response required per instruction).

[0084] Among them, compared with the prior art, under the same hardware conditions, the above four dimensions of attack resistance are realized, active security defense and protection are realized, and more than 95% of the original device compatibility is maintained. The specific implementation scheme design is as follows:

[0085] Step one: Establish a number of control security channels:

[0086] 1) Executive body: number of device user login terminal and number of device login authentication server.

[0087] 2) Key step effect:

[0088] The client sends ClientHello, including the supported TLS version and the list of cipher suites.

[0089] The server selects ECDHE-ECDSA-AES256-GCM-SHA384 suite to respond to ServerHello.

[0090] Complete key exchange and certificate verification (use OV SSL certificate, key length 384 bits).

[0091] Establish an encrypted application data transmission channel.

[0092] 3) Key step effect:

[0093] Provide end-to-end encrypted communication; prevent traffic sniffing and man-in-the-middle attacks; provide a secure carrier for subsequent authentication.

[0094] Step two: Authenticate number of device login static credentials:

[0095] 1) Executive body: number of device login authentication server.

[0096] 2) Key steps:

[0097] The client sends AuthRequest = {Username, HASH(Password||Salt)}.

[0098] The server queries the database for verification:

[0099] Calculate HASH'(StoredPassword||Salt).

[0100] Compare HASH' == HASH.

[0101] Fail to accumulate error count, 5 errors trigger 15 minutes lock.

[0102] 3) Key steps:

[0103] Verify the authenticity of the user's identity; defend against brute force attacks; prevent brute force attacks by limiting the number of errors.

[0104] Step 3: Verify the number of access devices dynamic password:

[0105] 1) Perform the subject: number of devices login authentication server → SMS gateway → user terminal.

[0106] 2) Key steps:

[0107] Server-generated: OTP = (Truncate(Timestamp / 30) + ServerSeed) mod 1000000.

[0108] Send to the user's registered mobile phone through the SMPP protocol.

[0109] The client needs to submit the correct OTP within 300 seconds.

[0110] The server verifies the time window and the value of the match.

[0111] 3) Key steps:

[0112] Implement two-factor authentication; prevent unauthorized access due to credential compromise; bind the user's physical device (mobile phone).

[0113] Step 4: Negotiate the number of device session keys (derive three keys):

[0114] 1) Perform the subject: number of devices user login terminal and number of devices login authentication server.

[0115] 2) Key steps:

[0116] Through ECDHE exchange to generate SharedKey = (g^a mod p)^b mod p.

[0117] Derive three sub-keys:

[0118] SessionKey = HKDF(SharedKey, "SESSION", 256).

[0119] MACKey = HKDF(SharedKey, "MAC", 256).

[0120] IVSeed = HKDF(SharedKey, "IV", 128).

[0121] 3) Key steps:

[0122] Establish a temporary session key; achieve forward security; provide cryptographic material for challenge-response.

[0123] Step Five: Challenge (Generate challenge value) Number-Through Device Control Instruction:

[0124] 1) Execution subject: Number-Through Device logs in to the authentication server.

[0125] 2) Key steps:

[0126] Receive client instruction request CommandReq = {DeviceID, CmdType}.

[0127] Generate challenge value: Chall = HMAC(SessionID || SeqNo || Timestamp, MACKey).

[0128] Return {Chall, Validity=5s} to the client.

[0129] 3) Key steps:

[0130] Ensure instruction freshness; bind specific session and device; prevent replay attacks.

[0131] Step Six: Verify Number-Through Device Instruction Response:

[0132] 1) Execution subject: Number-Through Device user logs in to the terminal → Number-Through Device logs in to the authentication server.

[0133] 2) Key steps:

[0134] Client calculates: Resp = HMAC(Chall || CmdBody, MACKey).

[0135] Submit complete instruction package: {Chall, Resp, CmdBody, Timestamp}.

[0136] Server verification:

[0137] Time validity (±2 seconds).

[0138] Challenge value matching.

[0139] HMAC check correctness.

[0140] 3) Key steps:

[0141] Verify instruction integrity; confirm operator legitimacy; provide non-repudiation.

[0142] Step seven: Forwarding the security instruction of the number passing device:

[0143] 1) The execution subject: the number passing device logs in the authentication server -> the number passing device.

[0144] 2) Key steps:

[0145] Server signature instruction: Sig = ECDSA_Sign(CmdHash, ServerPrivateKey).

[0146] Published to the / cmd / DeviceID topic through MQTT over TLS.

[0147] Device verification:

[0148] Certificate chain validity.

[0149] Signature authenticity.

[0150] Timestamp freshness.

