Client authentication method, apparatus, device, storage medium and product

Abstract

The present disclosure relates to a client authentication method and device, electronic equipment and storage medium. The method comprises: generating a first client public-private key pair corresponding to a first client; obtaining verification code information corresponding to a second client; sending an authentication request of the first client to an encryption machine; in response to authentication passing, receiving authentication feedback information returned by the encryption machine; and decrypting the authentication feedback information by using the first client private key to obtain a data encryption key and an authentication key. In the client authentication process, in addition to setting a data encryption key for end-to-end data encryption and decryption for a trust circle in which the client is located, an authentication key for client authentication is also set. The authentication process is simple and does not require a complex encryption protocol. At the same time, the synchronization problem of the client public key among multiple devices is avoided, the implementation process of the synchronization mechanism is simplified, and the system efficiency and security are improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a client authentication method, apparatus, electronic device, storage medium, and computer program product. Background Technology

[0002] With the widespread use of personal data on electronic devices and in cloud storage, data security during synchronization and storage has become a major concern for users. End-to-end encryption (E2EE) serves as an effective solution, ensuring that data remains encrypted throughout transmission and storage, with only the sender and receiver possessing the decryption key to access the data content. In mobile devices, end-to-end encryption typically generates encryption keys via a security chip. Data is encrypted on the device before being uploaded to the cloud, ensuring that network nodes and servers cannot decrypt it, effectively preventing external and internal personnel from stealing user privacy.

[0003] However, users typically own multiple devices (such as phones, tablets, and computers) and need to securely synchronize data across these devices. Since cloud storage provides encrypted backups, the encryption keys need to be securely synchronized to other devices via end-to-end encryption. To ensure the new device is the user's actual device, the old device usually needs to authenticate the new device. Only after successful authentication can the encryption keys be securely synchronized to the new device. This process not only ensures data security but also improves the efficiency of collaboration between multiple devices. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this disclosure provides a client authentication method, apparatus, electronic device, storage medium, and computer program product.

[0005] According to a first aspect of the present disclosure, a client authentication method is provided, the method comprising: generating a first client public key and a first client private key corresponding to a first client; obtaining verification code information corresponding to a second client; the second client being an authenticated client; sending an authentication request of the first client to an encryption device; the authentication request of the first client including at least: a first device key, the verification code information, and the first client public key; the first device key being a device key corresponding to the first client; receiving authentication feedback information of the first client returned by the encryption device in response to successful authentication of the first client's authentication request based on the verification code information; decrypting the authentication feedback information of the first client using the first client private key to obtain a data encryption key and an authentication key; the data encryption key being used for end-to-end data encryption and decryption; and the authentication key being used for client authentication.

[0006] In some exemplary embodiments of this disclosure, sending the authentication request of the first client to the encryption machine further includes: generating first authentication information based on first device information, authentication verification information, the first device key, the verification code information, and the hash value of the first client public key; the first device information corresponds to the first client; encrypting the first authentication information using the encryption machine's client public key to obtain encrypted first authentication information; and generating the authentication request of the first client based on the encrypted first authentication information and the first client public key.

[0007] In some exemplary embodiments of this disclosure, generating the first authentication information based on the hash value of the first device information, authentication verification information, the first device key, the verification code information, and the first client public key further includes: performing slow hashing, salting, and / or SRP algorithm processing on the first device key and the verification code information.

[0008] In some exemplary embodiments of this disclosure, the authentication method for the second client includes: generating a second client public key and a second client private key corresponding to the second client; sending an authentication request for the second client to the encryption machine; the authentication request for the second client includes at least: a second device key and a second client public key; in response to successful authentication of the second client's authentication request, receiving authentication feedback information of the second client returned by the encryption machine; and decrypting the authentication feedback information of the second client using the second client private key to obtain the data encryption key and the authentication key.

[0009] In some exemplary embodiments of this disclosure, the authentication method for the second client includes: generating a second client public key and a second client private key corresponding to the second client; generating the data encryption key and the authentication key; sending an authentication request from the second client to the encryption device; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key; in response to successful authentication of the second client's authentication request, receiving authentication success information from the encryption device; and saving the data encryption key and the authentication key based on the authentication success information.

