Equipment identity verification method, electronic equipment, storage medium and product

Abstract

The invention discloses a device identity verification method, an electronic device, a storage medium and a product, relates to the technical field of information security, and is applied to a device end, the device end stores a device public key and a device public key signature result, and the device public key is generated by the device end. The equipment public key signature result is generated by signing an equipment public key through a signature center public key by a preset off-line security signature center, the signature center public key is generated by the preset off-line security signature center, and the method comprises the following steps: sending the equipment public key and the equipment public key signature result to a server side, the equipment public key and the equipment public key signature result are received and verified by the server side to judge whether the equipment side is credible or not; and under the condition that the server side judges that the equipment side is credible, data transmission with the server side is carried out. The technical problem that the security and the high efficiency cannot be considered at the same time in the current signature authentication technology is solved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a device authentication method, apparatus, electronic device, storage medium and computer program product. Background Technology

[0002] To authenticate the legitimacy of devices or accessories and prevent piracy and counterfeiting, manufacturers typically use a signing tool to sign the shipped devices or accessories, and then use a signing terminal to authenticate them. Only devices or accessories that pass authentication can proceed with subsequent operations. However, existing signature authentication technologies do not fully consider the limited resources of the underlying firmware. They usually require large digital certificates and keys, which occupy a lot of storage space on the device or accessory and greatly increase the amount of computation and processing time required during the authentication process. Embedded devices have limited computing power and processing speed. Therefore, current signature authentication technologies cannot balance security and efficiency. Summary of the Invention

[0003] The main purpose of this application is to provide a device authentication method, apparatus, electronic device, storage medium, and computer program product, which aims to solve the technical problem that current signature authentication technology cannot simultaneously achieve both security and efficiency.

[0004] To achieve the above objectives, this application proposes a device authentication method. The device authentication method is applied to a device, which stores a device public key and a device public key signature result. The device public key is generated by the device, and the device public key signature result is generated by a preset offline security signature center signing the device public key using the signature center's public key. The signature center's public key is generated by the preset offline security signature center. The device authentication method includes:

[0005] The device public key and the device public key signature result are sent to the server. The device public key and the device public key signature result will be received and verified by the server to determine whether the device is trustworthy.

[0006] If the server determines that the device is trustworthy, data transmission will be performed with the server.

[0007] In one embodiment, the step of transmitting data with the server is further included before:

[0008] Receive the server public key and server public key signature result sent by the server, wherein the server public key is generated by the server.

[0009] Verify whether the server is trustworthy;

[0010] If the server is trusted, the steps of transmitting data with the server are performed based on the server's public key.

[0011] In one embodiment, the device also stores the public key of the signature center, and the step of verifying whether the server is trustworthy includes:

[0012] The signature center's public key is used to sign the server's public key, generating a verification signature result;

[0013] Determine whether the verification signature result is consistent with the server public key signature result;

[0014] If the verification signature result is consistent with the server public key signature result, it indicates that the server public key signature result was generated by the signature center public key, and the server is deemed trustworthy.

[0015] In one embodiment, the device also stores a device private key and first communication data, and the step of transmitting data with the server includes:

[0016] The first communication data is encrypted using the server's public key to generate a first ciphertext result;

[0017] The first ciphertext signature is generated by signing the first ciphertext result using the device's private key.

[0018] The first ciphertext result and the first ciphertext signature are sent to the server.

[0019] In one embodiment, the step of transmitting data with the server further includes:

[0020] After receiving the second ciphertext result and the second ciphertext signature from the server, the server's public key is used to verify the second ciphertext signature;

[0021] If it is determined that the second ciphertext result is complete and comes from the server holding the server private key, the second ciphertext result is decrypted using the device private key to obtain the second communication data.

[0022] In one embodiment, the step of signing the first ciphertext result using the device private key to generate a first ciphertext signature includes:

[0023] A first random number is generated, and the first ciphertext result is concatenated with the first random number to form a first encrypted data block, wherein the device sends the first ciphertext result and the first ciphertext signature with the first random number.

[0024] The first encrypted data block is hashed using a hash function to generate a first target hash value.

[0025] The first target hash value is encrypted using the device's private key to generate a first ciphertext signature.

[0026] In one embodiment, the server sends the second ciphertext result and the second ciphertext signature with a second random number. The step of verifying the second ciphertext signature using the server's public key after receiving the second ciphertext result and the second ciphertext signature from the server includes:

[0027] Receive the second random number, the second ciphertext result, and the second ciphertext signature; concatenate the second ciphertext result with the second random number to form a second encrypted data block.