[0151] 3. Key step role:

[0152] Ensure that the instruction source is credible; prevent tampering within the channel; and realize device-level access control.

[0153] In this embodiment, through the close cooperation of the above seven steps, a security protection system covering the entire life cycle of authentication is constructed, each step not only independently completes a specific security function, but also forms a defense depth through cryptography association, and finally realizes a security effect superior to traditional schemes.

[0154] Among them, in some embodiments, based on the design concept of hierarchical security architecture, a complete security protection system from user access to device control is constructed. The system adopts a general architecture of "three layers and four modules", realizes the secure interoperation between components through standardized interface protocols, ensures high performance, and meets the requirements of number passing device security login, access and control.

[0155] This embodiment is described from two dimensions of overall architecture and hierarchical details. The hierarchical design of the system adopts a clear vertical layered architecture, which is divided into three main levels of device layer, transmission layer and application layer from bottom to top.

[0156] As shown in the product structure relationship device structure diagram, the device includes a device layer, a transmission layer and an application layer, specifically as follows: Figure 3

[0157] 1. Device layer:

[0158] ​The device layer includes various types of data communication devices and their security modules, responsible for the execution of final instructions and the guardianship of security boundaries. The device is equipped with an SSX1405 security chip that meets the national standard, supporting the SM2 / SM3 / SM4 algorithm suite, providing hardware-level key protection and a secure computing environment. This layer establishes the device trust root through secure boot, firmware signature verification, and other technologies.

[0159] 2. Transmission layer:

[0160] As the nerve center of the system, it is composed of an authentication server cluster and a message bus. It adopts dual-active high-availability deployment, with a single node processing capacity of up to 5000TPS, supporting linear expansion. Core components include:

[0161] Protocol conversion gateway: implements the adaptation of industrial protocols such as MQTT / Modbus / DNP3.

[0162] Security policy engine: access control decision point based on RBAC model.

[0163] Real-time audit module: blockchain storage system for recording all security events.

[0164] 3. Application layer:

[0165] The terminal user-oriented operation interface and management system provides WEB, mobile APP, and CLI access methods. It adopts micro-frontend architecture and integrates the following functional modules:

[0166] Device topology visualization module, authentication strategy configurator, security posture board, and emergency response console.

[0167] Specifically, the functions of each layer, the involved basic components, and the typical technical information are shown in Table 1:

[0168] Table 1: System operation function, involved basic components, and typical technical information table

[0169]

[0170] Among them, the functions of each structure are as follows:

[0171] In the device layer to the transmission layer, the data communication device undertakes the important task of uploading its running state and login information to the data communication device login authentication server. Specifically, the data communication device uses the Syslog protocol to send or push login information or device running state information to the transmission layer through the SNMP Agent, and encapsulates these information into XML format. The transmission layer distributes data through Kafka, partitions and streams according to device type, and finally accurately transmits login information to the data communication device login authentication server.

[0172] At the transport layer to the application layer, the communication module transmits data to the intelligent agent management platform deployed on the server / cloud platform through the Internet (TCP / IP), cellular network or private network. This platform is responsible for adjusting and optimizing the instruction execution strategy, traffic cleaning threshold and firewall rules. The specific process is as follows: first, parse Syslog and associate it with the CMDB database to supplement the operator's department information; then perform threshold judgment on SNMP data, such as triggering an alarm when the CPU usage exceeds 80%; then create a log index in Elasticsearch to support query; finally, push the topology change event to the operation and maintenance terminal in real time through WebSocket.

[0173] At the application layer to the transport layer, the intelligent agent management platform server or cloud platform will push the dynamic defense strategy adjustment results and high-concurrency instruction processing results to the unmanned aerial vehicle command and control intelligent agent deployed on the unmanned aerial vehicle command and control system of each manufacturer through API or message queue.

[0174] From the transport layer to the device layer, the network dynamic defense adjustment strategy and unmanned aerial vehicle high-concurrency control instruction are sent to the perception layer through the transport layer, and the execution strategy or instruction execution parameter of the control instruction is adjusted.