[0010] According to a second aspect of the present disclosure, a client authentication method is provided, the method comprising: receiving an authentication request from a first client; the authentication request from the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to a second client; the second client is an authenticated client; acquiring second master key information corresponding to the second client and the verification code information; the second master key information includes at least: the second device key, a data encryption key, and an authentication key; in response to the verification code information in the authentication request from the first client being consistent with the acquired verification code information, the authentication request from the first client is authenticated successfully; generating and storing first master key information corresponding to the first client based on the first device key, the data encryption key, and the authentication key; sending authentication feedback information to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client public key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

[0011] In some exemplary embodiments of this disclosure, generating first master key information corresponding to the first client based on the first device key, data encryption key, and authentication key includes: generating first key information according to the first device information, the first device key, data encryption key, and authentication key; the first device information corresponds to the first client; and encrypting the first key information using the encryption machine service public key to obtain the first master key information.

[0012] In some exemplary embodiments of this disclosure, the authentication method for the second client includes: receiving an authentication request from the second client; the authentication request from the second client includes at least: a second device key and a second client public key; in response to successful authentication of the second client's authentication request, generating the data encryption key and the authentication key; generating and storing second master key information corresponding to the second client based on the second device key, the data encryption key, and the authentication key; and sending authentication feedback information to the second client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the second client public key.

[0013] In some exemplary embodiments of this disclosure, the authentication method of the second client includes: receiving an authentication request from the second client; the authentication request from the second client includes at least: a second device key, a data encryption key, an authentication key, and a second client public key; in response to successful authentication of the second client's authentication request, generating and saving second master key information corresponding to the second client based on the second device key, the data encryption key, and the authentication key; and sending authentication success information to the second client.

[0014] In some exemplary embodiments of this disclosure, obtaining the second master key information corresponding to the second client and the verification code information includes: receiving verification code upload information uploaded by the second client; the verification code upload information includes at least: verification code information encrypted with the authentication key; the verification code information is generated by the second client; obtaining the second master key information corresponding to the second client; and decrypting the encrypted verification code information with the authentication key in the second master key information to obtain the verification code information.

[0015] In some exemplary embodiments of this disclosure, the method further includes: receiving a verification code request sent by the second client; generating the verification code information in response to the verification code request sent by the second client; and sending verification code delivery information to the second client; the verification code delivery information includes at least: verification code information encrypted with the authentication key.

[0016] In some exemplary embodiments of this disclosure, the verification code information is configured with a valid time; in response to the expiration of the valid time, the verification code information becomes invalid.

[0017] According to a third aspect of the present disclosure, a client authentication apparatus is provided, comprising: a public-private key pair generation unit, configured to generate a first client public key and a first client private key corresponding to a first client; a verification code acquisition unit, configured to acquire verification code information corresponding to a second client; the second client being an authenticated client; an authentication request sending unit, configured to send an authentication request of the first client to an encryption device; the authentication request of the first client includes at least: a first device key, the verification code information, and the first client public key; the first device key being a device key corresponding to the first client; an authentication feedback information receiving unit, configured to receive authentication feedback information of the first client returned by the encryption device in response to successful authentication of the first client's authentication request based on the verification code information; a key acquisition unit, configured to decrypt the authentication feedback information of the first client using the first client private key to obtain a data encryption key and an authentication key; the data encryption key being used for end-to-end data encryption and decryption; and the authentication key being used for client authentication.

[0018] According to a fourth aspect of the present disclosure, a client authentication apparatus is provided, comprising: an authentication request receiving unit, configured to receive an authentication request from a first client; the authentication request from the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to a second client; the second client is an authenticated client; a verification code information acquisition unit, configured to acquire second master key information corresponding to the second client and the verification code information; the second master key information includes at least: the second device key, a data encryption key, and an authentication key; an authentication confirmation unit, configured to, in response to the first client's authentication request being authenticated if the verification code information in the authentication request matches the acquired verification code information; a first master key information generation unit, configured to generate and store the first master key information corresponding to the first client based on the first device key, the data encryption key, and the authentication key; and an authentication feedback information sending unit, configured to send authentication feedback information to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client public key; the data encryption key is used for end-to-end data encryption and decryption; and the authentication key is used for client authentication.

