Equipment interaction authentication method and related device
By employing dual encryption with both quantum encryption and SM4 encryption algorithms, combined with a quantum key management server, device interaction authentication is achieved. This solves the security and access control issues of device authentication schemes, and improves the security and controllability of device interaction.
Patent Information
- Application Number
- CN202511846189.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-08
- Publication Date
- 2026-02-13
AI Technical Summary
Existing device authentication schemes are unable to effectively defend against man-in-the-middle attacks, brute-force attacks, key leaks, and cross-client replay attacks, and lack fine-grained management of device access permissions, leading to increased risks of device security and user privacy breaches.
The device interaction authentication method employs dual encryption using quantum encryption and SM4 encryption algorithms. It performs consistency verification by obtaining the device key and token authorization quantity set during initialization on the client, and uses the key allocated by the quantum key management server for encryption and decryption. This controls the number and validity period of interaction tokens, thereby achieving secure and controllable device interaction.
It improves the security and controllability of device interaction, prevents unauthorized access, enhances the ability to detect abnormal access, and ensures the traceability and stability of device interaction in a multi-client environment.
Smart Images
Figure CN121530718A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of device interaction authentication, and particularly relates to a device interaction authentication method and related device. BACKGROUND
[0002] With the rapid development of network and intelligence of various terminal devices, the interaction mode between users and devices is expanding from the traditional local area network control to the remote access mode facing the Internet. Whether it is a smart device in a home scenario, a sensor node in an industrial scenario, or an edge device in a public service, it needs to realize safe and reliable remote interaction between different places, different users and different applications.
[0003] In this highly interconnected environment, the security risks brought by the exposure of devices to the Internet have significantly increased. Unauthorized access, illegal control, data theft and privacy leakage, and other security incidents occur frequently. A large number of cases show that as long as there is a weak link in the authentication chain of the device, it may lead to continuous access and operation of the device by others without the user's knowledge.
[0004] In addition, in the traditional authentication scheme, the device end usually relies on fixed keys, short-period session credentials or simple password mechanisms for identity verification, which is difficult to effectively resist threats such as man-in-the-middle attacks, brute force attacks, key leakage, cross-client replay attacks, etc. At the same time, in the scenario where multiple clients access the same device, there is a lack of fine-grained management mechanism for device access permissions, and it is difficult to form consistent, verifiable and traceable authorization relationships between different clients.
[0005] Therefore, it is necessary to propose an access authorization and authentication method for network devices with scalability and quantum security, which builds a stable and traceable device access control system through parameter initialization, quantum secure key agreement, cross-client authorization verification and abnormal access detection, so as to reduce the exposure risk of devices and protect user privacy and data security. SUMMARY
[0006] Based on this, the application aims to provide a device interaction authentication method and related device, which limits the number of client tokens within the period and adopts a more secure encryption method, controls the number of clients interacting with the target device, and improves the security of device interaction authorization.
[0007] In a first aspect, the application provides a device interaction authentication method, which is executed at the device end and includes:
[0008] Obtaining an interaction parameter initialized by a client, the interaction parameter including a device key and a token authorization number;
[0009] Receiving an interaction request initiated by an access client, the interaction request including a device key to be verified;
[0010] Based on the device key in the interaction parameters, the consistency of the device key to be verified is performed. When the verification is successful, an interaction token with a valid duration is issued to the access client that initiated the interaction request. The number of valid interaction tokens issued shall not exceed the number of tokens authorized.
[0011] When the interaction token is valid, the interaction is based on the interaction token to interact with the access client;
[0012] Both interaction parameters and interaction requests are encrypted using a quantum cryptography algorithm.
[0013] Furthermore, when the interaction token is valid, interacting with the access client based on the interaction token includes:
[0014] When an interaction token triggers an interaction event within its validity period, the validity period of the interaction token is recalculated starting from the moment the interaction trigger event occurs. The validity period of the interaction token is consistent with the validity period determined when the interaction token was issued.
[0015] Furthermore, the above methods include:
[0016] If the number of interaction tokens in a valid state at the same time exceeds the token authorization limit, stop issuing interaction tokens and generate an alarm message to send to the initialization client.
