Authentication method and device of terminal equipment and electronic equipment

Abstract

The invention discloses an authentication method and device of terminal equipment and electronic equipment. The method comprises the steps that under the offline condition, after target terminal equipment completes an authorization process, a target authorization permission file in a local memory is acquired; and performing an authentication process according to the target authorization permission file, the target authorization permission file being bound with a target chip identifier, and the target chip identifier being a chip identifier of the target terminal device. The technical problem that offline authentication in the prior art depends on cloud interaction, needs to preset a plurality of groups of keys or needs to be updated through satellite communication, and is not matched with autonomous authorization authentication of an offline terminal is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a terminal device authentication method and device and electronic equipment. BACKGROUND

[0002] Authorization and authentication can provide reliability and security assurance for high-precision positioning enhancement services (for example, satellite-based navigation enhancement services). As a service with extremely high requirements for security and reliability, high-precision positioning enhancement services need to design an efficient, secure and easy-to-manage authorization and authentication method. Most existing high-precision positioning enhancement services broadcast enhancement information in the form of the Internet, and the authorization and authentication of the services is mainly realized in the case of network. First, the terminal is authorized to register, and when the terminal is turned on, an authentication request is sent for authentication. After passing the authentication, the terminal uploads its approximate position to the ground data center based on the Nrtip protocol and receives grid difference data to complete high-precision positioning calculation. The whole process is completed by relying on the ground network and data center.

[0003] The following problems exist: offline authentication relies on cloud interaction: multiple sets of keys need to be pre-installed or updated through satellite communication, which violates the core requirement of the offline scenario. There is a risk of service theft: the cloud periodically generates encryption keys and decryption keys, and the decryption key is generated from the encryption key and is related to the device ID. However, in the offline case, there is no interaction between the legitimate terminal and the cloud. If an attacker clones the legitimate terminal key + ID to a new device, the new device can decrypt the received information and perform high-precision positioning calculation. The method in the related art is not suitable for offline terminal self-authorization and authentication.

[0004] At present, there is no effective solution to the above problems. SUMMARY

[0005] Embodiments of the present application provide a terminal device authentication method and device and electronic equipment to at least solve the technical problem that related art offline authentication relies on cloud interaction, multiple sets of keys need to be pre-installed or updated through satellite communication, and is not suitable for offline terminal self-authorization and authentication.

[0006] According to an aspect of an embodiment of the present application, a terminal device authentication method is provided, comprising: in an offline case, after a target terminal device completes an authorization process, obtaining a target authorization permission file in a local memory; and performing an authentication process according to the target authorization permission file, wherein the target authorization permission file is bound to a target chip identifier, and the target chip identifier is a chip identifier of the target terminal device.

[0007] Optionally, the terminal device completes the authorization process by receiving initial encrypted authorization license files created by the data center, wherein each initial encrypted authorization license file is bound to a chip identifier of a terminal device; decrypting the initial encrypted authorization license file and obtaining the initial chip identifier indicated by the terminal information field in the initial encrypted authorization license file; and in the case where the initial chip identifier is the same as the chip identifier of the target terminal device, the target terminal device performs the following authorization process: updating the local authorization license file in the local memory of the target terminal device to the initial encrypted authorization license file to obtain a target authorization license file, wherein the content of the terminal information field of the local authorization license file is the chip identifier of the target terminal device, the service validity content field and the service level field of the local authorization license file are empty.

[0008] Optionally, the local memory of the target terminal device is updated from an initially empty authorization license file to the initial encrypted authorization license file to obtain a target authorization license file, including: reading the content indicated by the service validity content field and the service level field in the initial encrypted authorization license file, wherein the service validity content field and the service level field are used to limit the use conditions of the corresponding service, and the service validity content is used to indicate the service validity period of the corresponding service; and updating the content indicated by the service validity content field and the service level field in the initial encrypted authorization license file to the corresponding fields of the local authorization license file to obtain the target authorization license file.

[0009] Optionally, the authentication process is performed according to the target authorization license file, including: the target terminal device reads the terminal identifier of the target terminal device after each boot; obtaining the target chip identifier in the target authorization license file; in the case where the target chip identifier is the same as the chip identifier of the target terminal device, performing service validity verification to obtain a verification result; and in the case where the verification result is that the service validity verification is passed, obtaining the service level information in the service level field of the target authorization license file.

[0010] Optionally, in the case where the target chip identifier is the same as the chip identifier of the target terminal device, the service validity verification is performed to obtain a verification result, including: the target terminal receives ephemeris data and obtains a target time in the ephemeris data; obtaining the service validity period of the service validity content field of the target authorization license file, wherein the service validity period includes a start time and an end time; and performing service validity verification according to the target time and the service validity period to obtain a verification result.

[0011] Optionally, the service validity verification is performed according to the target time and the service validity period, and a verification result is obtained, including: in a case where the target time is between the start time and the end time, determining that the verification result is that the service validity verification is passed; and in a case where the target time is earlier than the start time or later than the end time, determining that the verification result is that the service validity verification is not passed.

[0012] Optionally, after the service level information in the service level field of the target authorization license file is obtained, the method further includes: determining a service level in the service level information, the service level being one of: precise single point positioning, precise single point positioning with ambiguity fixed, and real-time dynamic precise single point positioning; and activating an algorithm corresponding to the service level information to perform positioning calculation.