[0028] The second encrypted data block is hashed using a hash function to generate a second target hash value.

[0029] The second ciphertext result is decrypted using the server's public key to determine the third target hash value;

[0030] If the second target hash value is the same as the third target hash value, it is determined that the second ciphertext result is complete and comes from the server holding the server private key.

[0031] Furthermore, to achieve the above objectives, this application also proposes a device authentication system applied to a device. The device stores a device public key and a device public key signature result. The device public key is generated by the device, and the device public key signature result is generated by a preset offline secure signature center signing the device public key using the signature center's public key. The signature center's public key is generated by the preset offline secure signature center. The device authentication system includes:

[0032] The sending module is used to send the device public key and the device public key signature result to the server, wherein the device public key and the device public key signature result will be received and verified by the server to determine whether the device is trustworthy;

[0033] The transmission module is used to transmit data with the server when the server determines that the device is trustworthy.

[0034] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the device authentication method as described above.

[0035] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the device authentication method described above.

[0036] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the device authentication method described above.

[0037] This application provides a device authentication method applied to a device. The device stores a device public key and a device public key signature result. The device public key is generated by the device, and the device public key signature result is generated by a preset offline secure signature center signing the device public key using the signature center's public key. The signature center's public key is also generated by the preset offline secure signature center. The device authentication method includes: sending the device public key and the device public key signature result to a server, wherein the device public key and the device public key signature result are received and verified by the server to determine whether the device is trustworthy; and if the server determines that the device is trustworthy, data is transmitted with the server.

[0038] This application introduces a pre-defined offline secure signature center to sign the device's public key and verifies it on the server side. This ensures that only devices with legitimate signatures can be considered trustworthy, greatly enhancing system security and preventing unauthorized device access. It also avoids storing large digital certificates on the device, thus saving valuable storage space. Furthermore, the verification process only involves comparing the public key and the signature result, reducing computation and processing time, improving verification efficiency, and better adapting to the limited computing power and processing speed of embedded devices. Compared to related solutions, this application uses offline signing and public-private key encryption / decryption for identity verification, eliminating the need for large digital certificates, significantly reducing storage space, shortening computation and processing time, significantly reducing resource consumption, and improving verification efficiency. This allows signature authentication technology to be effectively implemented on resource-constrained devices, ensuring both security and high efficiency. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart illustrating an embodiment of the device authentication method of this application.

[0042] Figure 2 A schematic diagram of the system signature process provided in Embodiment 1 of the device authentication method of this application;

[0043] Figure 3 This is a schematic diagram illustrating a scenario where the device, acting as a host, interacts with the server for verification, as provided in Embodiment 1 of the device authentication method of this application.

[0044] Figure 4 This is a schematic diagram illustrating the scenario of interaction and verification between the device and the server when the device is an accessory, as provided in Embodiment 1 of the device authentication method of this application.

[0045] Figure 5 A simplified flowchart illustrating the device authentication method provided in Embodiment 2 of this application;

[0046] Figure 6 This is a schematic diagram illustrating the data interaction scenario between the device and the server when the device is a host, as provided in Embodiment 2 of the device authentication method of this application.

[0047] Figure 7 This is a schematic diagram illustrating the data interaction between the device and the server when the device is an accessory, as provided in Embodiment 2 of the device authentication method of this application.

[0048] Figure 8 This is an overall structural diagram of the device authentication method provided in Embodiment 2 of the present application;

[0049] Figure 9 This is a schematic diagram of the module structure of the device authentication device according to an embodiment of this application;

[0050] Figure 10 This is a schematic diagram of the device structure of the hardware operating environment involved in the device authentication method in this application embodiment.

[0051] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0052] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0053] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0054] The main solution of this application embodiment is: applied to the device side, the device side stores the device public key and the device public key signature result, the device public key is generated by the device side, the device public key signature result is generated by a preset offline security signature center signing the device public key with the signature center public key, the signature center public key is generated by the preset offline security signature center, the device authentication method includes: sending the device public key and the device public key signature result to the server side, wherein the device public key and the device public key signature result will be received and verified by the server side to determine whether the device side is trustworthy; if the server side determines that the device side is trustworthy, data is transmitted with the server side.

[0055] In this embodiment, for ease of description, the device authentication system will be used as the execution subject in the following description.

[0056] Because existing technologies ignore the limited resources of the underlying firmware, they often require the deployment of large digital certificates and keys, which not only consumes a lot of storage space, but also increases the computational burden and latency in the authentication process. Furthermore, due to the limited computing power and processing speed of embedded devices, current signature authentication schemes are unable to maintain efficient operation while ensuring security.