[0017] Furthermore, generating alarm information and sending it to the initialization client includes:
[0018] The generated alarm information is sent directly to the service platform to trigger the service platform to forward the alarm information to the initialization client.
[0019] Furthermore, obtaining the interaction parameters set during client initialization includes:
[0020] The receiving service platform forwards the interaction parameters from the initialization client. The interaction parameters are encrypted using the first quantum key allocated by the quantum key management server.
[0021] Receive the first quantum key assigned by the quantum key management server;
[0022] The device key and the number of authorized tokens are obtained by decrypting the interaction parameters using the first quantum key and then written to storage.
[0023] Furthermore, receiving interaction requests initiated by the access client includes:
[0024] The receiving service platform forwards the interaction request from the accessing client. The interaction request is encrypted using the second quantum key allocated by the quantum key management server.
[0025] Receive the second quantum key assigned by the quantum key management server;
[0026] The key to the device to be verified is obtained by decrypting the interaction request using the second quantum key.
[0027] Furthermore, both the interaction parameters and the interaction requests are double-encrypted using both quantum encryption and SM4 encryption algorithms.
[0028] Secondly, the present invention provides a device interaction authentication and authorization apparatus, deployed on a device, comprising:
[0029] The interaction parameter acquisition module is used to acquire the interaction parameters set during client initialization. The interaction parameters include the device key and the number of authorized tokens.
[0030] The interaction request receiving module is used to receive interaction requests initiated by the access client. The interaction request includes the device key to be verified.
[0031] The token issuance module is used to verify the consistency of the device key to be verified based on the device key in the interaction parameters. When the verification is successful, it issues an interaction token with a valid duration to the access client that initiated the interaction request. The number of valid interaction tokens issued shall not exceed the number of tokens authorized.
[0032] The interaction module is used to interact with the access client based on the interaction token when the interaction token is valid.
[0033] Both interaction parameters and interaction requests are encrypted using a quantum cryptography algorithm.
[0034] Thirdly, the present invention provides an electronic device including a memory storing computer-executable instructions and a processor, wherein when the computer-executable instructions are executed by the processor, the device performs the various steps of the device interaction authentication method provided in the first aspect.
[0035] Fourthly, the present invention provides a readable storage medium storing a computer-executable program, which, when executed, enables the implementation of the various steps of the device interaction authentication method provided in the first aspect.
[0036] The present invention has the following beneficial effects:
[0037] This invention proposes a device interaction authentication method. The method obtains the device key and token authorization quantity set by the initialization client on the device side, and performs consistency verification on the device key submitted by the accessing client. Only when the verification passes is an interaction token with a valid duration issued to the accessing client, while simultaneously controlling the number of valid interaction tokens to not exceed the authorized quantity, thereby achieving device-level independent authentication and access control. In a further embodiment, the interaction token can be automatically renewed if an interaction trigger event occurs within its valid duration, improving the continuous interaction experience. In a more preferred embodiment, when the number of valid interaction tokens exceeds the authorized quantity, an alarm message is generated to notify the initialization client, enhancing the abnormal access detection capability. The authentication method proposed in this invention ensures that the device interaction process remains secure, controllable, and traceable in a multi-client environment. Attached Figure Description
[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0039] Figure 1 A flowchart illustrating the implementation of the device interaction authentication method provided in this embodiment of the invention;
[0040] Figure 2 A flowchart illustrating the interactive authentication method for video surveillance equipment provided in an embodiment of the present invention;
[0041] Figure 3 This is a schematic diagram of the device interaction authentication and authorization device provided in an embodiment of the present invention;
[0042] Figure 4 This is an electronic device architecture diagram provided for an embodiment of the present invention. Detailed Implementation
[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0044] See Figure 1 One embodiment of the present invention provides a device interaction authentication method from the device side perspective, including the following steps:
[0045] Step S110. Obtain the interaction parameters set in the initialization client. The interaction parameters include the device key and the number of tokens authorized.
[0046] In this step, the device side refers to the target interactive device of the client, such as a smart terminal, IoT device, or industrial control terminal; the initialization client is the user terminal that establishes interaction with the device for the first time and sets the device's security parameters, such as a smartphone, tablet, or management terminal, which sets the interaction parameters through the user interface and submits them to the device side.