[0013] Optionally, the initial encrypted authorization license file is obtained by encrypting service information using an encryption algorithm, wherein the service information is obtained in response to an input instruction of a user using the target terminal, and the service information includes a terminal information field, a service validity field, and a service level field.

[0014] According to another aspect of the embodiments of the present application, a terminal device authentication method is provided, including: obtaining a target authorization license file in a local memory after a target terminal device completes an authorization process in an offline case; and performing an authentication process according to the target authorization license file, wherein the target authorization license file is bound to a target chip identifier, and the target chip identifier is a chip identifier of the target terminal device.

[0015] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, and the non-volatile storage medium stores a program, wherein the program, when executed, controls a device in which the non-volatile storage medium is located to perform the terminal device authentication method.

[0016] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory and a processor, and the processor is configured to execute a program stored in the memory, wherein the program, when executed, performs the terminal device authentication method.

[0017] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, and the computer instructions, when executed by a processor, implement the terminal device authentication method.

[0018] In the embodiment of the present application, the target terminal device obtains the target authorization license file in the local memory after completing the authorization process in an offline case; the target authorization license file is bound with the target chip identifier, and the target chip identifier is the chip identifier of the target terminal device; the target authorization license file is obtained after authorization; the authentication process is performed according to the target authorization license file, and the authentication process is performed only according to the target authorization license file in an offline case, thereby solving the technical problem that the related art offline authentication depends on cloud interaction, requires preloading of multiple sets of keys or updating through satellite communication, and is not suitable for offline terminal self-authorization. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0020] Figure 1 FIG. 1 is a hardware structure block diagram of a computer terminal for implementing the authentication method of the terminal device according to the embodiment of the present application;

[0021] Figure 2 FIG. 2 is a flowchart of the authentication method of the terminal device according to the embodiment of the present application;

[0022] Figure 3 FIG. 3 is a flowchart of the authorization authentication system of the terminal device according to the embodiment of the present application;

[0023] Figure 4 FIG. 4 is a flowchart of the generation of the authorization license file according to the embodiment of the present application;

[0024] Figure 5 FIG. 5 is a flowchart of the encryption of the authorization license file according to the embodiment of the present application;

[0025] Figure 6 FIG. 6 is a flowchart of the authorization process according to the embodiment of the present application;

[0026] Figure 7 FIG. 7 is a flowchart of the authentication process according to the embodiment of the present application;

[0027] Figure 8 FIG. 8 is a structural schematic diagram of the authentication device of the terminal device according to the embodiment of the present application. DETAILED DESCRIPTION

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] The information collected in this application embodiment is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken. It does not violate public order and good morals, and provides corresponding operation entry points for users to choose to authorize or reject the automated decision results. If the user chooses to reject, the process will proceed to the expert decision-making process.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] To better understand the embodiments of this application, the technical terms involved in the embodiments of this application are explained below:

[0032] Satellite-based augmentation systems (SBAs) use geostationary orbit (GEO) satellites equipped with satellite navigation augmentation signal transponders to broadcast various correction information such as ephemeris errors, satellite clock errors, and ionospheric delays to users, thereby improving the positioning accuracy of the original satellite navigation system.

[0033] User authentication: A method for authenticating users attempting to access services from a service provider in a communication network.

[0034] Standard Point Positioning (SPP): A GNSS-based positioning technology that mainly relies on pseudorange observations and broadcast ephemeris for positioning, without complex error processing strategies or carrier phase observations that require fixed ambiguities.

[0035] Precise Point Positioning (PPP): A positioning technology that uses uniformly distributed CORS stations to resolve high-precision satellite ephemeris products, clock error corrections, and other errors to achieve static millimeter to centimeter-level and dynamic centimeter to decimeter-level positioning services.

[0036] Precise Point Positioning with Ambiguity Resolution (PPP-AR): A precise point positioning technology that uses uncorrected phase fractional bias products to fix phase float ambiguities to integers, thereby improving positioning accuracy and convergence speed.

[0037] Precise Point Positioning - Real-Time Kinematic (PPP-RTK): A high-precision positioning technology based on the state domain (SSR), which generates a set of state corrections including satellite clock errors, orbit errors, and regional ionospheric errors by comprehensive estimation and modeling of base station data, and sends them to the rover station for position solution, achieving sub-centimeter-level positioning accuracy under dynamic conditions. PPP-RTK technology is particularly suitable for services that require high-frequency and high-precision positioning, such as autonomous driving cars and precision agricultural machinery positioning.

[0038] Networked Transport of RTCM via Internet Protocol (NTRIP): A protocol for transmitting RTCM over the Internet.