[0057] This application provides a solution that uses offline signing and public-private key encryption / decryption mechanisms for authentication, eliminating the need for bulky digital certificates and thus significantly saving storage space. This not only reduces computational load and processing time but also significantly lowers resource consumption and improves verification efficiency, enabling signature authentication technology to operate efficiently on resource-constrained devices. It ensures the security of data transmission and device access while also taking into account rapid operational response, achieving a perfect balance between security and efficiency. This provides an ideal authentication solution for resource-constrained environments such as embedded systems.

[0058] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or device authentication system capable of performing the above functions. The following description uses a device authentication system as an example to illustrate this embodiment and the subsequent embodiments.

[0059] Based on this, embodiments of this application provide a device authentication method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the device authentication method of this application.

[0060] This embodiment applies to the device side, which stores the device public key and the device public key signature result. The device public key is generated by the device side, and the device public key signature result is generated by a preset offline security signature center signing the device public key using the signature center's public key. The signature center's public key is generated by the preset offline security signature center. The device authentication method includes steps S01 to S02:

[0061] Step S01: Send the device public key and the device public key signature result to the server. The device public key and the device public key signature result will be received and verified by the server to determine whether the device is trustworthy.

[0062] It should be noted that the device can be a host or an accessory. The host refers to the main component of the device, which contains the core functions and main electronic components and is responsible for performing the main tasks and operations of the device. Accessories refer to those additional parts that are not core parts of the device but are essential for the normal operation and use of the device, including various sensors, catheters, probes, patient positioning devices, etc. The device is the entity that initiates the authentication request, which is responsible for generating and storing the device's public key and signature results, and sending this information to the server. The server is the entity that receives and verifies this information, which is responsible for determining whether the device is trustworthy and deciding whether to allow data transmission accordingly. The device and the server are two equivalent execution entities, each undertaking different responsibilities, and together they constitute a complete device authentication system.

[0063] Additionally, it should be noted that on the device side, any device requiring authentication will generate a pair of device public keys and device private keys. For the host, this is represented by the host public key and host private key; for accessories, it is represented by the accessory public key and accessory private key. Before leaving the factory, the device public key is sent to a preset offline security signature center for signing. The preset offline security signature center is an independent, highly secure system containing a signature center public key and a signature center private key, used to verify that the signature result was generated by the preset offline security signature center. After signing the device public key, the preset offline security signature center generates a device public key signature result and returns the device public key signature result along with the signature center public key to the corresponding device. The device public key signature result is represented as the host public key signature result for the host and as the accessory public key signature result for the accessory. The device public key and device public key signature result are sent to the server so that the server can verify the trustworthiness of the device.

[0064] For example, to aid in understanding the technical concept or principles of this application, please refer to Figure 2 , Figure 2 A schematic diagram of the system signature process is provided.

[0065] When the execution entity is the device, A is the preset offline security signature center, B is the device, B1 is the host computer, and B2 is the device, including the host and accessories. Before leaving the factory, any device B2 will generate a pair of device public keys (including the host public key and accessory public key) and device private keys (including the host private key and accessory private key). Through the host computer B1 deployed on device B2 (the host computer mainly provides the user interface, realizes data collection, processing, display and storage, and sends control commands to the lower-level devices; it can be a personal computer, workstation, or other device), the device public key is sent to the offline security signature center A. The offline security signature center A signs the device public key and generates a device public key signature result (including the host public key signature result and accessory public key signature result), and returns the device public key signature result and the signature center public key together to the corresponding device B2 through the host computer B1.

[0066] When the execution entity is the server, C represents the server, C1 represents the server, and C2 represents the encryption machine. Upon initial server deployment, encryption machine C2 generates a public and private key pair. Through server C1, deployed on encryption machine C2, the public key is sent to offline security signature center A. Offline security signature center A signs the public key, generates a public key signature result, and returns the signature result along with the signature center's public key to encryption machine C2 via server C1.

[0067] Understandably, compared to the traditional one-way public key sending method, step S01 requires the device to send the host public key and the host public key signature result simultaneously, so that the server can more comprehensively verify the identity of the device and the authenticity of the public key, thereby improving the security of the system.

[0068] Step S02: If the server determines that the device is trustworthy, data is transmitted with the server.

[0069] It should be noted that once the server determines that the device is trustworthy (the device's public key signature result is generated by the signature center's public key), data transmission begins between the device and the server, including the exchange of device status data, control commands, and other information.