[0047] The device key is set by the user through the initialization client. It uniquely identifies the binding relationship between the initialization client and the device and serves as the verification basis for subsequent access clients to obtain interaction tokens. This key can be set by the user in the initialization client. In some optional embodiments, the device key can also be a random code generated by the device and confirmed by the user.
[0048] The token authorization limit is used to limit the number of valid interaction tokens that the device allows at the same time, ensuring that the device can control the access scale when multiple clients access it concurrently, and preventing unauthorized excessive access.
[0049] Specifically, users can input or select a device key through the interactive interface of the initialization client. Users can customize character and number combinations or system-generated random keys and set the token authorization limit, which is the upper limit of the number of access clients allowed to interact with the device at the same time. The initialization client obtains the first quantum key from the quantum key management server to encrypt the interaction parameters and sends the encrypted interaction parameters to the device through the service platform. After receiving the interaction parameters, the device uses the first quantum key allocated by the quantum key management server to decrypt them and writes the device key and the token authorization limit into storage, completing the initialization settings.
[0050] In a further embodiment, the device can prevent modification of the device key after the initial setup is completed, unless the device is restored to its initial state through a physical or software reset operation, thereby ensuring the uniqueness and security of the device key.
[0051] In a more preferred embodiment, after receiving and decrypting the interaction parameters, the device can feed back the receiving status or verification result to the initialization client through the service platform, ensuring that the user is aware of the setting results in real time and allowing the user to readjust the parameters.
[0052] In a further embodiment, the number of authorized tokens can be flexibly set according to device type, operating scenario, or user needs. For example, it can be set to 2-3 clients in a home environment and 5-10 clients in an industrial environment, which facilitates device control of concurrent access.
[0053] In a further embodiment, the transmission of interaction parameters can be double-encrypted using quantum keys and traditional symmetric encryption algorithms (such as SM4) to improve the protection against eavesdropping and tampering during network transmission.
[0054] Step S120. Receive an interaction request initiated by the access client. The interaction request includes the device key to be verified.
[0055] Specifically, an access client refers to a terminal that wishes to interact with the device after initialization, such as a smartphone, tablet, or other user terminal. The access client obtains operation permissions by sending an interaction request to the device.
[0056] The device receives interaction requests submitted by the access client through the service platform. The interaction request includes at least the device key to be verified submitted by the access client, and may also include other operation request information, such as access type (e.g., reading status, controlling actuator), timestamp, client identifier, etc., which are used by the device for permission control, logging and security auditing.
[0057] The device key to be verified corresponds to but is different from the device key stored on the device. It is used to verify whether the accessing client has the right to operate the device. It is usually entered by the user on the accessing client or selected by the accessing client interface. For example, the user enters the device key set during initialization or a key generated by copying and pasting. After receiving the device key to be verified, the device compares it with the stored device key. If they match, an interaction token can be issued; otherwise, access is denied.
[0058] When the client initiates an interaction request, it enters the device key to be verified and requests a second quantum key from the quantum key management server to encrypt the interaction request. The encrypted request is then forwarded to the device through the service platform. After receiving the request, the device decrypts it using the second quantum key to obtain the device key to be verified and related operation request information, and prepares to perform consistency verification.
[0059] In a more preferred embodiment, the access client can automatically generate a random session ID or timestamp before initiating a request to prevent replay attacks, and the device verifies the session ID or timestamp when receiving the request.
[0060] In a further embodiment, the device can record the request content after receiving the interaction request, including information such as client identifier, request time, operation type, and request status, to support subsequent security auditing and anomaly analysis.
[0061] Step S130. Perform consistency verification on the device key to be verified based on the device key in the interaction parameters. If the verification is successful, issue an interaction token with a valid duration to the access client that initiated the interaction request. The number of valid interaction tokens issued shall not exceed the number of tokens authorized.
[0062] In this step, after receiving the device key to be verified submitted by the access client, the device verifies its consistency with the device key set and stored by the initialization client. This verification is a crucial step for the device to decide whether to issue an interaction token to the access client. The interaction token is used to identify the access client's access permissions within its validity period and to control the interaction behavior between the device and the client.