[0039] In the related art, some high-precision positioning enhanced services mostly broadcast enhanced information in the form of the Internet, and the authorization and authentication of the services are mainly realized in the case of network. First, the terminal is registered and authorized, and then the terminal sends an authentication request for authentication after being powered on. After passing the authentication, the terminal uploads its approximate position to the ground data center based on the Nrtip protocol and receives grid difference data to complete high-precision positioning calculation. The whole process is completed by relying on the ground network and the data center. Offline authentication relies on cloud interaction: multiple sets of keys need to be pre-set or updated through satellite communication, which is contrary to the core requirement of the offline scenario. There is a risk of service theft: the cloud periodically generates encryption keys and decryption keys, and the decryption key is generated from the encryption key and is related to the device ID. However, in the offline case, the legal terminal has no interaction with the cloud. If an attacker clones the legal terminal key + ID to a new device, the new device can decrypt the received information and perform high-precision positioning calculation. Therefore, there is a technical problem that the related art relies on cloud interaction for offline authentication, needs to pre-set multiple sets of keys or update them through satellite communication, and is not suitable for offline terminal self-authorization and authentication. In order to solve this problem, the related solutions are provided in the embodiments of the present application, which are described in detail below.

[0040] According to the embodiments of the present application, an embodiment of an authentication method of a terminal device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] The method embodiments provided in the embodiments of the present application can be executed in a computer terminal or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal for implementing an authentication method of a terminal device is shown. As shown in Figure 1 , the computer terminal 10 can include one or more (shown in the figure as 102a, 102b, …, 102n) processors 102 (the processor 102 can include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication function. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, and it does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 can include more or fewer components than those shown in Figure 1 , or have a different configuration from Figure 1 .

[0042] It should be noted that the one or more processors 102 and / or other data processing circuitry described above can be generally referred to herein as "data processing circuitry". The data processing circuitry can be embodied in whole or in part as software, hardware, firmware, or any combination thereof. Furthermore, the data processing circuitry can be a single standalone processing module or incorporated in whole or in part within any of the other elements of the computer terminal 10. As referred to in embodiments of the present application, the data processing circuitry functions as a processor to control, for example, the selection of the variable resistance terminal path in connection with the interface.

[0043] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the terminal device authentication method in embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implements the terminal device authentication method described above. The memory 104 can include a high-speed random access memory and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 can further include a memory disposed remotely with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0044] The transmission device 106 is used to receive or send data via a network. Specific examples of the network can include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC) which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module which is used to communicate with the Internet in a wireless manner.

[0045] The display can be, for example, a touch screen type liquid crystal display (LCD) which can enable a user to interact with the user interface of the computer terminal 10.

[0046] In the above operating environment, embodiments of the present application provide an embodiment of a terminal device authentication method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0047] AsFigure 2 Fig. 1 is a flowchart of a method for authenticating a terminal device according to an embodiment of the present application, which includes the following steps:

[0048] In step S202, the target terminal device obtains a target authorization permission file in the local memory after completing the authorization process in an offline case.

[0049] Authorization refers to the assignment of access or operation permissions of a specific resource to a user or entity by a resource owner, which can limit the user to access only the authorized resources and prevent unauthorized operations. Authentication verifies whether the identity or permission declared by the user is real and valid, which can ensure the authenticity of the visitor's identity, intercept illegal requests, and resist security risks such as fake identity and credential theft. Authorization and authentication can provide reliability and security assurance for high-precision positioning enhancement services. As a service with extremely high requirements for security and reliability, high-precision positioning enhancement services need to design an efficient, secure, and easy-to-manage authorization and authentication method.

[0050] In some embodiments of the present application, the authorization process and the authentication process performed by the target terminal device are authorization and authentication of a target service (high-precision positioning enhancement service, for example, satellite-based navigation enhancement service, which broadcasts additional satellite-based enhancement information to GNSS receivers through satellites in geostationary orbit (GEO) to help users obtain more accurate and reliable positioning, navigation, and timing services in a specific area). The authorization process confirms whether the terminal is permitted to use a specific level of enhancement service, and the authentication process verifies the validity and authenticity of the authorization information of the terminal before the terminal uses the service, ensuring that the terminal can independently determine its use permission in a network-free environment. The use scenario is that the terminal cannot complete the authorization and authentication process at all without interacting with the cloud, which is not only suitable for areas without ground networks such as oceans and deserts, but also suitable for areas with ground networks. The core devices involved in the method of the embodiments of the present application include satellite side (communication satellite), terminal side (i.e., target terminal device), and data center, and the functions of each part are as follows: communication satellite: broadcast satellite-based enhancement information. Beidou satellite: medium earth orbit (MEO) / inclined geosynchronous satellite orbit (IGSO) orbit satellite, L-band (a radio frequency band, referring to a band with a frequency range of 1 to 2 GHz), providing navigation signals and time reference. User terminal (i.e., target terminal device): receiving navigation signals and satellite broadcast satellite-based enhancement signals, performing user layered authentication process and positioning solution. Data center: deploying operation platform and service platform, generating differential enhancement correction information, and generating encrypted authorization permission files according to user demand.

[0051] In the technical solution provided in step S202, the initial encrypted authorization license file is obtained by encrypting the service information using an encryption algorithm, wherein the service information is obtained in response to an input instruction of a user using a target terminal, and the service information includes a terminal information field, a service validity field, and a service level field. The following describes the construction process of the initial encrypted authorization license file.