[0175] In addition, the present application compares the present embodiment with the traditional scheme, and the present application has significant advantages over the prior art, mainly due to the application of the intelligent agent distributed consensus algorithm and edge computing technology, game theory or reinforcement learning algorithm, and the design of the utility function resource scheduling strategy. These technologies work together to achieve high-concurrency processing. Intelligent agents can provide thousands of policy negotiation requests per second through distributed consensus algorithms and edge computing. It has dynamic adaptability, and intelligent agents dynamically generate strategies with a time of ≤500ms by combining game theory or reinforcement learning algorithms. It optimizes resource utilization, and intelligent agents schedule resources based on utility functions to reduce resource waste by 50%. It enhances security by actively defending against man-in-the-middle attacks (TLS certificate fixation technology), replay attacks (challenge value containing a monotonically increasing serial number), brute force attacks (multi-factor authentication + attempt limit), and session hijacking (fresh challenge response required for each instruction) in four dimensions, while maintaining more than 95% compatibility with existing devices, effectively ensuring the security of the communication of the number of devices. It also improves the efficiency of policy execution, and intelligent agents directly send adjustment instructions to the device layer through the transport layer, reducing intermediate links and shortening policy execution delay. The comparison between the traditional scheme and the present embodiment is shown in Table 2 below:

[0176] Table 2: Comparison of technical features between traditional scheme and present embodiment

[0177]

[0178] It can be seen that the application comprehensively surpasses the traditional scheme in policy generation, response speed, resource utilization, system cooperation and security through intelligent agent distributed cooperation, edge computing real-time processing and dynamic learning algorithm, and realizes the paradigm upgrade from "static passive" to "dynamic active".

[0179] Specifically, the core of the application is "dynamic, multi-dimensional and physical interaction":

[0180] 1) Digital access device login dynamic key: using the national SM2 algorithm, a temporary session key is generated each time the device is logged in, replacing the static certificate.

[0181] Among them, the traditional device login relies on static RSA certificate or fixed password, which has the risk of long-term validity. The embodiment adopts a dynamic key negotiation mechanism, generates a temporary session key (ECDH exchange) based on the SM2 algorithm, and automatically updates every 5 minutes to prevent long-term abuse after key leakage. At the same time, two-factor mixed authentication is introduced, which requires the operation and maintenance personnel to provide device digital certificate (X.509v3 extension field) and TOTP dynamic password, to ensure the identity is trusted. In order to prevent man-in-the-middle attacks, the device end displays the last 4 digits of the key fingerprint through LED flashing code, and the operation and maintenance personnel need to manually check for consistency before logging in. This scheme has been deployed in a certain financial data center, successfully resisting the forgery attack on the SSH certificate, and improving the login security of the digital access device.

[0182] 2) Random verification code for digital access device: 6-bit mixed code (resisting fake base station hijacking attack) is generated combining with device features (serial number, location information).

[0183] Among them, the traditional digital access device SMS verification code only uses 4 digits, which is easy to be intercepted by a fake base station and subjected to brute force cracking. The embodiment uses a random number generator to generate a 6-bit mixed verification code, which contains the last 3 digits of the device serial number and the geographic location hash value, ensuring that the verification code is strongly bound to the device. After the system detects 3 consecutive failed attempts, it automatically triggers the fuse mechanism to close the device management port and supports notifying the security operation and maintenance center. In addition, the content of the verification code SMS is encrypted and stored to prevent the operator channel from being tampered with. The embodiment intercepts 100% of the fake base station attacks, and the security is significantly improved compared with the traditional scheme.

[0184] 3) Digital access device instruction-level encryption + physical confirmation: each control instruction is encrypted, and high-risk operations need to trigger the device physical button.

[0185] The instruction execution scheme of the traditional data communication device only encrypts the whole SSH session, and cannot prevent malicious instruction injection in the legal session. The embodiment implements instruction-level fine-grained encryption, and each instruction of the data communication device uses independent encryption, and the initial vector of the instruction is dynamically generated by the timestamp and the instruction counter. For high-risk operations (such as port switching, configuration emptying, etc.), the system requires real-time authentication of the operation and maintenance personnel's permission (trigger signal verification) to ensure that the instruction executor has real-time login and control permission of the data communication device.

[0186] The embodiment improves the security of the data communication device management by three innovative technical points of dynamic authentication of the encryption authentication of the device login, random enhancement of the SMS of the device login, and real-time instruction interaction verification of the encryption authentication of the device control instruction execution, and fills the gap of the compliance and attack resistance of the traditional technology in the login and instruction control of the data communication device.

[0187] Based on the same inventive concept, the embodiment of the present application also provides a data communication device dynamic encryption authentication device for implementing the above-mentioned data communication device dynamic encryption authentication method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more data communication device dynamic encryption authentication device embodiments provided below can refer to the limitations of the data communication device dynamic encryption authentication method in the above text, which will not be repeated here.

[0188] In an exemplary embodiment, a data communication device dynamic encryption authentication device for implementing the data communication device dynamic encryption authentication method is provided, comprising:

[0189] A user terminal is configured to initiate a connection request, submit authentication credentials, receive a dynamic password, and send a control instruction and a challenge value.