[0070] For example, to aid in understanding the technical concept or principles of this application, please refer to Figure 3 and Figure 4 , Figure 3 It provides a schematic diagram of a scenario where the device acts as the host and interacts with the server for verification. Figure 4 A schematic diagram of the interaction and verification between the device and the server is provided when the device is an accessory. B21 is the host and B22 is the accessory.

[0071] like Figure 3As shown, before device B and server C perform encrypted data transmission, if device B21 is a host, host B21 receives the server public key and server public key signature result sent by server C through host computer B1. If the server public key signature result is determined to be generated by the signature center's public key, then server C is deemed trustworthy, and subsequent data transmission can proceed. Before server C and device B perform encrypted data transmission, if server C2 is an encryption machine, encryption machine C2 receives the host public key and host public key signature result sent by device B through server C1. If the host public key signature result is determined to be generated by the signature center's public key, then device B is deemed trustworthy, and subsequent encrypted data transmission can proceed.

[0072] like Figure 4 As shown, before device B and server C perform encrypted data transmission, if device B is an accessory and server C is the host, accessory B22 receives the host public key and its signature from server C. If the signature is determined to be generated by the signature center's public key, server C is deemed trustworthy, and subsequent data transmission proceeds. Before server C and device B perform encrypted data transmission, if server C is the host and device B is an accessory, host B21 receives the accessory public key and its signature from device B. If the signature is determined to be generated by the signature center's public key, device B is deemed trustworthy, and subsequent encrypted data transmission proceeds.

[0073] Understandably, step S02, through a two-way authentication mechanism, enables both the device and the server to verify each other's identity, thereby enhancing system security. At the same time, it saves storage space by not using a large digital certificate for two-way authentication, and ensures that encrypted communication is only established after successful authentication. This further enhances system security while ensuring overall system efficiency.

[0074] In one feasible implementation, step S02, prior to the step of transmitting data with the server, further includes steps A01 to A03:

[0075] Step A01: Receive the server public key and the server public key signature result sent by the server. The server public key is generated by the server.

[0076] It should be noted that the server can be an encryption machine or a host. On the device side, the host computer receives the server's public key and the server's public key signature result sent by the server. The server's public key is generated by the server and is used to verify the correctness of the signature result sent by the server and to encrypt the data subsequently sent to the server. The server's public key signature result is similar to the device's public key signature result, which is also generated by a preset offline security signature center that signs the server's public key.

[0077] Step A02: Verify whether the server is trustworthy;

[0078] It should be noted that after receiving the server's public key and the server's public key signature result, the device performs a verification operation on the server's public key signature result using the saved signature center's public key. This verifies the validity of the signature, checks whether the server's public key signature result was generated by a preset offline secure signature center that holds the signature center's private key, and confirms that the server's public key signature result is associated with the server's public key. This verifies the authenticity of the server's public key and the trustworthiness of the server. If the signature is valid, it means that the server's public key was indeed certified by the preset offline secure signature center, and the corresponding server can be determined to be trustworthy.

[0079] Step A03: If the server is trusted, perform the steps of data transmission with the server based on the server's public key.

[0080] It should be noted that after the server determines that the device is trustworthy and the device also determines that the server is trustworthy, the device will save the server's public key and perform secure data transmission with the server.

[0081] In this embodiment, by verifying the server and receiving the server's public key and its signature, the device can perform subsequent server authentication, ensuring that the server that needs to interact with the data is legitimate and improving system security.

[0082] In one feasible implementation, the device also stores the signature center's public key. In step A02, the step of verifying whether the server is trustworthy includes steps A11 to A13:

[0083] Step A11: Sign the server's public key using the signature center's public key to generate a verification signature result;

[0084] It should be noted that the device has a pre-stored signature center public key. After receiving the server public key to be verified and the server public key signature result, it uses the signature center public key to perform a signature operation on the server public key to generate a verification signature result. The verification signature result is an encrypted data block used to prove the authenticity and origin of the server public key.

[0085] Step A12: Determine whether the verification signature result is consistent with the server's public key signature result;

[0086] It should be noted that the comparison process between the verification signature result generated in step A11 and the server public key signature result provided by the server includes decryption and verification of the integrity of the signature to ensure that the two signature results are completely consistent in content and format.

[0087] Step A13: If the verification signature result is consistent with the server's public key signature result, it means that the server's public key signature result was generated by the signature center's public key, and the server is deemed trustworthy.

[0088] It should be noted that if the comparison result of step A12 is consistent, then the system can confirm that the server's public key signature result was indeed issued by the signature center, thereby confirming that the corresponding server is trustworthy.