[0052] Figure 3 A flowchart of an authorization authentication system of a terminal device is provided according to an embodiment of the present application. The satellite-based navigation enhancement user authorization authentication system (i.e., the authorization authentication system of the terminal device) can be used to execute the method in the embodiment of the present application, and includes an authorization license file generation encryption module, an authorization license file decryption module, a service authorization authentication module, and a signal receiving module. The signal receiving module receives navigation signals and satellite broadcast satellite-based enhancement signals. The authorization license file generation encryption module generates an authorization license file according to user input information. The authorization license file decryption module encrypts and decrypts the generated authorization license file. The service authorization authentication module authorizes and authenticates services, and calls a corresponding satellite-based enhancement algorithm (such as PPP / PPP-AR / PPP-RTK) according to the authentication result.

[0053] The initial encrypted authorization license file is constructed by a service authorization authentication module of a data center. First, a user of a target terminal inputs service information by inputting an instruction. The service information includes a terminal information field, a service validity field, and a service level field. The content of the terminal information field is a chip identifier (chip unique identifier (UID), which refers to a unique identification code embedded in the hardware of the user terminal). The service validity content field and the service level field are used to limit the use conditions of the corresponding service. The service validity content is used to indicate the service validity period of the corresponding service, i.e., the service start and end time. The service level field is PPP / PPP-AR / PPP-RTK, so as to provide corresponding precision levels according to different service requirements. The data center generates an initial authorization license file in response to the input instruction of the user based on the service information of the input instruction of the user. The authorization license file is bound to the device unique identifier, i.e., the chip UID. Next, an asymmetric encryption algorithm (for example, RSA or ECC) is used to encrypt the initial authorization license file, and an initial encrypted authorization license file is obtained.

[0054] The functions of each field in the service information are as follows: When generating the license file, the data center embeds the chip identifier into the terminal information field. This ensures that the authorization is specific to the device, not a general authorization. After the terminal device powers on, it reads the locally stored license file and first checks whether the chip identifier in the terminal information field matches the device's own chip identifier. If they match, the terminal is a legitimate and authorized device; if they do not match, the service is denied, preventing the use of unauthorized devices. When creating the license file, the data center defines the valid start and end times of the service through the service validity field. This means that even if the terminal has the correct UID, the service may be rejected because the time is not within the validity period. The terminal device compares the timestamp in the received satellite ephemeris data with the time range in the service validity field. If the current time is within the service validity period, the service can be activated; if it is outside the validity period, the service authorization is considered invalid, and the terminal can only use the SPP service. When applying for services, users can select different service levels such as PPP, PPP-AR, or PPP-RTK through the service level field according to their needs. The data center sets a Service Level Class (SLC) field in the license file based on the user's selection to ensure accurate service authorization. Terminal devices read the SLC field to confirm the type of service they are authorized to access. This allows the terminal to invoke the appropriate location algorithm based on the SLC information, ensuring that the terminal can only access its authorized services and preventing SLC abuse.

[0055] Figure 4 This is a flowchart of an authorization license document generation process provided according to an embodiment of this application. First, the user registers / logs in to the operation platform (deployment). Figure 3 (See the system platform shown). Then select the service duration. Select the service level, determine the service level field, bind the terminal device (i.e., set the terminal information field), select the service effective time (the service effectiveness field is determined by the service effective time and service duration), and finally generate the license file (i.e., the initial license file mentioned above).

[0056] Figure 5 This is a flowchart of an encryption process for an authorization file provided according to an embodiment of this application, which uses an authorization file encryption module (i.e., the one described above). Figure 3 The system's license file generation encryption module requests encryption for the license file, calls an asymmetric encryption algorithm, generates an encrypted license file, and downloads the encrypted license file.

[0057] The terminal device completes the authorization process by the following way: receiving initial encrypted authorization license files created by the data center, wherein each initial encrypted authorization license file is bound to a chip identifier of a terminal device; decrypting the initial encrypted authorization license file and obtaining the initial chip identifier indicated by the terminal information field in the initial encrypted authorization license file; in the case that the initial chip identifier is the same as the chip identifier of the target terminal device, the target terminal device performs the following authorization process: updating the local authorization license file in the local memory of the target terminal device to the initial encrypted authorization license file to obtain a target authorization license file, wherein the content of the terminal information field of the local authorization license file is the chip identifier of the target terminal device, the service validity content field and the service level field of the local authorization license file are empty.

[0058] There are various implementation manners for updating the initial encrypted authorization license file to the initial authorization license file in the local memory of the target terminal device to obtain the target authorization license file, for example: reading the content indicated by the service validity content field and the service level field in the initial encrypted authorization license file, wherein the service validity content field and the service level field are used to limit the use conditions of the corresponding service, and the service validity content is used to indicate the service validity period of the corresponding service; updating the content indicated by the service validity content field and the service level field in the initial encrypted authorization license file to the corresponding fields of the local authorization license file to obtain the target authorization license file. The authorization process is described in detail below.

