Authentication method for client and authentication method for server

Abstract

This invention provides an authentication method, system, and medium for a client, as well as an authentication method, system, and medium for a server. The client-side authentication method includes the following steps: encrypting the public key of a second asymmetric key pair generated by the client and device information using the public key of a first asymmetric key pair generated by the server; sending the encrypted public key of the second asymmetric key pair and device information as a reporting request to the server; encrypting pre-authentication information using the private key of the second asymmetric key pair and sending it to the server to obtain a dynamic symmetric key; decrypting the dynamic symmetric key using the private key of the second asymmetric key pair; encrypting login information using the dynamic symmetric key and the private key of the second asymmetric key pair; sending the encrypted login information to the server to obtain a token generated after authentication; and decrypting the token using the private key of the second asymmetric key pair and the dynamic symmetric key.

Description

Technical Field

[0001] This invention relates to the field of network security, and more particularly to an authentication method for a client, an authentication system for a client, and a computer-readable storage medium, as well as an authentication method for a server, an authentication system for a server, and a computer-readable storage medium. Background Technology

[0002] Network information security has become crucial for ensuring the stable operation of information systems and maintaining data integrity and confidentiality. Strengthening information security protection is an inevitable requirement of technological development and a foundation for user trust.

[0003] Therefore, there is an urgent need in this field for an authentication technology for clients and an authentication technology for servers, which can effectively prevent man-in-the-middle attacks and identity impersonation, and improve communication security and data integrity. Summary of the Invention

[0004] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0005] This invention provides an authentication method, an authentication system, and a computer-readable storage medium for a client, as well as an authentication method, an authentication system, and a computer-readable storage medium for a server. These methods utilize dynamic keys for two-way authentication between the client and server, effectively preventing man-in-the-middle attacks and identity impersonation, and enhancing communication security and data integrity.

[0006] Specifically, the authentication method for a client provided by the first aspect of the present invention includes the following steps: encrypting the public key of a second asymmetric key pair generated by the client and device information using the public key of a first asymmetric key pair generated by the server, and sending the encrypted public key of the second asymmetric key pair and device information as a reporting request to the server; encrypting pre-authentication information using the private key of the second asymmetric key pair and sending the encrypted pre-authentication information to the server to obtain a dynamic symmetric key generated by the server, wherein the obtained dynamic symmetric key is encrypted by the public key of the second asymmetric key pair; decrypting the dynamic symmetric key using the private key of the second asymmetric key pair to obtain the dynamic symmetric key; in response to a user's login operation, encrypting login information using the dynamic symmetric key and encrypting the login information encrypted by the dynamic symmetric key using the private key of the second asymmetric key pair; sending the encrypted login information to the server to obtain a token generated after authentication by the server, wherein the token is encrypted by the dynamic symmetric key and then encrypted using the public key of the second asymmetric key pair; and decrypting the token using the private key of the second asymmetric key pair and the dynamic symmetric key to obtain the token.

[0007] Preferably, in one embodiment of the present invention, the method further includes the steps of: responding to a user's business request operation, encrypting the business parameters and the token using the dynamic symmetric key, sending the encrypted business parameters and the token to the server and obtaining the processing result returned by the server, wherein the processing result is encrypted using the dynamic symmetric key; and decrypting the processing result using the dynamic symmetric key.

[0008] Preferably, in one embodiment of the present invention, the method further includes the steps of: in response to the failure of the dynamic symmetric key, encrypting the pre-authentication information using the private key of the second asymmetric key pair and sending the encrypted pre-authentication information to the server to obtain the updated dynamic symmetric key from the server; and / or in response to the update of the second asymmetric key pair, encrypting the updated public key and device information of the second asymmetric key pair using the public key of the first asymmetric key pair, and sending the encrypted public key and device information of the second asymmetric key pair as an update reporting request to the server.

[0009] Furthermore, the above-described authentication method for a server according to a second aspect of the present invention includes the steps of: in response to receiving a reporting request sent by a client, decrypting the reporting request using the private key of a first asymmetric key pair generated by the server to obtain the public key of a second asymmetric key pair and device information; in response to receiving pre-authentication information sent by the client, decrypting the pre-authentication information using the public key of the second asymmetric key pair, and generating a dynamic symmetric key after the pre-authentication information is verified; encrypting the dynamic symmetric key using the public key of the second asymmetric key pair, and sending the encrypted dynamic symmetric key to the client; in response to receiving login information sent by the client, decrypting the login information using the public key of the second asymmetric key pair and the dynamic symmetric key, and generating a token after the login information is authenticated; and encrypting the token using the dynamic symmetric key and encrypting the token encrypted by the dynamic symmetric key using the public key of the second asymmetric key pair, and sending the encrypted token to the client.