[0019] According to a fifth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement any of the client authentication methods described in the present disclosure.

[0020] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, wherein when instructions in the storage medium are executed by a processor of a mobile terminal, the mobile terminal is enabled to perform any of the client authentication methods described herein.

[0021] According to a seventh aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the client authentication methods described in the present disclosure.

[0022] The technical solutions provided by the embodiments of this disclosure may include the following beneficial effects:

[0023] This disclosure, during the client authentication process, not only sets a data encryption key for end-to-end data encryption and decryption within the client's trust circle, but also sets an authentication key for client authentication. This authentication process is simple and requires no complex encryption protocols. Simultaneously, it avoids the problem of synchronizing the client's public key across multiple devices, simplifies the implementation of the synchronization mechanism, and improves system efficiency and security.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0025] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0026] Figure 1 This is a flowchart of a client authentication method according to an exemplary embodiment of the present disclosure. Figure 1 .

[0027] Figure 2 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 1 .

[0028] Figure 3 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 2 .

[0029] Figure 4 This is a flowchart of a client authentication method according to an exemplary embodiment of the present disclosure. Figure 2 .

[0030] Figure 5 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 3 .

[0031] Figure 6 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 4 .

[0032] Figure 7 This is a flowchart of a verification code information acquisition method according to an exemplary embodiment of the present disclosure. Figure 1 .

[0033] Figure 8 This is a flowchart of a verification code information acquisition method according to an exemplary embodiment of the present disclosure. Figure 2 .

[0034] Figure 9 This is an interactive diagram illustrating a first client authentication process according to an exemplary embodiment of the present disclosure.

[0035] Figure 10 This is an interactive diagram illustrating a second client authentication process according to an exemplary embodiment of this disclosure.

[0036] Figure 11This is an interactive diagram illustrating the verification code information acquisition process according to an exemplary embodiment of this disclosure.

[0037] Figure 12 This is a frame of a client authentication device illustrated according to an exemplary embodiment of the present disclosure. Figure 1 .

[0038] Figure 13 This is a frame of a client authentication device illustrated according to an exemplary embodiment of the present disclosure. Figure 2 .

[0039] Figure 14 This is a block diagram illustrating an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0040] Exemplary embodiments of this disclosure will be described in detail herein, examples of which are illustrated in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. Various changes, modifications, and equivalents of the methods, apparatus, and / or systems described herein will become apparent upon understanding this disclosure. For example, the order of operations described herein is merely illustrative and is not limited to those orders set forth herein, but can be changed as will become apparent upon understanding this disclosure, except for operations that must be performed in a particular order. Furthermore, for clarity and brevity, descriptions of features known in the art may be omitted.

[0041] The embodiments described below, which are examples of some of the embodiments of this disclosure, do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0042] In related technologies, the authentication process of a new device through an older device often relies on the device's public key for signature verification, involving the signing and verification of public and private keys, and also requiring the use of the SPR (Signature Recognition Process) algorithm. This results in a cumbersome process with significant computational overhead. Furthermore, after a new device joins the trust circle, its public key information needs to be synchronized to other devices to ensure that older devices recognize its trustworthiness. This process further increases system complexity and management difficulty. These issues impact user experience and system performance, necessitating a simpler and more efficient solution.

[0043] The steps of the method in the exemplary embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings and examples.

[0044] Figure 1 This is a flowchart of a client authentication method according to an exemplary embodiment of the present disclosure. Figure 1 . Figure 9 This is an interactive diagram illustrating a first client authentication process according to an exemplary embodiment of this disclosure. The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminal devices, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer cluster consisting of one or more computers.