[0059] The target terminal device receives an initial encrypted authorization permission file created by the data center through a secure channel (such as a Beidou short message, a USB / serial port, or the like) when the target terminal device is started for the first time or registers for a target service. The terminal device is preconfigured with a private key shared with the data center, and the private key is used to decrypt the received encrypted file. When the terminal receives the encrypted authorization permission file, the private key is used to decrypt it. Successful decryption means that the permission file comes from a trusted data center, and if decryption fails, the authorization authentication process is terminated. The decrypted permission file contains a terminal information field, which indicates the initial chip identifier (i.e., the chip UID). The target terminal device reads this field and compares it with its own chip identifier. If they match, the terminal is a authorized device, and the authorization process continues, otherwise, the replacement unbinding process is performed, which means that the initial encrypted authorization permission file sent is not the initial encrypted authorization permission file of the target terminal, and a new initial encrypted authorization permission file is sent to the target terminal to re-perform the process. If the initial chip identifier matches the chip identifier of the target terminal device, the terminal device updates the local authorization permission file in its local memory. The update process includes copying the service validity content field and the service level field from the initial encrypted authorization permission file to the local authorization permission file, while retaining the original chip identifier field (i.e., the chip identifier of the target terminal device) of the local authorization permission file, and completing the authorization process. It should be noted that before the target terminal device is started for the first time or registered, the local authorization permission file is in an initialized state, at this time, the content of the terminal information field is the chip identifier of the target terminal device, and the service validity content field and the service level field are empty, indicating that the service is not authorized. It should be noted that the authorization operation only needs to be performed once, and after the authorization is successful, the target terminal device only needs to perform the authentication process after each startup. The authentication process includes verifying the validity period of the service, checking whether the service level matches the current demand, and the like, which can be completed by the terminal independently without real-time communication with the data center.

[0060] Figure 6 According to the authorization process provided in the embodiments of the present application, after the terminal (i.e., the target terminal device) is started, the encrypted authorization permission file (i.e., the initial encrypted authorization permission file) is imported, and then the authorization file is decrypted, the SN information (i.e., the chip identifier) is read, and it is determined whether the authorization process is performed, and if not, the replacement unbinding process is performed. If yes, the authorization process is performed: the service time and the service level are identified, and the saved authorization permission file (local) is updated (i.e., the content indicated by the service validity content field and the service level field in the initial encrypted authorization permission file is updated to the corresponding fields of the local authorization permission file to obtain the target authorization permission file), and then the authorization is completed.

[0061] In step S204, the target authorization permission file is used to perform the authentication process.

[0062] In the technical solution provided in step S204, the target authorization license file is bound to the target chip identifier, and the target chip identifier is the chip identifier of the target terminal device.

[0063] Before obtaining the target chip identifier in the target authorization license file, the terminal device decrypts the target authorization license file by using a preset private key, wherein the target authorization license file is an encrypted file.

[0064] There are various implementation manners of the authentication process according to the target authorization license file, for example: the target terminal device reads the terminal identifier of the local terminal device after each startup; obtains the target chip identifier in the target authorization license file; in the case where the target chip identifier is the same as the chip identifier of the target terminal device, service validity verification is performed to obtain a verification result; in the case where the verification result is that the service validity verification is passed, service level information in a service level field of the target authorization license file is obtained.

[0065] In the case where the target chip identifier is the same as the chip identifier of the target terminal device, there are various implementation manners of performing service validity verification to obtain a verification result, for example: the target terminal receives ephemeris data and obtains a target time in the ephemeris data; obtains a service validity period of a service validity content field of the target authorization license file, wherein the service validity period includes a start time and an end time; performs service validity verification according to the target time and the service validity period to obtain a verification result.

[0066] There are various implementation manners of performing service validity verification according to the target time and the service validity period to obtain a verification result, for example: in the case where the target time is between the start time and the end time, it is determined that the verification result is that the service validity verification is passed; in the case where the target time is earlier than the start time or later than the end time, it is determined that the verification result is that the service validity verification is not passed.

[0067] After obtaining the service level information in the service level field of the target authorization license file, the service level in the service level information is determined, and the service level is one of the following: precise point positioning, precise point positioning with ambiguity fixed, real-time dynamic precise point positioning; and an algorithm corresponding to the service level information is activated to perform positioning calculation. The authentication process is described in detail below.

[0068] The authentication process is performed each time the target terminal device is powered on after the authorization process is completed, and is used to verify whether the service is valid and whether the service level meets the current demand, to ensure that the terminal device can only use the satellite navigation enhancement service within the authorized range. After the terminal device is powered on, the terminal identifier stored in the local internal storage, i.e. the chip UID, is first read. Then the target authorization license file is parsed to obtain the target chip identifier in the target authorization license file, and the terminal identifier of the target terminal device is compared with the target chip identifier in the target authorization license file to ensure that they are consistent. If they are not consistent, the target terminal device can only perform SPP service and output the SPP positioning result. In the case where the target chip identifier is the same as the chip identifier of the target terminal device, the service validity verification is performed: the target terminal receives ephemeris data and obtains the target time in the ephemeris data (i.e. the current time of the time of acquisition), wherein the ephemeris data can be Beidou ephemeris data, which is used to describe the position data and motion state information of satellites in the Beidou satellite navigation system. These data are crucial for accurate positioning and navigation of ground receivers. The ephemeris data contains the orbital parameters of each satellite, including but not limited to the orbital position, velocity and time information of the satellite, so that the receiver can calculate the exact position of the satellite at any given time, and further calculate the geographical position of the receiver itself based on the received satellite signals.

[0069] Next, the service validity content field in the target authorization license file is read to obtain the start time and end time of the service. It is judged whether the target time is within the valid period of the service, i.e. whether the target time is later than the start time and earlier than the end time. If yes, the service validity verification is passed, and the terminal can continue to verify the service level. If no, the service validity verification is not passed, and the terminal algorithm rejects the service, and can only use the standard positioning service (SPP) to output the SPP positioning result.