[0010] Preferably, in one embodiment of the present invention, the method further includes the steps of: in response to receiving service parameters sent by the client, decrypting the service parameters using the dynamic symmetric key and authenticating based on the token; after successful authentication, performing service processing based on the service parameters and encrypting the processing result using the dynamic symmetric key; and sending the encrypted processing result to the client.

[0011] Preferably, in one embodiment of the present invention, the method further includes the steps of: deleting the public key and device information of the stored second asymmetric key pair in response to receiving a deletion request sent by the client; and / or deleting the public key and device information of the stored second asymmetric key pair in response to the fact that the public key of the stored second asymmetric key pair has not been used for a longer period than a preset value.

[0012] Furthermore, the authentication system for a client provided according to a third aspect of the present invention includes a memory and a processor. The memory stores computer instructions. The processor is connected to the memory and configured to execute the computer instructions stored in the memory to implement the authentication method for a client provided in the first aspect of the present invention.

[0013] Furthermore, the authentication system for a server provided according to a fourth aspect of the present invention includes a memory and a processor. The memory stores computer instructions. The processor is connected to the memory and configured to execute the computer instructions stored in the memory to implement the authentication method for a server provided in the second aspect of the present invention.

[0014] Furthermore, the computer-readable storage medium provided according to the fifth aspect of the present invention stores computer instructions. When the computer instructions are executed by a processor, they implement the authentication method for a client provided in the first aspect of the present invention.

[0015] Furthermore, the computer-readable storage medium provided according to the sixth aspect of the present invention stores computer instructions. When the computer instructions are executed by a processor, they implement the authentication method for a server provided in the second aspect of the present invention. Attached Figure Description

[0016] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0017] Figure 1 A communication architecture diagram between a client and a server is shown according to some embodiments of the present invention;

[0018] Figure 2 A schematic diagram of an authentication system for a client provided according to some embodiments of the present invention is shown;

[0019] Figure 3 A schematic diagram of an authentication system for a server provided according to some embodiments of the present invention is shown;

[0020] Figure 4 This diagram illustrates an authentication flowchart between an application and a platform system, provided according to some embodiments of the present invention.

[0021] Figure 5 A timing diagram based on the relationship between an application and a platform system is shown, according to some embodiments of the present invention;

[0022] Figure 6 A flowchart of an authentication method for a client, provided according to some embodiments of the present invention, is shown; and

[0023] Figure 7 A flowchart of a server-side authentication method provided according to some embodiments of the present invention is shown.

[0024] Figure label:

[0025] 110: Smart terminal;

[0026] 120: Application;

[0027] 130: Platform system;

[0028] 200: Authentication system used for clients;

[0029] 210: Memory;

[0030] 211: Computer-readable storage medium;

[0031] 220: Processor;

[0032] 300: Used for server-side authentication systems;

[0033] 310: Memory;

[0034] 311: Computer-readable storage medium;

[0035] 320: Processor;

[0036] S610~S660: Steps; and

[0037] S710~S750: Steps. Detailed Implementation

[0038] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should be noted that the aspects described below with reference to the accompanying drawings and specific embodiments are merely exemplary and should not be construed as limiting the scope of protection of the present invention in any way.

[0039] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0040] Furthermore, the terms "upper," "lower," "left," "right," "top," "bottom," "horizontal," and "vertical" used in the following description should be understood as the orientations shown in the relevant paragraphs and accompanying drawings. These relative terms are for illustrative purposes only and do not imply that the described apparatus must be manufactured or operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0041] It is understood that although terms such as "first," "second," and "third" may be used herein to describe various components, regions, layers, and / or parts, these components, regions, layers, and / or parts should not be limited by these terms, and these terms are only used to distinguish different components, regions, layers, and / or parts. Therefore, the first components, regions, layers, and / or parts discussed below may be referred to as second components, regions, layers, and / or parts without departing from some embodiments of the present invention.