[0063] Specifically, the device compares the decrypted device key to be verified with the stored device key. If they match, the verification is successful, and the device generates and issues an interaction token. If they do not match, the device refuses to issue the interaction token, preventing the access client from performing subsequent operations, and can generate an alarm message to notify the initialization client.
[0064] The device generates an interaction token based on the configured validity period. The initial validity period can be, for example, 10 minutes. The interaction token status is maintained by the device as "valid" or "invalid". At the same time, the device checks in real time whether the number of currently valid interaction tokens has reached the number of tokens authorized by the initialization client. If the limit has been reached, the device stops issuing new interaction tokens and generates an alarm message to notify the initialization client.
[0065] In a more preferred embodiment, if the number of valid interaction tokens currently existing exceeds the number of authorized tokens, the device generates an alarm message, which can be directly sent to the service platform and forwarded to the initialization client by the service platform to ensure that abnormal access is responded to in a timely manner.
[0066] Step S140. When the interaction token is valid, interact with the access client based on the interaction token.
[0067] When the interaction token issued to the accessing client is valid, the device enters a controlled interaction phase based on the interaction token. Each subsequent business request submitted by the accessing client includes the currently valid interaction token, which serves as the interaction authorization credential. The device uses this token to authenticate, verify, and confirm the permission level of the accessing client's interaction behavior in this round. In this way, the system can continuously verify the legitimacy of the accessing client during subsequent interactions, preventing unauthorized entities from gaining unauthorized access after initial verification.
[0068] Specifically, when a client initiates any business interaction requiring authentication, it uploads an interaction token along with the request. The device first checks the validity of the interaction token, including but not limited to whether it has expired, been revoked, matches the issuing recipient, and is associated with the correct interaction session. Only when the interaction token is confirmed to be valid will the system further process the specific business instructions submitted by the client.
[0069] In a further embodiment, a token renewal mechanism is introduced. When an interaction trigger event occurs within the validity period of a valid interaction token, the device recalculates the token validity period starting from the time of the event, so that the token's continuous validity period remains consistent with that at the time of initial issuance, ensuring the continuity of active sessions, while limiting the security risks of idle tokens existing for a long time.
[0070] Specifically, during the process of processing access client requests based on valid interaction tokens, the device can adjust the remaining validity period of the interaction token according to a set policy. For example, whenever the access client successfully performs a legitimate operation, the system can automatically extend the validity period of the interaction token based on a preset token renewal policy, so that continuously active interactions remain stable, while interactions that have been inactive for a long time automatically expire. This policy can balance security and user experience.
[0071] In a more preferred embodiment, the valid state of the interaction token can also be used for collaborative interaction between multiple devices. In a multi-device collaboration scenario, a valid interaction token held by the primary access client can authorize certain restricted operations to be initiated by the secondary device. After recognizing the interaction token in the authorization chain, the device can perform proxy authorization for the secondary access client, thereby expanding the multi-client collaborative control scenario.
[0072] See Figure 2 The following section further illustrates the invention through the interaction between the video surveillance equipment and the client.
[0073] In one embodiment of the present invention, when a user interacts with a surveillance camera through a client, the interaction process includes the following:
[0074] During the initial binding interaction, the user sets a device key (UserDeviceKey) and a token authorization quantity (limitCount) through the client. The client triggers the quantum security service platform to allocate a quantum key through the quantum security SDK. Both the client and the monitoring camera obtain a quantum key (key0). The client uses the SM4 algorithm and the quantum key key0 to encrypt the data UserDeviceKey and limitCount, and then obtains an encrypted interaction parameter encData.
[0075] The client sends the encrypted encData to the surveillance camera through the video surveillance platform. After receiving the encData, the surveillance camera decrypts it using the SM4 algorithm and the quantum key key0 to obtain UserDeviceKey and limitCount, and stores them locally on the surveillance camera.
[0076] When a user needs to control the camera, they still need to enter a device key (UserDeviceKey1) to be verified through the client. The client triggers the quantum security service platform to allocate a quantum key through the quantum security SDK. Both the client and the monitoring camera obtain a quantum key (key1).
[0077] After encrypting userDeviceKey1 using the SM4 algorithm and quantum key key1, the client obtains an encrypted interaction request (deUserDeviceKey1), which is then sent to the surveillance camera through the video monitoring platform.