[0089] In this embodiment, by introducing the public key of the signature center to sign the public key of the server, the security and credibility of the signature are guaranteed. Through efficient algorithm and process design, rapid verification is achieved. By leveraging the authority of the signature center and the security of public key encryption technology, security issues such as fake servers and man-in-the-middle attacks are effectively prevented.

[0090] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 5 , Figure 5 This is a flowchart illustrating the second embodiment of the device authentication method of this application. The device also stores a device private key and first communication data. In step S02, the step of transmitting data with the server includes steps S11 to S13:

[0091] Step S11: Encrypt the first communication data using the server's public key to generate the first ciphertext result;

[0092] It should be noted that on the device side, any host that needs to be authenticated will generate a corresponding device private key when generating the device public key. The first communication data refers to the raw data that the device needs to send to the server to realize communication between the server and the device. The first ciphertext result is the first communication data encrypted with the server public key, which can only be decrypted by the server private key. The server private key is kept by the server itself.

[0093] Step S12: Sign the first ciphertext result using the device private key to generate the first ciphertext signature;

[0094] It should be noted that the first ciphertext signature is the result of signing the first ciphertext result using the device's private key. It is used by the server to verify the integrity of the first communication data. Since the device's private key is kept secret, it can only be decrypted by the device using the device's public key.

[0095] Step S13: Send the first ciphertext result and the first ciphertext signature to the server.

[0096] It should be noted that the device sends the encrypted first ciphertext result and its corresponding first ciphertext signature to the server. These two elements together constitute the data packet, ensuring the integrity and verifiability of the data during transmission.

[0097] For example, to aid in understanding the technical concept or principles of this application, please refer to Figure 6 and Figure 7 , Figure 6 It provides a schematic diagram illustrating the data interaction scenario between the device and the server when the device is the host. Figure 7 It provides a schematic diagram illustrating the data interaction between the device and the server when the device is an accessory.

[0098] like Figure 6 As shown, when the device is a host, the host B21 sends the first ciphertext result and the first ciphertext signature to the server C through the host computer B1; when the server is an encryption machine, the encryption machine C2 sends the second ciphertext result and the second ciphertext signature to the device B through the server C1.

[0099] like Figure 7 As shown, when the device is an accessory, accessory B22 directly sends the first ciphertext result and the first ciphertext signature to the server C; when the server is a host, host B21 directly sends the second ciphertext result and the second ciphertext signature to the device B.

[0100] In this embodiment, the first communication data is encrypted using the server's public key to generate a first ciphertext result. The first ciphertext result is unreadable to unauthorized third parties, thus protecting data privacy. Even if the data is intercepted, attackers without the corresponding private key cannot decrypt and obtain the original information. The first ciphertext result is signed using the device's private key to generate an unforgeable first ciphertext signature. This signature is closely related to the data, and any tampering with the data will invalidate the signature. Although the signature verification step is added, the generation and verification process of the digital signature is relatively efficient and will not become a bottleneck for data transmission, thus improving transmission efficiency.

[0101] In one feasible implementation, step S02, after the step of transmitting data with the server, further includes steps B01 to B02:

[0102] Step B01: After receiving the second ciphertext result and the second ciphertext signature from the server, verify the second ciphertext signature using the server's public key;

[0103] It should be noted that the second ciphertext result is similar to the first ciphertext result; it is the result of the server encrypting the original data to be exchanged with the device using the host's public key. The second ciphertext signature is similar to the first ciphertext signature; it is the result of signing the second ciphertext result using the server's private key. After successfully receiving the second ciphertext result and corresponding second ciphertext signature from the server, the device uses the pre-saved server public key and a public key verification algorithm to verify the second ciphertext signature, confirming its authenticity and integrity.

[0104] Step B02: If it is determined that the second ciphertext result is complete and comes from the server holding the server private key, the second ciphertext result is decrypted using the device private key to obtain the second communication data.

[0105] It should be noted that after verifying and confirming the validity of the second ciphertext signature, the device uses the host's private key to decrypt the second ciphertext result, thereby recovering the original, unencrypted second communication data and enabling communication with the server. The second communication data, similar to the first communication data, refers to the original data that the server needs to send to the device.

[0106] In this embodiment, by verifying the validity of the second ciphertext signature using the server's public key, the device can confirm that the data was indeed sent by a legitimate server holding the server's private key and has not been tampered with during transmission, thus ensuring the integrity of the data. After verifying that the second ciphertext signature is correct, the device uses its own host private key to decrypt the second ciphertext result, thereby recovering the original, unencrypted second communication data and protecting the confidentiality of the data.