[0042] As mentioned above, network information security has become crucial for ensuring the stable operation of information systems and maintaining data integrity and confidentiality. Strengthening information security protection is an inevitable requirement of technological development and a foundation for user trust.

[0043] This invention provides an authentication method, an authentication system, and a computer-readable storage medium for a client, as well as an authentication method, an authentication system, and a computer-readable storage medium for a server. These methods utilize dynamic keys for two-way authentication between the client and server, effectively preventing man-in-the-middle attacks and identity impersonation, and enhancing communication security and data integrity.

[0044] Please refer to Figure 1 , Figure 1 A communication architecture diagram between a client and a server is shown according to some embodiments of the present invention.

[0045] like Figure 1 As shown, the communication architecture provided by this invention may include three core modules: a smart terminal 110, an application program 120, and a platform system 130 acting as a server. This communication architecture can be applied to distributed systems.

[0046] Smart terminal 110 refers to any device or machine with computing processing capabilities, including but not limited to mobile phones, smart speakers, smart access control systems, tablets, and other terminal devices. In the following description, the terms "smart terminal," "smart device," "terminal equipment," "terminal," and "user equipment" are used interchangeably.

[0047] Application 120 can be installed on smart terminal 110 to implement specific functions or services. Users can download and install application 120 on smart terminal 110. Application 120 can read device information of smart terminal 110, including device type, serial number, unique code, etc. In some embodiments, application 120 can be an authentication system for clients provided by the present invention; in other embodiments, the authentication system for clients provided by the present invention can be configured within application 120.

[0048] In some non-limiting embodiments, the authentication method for clients provided by the present invention can be implemented via the authentication system for clients provided by the present invention.

[0049] Figure 2 A schematic diagram of an authentication system for a client is shown, according to some embodiments of the present invention.

[0050] Please refer to Figure 2The client-side authentication system 200 may be configured with a memory 210 and a processor 220. The memory 210 includes, but is not limited to, the computer-readable storage medium 211 described in the third aspect of the present invention, which stores computer instructions thereon. The processor 220 is connected to the memory 210 and configured to execute the computer instructions stored in the memory to implement the client-side authentication method provided by the present invention.

[0051] The authentication system for clients provided by this invention may also include multiple program modules. These program modules can be stored in memory. Program modules include, but are not limited to, an operating system, one or more applications, other program modules, and program data; each or some combination of these examples may include an implementation of a network environment. Program modules are typically used to perform the functions and / or methods described in the embodiments of this invention. For example, in... Figure 1 In the illustrated embodiment, the program modules in application 120 may include a device information unit, a RAS (Remote Access Service) device key unit, and an authentication unit. The device information unit, RAS device key unit, and authentication unit can implement the various steps and functions of the authentication method for the client, either individually or together.

[0052] Application 120 can send requests to platform system 130, and platform system 130 can respond to requests initiated by application 120. Platform system 130 can act as a server. In some embodiments, platform system 130 can be the authentication system for server provided by the present invention. In other embodiments, the authentication system for server provided by the present invention can be configured in platform system 130.

[0053] In some non-limiting embodiments, the above-described authentication method for the server provided by the present invention can be implemented via the above-described authentication system for the server provided by the present invention.

[0054] Figure 3 A schematic diagram of an authentication system for a server side provided according to some embodiments of the present invention is shown.

[0055] Please refer to Figure 3 The server-side authentication system 300 may be configured with a memory 310 and a processor 320. The memory 310 includes, but is not limited to, the computer-readable storage medium 311 described in the third aspect of the present invention, which stores computer instructions. The processor 320 is connected to the memory 310 and configured to execute the computer instructions stored in the memory to implement the server-side authentication method provided by the present invention.

[0056] The server-side authentication system provided by this invention may also include multiple program modules. These program modules can be stored in memory. Program modules include, but are not limited to, an operating system, one or more applications, other program modules, and program data; each or some combination of these examples may include an implementation of a network environment. Program modules are typically used to perform the functions and / or methods described in the embodiments of this invention. For example, in... Figure 1 In the illustrated embodiment, the program modules in the platform system 130 may include a platform authentication unit, a dynamic key unit, a RAS device key management unit, an authentication unit, and a platform service unit. These program modules can implement the steps and functions of the authentication method used on the server side, either individually or in combination.