[0078] After receiving deUserDeviceKey1, the surveillance camera decrypts it using the SM4 algorithm and the quantum key key1 to obtain userDeviceKey1. It then compares this userDeviceKey1 with the original userDeviceKey stored in the surveillance camera. If the comparison results are inconsistent, the user is prohibited from operating the camera. If the comparison results are consistent, a 10-minute valid interaction token (deviceToken) is issued and returned to the client.
[0079] The camera controls the number of active deviceTokens. When the number of authorized active tokens exceeds limitCount, it stops issuing deviceTokens and asynchronously sends an alarm message to the video surveillance platform, which then alerts the user to the risk of privacy leakage.
[0080] When the user interacts with the camera (such as previewing video), the client uses a deviceToken to interact with the device. The camera authenticates the deviceToken, and only deviceTokens issued by the camera can perform operations. DeviceTokens not issued by the camera will refuse client control.
[0081] When the deviceToken is active within 10 minutes, meaning there is an interaction trigger time, the camera automatically extends its validity period, maintaining it for another 10 minutes.
[0082] Furthermore, when a user needs to unbind the surveillance camera's authorization to the client, an unbinding command is issued, and the camera will clear the userDeviceKey, limitCount, and deviceToken authorizations.
[0083] The disclosed method can be implemented using various types of devices. Therefore, the present invention also discloses an apparatus corresponding to the above method, and specific embodiments are given below for detailed description.
[0084] like Figure 3 As shown, one embodiment of the present invention provides a device interaction authentication and authorization apparatus, deployed on the device side, including:
[0085] The interaction parameter acquisition module 302 is used to acquire the interaction parameters set during client initialization. The interaction parameters include the device key and the number of authorized tokens.
[0086] The interaction request receiving module 304 is used to receive the interaction request initiated by the access client. The interaction request includes the device key to be verified.
[0087] The token issuance module 306 is used to perform consistency verification on the device key to be verified based on the device key in the interaction parameters. When the verification is successful, it issues an interaction token with a valid duration to the access client that initiated the interaction request. The number of valid interaction tokens issued does not exceed the number of tokens authorized.
[0088] The interaction module 308 is used to interact with the access client based on the interaction token when the interaction token is in a valid state;
[0089] Both interaction parameters and interaction requests are encrypted using a quantum cryptography algorithm.
[0090] The device provided in this application embodiment has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.
[0091] The methods and related apparatuses mentioned in the above embodiments are described with reference to the method flowcharts and / or structural diagrams provided in the embodiments of this application. Specifically, each block of the method flowchart and / or structural diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 A schematic diagram of one or more processes and / or structures. Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 A process or multiple processes and / or structures illustrate the steps of the functions specified in one or more boxes.
[0092] The following embodiments illustrate the application of this method to a computer device. It is understood that the computer device can be any device with computing and processing capabilities, including but not limited to servers or personal laptops. In one embodiment, the computer device can be an application server, which can be a server used to run the application under test.
[0093] See Figure 4 This document illustrates a hardware block diagram of an electronic device intended to represent various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.
[0094] like Figure 4 As shown, the electronic device includes: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4;
[0095] In this embodiment of the application, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4;
[0096] Processor 1 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.
[0097] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;
[0098] The memory stores a program, which the processor can call. The program is used to implement the various processing steps of the aforementioned device interaction authentication scheme.
[0099] This invention also provides a readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements various processing flows of the device interaction authentication scheme provided in any possible implementation of the above embodiments and / or in combination with the embodiments.
[0100] The invention has been described in particular detail above with respect to possible scenarios, and those skilled in the art will recognize that the invention can be practiced through other embodiments. Specific naming of components, capitalization of terms, attributes, data structures, or any other programming or structural aspects are not mandatory or important, and the mechanisms or features of implementing the invention may have different names, forms, or procedures. The system can be implemented through a combination of hardware and software (as described), entirely through hardware elements, or entirely through software elements. The specific division of functions among the various system components described herein is merely exemplary and not mandatory; rather, the functions performed by a single system component can be performed by multiple components, or the functions performed by multiple components can be performed by a single component.
[0101] Those skilled in the art should understand that the various steps of the disclosed methods can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using device-executable program code, which can then be stored in a storage device for execution by the computing device. Alternatively, they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Therefore, the embodiments disclosed in this invention are not limited to any specific hardware and software combination.