[0107] In one feasible implementation, step S12, which involves signing the first ciphertext result using the device private key to generate a first ciphertext signature, includes steps B11 to B13:

[0108] Step B11: Generate a first random number, concatenate the first ciphertext result with the first random number to form a first encrypted data block, wherein the device sends the first ciphertext result and the first ciphertext signature with the first random number.

[0109] It should be noted that the system generates a first random number, which serves as a unique, one-time-use security element designed to increase unpredictability and security during data transmission. This random number is concatenated (i.e. directly appended) to the existing first ciphertext result to form the first encrypted data block. When the device sends the first encrypted data block, it also carries the first random number so that the server can verify its integrity and authenticity.

[0110] Step B12: Perform a hash operation on the first encrypted data block using a hash function to generate the first target hash value;

[0111] It should be noted that the system uses a hash function to perform a hash operation on the first encrypted data block, generating a fixed-length hash value, namely the first target hash value. The design of the hash function ensures that any small change to the original data will result in a significant change in the hash value, which is used to verify the integrity of the data.

[0112] Step B13: Encrypt the first target hash value using the device private key to generate the first ciphertext signature.

[0113] It should be noted that the first target hash value is encrypted using the device's private key to generate the first ciphertext signature. The device's private key is unique to the device, and only the device's public key can decrypt the first ciphertext signature. Therefore, the first ciphertext signature can serve as the device's confirmation of the integrity and origin of the first encrypted data block.

[0114] In this embodiment, by introducing random numbers and concatenating them into the ciphertext result, the complexity and randomness of the data are increased, making it difficult for attackers to predict and tamper with the data, thereby improving the security of data transmission. Through hash operations, data blocks of arbitrary length can be mapped to hash values ​​of fixed length, which facilitates storage and comparison, while retaining the ability to verify data integrity. Any tampering with the encrypted data block will be quickly identified through the difference in hash values. The ciphertext signature proves that the data was indeed generated by the device holding the private key, which is non-repudiable. The verifier can decrypt the ciphertext signature with the public key to verify the source and integrity of the data, thereby confirming the identity of the sender, and realizing efficient and secure signature authentication of encrypted data blocks.

[0115] In one feasible implementation, in step B01, the server sends the second ciphertext result and the second ciphertext signature along with a second random number. The step of verifying the second ciphertext signature using the server's public key after receiving the second ciphertext result and the second ciphertext signature from the server includes steps B21 to B24:

[0116] Step B21: Receive the second random number, the second ciphertext result, and the second ciphertext signature; concatenate the second ciphertext result with the second random number to form the second encrypted data block.

[0117] It should be noted that, similar to the first random number, the second random number is a unique security element used only once, designed to increase unpredictability and security during data transmission. After receiving the second random number, the second ciphertext result, and the second ciphertext signature sent by the server, the device concatenates the second ciphertext result with the second random number to form the second encrypted data block.

[0118] Step B22: Perform a hash operation on the second encrypted data block using a hash function to generate a second target hash value;

[0119] It should be noted that the device uses the same hash function as the server to perform a hash operation on the second encrypted data block, generating a second target hash value, which is used for subsequent comparison with the hash value obtained by decrypting from the second ciphertext signature.

[0120] Step B23: Decrypt the second ciphertext result using the server's public key to determine the third target hash value;

[0121] It should be noted that the device uses the server's public key to decrypt the second ciphertext signature to obtain the third target hash value. The third target hash value is obtained by the server using its private key to encrypt the hash value of the second encrypted data block before sending.

[0122] Step B24: If the second target hash value is the same as the third target hash value, determine that the second ciphertext result is complete and comes from the server holding the server's private key.

[0123] It should be noted that the second target hash value is compared with the third target hash value. If they are the same, the second ciphertext result is determined to be complete and from the server holding the server's private key; if they are different, the verification is determined to have failed, and there may be a risk that the data has been tampered with or forged.

[0124] In this embodiment, by reconstructing the encrypted data block sent by the server, the integrity and accuracy of the basic data for subsequent verification steps are ensured. Through the hash function, any minor modification to the original data will result in a significant change in the hash value, thereby enabling rapid identification of whether the data has been tampered with. By decrypting the ciphertext signature and obtaining its hash value, the client can verify whether the hash value is consistent with the hash value it calculated for the second encrypted data block, thus confirming that the second ciphertext result does indeed come from the server holding the server's private key and has not been tampered with. This achieves comprehensive verification of the security and integrity of the ciphertext result, improving the overall efficiency and reliability of the signature authentication technology.