[0057] The working principles of the aforementioned client-side and server-side authentication systems will be described below with reference to some embodiments of client-side and server-side authentication methods. Those skilled in the art will understand that these embodiments of client-side and server-side authentication methods are merely non-limiting implementations provided by this invention, intended to clearly demonstrate the main concepts of the invention and provide specific solutions convenient for public implementation, rather than limiting all functions or operating methods of the client-side and server-side authentication systems. Similarly, the client-side and server-side authentication systems are also merely non-limiting implementations provided by this invention, and do not limit the executing entities and execution order of the steps in these client-side and server-side authentication methods.

[0058] Please refer to Figure 4 , Figure 5 , Figure 6 and Figure 7 , Figure 4 This diagram illustrates an authentication flowchart between an application and a platform system according to some embodiments of the present invention. Figure 5 A timing diagram based on the relationship between an application and a platform system, according to some embodiments of the present invention, is shown. Figure 6 A flowchart of an authentication method for a client, according to some embodiments of the present invention, is shown. Figure 7 A flowchart of a server-side authentication method provided according to some embodiments of the present invention is shown.

[0059] like Figure 4 and Figure 5As shown, users can first install an application (App) on their smart device and initialize it, including configuring configuration files and setting up the basic runtime environment. Afterward, the installed application can read and store device information, including the smart device's device type, unique device code, serial number, and other information. Figure 1 In the illustrated embodiment, the application 120 can read and store the device information of the smart device through the device information unit.

[0060] exist Figure 4 and Figure 5 In the illustrated embodiment, the application installed on the smart device can be configured with an authentication system for clients. The application can generate device RAS key pair information based on the obtained device information such as device type, serial number, unique code, production date, and random number. Figure 1 In the illustrated embodiment, application 120 can generate device RAS key pair information through the RAS device key unit.

[0061] Remote Access Service (RAS) is a network technology that allows users to securely connect to private networks or internal enterprise systems over public networks (such as the Internet). RAS's core functions include authentication, authorization, and secure communication, and it is commonly used in scenarios such as remote work and Virtual Private Networks (VPNs). RAS ensures the security and reliability of remote access by verifying user identity and establishing encrypted channels. The RAS key is an asymmetric key.

[0062] Those skilled in the art will understand that the technical solution for implementing asymmetric encryption based on RAS keys is merely a non-limiting implementation method provided by this invention, intended to clearly demonstrate the main concept of this invention and provide a specific solution that is easy for the public to implement, rather than being used to limit the scope of protection of this invention.

[0063] Please refer to Figure 6 The authentication system for the client can perform step S610: use the public key of the first asymmetric key pair generated by the server to encrypt the public key of the second asymmetric key pair generated by the client and the device information, and send the encrypted public key of the second asymmetric key pair and the device information as a reporting request to the server.

[0064] exist Figure 4 and Figure 5 In the illustrated embodiment, the first asymmetric key pair may be a platform RAS key generated by the platform system, and the second asymmetric key pair may be a device RAS key generated by the application based on the device information of the smart device.

[0065] Applications can send reporting requests to the platform system, which acts as a server. The reporting request can include the public key of the encrypted device RAS key and device information. The application can use the public key of the platform RAS key generated by the platform system to encrypt the public key of the device RAS key pair and the device information, and then send the encrypted public key of the device RAS key and the device information as a reporting request to the platform system.

[0066] like Figure 7 As shown, the authentication system for the server can perform step S710: in response to receiving a reporting request sent by the client, decrypt the reporting request using the private key of the first asymmetric key pair generated by the server to obtain the public key of the second asymmetric key pair and device information.

[0067] exist Figure 4 and Figure 5 In the illustrated embodiment, the reporting request is encrypted using the public key of the platform RAS key generated by the platform system. Therefore, after the platform system receives the reporting request sent by the application, it can use the private key of the platform RAS key to decrypt the reporting request, thereby obtaining and storing the public key of the device RAS key and device information. Figure 1 In the embodiment shown, the platform system 130 can store the device information and corresponding device RAS keys of each smart device in the distributed system through the RAS device key management unit.

[0068] Thus, through steps S610 and S710, the client and server can implement the reporting process. When the client transmits the public key of the second asymmetric key pair generated by the client and the device information to the server for reporting, it needs to use the public key of the first asymmetric key pair generated by the server for encryption. After receiving the client's reporting request, the server uses the private key of the first asymmetric key pair for decryption and verification, thereby ensuring the legitimacy of the reporting by the legitimate device client when reporting the public key of the second asymmetric key pair and the device information.