[0102] The programs (also referred to as programs, software, software applications, or code) executable by these computing devices include machine instructions of a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.
[0103] Certain aspects of this invention include the process steps and instructions described herein in algorithmic form. It should be noted that the process steps and instructions of this invention can be implemented in software, firmware, and / or hardware, and when implemented in software, they can be downloaded, stored on various operating systems and operated from said platforms.
[0104] Those skilled in the art will understand that the structures shown in the figures are merely block diagrams of some structures related to the present application and do not constitute a limitation on the terminal device to which the present application is applied. Specific terminal devices may include more or fewer components than those shown in the figures, or combine certain components, or have different component arrangements.
[0105] In the description of this specification, the use of terms such as "one embodiment," "some embodiments," "example," "specific example," or "possible design," etc., refers to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0106] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0107] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A device interaction authentication method, characterized in that, Executed on the device side, including: Obtain the interaction parameters set during client initialization, including the device key and the number of authorized tokens; Receive an interaction request initiated by an access client, the interaction request including a device key to be verified; The device key to be verified is verified for consistency based on the device key. When the verification is successful, an interaction token with a valid duration is issued to the access client that initiated the interaction request. The number of valid interaction tokens issued does not exceed the number of tokens authorized. When the interaction token is valid, the interaction is based on the interaction token to interact with the access client; Both the interaction parameters and the interaction request are encrypted using a quantum cryptography algorithm.
2. The method according to claim 1, characterized in that, When the interaction token is valid, interacting with the access client based on the interaction token includes: When an interaction token triggers an interaction event within its validity period, the validity period of the interaction token is recalculated starting from the moment the interaction trigger event occurs. The validity period of the interaction token is consistent with the validity period determined when the interaction token was issued.
3. The method according to claim 1, characterized in that, The method further includes: If the number of interaction tokens in a valid state at the same time exceeds the token authorization limit, stop issuing interaction tokens and generate an alarm message to send to the initialization client.
4. The method according to claim 3, characterized in that, The generation of alarm information and its sending to the initialization client includes: The generated alarm information is sent directly to the service platform to trigger the service platform to forward the alarm information to the initialization client.
5. The method according to claim 1, characterized in that, The interaction parameters for obtaining the initial client settings include: The receiving service platform forwards interaction parameters from the initialization client, and the interaction parameters are encrypted using the first quantum key allocated by the quantum key management server; Receive the first quantum key allocated by the quantum key management server; The device key and the number of authorized tokens are obtained by decrypting the interaction parameters using the first quantum key.
6. The method according to claim 1, characterized in that, The interaction request initiated by the client includes: The receiving service platform forwards an interaction request from the accessing client, and the interaction request is encrypted using a second quantum key allocated by the quantum key management server; Receive the second quantum key assigned by the quantum key management server; The interaction request is decrypted using the second quantum key to obtain the key for the device to be verified.
7. The method according to claim 1, characterized in that, Both the interaction parameters and the interaction request are double-encrypted using both quantum encryption and SM4 encryption algorithms.
8. A device interaction authentication and authorization device, characterized in that, Deployed on the device side, including: The interaction parameter acquisition module is used to acquire the interaction parameters set during client initialization, including the device key and the number of authorized tokens. An interaction request receiving module is used to receive an interaction request initiated by an access client, wherein the interaction request includes a device key to be verified. The token issuance module is used to perform consistency verification on the device key to be verified based on the device key in the interaction parameters. When the verification is successful, an interaction token with a valid duration is issued to the access client that initiated the interaction request. The number of valid interaction tokens issued does not exceed the number of tokens authorized. The interaction module is used to interact with the access client based on the interaction token when the interaction token is valid. Both the interaction parameters and the interaction request are encrypted using a quantum cryptography algorithm.
9. An electronic device, characterized in that, The device includes a memory storing computer-executable instructions and a processor, which, when executed by the processor, causes the device to perform the device interaction authentication method as described in any one of claims 1 to 7.
10. A readable storage medium, characterized in that, It stores a computer-executable program that, when executed, implements the device interaction authentication method as described in any one of claims 1 to 7.