[0125] For example, to aid in understanding the technical concept or principles of this application, please refer to Figure 8 , Figure 8The overall structure diagram of the device authentication method is provided. For device B, before shipment, the device public key is sent to the offline security signature center for signing. The device public key signing result and the signature center public key are returned to device B. For server C, during the initial deployment, the server public key is sent to the offline security signature center for signing. The server public key signing result and the signature center public key are returned to server C. Device B and server C authenticate each other using the signature center public key. After confirming that the other party's public key signing result is valid, they save the other party's public key, trust the other party, and conduct encrypted communication.

[0126] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the device authentication method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0127] This application also provides a device authentication system; please refer to [link / reference]. Figure 9 The device authentication system is applied to the device itself. The device stores the device's public key and its signature. The device's public key is generated by the device, and the signature is generated by a pre-defined offline security signature center that signs the device's public key using the signature center's public key. The signature center's public key is also generated by the pre-defined offline security signature center. The device authentication system includes:

[0128] The sending module 10 is used to send the device public key and the device public key signature result to the server. The device public key and the device public key signature result will be received and verified by the server to determine whether the device is trustworthy.

[0129] The transmission module 20 is used to transmit data with the server when the server determines that the device is trustworthy.

[0130] Optionally, the device authentication system also includes an authentication module 30, which is further used for:

[0131] Receive the server's public key and the server's public key signature result sent by the server. The server's public key is generated by the server.

[0132] Verify whether the server is trustworthy;

[0133] If the server is trusted, the steps for data transmission with the server are performed based on the server's public key.

[0134] Optionally, the device also stores the signature center's public key, and the verification module 30 is also used for:

[0135] The signature center's public key is used to sign the server's public key, generating a verification signature result;

[0136] Determine whether the verification signature result matches the server's public key signature result;

[0137] If the verification signature result matches the server's public key signature result, it means that the server's public key signature result was generated by the signature center's public key, and the server is deemed trustworthy.

[0138] Optionally, the device also stores the device private key and the first communication data, and the transmission module 20 is further used for:

[0139] The first communication data is encrypted using the server's public key to generate the first ciphertext result;

[0140] The first ciphertext result is signed using the device's private key to generate the first ciphertext signature;

[0141] Send the first ciphertext result and the first ciphertext signature to the server.

[0142] Optionally, the device authentication system also includes a decryption module 40, which is further used for:

[0143] After receiving the second ciphertext result and the second ciphertext signature from the server, the server's public key is used to verify the second ciphertext signature;

[0144] If it is confirmed that the second ciphertext result is complete and comes from the server holding the server's private key, the second ciphertext result is decrypted using the device's private key to obtain the second communication data.

[0145] Optionally, the transmission module 20 is also used for:

[0146] A first random number is generated, and the first ciphertext result is concatenated with the first random number to form a first encrypted data block. The device sends the first ciphertext result and the first ciphertext signature with the first random number.

[0147] The first encrypted data block is hashed using a hash function to generate the first target hash value.

[0148] The first target hash value is encrypted using the device's private key to generate the first ciphertext signature.

[0149] Optionally, the server sends the second ciphertext result and the second ciphertext signature along with a second random number, and the decryption module 40 is also used for:

[0150] Receive the second random number, the second ciphertext result, and the second ciphertext signature; concatenate the second ciphertext result with the second random number to form the second encrypted data block.

[0151] The second encrypted data block is hashed using a hash function to generate the second target hash value.

[0152] The server's public key is used to decrypt the second ciphertext result to determine the third target hash value;

[0153] If the second target hash value is the same as the third target hash value, it is determined that the second ciphertext result is complete and comes from the server holding the server's private key.

[0154] The device authentication apparatus provided in this application, employing the device authentication method described in the above embodiments, can solve the technical problem that current signature authentication technologies cannot simultaneously achieve both security and efficiency. Compared with the prior art, the beneficial effects of the device authentication apparatus provided in this application are the same as those of the device authentication method described in the above embodiments, and other technical features in the device authentication apparatus are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0155] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the device authentication method in Embodiment 1 above.

[0156] The following is for reference. Figure 10 The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, and PADs (Portable Application Description: Tablet PCs), as well as fixed terminals such as digital TVs and desktop computers. Figure 10 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0157] like Figure 10As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. While electronic devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0158] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0159] The electronic device provided in this application, employing the device authentication method described in the above embodiments, can solve the technical problem that current signature authentication technologies cannot simultaneously achieve both security and efficiency. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the device authentication method described in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0160] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0161] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0162] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the device authentication method described in the above embodiments.