[0069] Next, as Figure 6 and Figure 7 As shown, the pre-authentication process can be implemented by the client and the server through steps S620~S630 and S720~S730.

[0070] The authentication system for the client can perform steps S620~S630: encrypt the pre-authentication information using the private key of the second asymmetric key pair and send the encrypted pre-authentication information to the server to obtain the dynamic symmetric key generated by the server. The obtained dynamic symmetric key is encrypted by the public key of the second asymmetric key pair; decrypt the dynamic symmetric key using the private key of the second asymmetric key pair to obtain the dynamic symmetric key.

[0071] The authentication system for the server can perform steps S720~S730: in response to receiving pre-authentication information sent by the client, decrypt the pre-authentication information using the public key of the second asymmetric key pair, generate a dynamic symmetric key after the pre-authentication information is verified; encrypt the dynamic symmetric key using the public key of the second asymmetric key pair, and send the encrypted dynamic symmetric key to the client.

[0072] The client can send encrypted pre-authentication information to the server. Upon receiving the pre-authentication information, the server decrypts and verifies it to generate a dynamic symmetric key. The server then encrypts the generated dynamic symmetric key and sends it to the client. The client decrypts the received encrypted dynamic symmetric key to cache it.

[0073] exist Figure 4 and Figure 5 In the illustrated embodiment, the application can encrypt the pre-authentication information using the private key of the device's RAS key and send the encrypted pre-authentication information to the platform system. Here, the pre-authentication information can be the device's account information, such as a unique device identifier, user information, etc.

[0074] After receiving the pre-authentication information from the application, the platform system authenticates the signature in the pre-authentication information, decrypts it using the public key of the stored device RAS key to obtain the pre-authentication information, and verifies the authentication device information and user information based on the decrypted pre-authentication information. After successful pre-authentication verification, the platform system can generate a dynamic symmetric key with a validity period. Figure 1 In the embodiment shown, the platform system 130 can use the platform authentication unit to verify the pre-authentication information and use the dynamic key unit to generate a dynamic symmetric key.

[0075] In the above embodiments, the generated dynamic symmetric key can be an AES (Advanced Encryption Standard) key. AES is a symmetric encryption algorithm that supports 128, 192, and 256-bit key lengths, offering high efficiency, strong security, and good adaptability.

[0076] Those skilled in the art will understand that the technical solution for implementing symmetric encryption based on AES keys is merely a non-limiting implementation method provided by this invention, intended to clearly demonstrate the main concept of this invention and provide a specific solution that is easy for the public to implement, rather than being used to limit the scope of protection of this invention.

[0077] The platform system can then encrypt the generated dynamic symmetric key with an expiration date. The platform system uses the public key of the device's RAS key to encrypt the AES key and returns the encrypted AES key response to the application.

[0078] After receiving the encrypted AES key, the application decrypts it using the private key of the device's RAS key to obtain an AES key with an expiration date. The application then caches the AES key based on its expiration date.

[0079] Dynamic symmetric keys are keys that are dynamically generated and regenerated upon expiration, ensuring high security for key exchanges between the client and server.

[0080] Based on the validity period of the dynamic symmetric key, when the dynamic symmetric key expires, the server can update the dynamic symmetric key. The client can then repeat the aforementioned steps, using the private key of the second asymmetric key pair to encrypt the pre-authentication information and send the encrypted pre-authentication information to the server to obtain the updated dynamic symmetric key. The validity period of the dynamic symmetric key can be half an hour, one hour, or a custom time.

[0081] The second asymmetric key pair generated by the client (such as the device RAS key in the above embodiment) is also dynamically generated. The client-generated second asymmetric key pair can be updated automatically upon expiration or manually by the user. For example, when the second asymmetric key pair exceeds a certain preset time value, the client can automatically update the second asymmetric key pair and replace the old one. Figure 1 In the illustrated embodiment, application 120 can update the device RAS key via the RAS device key unit.

[0082] Each time the client updates the second asymmetric key pair, it can read device information, including device type, unique device code, serial number, etc. Then, it generates a new second asymmetric key pair based on the read device information.

[0083] In response to the update of the second asymmetric key pair, the client can use the public key of the first asymmetric key pair to encrypt the updated public key of the second asymmetric key pair and the device information, and send the encrypted public key of the second asymmetric key pair and the device information as an update reporting request to the server.