[0070] After the service validity verification is passed and the service level information in the service level field of the target authorization license file is obtained, the terminal further reads the service level field in the target authorization license file to obtain the service level information (one of PPP, PPP-AR and PPP-RTK). The service level corresponding to the service level information is determined, and the corresponding positioning algorithm is activated according to the service level information to output the satellite-based enhancement high-precision positioning result. The process is described in detail below.

[0071] Positioning solution refers to the process of using satellite navigation signals, combined with ground-based assistance information or services, to calculate the precise position, velocity and time of the target user terminal through geometric inversion. Positioning solution algorithms can be classified according to accuracy requirements and resource consumption, including SPP, PPP, PPP-AR, and PPP-RTK. When the service validity is verified, the terminal device selects and activates the corresponding positioning solution algorithm according to the service level information in the target authorization license file. The specific process is as follows: the terminal device reads the service level field in the target authorization license file to obtain the service level information (one of PPP, PPP-AR, and PPP-RTK). Based on the service level information, the terminal determines the accuracy level and usage conditions required for this positioning service.

[0072] According to the service level information, the terminal selects and activates the corresponding positioning solution algorithm: if the service level information is PPP-AR, the terminal further processes the carrier phase ambiguity on the basis of the PPP algorithm to fix it as an integer value, accelerating the positioning convergence. The specific process is as follows: the target terminal device receives the carrier phase observation value of the satellite, obtains the high-precision satellite orbit, clock product required by PPP-AR, and atmospheric delay correction model. Using satellite-based augmentation information, the terminal performs ambiguity resolution to attempt to fix the carrier phase ambiguity from a floating point value to an integer value. Dynamic constraints (such as user motion patterns and known position information) are applied to further optimize the ambiguity search process. The ambiguity fixing result and correction information are input into the PPP-AR positioning model to calculate the position, velocity and time information of the target terminal device. High-precision positioning results under satellite-based augmentation service are generated.

[0073] If the service level information is PPP-RTK, the target terminal device will combine real-time base station correction data or state domain correction amount to perform high-precision positioning solution under dynamic conditions using the PPP-RTK algorithm, which is as follows: the target terminal device receives real-time carrier phase observation values from multiple satellites. Through satellite-based augmentation service, state domain correction information is obtained, including satellite clock bias, orbit error, regional atmospheric delay, etc., which is generated by the ground control center by processing multiple base station data. Real-time positioning solution is performed by combining real-time received carrier phase observation values with state domain correction information. The PPP-RTK positioning algorithm can achieve rapid convergence and provide high-precision positioning results under dynamic conditions through the use of real-time correction information. According to the motion state and position information of the target terminal device, dynamic constraints are applied to further optimize the positioning solution process, improve the positioning accuracy and processing efficiency, and finally generate high-precision positioning results under satellite-based augmentation service.

[0074] If the service level information is PPP, the terminal device receives carrier phase and pseudorange observations from multiple satellites. High-precision satellite orbits (precise ephemeris) and clock difference information, as well as atmospheric delay correction models, are received through the satellite-based augmentation service, and the carrier phase observations are preprocessed, including correcting ionospheric and tropospheric delays, and satellite and receiver clock errors. Based on the preprocessed observations and preliminary estimates (such as SPP results), the receiver's position, velocity, and clock bias state vector is initialized. Least squares or Kalman filtering is used for iterative solution, and in each iteration, the estimation result of the previous period is used as the initial value of the current period to optimize the state vector estimation until a satisfactory precision is converged. Based on the final converged solution, the high-precision positioning result under the satellite-based augmentation service is output.

[0075] The high-precision positioning result under the satellite-based augmentation service includes the three-dimensional coordinates, velocity, timestamp, and positioning accuracy indicators and integrity parameters of the target terminal, which will be used for navigation, time service, or other high-precision applications.

[0076] Figure 7 is a kind of authentication flowchart provided according to the embodiment of the application, terminal starts, reads authorized license file (local (i.e. the target authorized license file described above)), then carries out authorized license file analysis, in the case where format is not correct, output SPP positioning result. In the case where format is correct, read device SN, verify device identification information, in the case where it is not consistent, output SPP positioning result. In the case where it is consistent, read ephemeris time (i.e. the target terminal receives ephemeris data and obtains the target time in ephemeris data), verify service validity period (i.e. in the case where the target chip identification and the chip identification of the target terminal device are the same, service validity is verified), in the case where it is not consistent, output SPP positioning result. If consistent, match satellite-based augmentation service level and output satellite-based augmentation high-precision positioning result (i.e. the service level in the service level information is determined, and the service level is one of the following: precise point positioning, precise point positioning with ambiguity fixed, real-time kinematic precise point positioning;Activate the algorithm corresponding to the service level information to perform positioning solution.