[0045] like Figure 1 , 9 As shown, in some embodiments, the client authentication method of this disclosure includes:

[0046] In step S110, a first client public key and a first client private key corresponding to the first client are generated.

[0047] In this embodiment of the disclosure, a user possesses an authenticated client (second client) and needs to authenticate an unauthenticated client (first client) to join the trusted circle of the authenticated client, thereby enabling secure data synchronization between devices. The client authentication method provided in this embodiment can be applied to the first client to be authenticated.

[0048] In this embodiment, the first client generates a public-private key pair, including a first client public key clientPubKey1 and a first client private key clientPriKey1. The first client public key and the first client private key can be an RSA public-private key pair, used to encrypt and decrypt data traveling between the encryption device and the client. The first client public key is uploaded to the encryption device, and the first client private key is stored on the first client's device.

[0049] In an exemplary embodiment, the first client may request a temporary random number (nonce) from the server. This nonce typically consists of a random number and a timestamp. The client may carry this nonce in subsequent requests. The server verifies the uniqueness and time validity of the nonce to prevent replay attacks (i.e., prevent attackers from reusing the same request) and ensure that requests are completed within a valid timeframe.

[0050] In step S120, the verification code information corresponding to the second client is obtained; the second client is an authenticated client.

[0051] In this embodiment, client authentication is performed on the unauthenticated client (first client) based on the verification code information displayed on the authenticated client (second client). Unlike the client's device key, the verification code information is a temporarily valid verification method and is randomly generated. This verification code information can be generated by the second client and synchronized to the encryption device for subsequent authentication, or it can be generated by the encryption device or the server and sent to the second client. The first client obtains the verification code information from the second client. The user can input the verification code information displayed on the second client into the first client, or the user can obtain the verification code information from the second client via communication. This disclosure does not limit the specific method of obtaining the verification code information.

[0052] In an exemplary embodiment, a validity period can be set for the verification code information. The verification code information becomes invalid upon the expiration of the validity period. For example, the validity period is five minutes.

[0053] In step S130, an authentication request from the first client is sent to the encryption machine; the authentication request from the first client includes at least: a first device key, the verification code information, and a first client public key; the first device key is the device key corresponding to the first client.

[0054] In this embodiment of the disclosure, the first client sends an authentication request to the encryption device. The authentication request includes at least: a first device key, verification code information, and a first client public key clientPubKey1. The first device key is the device key corresponding to the first client (the unauthenticated client).

[0055] In an exemplary embodiment, the device key is a key used to identify the client device. Different client devices within the same trust circle can have different device keys. The device key can be a device unlock key, which is a key set by the user to unlock the device, such as an unlock password. The device key can also be a device recovery key, which is a string of characters randomly generated by a program on the device and used to recover the device.

[0056] In an exemplary embodiment, the authentication request of the first client can be generated through the following process.

[0057] First authentication information is generated based on the first device information, authentication verification information, first device key, verification code information, and the hash value of the first client public key; the first device information corresponds to the first client.

[0058] The first authentication information is encrypted using the encryption machine client's public key to obtain the encrypted first authentication information;

[0059] Based on the encrypted first authentication information and the first client public key, an authentication request for the first client is generated.

[0060] In this embodiment, the first client obtains first device information, authentication verification information, a first device key, verification code information, and the hash value of a first client public key. The first device information is related to the first client device, such as user ID and device information. The authentication verification information is information used for authentication verification, such as the aforementioned temporary random number (nonce). The hash value of the first client public key is a hash value obtained by hashing the first client public key clientPubKey1. This hash value can be used to verify the first client public key clientPubKey1 to ensure that the public key has not been tampered with.

[0061] The first client concatenates the first device information, authentication verification information, first device key, verification code information and hash value of the first client public key obtained above to generate the first authentication information clientTicket1.