[0084] In response to a client's updated reporting request, the server can decrypt the request using the public key of the first asymmetric key pair to obtain the updated public key of the second asymmetric key pair and device information. Figure 1In the embodiment shown, the platform system 130 can update the relevant information stored in the RAS device key management unit after obtaining the updated public key and device information of the second asymmetric key pair.

[0085] Preferably, such as Figure 5 As shown in S501-S507, when the device RAS key is updated periodically or manually, the application can read the device information of the smart device and generate a new device RAS key based on the read device information. The application uses the public key of the platform RAS key to encrypt the public key of the new device RAS key and the device information, and then sends it to the platform system. After receiving and decrypting the new reporting request sent by the application, the platform system updates the public key of the stored device RAS key and returns the update result to the application. After receiving the update result returned by the platform system, the application replaces the old device RAS key to update the device RAS key.

[0086] Preferably, the first asymmetric key pair generated by the server (such as the platform RAS key in the above embodiment) is also dynamically generated. The first asymmetric key pair generated by the server can be updated periodically, such as once a week, once a month, or according to the client version, or it can be updated at a custom time set by the server.

[0087] Please continue to refer to this. Figure 6 and Figure 7 Through steps S640~S660 and S740~S750, the client and server can implement the authentication login process.

[0088] The authentication system for the client can perform steps S640~S660: In response to the user's login operation, encrypt the login information using a dynamic symmetric key and encrypt the login information encrypted by the dynamic symmetric key using the private key of the second asymmetric key pair; send the encrypted login information to the server to obtain the token generated after authentication by the server, the token being encrypted by the dynamic symmetric key and then by the public key of the second asymmetric key pair; decrypt the token using the private key of the second asymmetric key pair and the dynamic symmetric key to obtain the token.

[0089] The authentication system for the server can perform steps S740~S750: In response to receiving login information sent by the client, decrypt the login information using the public key of the second asymmetric key pair and the dynamic symmetric key, and generate a token after the login information is authenticated; encrypt the token using the dynamic symmetric key and encrypt the token encrypted by the dynamic symmetric key using the public key of the second asymmetric key pair, and send the encrypted token to the client.

[0090] When a user logs in to the client, the client uses a dynamic symmetric key to encrypt the login information, and then uses the private key of a second asymmetric key pair to encrypt the login information encrypted with the dynamic symmetric key, resulting in double-encrypted login information. The client sends this encrypted login information to the server, which then decrypts it using the public key of the second asymmetric key pair and the dynamic symmetric key to obtain the login information.

[0091] The server authenticates the user based on login information. Upon successful authentication, a token is generated, which has an expiration period. The server then encrypts the token using a dynamic symmetric key, and subsequently encrypts the token using the public key of a second asymmetric key pair, resulting in a double-encrypted token. The server sends this encrypted token to the client, which decrypts it using the private key of the second asymmetric key pair and the dynamic symmetric key to obtain the final token.

[0092] exist Figure 4 and Figure 5 In the illustrated embodiment, the user logs in to the application to initiate a formal authentication request. The application encrypts the user's login information (which may be their username and password) using an AES key. Then, the application encrypts the AES-encrypted login information again using the device's RAS key's private key and sends this double-encrypted login information to the platform system.

[0093] After receiving a formal authentication request from the application, the platform system verifies the signature and decrypts it sequentially using the device's RAS key's public key and AES key to obtain the specific login information. Based on the login information, user authentication and authorization are performed, and an authentication token is generated upon successful authentication. The platform system can also obtain authentication result information after authentication.

[0094] The platform system uses an AES key to encrypt the authentication token and authentication result information, and then uses the public key of the device's RAS key to encrypt them again, returning the encrypted authentication token and authentication result information to the application.

[0095] The application uses the device's RAS key's private key and AES key in sequence to decrypt the received information to obtain the encrypted authentication token and authentication result information.

[0096] The first asymmetric key pair used by the client is generated based on device information. Therefore, each device's client uses a different first asymmetric key pair, meaning each device has a unique key. This allows for a dynamic authentication mechanism between the communicating parties, ensuring both parties possess legitimate identities. Furthermore, during communication, the symmetric key used for business communication and the asymmetric key used for user authentication complement each other, jointly enhancing the security and reliability of the communication process.