[0077] In the related art, for the authorization and authentication of satellite-based navigation augmentation service, the following methods are usually used:

[0078] The cloud periodically generates an encryption key (the key is irrelevant to the device ID); after the terminal is started, the terminal initiates an authentication and authorization request to the cloud and applies for a decryption key, the decryption key is generated from the encryption key and is relevant to the device ID, and the encryption key can be decrypted reversely; to meet the offline use, the decryption key can be imported locally through a USB / serial port or be updated through a Beidou short message; the terminal receives the satellite-based navigation enhancement information and uses the decryption key to perform decompression, decryption and decoding; and a high-precision positioning calculation module performs high-precision positioning calculation based on the decompressed, decrypted and decoded differential data.

[0079] The above method has a coarse service granularity and only supports a single enhancement service, and cannot distinguish multiple service levels such as PPP / PPP-AR / PPP-RTK. Multiple keys need to be preset or updated through satellite communication, which violates the core requirement of a network-free scene. The cloud periodically generates an encryption key and a decryption key, the decryption key is generated from the encryption key and is relevant to the device ID, but in an offline case, a legal terminal has no interaction with the cloud, and if an attacker clones the key and ID of the legal terminal to a new device, the new device can decrypt the received satellite-based navigation enhancement information and perform high-precision positioning calculation. The method of the embodiment of the application provides a user authorization and authentication method for satellite-based navigation enhancement in a network-free case, binds a service authorization permission file with a device unique identifier (chip UID), a service level and a service validity period, and designs a layered progressive security verification process for business authentication, respectively performs terminal legality verification, service validity period verification and service level matching, and designs a theft prevention mechanism from the hardware layer and the time layer, which can avoid service theft risk. On the hardware layer, the target authorization permission file is bound with the device unique identifier (chip UID), and the physical tamper-proof chip UID ensures the uniqueness of the terminal; on the time layer, real-time satellite ephemeris data is taken as a timestamp to resist clock tampering attacks (synchronization accuracy ±20ns). The entire authentication process can be completed completely autonomously by the terminal using a set of authorization permission files in an offline case, without the need for multiple decryption keys or interaction with the cloud to update the keys, eliminating the key update dependency (reducing 90% of communication overhead). At the same time, fine-grained control of the service granularity is provided, and hierarchical authentication of PPP / PPP-AR / PPP-RTK is supported, which can meet the service requirements of different users.

[0080] Figure 8 It is a structural schematic diagram of an authentication device of a terminal device according to the embodiment of the application, comprising:

[0081] The acquisition module 802 is configured to, in an offline case, acquire a target authorization permission file in the local memory after the target terminal device completes the authorization process.

[0082] The obtaining module 802 is further configured to complete the authorization process by the terminal device in the following manner: receiving an initial encrypted authorization license file created by the data center, wherein each initial encrypted authorization license file is bound to a chip identifier of one terminal device; decrypting the initial encrypted authorization license file and obtaining an initial chip identifier indicated by a terminal information field in the initial encrypted authorization license file; in a case where the initial chip identifier is the same as a chip identifier of the target terminal device, the target terminal device performs the following authorization process: updating a local authorization license file in a local memory of the target terminal device to the initial encrypted authorization license file to obtain a target authorization license file, wherein content of a terminal information field of the local authorization license file is the chip identifier of the target terminal device, content of a service validity content field of the local authorization license file, and a service level field are empty.

[0083] The obtaining module 802 is further configured to update an initial authorization license file in a local memory of the target terminal device, which is initially empty, to the initial encrypted authorization license file to obtain the target authorization license file: reading content indicated by a service validity content field and a service level field in the initial encrypted authorization license file, wherein the service validity content field and the service level field are used to limit use conditions of a corresponding service, and the service validity content is used to indicate a service validity period of the corresponding service; updating the content indicated by the service validity content field and the service level field in the initial encrypted authorization license file to corresponding fields of the local authorization license file to obtain the target authorization license file.

[0084] The authentication module 804 is configured to perform an authentication process according to the target authorization license file, wherein the target authorization license file is bound to a target chip identifier, and the target chip identifier is a chip identifier of the target terminal device.

[0085] The authentication module 804 is further configured to read a terminal identifier of the target terminal device after each startup of the target terminal device; obtain the target chip identifier in the target authorization license file; in a case where the target chip identifier is the same as the chip identifier of the target terminal device, perform service validity verification to obtain a verification result; and in a case where the verification result is that the service validity verification is passed, obtain service level information in a service level field of the target authorization license file.

[0086] The authentication module 804 is further configured to, in a case where the target chip identifier is the same as the chip identifier of the target terminal device, perform service validity verification to obtain a verification result: the target terminal receives the ephemeris data and obtains a target time point in the ephemeris data; obtain a service validity period of a service validity content field of the target authorization license file, wherein the service validity period comprises a start time point and an end time point; perform service validity verification according to the target time point and the service validity period to obtain a verification result. In a case where the target time point is between the start time point and the end time point, it is determined that the verification result is that the service validity verification is passed. In a case where the target time point is earlier than the start time point or later than the end time point, it is determined that the verification result is that the service validity verification is not passed.

[0087] The authentication module 804 is further configured to, after obtaining the service level information in the service level field of the target authorization license file, determine a service level in the service level information, the service level being one of: precise point positioning, precise point positioning with ambiguity fixed, and real-time kinematic precise point positioning; and activate an algorithm corresponding to the service level information to perform positioning calculation.