[0163] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0164] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0165] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by an electronic device, they cause the following to occur in the device authentication process: the device sends its public key and a signature result to the server, whereby the server receives and verifies the public key and signature result to determine if the device is trustworthy; the device receives its server public key and signature result from the server, where the server public key is generated by the server; if the signature result is generated by a signature center, the server is deemed trustworthy, and upon receiving the trustworthiness determination from the server, the server public key is saved and encrypted data is transmitted with the server; the server receives the device public key and signature result from the device, whereby the device public key is generated by the device; the server sends its public key and signature result to the device, whereby the device receives and verifies the public key and signature result to determine if the server is trustworthy; if the signature result is generated by a signature center, the device is deemed trustworthy, and upon receiving the trustworthiness determination from the device, the device public key is saved and encrypted data is transmitted with the device.

[0166] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0169] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described device authentication method. This solves the technical problem that current signature authentication technologies cannot simultaneously achieve both security and efficiency. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the device authentication method provided in the above embodiments, and will not be repeated here.

[0170] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the device authentication method described above.

[0171] The computer program product provided in this application can solve the technical problem that current signature authentication technologies cannot simultaneously achieve both security and efficiency. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the device authentication method provided in the above embodiments, and will not be repeated here.

[0172] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A device authentication method, characterized in that, Applied to the device side, the device side stores a device public key and a device public key signature result. The device public key is generated by the device side, and the device public key signature result is generated by a preset offline security signature center signing the device public key using the signature center's public key. The signature center's public key is generated by the preset offline security signature center. The device authentication method includes: The device public key and the device public key signature result are sent to the server. The device public key and the device public key signature result will be received and verified by the server to determine whether the device is trustworthy. If the server determines that the device is trustworthy, data transmission will be performed with the server.

2. The device authentication method as described in claim 1, characterized in that, Prior to the step of transmitting data with the server, the following steps are also included: Receive the server public key and server public key signature result sent by the server, wherein the server public key is generated by the server. Verify whether the server is trustworthy; If the server is trusted, the steps of transmitting data with the server are performed based on the server's public key.

3. The device authentication method as described in claim 2, characterized in that, The device also stores the public key of the signature center. The step of verifying whether the server is trustworthy includes: The signature center's public key is used to sign the server's public key, generating a verification signature result; Determine whether the verification signature result is consistent with the server public key signature result; If the verification signature result is consistent with the server public key signature result, it indicates that the server public key signature result was generated by the signature center's public key, and the server is deemed trustworthy.

4. The device authentication method as described in claim 1 or 2, characterized in that, The device also stores a device private key and first communication data. The step of transmitting data with the server includes: The first communication data is encrypted using the server's public key to generate a first ciphertext result; The first ciphertext signature is generated by signing the first ciphertext result using the device's private key. The first ciphertext result and the first ciphertext signature are sent to the server.

5. The device authentication method as described in claim 4, characterized in that, Following the step of transmitting data with the server, the method further includes: After receiving the second ciphertext result and the second ciphertext signature from the server, the second ciphertext signature is verified using the server's public key; If it is determined that the second ciphertext result is complete and comes from a server holding the server's private key, the second ciphertext result is decrypted using the device's private key to obtain the second communication data.

6. The device authentication method as described in claim 4, characterized in that, The step of signing the first ciphertext result using the device private key to generate the first ciphertext signature includes: A first random number is generated, and the first ciphertext result is concatenated with the first random number to form a first encrypted data block, wherein the device sends the first ciphertext result and the first ciphertext signature with the first random number. The first encrypted data block is hashed using a hash function to generate a first target hash value. The first target hash value is encrypted using the device's private key to generate a first ciphertext signature.

7. The device authentication method as described in claim 5, characterized in that, When the server sends the second ciphertext result and the second ciphertext signature, it carries a second random number. The step of verifying the second ciphertext signature using the server's public key after receiving the second ciphertext result and the second ciphertext signature from the server includes: Receive the second random number, the second ciphertext result, and the second ciphertext signature; concatenate the second ciphertext result with the second random number to form a second encrypted data block. The second encrypted data block is hashed using a hash function to generate a second target hash value. The second ciphertext result is decrypted using the server's public key to determine the third target hash value; If the second target hash value is the same as the third target hash value, it is determined that the second ciphertext result is complete and comes from the server holding the server private key.

8. An electronic device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the device authentication method as described in any one of claims 1 to 7.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the device authentication method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the device authentication method as described in any one of claims 1 to 7.

Images