[0097] Thus, in the authentication and login process of the above embodiment, the key exchange between the application (as a client) and the platform system (as a server) uses a dynamic device RAS key generated by the application based on device information. The platform system can authenticate the legitimacy of the smart device with the application installed, and the application on the smart device can authenticate the legitimacy of the platform system, thereby realizing two-way authentication between the application and the platform system.

[0098] The client can generate and update asymmetric keys and perform two-way authentication with the server. The server can generate and update dynamic symmetric keys and perform two-way authentication with the client. In addition, the client and server can provide users with corresponding business functions. The client and server interact with each other for business functions through dynamic symmetric keys.

[0099] Specifically, after completing the two-way authentication between the client and the server through the authentication login process, the client and the server can also implement the business request and response process.

[0100] An authentication system for clients can perform the following steps: responding to a user's business request operation, encrypting business parameters and a token using a dynamic symmetric key, sending the encrypted business parameters and token to the server and obtaining the processing result returned by the server, encrypting the processing result using a dynamic symmetric key; and decrypting the processing result using a dynamic symmetric key.

[0101] An authentication system for the server side can perform the following steps: in response to receiving business parameters sent by the client, decrypting the business parameters using a dynamic symmetric key and authenticating based on a token; after successful authentication, performing business processing based on the business parameters and encrypting the processing result using a dynamic symmetric key; and sending the encrypted processing result to the client.

[0102] Users can initiate business requests through the client, which converts these requests into business parameters. The client encrypts the business parameters and a token using a dynamic symmetric key and sends the encrypted parameters and token to the server. Upon receiving the business parameters, the server decrypts them using the dynamic symmetric key and authenticates the user based on the token. If authentication is successful, the server processes the business logic based on the parameters to obtain the processing result. The server then encrypts the processing result using the dynamic symmetric key and sends it back to the client. The client receives the encrypted result, decrypts it using the dynamic symmetric key, and obtains the final result, completing the entire business request and response process.

[0103] exist Figure 1 In the illustrated embodiment, application 120 can use the authentication unit to complete the authentication function; platform system 130 can use the authorization unit to complete the above-mentioned login information authentication and token authentication functions, and use the platform business unit to complete the business function logic processing.

[0104] Furthermore, the client and server can implement an uninstallation process. When a user initiates an uninstallation operation, the client can asynchronously send a deletion request for the currently used second asymmetric key pair to the server after receiving the uninstallation command. Upon receiving the deletion request from the client, the server can delete the stored public key and device information of the second asymmetric key pair.

[0105] like Figure 5 As shown, the user sends an uninstallation command to the application. Upon receiving the uninstallation command, the application encrypts the uninstallation information using the public key of the platform's RAS key and sends the encrypted uninstallation information to the platform system. After receiving the uninstallation information, the platform system deletes the public key of the device's RAS key corresponding to the device.

[0106] In addition, the server can periodically monitor the usage frequency of each second asymmetric key pair stored in the RAS device key management unit. When the public key of a certain second asymmetric key pair has not been used for a longer period than a preset value, the server can also delete the public key and device information of that second asymmetric key pair. Preferably, the preset value is longer than the time limit for the device to periodically update the second asymmetric key pair.

[0107] In summary, the client-side and server-side authentication technologies provided by this invention enhance the security and reliability of communication by using dynamic keys to mutually verify identities between the client and server. This invention ensures that both parties possess legitimate identities by implementing a dynamic authentication mechanism between them, preventing security threats such as man-in-the-middle attacks and identity forgery. Furthermore, the dynamic nature of the technology adapts to constantly changing network environments and user needs, improving the flexibility and real-time performance of authentication, thereby providing stronger security guarantees for scenarios with high security requirements.

[0108] Although the methods described above are illustrated and depicted as a series of actions for the sake of simplicity, it should be understood and appreciated that these methods are not limited by the order of the actions, as some actions may occur in a different order and / or concurrently with other actions from the illustrations and descriptions herein or not illustrated and described herein but which may be understood by those skilled in the art, according to one or more embodiments.

[0109] Those skilled in the art will understand that information, signals, and data can be represented using any of a variety of different techniques and skills. For example, the data, instructions, commands, information, signals, bits, symbols, and chips described throughout the above description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or optical particles, or any combination thereof.

[0110] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the invention.