[0190] An authentication server is configured to establish and manage a TLS encrypted communication channel, verify static identity credentials and dynamic passwords, generate and verify challenge values, forward control instructions, and record security audit logs.

[0191] A data communication device is configured to receive and execute control instructions sent by the authentication server.

[0192] An SMS gateway communicates with the authentication server and is configured to send a dynamic password to the user terminal.

[0193] The authentication server integrates a security chip for accelerating cryptographic operations and securely storing pre-shared keys.

[0194] In an exemplary embodiment, a computer device, which can be a server or a terminal, has an internal structure as shown in Figure 4As shown in the figure. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to implement a dynamic encryption authentication method of a computer device.

[0195] Those skilled in the art can understand that, Figure 4 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0196] In an exemplary embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the above method embodiments.

[0197] In an exemplary embodiment, a computer readable storage medium is provided, storing a computer program, which is executed by a processor to implement the steps in the above method embodiments.

[0198] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0199] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to a memory, a database or other medium used in the embodiments provided in the present application can include at least one of a non-volatile and a volatile memory. The non-volatile memory can include a read-only memory (ROM), a magnetic tape, a floppy disk, a flash memory, an optical storage, a high-density embedded non-volatile memory, a resistive random access memory (ReRAM), a magnetoresistive random access memory (MRAM), a ferroelectric random access memory (FRAM), a phase change memory (PCM), a graphene memory, etc. The volatile memory can include a random access memory (RAM) or an external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as a static random access memory (SRAM) or a dynamic random access memory (DRAM), etc.

[0200] The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a blockchain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0201] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0202] The principles and implementation modes of the present application are described by using specific examples in the present application. The above embodiments are only used to help understand the method and its core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range can be changed. In conclusion, the content of the present application should not be understood as a limitation.

Claims

1. A dynamic encryption authentication method for data communication equipment, characterized in that, include: S1. An encrypted communication channel based on a transport layer security protocol is established between the user terminal and the data communication equipment through an authentication server; S2. On the encrypted communication channel, the authentication server receives the static identity credential submitted by the user terminal for first verification; after successful verification, it sends a dynamic password to the user terminal through the SMS gateway and performs a second verification on the dynamic password submitted by the user terminal; the dynamic password is a one-time password. When the authentication server triggers a circuit breaker mechanism after the number of consecutive authentication failures reaches a preset threshold, it will lock the login method using dynamic passwords. S3. After the second verification is passed, when the user terminal initiates a control command, the challenge value is sent to the user terminal through the authentication server. The user terminal uses the pre-shared key to calculate the challenge value, generates a response code, and returns the response code to the authentication server; The authentication server verifies the validity of the response code and forwards the control command to the target data communication device after successful verification; the challenge value includes a monotonically increasing sequence number and a nanosecond-level timestamp; the response code is calculated and generated using a hash-based message authentication code algorithm. S4. The data communication device executes the received control commands and records the command execution event to the security audit log.

2. The dynamic encryption authentication method for data communication equipment according to claim 1, characterized in that, The encrypted communication channel uses the TLS 1.3 protocol; The encrypted communication channel uses a cipher suite that supports forward secrecy.

3. The dynamic encryption authentication method for data communication equipment according to claim 1, characterized in that, Verifying the validity of the response code specifically includes: The response code is considered valid when the difference between the nanosecond-level timestamp and the server time is within ±2 seconds.

4. The dynamic encryption authentication method for data communication equipment according to claim 3, characterized in that, After step S2 and before step S3, the following is also included: The session binding process includes the following steps: A trusted context is established based on the authentication server; the trusted context is used to triple bind the user terminal identifier, the data communication device identifier, and the current session identifier.

5. A dynamic encryption authentication device for data communication equipment for implementing the dynamic encryption authentication method for data communication equipment as described in any one of claims 1-4, characterized in that, include: The user terminal is used to initiate connection requests, submit authentication credentials, receive dynamic passwords, and send control commands and challenge values. The authentication server is used to establish and manage TLS encrypted communication channels, verify static identity credentials and dynamic passwords, generate and verify challenge values, forward control commands, and record security audit logs. Data communication equipment is used to receive and execute control commands sent by the authentication server; The SMS gateway communicates with the authentication server to send dynamic passwords to user terminals.

6. The dynamic encryption authentication device for data communication equipment according to claim 5, characterized in that, The authentication server integrates a security chip to accelerate cryptographic operations and securely store pre-shared keys.

7. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement a dynamic encryption authentication method for data communication devices according to any one of claims 1-4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a dynamic encryption authentication method for data communication devices as described in any one of claims 1-4.

Images