[0088] It should be noted that, Figure 8 The authentication device of the terminal device shown in the above Figure 2 The authentication method of the terminal device shown in the above Figure 2 The authentication method of the terminal device shown in the above

[0089] It should be noted that, each module in the authentication device of the terminal device described above can be a program module (for example, a program instruction set for implementing a certain specific function) or a hardware module, and for the latter, it can be in the following form, but is not limited to this: the form of each module is a processor, or the functions of each module are implemented by a processor.

[0090] The embodiments of the present application also provide a non-volatile storage medium, which comprises a stored program, wherein when the program is running, the non-volatile storage medium controls the device where the non-volatile storage medium is located to perform the authentication method of the terminal device in any one of the above embodiments.

[0091] The embodiments of the present application also provide an electronic device, which comprises a processor, and the processor is used to run a program, wherein when the program is running, the electronic device performs the authentication method of the terminal device in any one of the above embodiments.

[0092] According to another aspect of the embodiments of the present application, a computer program product is also provided, which comprises a computer program, and when the computer program is executed by a processor, the authentication method of the terminal device in any one of the above embodiments is implemented.

[0093] In the above-described embodiments of the present application, the description of each embodiment focuses on different aspects, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0094] In several embodiments provided in the present application, it should be understood that the disclosed technical content can be implemented by other manners. Among them, the above-described device embodiments are only schematic, for example, the division of the units can be a logical function division, and in actual implementation, there can be another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0095] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0096] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0097] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the related art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0098] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principle of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be regarded as the protection scope of the present application.

Claims

1. An authentication method for a terminal device, characterized in that, include: In offline mode, after the target terminal device completes the authorization process, it obtains the target license file from its local memory; An authentication process is performed based on the target license document, wherein the target license document is bound to a target chip identifier, and the target chip identifier is the chip identifier of the target terminal device.

2. The method according to claim 1, characterized in that, The terminal device completes the authorization process in the following ways: Receive an initial encrypted license file created by the data center, wherein each of the initial encrypted license files is bound to a chip identifier of a terminal device; The initial encrypted license file is decrypted, and the initial chip identifier indicated by the terminal information field in the initial encrypted license file is obtained; If the initial chip identifier is the same as the chip identifier of the target terminal device, the target terminal device performs the following authorization process: The local license file in the local memory of the target terminal device is updated to the initial encrypted license file to obtain the target license file. The terminal information field of the local license file contains the chip identifier of the target terminal device, and the service validity content field and service level field of the local license file are empty.

3. The method according to claim 2, characterized in that, The step of updating the initially empty license file in the local memory of the target terminal device to the initial encrypted license file to obtain the target license file includes: Read the contents indicated by the service validity content field and the service level field in the initial encrypted license file, wherein the service validity content field and the service level field are used to limit the usage conditions of the corresponding service, and the service validity content is used to indicate the service validity period of the corresponding service; The content indicated by the service validity content field and service level field in the initial encrypted license file is updated to the corresponding fields in the local license file to obtain the target license file.

4. The method according to claim 3, characterized in that, The authentication process based on the target license document includes: Each time the target terminal device is powered on, its own terminal identifier is read. Obtain the target chip identifier from the target license file; If the target chip identifier is the same as the chip identifier of the target terminal device, a service validity verification is performed to obtain the verification result; If the verification result is that the service validity verification is passed, the service level information in the service level field of the target license file is obtained.

5. The method according to claim 4, characterized in that, If the target chip identifier is the same as the chip identifier of the target terminal device, service validity verification is performed to obtain the verification result, including: The target terminal receives ephemeris data and obtains the target time from the ephemeris data; Obtain the service validity period from the service validity content field of the target license file, wherein the service validity period includes a start time and an end time; The service validity is verified based on the target time and the service validity period to obtain the verification result.

6. The method according to claim 5, characterized in that, The process of verifying service validity based on the target time and the service validity period to obtain the verification result includes: If the target time is between the start time and the end time, the verification result is determined to be a successful service validity verification. If the target time is earlier than the start time or later than the end time, the verification result is determined to be a service validity verification failure.

7. The method according to claim 4, characterized in that, After obtaining the service level information from the service level field of the target license file, the method further includes: The service level in the service level information is determined, and the service level is one of the following: precise single-point positioning, precise single-point positioning with fixed ambiguity, and real-time dynamic precise single-point positioning; The algorithm corresponding to the service level information is activated to perform location calculation.

8. The method according to claim 2, characterized in that, The initial encrypted license file is obtained by encrypting the service information using an encryption algorithm. The service information is obtained in response to the input instructions of the user using the target terminal, and the service information includes a terminal information field, a service validity field, and a service level field.

9. An authentication device for a terminal device, characterized in that, include: The acquisition module is used to acquire the target license file in the local memory of the target terminal device after the authorization process is completed in an offline situation. The authentication module is used to perform an authentication process based on the target license file, wherein the target license file is bound to the target chip identifier, and the target chip identifier is the chip identifier of the target terminal device.

10. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores a program, wherein when the program is executed, it controls the device where the non-volatile storage medium is located to execute the authentication method of the terminal device according to any one of claims 1 to 8.

11. An electronic device, characterized in that, include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the authentication method of the terminal device according to any one of claims 1 to 8.

12. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the authentication method of the terminal device according to any one of claims 1 to 8.

Images