[0111] The various illustrative logic modules and circuits described in conjunction with the embodiments disclosed herein may be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0112] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0113] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0114] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An authentication method for a client, characterized in that, Including the following steps: The public key of the first asymmetric key pair generated by the server is used to encrypt the public key of the second asymmetric key pair generated by the client and the device information. The encrypted public key of the second asymmetric key pair and the device information are then sent to the server as a reporting request. The pre-authentication information is encrypted using the private key of the second asymmetric key pair and sent to the server to obtain the dynamic symmetric key generated by the server. The obtained dynamic symmetric key is then encrypted using the public key of the second asymmetric key pair. The dynamic symmetric key is obtained by decrypting using the private key of the second asymmetric key pair; In response to a user's login operation, the login information is encrypted using the dynamic symmetric key and the login information encrypted by the dynamic symmetric key is encrypted using the private key of the second asymmetric key pair; Send the encrypted login information to the server to obtain the token generated by the server after authentication. The token is encrypted by the dynamic symmetric key and then encrypted with the public key of the second asymmetric key pair. as well as The token is obtained by decrypting using the private key of the second asymmetric key pair and the dynamic symmetric key.

2. The authentication method for a client as described in claim 1, characterized in that, It also includes the steps of: responding to a user's business request operation, encrypting the business parameters and the token using the dynamic symmetric key, sending the encrypted business parameters and the token to the server and obtaining the processing result returned by the server, wherein the processing result is encrypted using the dynamic symmetric key; as well as The processing result is obtained by decrypting using the dynamic symmetric key.

3. The authentication method for a client as described in claim 1, characterized in that, It also includes the following steps: In response to the failure of the dynamic symmetric key, the pre-authentication information is encrypted using the private key of the second asymmetric key pair, and the encrypted pre-authentication information is sent to the server to obtain the updated dynamic symmetric key from the server. and / or In response to the update of the second asymmetric key pair, the public key of the updated second asymmetric key pair and the device information are encrypted using the public key of the first asymmetric key pair, and the encrypted public key of the second asymmetric key pair and the device information are sent to the server as an update reporting request.

4. An authentication method for a server, characterized in that, Including the following steps: In response to receiving a reporting request from the client, the server decrypts the reporting request using the private key of the first asymmetric key pair generated on the server side to obtain the public key of the second asymmetric key pair and device information. In response to receiving the pre-authentication information sent by the client, the pre-authentication information is decrypted using the public key of the second asymmetric key pair, and a dynamic symmetric key is generated after the pre-authentication information is verified. The dynamic symmetric key is encrypted using the public key of the second asymmetric key pair, and the encrypted dynamic symmetric key is sent to the client. In response to receiving login information sent by the client, the login information is decrypted using the public key of the second asymmetric key pair and the dynamic symmetric key, and a token is generated after the login information is authenticated. as well as The token is encrypted using the dynamic symmetric key, and the token encrypted by the dynamic symmetric key is encrypted using the public key of the second asymmetric key pair. The encrypted token is then sent to the client.

5. The authentication method for the server side as described in claim 4, characterized in that, It also includes the following steps: In response to receiving the service parameters sent by the client, the service parameters are decrypted using the dynamic symmetric key and authentication is performed based on the token. After successful authentication, the service parameters are used for service processing and the processing result is encrypted using the dynamic symmetric key. as well as The encrypted processing result is sent to the client.

6. The authentication method for the server side as described in claim 4, characterized in that, It also includes the following steps: In response to receiving a deletion request from the client, delete the stored public key and device information of the second asymmetric key pair; and / or In response to the fact that the public key of the stored second asymmetric key pair has not been used for a longer than a preset value, the public key and device information of the stored second asymmetric key pair are deleted.

7. An authentication system for a client, characterized in that, include: Memory, on which computer instructions are stored; as well as A processor, connected to the memory, and configured to execute computer instructions stored on the memory to implement the authentication method for a client as described in any one of claims 1 to 3.

8. An authentication system for a server, characterized in that, include: Memory, on which computer instructions are stored; as well as A processor, connected to the memory, and configured to execute computer instructions stored on the memory to implement the authentication method for a server as described in any one of claims 4 to 6.

9. A computer-readable storage medium storing computer instructions thereon, characterized in that, When the computer instructions are executed by the processor, the authentication method for the client as described in any one of claims 1 to 3 is implemented.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When the computer instructions are executed by the processor, the authentication method for the server side as described in any one of claims 4 to 6 is implemented.

Images