[0062] The first authentication information, clientTicket1, is encrypted using the encryption machine's client public key, hsmClientPubKey, to obtain the encrypted first authentication information, encClientTicket1. The encryption machine's client public key, hsmClientPubKey, is an RSA public-private key pair generated by the encryption machine for the client, used to encrypt and decrypt data uploaded by the client to the encryption machine. The encryption machine's client public key, hsmClientPubKey, is pre-stored on the client. The corresponding encryption machine client private key, hsmClientPriKey, is stored in the encryption machine.

[0063] Based on the encrypted first authentication information encClientTicket1 and the first client public key clientPubKey1, an authentication request for the first client is generated to package and upload the first authentication information encClientTicket1 and the first client public key clientPubKey1 to the encryption machine.

[0064] It should be noted that the information contained in the first authentication information encClientTicket1 can be adjusted according to the actual application needs. As long as the authentication request of the first client includes at least the first device key, verification code information and the first client public key, it should be considered as within the protection scope of this disclosure.

[0065] In an exemplary embodiment, to further enhance the security of device key uploads and avoid plaintext uploads, the device key can be processed during the authentication request generation process. This includes, but is not limited to, slow hashing, salting, and / or SRP algorithm processing of the first device key and verification code information. Slow hashing is a hash function intentionally designed to be computationally slow, increasing computational complexity to resist brute-force attacks. Salting involves adding a randomly generated string (called a "salt") to the original data during the hashing process before performing the hash calculation. The SRP algorithm (Secure Remote Password) is an encryption protocol for password authentication designed to avoid transmitting the user's password in plaintext to the server while providing secure authentication. Depending on the specific application requirements, the user can perform the above processing on the first device key and / or verification code information. Alternatively, a combination of one or more of the above processing methods can be selected to process the device key, depending on the specific application requirements.

[0066] In step S140, in response to the successful authentication of the first client's authentication request based on the verification code information, the authentication feedback information of the first client returned by the encryption machine is received.

[0067] In this embodiment, the encryption machine compares the verification code information uploaded in the authentication request of the first client with the pre-cached verification code information to determine whether the authentication request of the first client is successful. When the encryption machine determines that the authentication request of the first client is successful, it returns authentication feedback information to the first client.

[0068] In this embodiment, the authentication feedback information of the first client includes at least a data encryption key `masterKey` and an authentication key `userAuthKey`, encrypted using the first client public key `clientPubKey1`. The data encryption key `masterKey` is distributed to the security chip of each client device for end-to-end data encryption and decryption. The authentication key `userAuthKey`, also distributed to the security chip of each client device along with the data encryption key `masterKey`, is used for client authentication. The data encryption key `masterKey` and the authentication key `userAuthKey` are shared by all client devices within the trust circle; only devices that have been authenticated and joined the trust circle can receive both the data encryption key `masterKey` and the authentication key `userAuthKey`.

[0069] In an exemplary embodiment, the data encryption key masterKey and the authentication key userAuthKey can be generated by the encryption machine or by the client device that was initially registered.

[0070] In an exemplary embodiment, after the encryption machine's authentication request is successfully authenticated, it first obtains the data encryption key masterKey and the authentication key userAuthKey corresponding to the second client. Then, based on the first client public key clientPubKey1 from the authentication request, it encrypts the data encryption key masterKey and the authentication key userAuthKey respectively, obtaining the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey. Next, it signs the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey using the encryption machine's signature private key hsmSignPriKey, obtaining the signed data encryption key and authentication key, denoted as clientSign. The encryption machine signature private key hsmSignPriKey is the public-private key pair used for signing and verifying the data returned by the encryption machine to the client. The encryption machine signature public key hsmSignPubKey is pre-stored on the client. The corresponding encryption machine signature private key hsmSignPriKey is stored in the encryption machine.

[0071] In step S150, the authentication feedback information of the first client is decrypted using the first client's private key to obtain a data encryption key and an authentication key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

[0072] In this embodiment, the first client, using the first client private key clientPriKey1 generated in step S110, decrypts the encrypted data encryption key encMasterKey and authentication key encUserAuthKey in the authentication feedback information of the first client based on the RSA algorithm to obtain the corresponding data encryption key masterKey and authentication key userAuthKey. The data encryption key masterKey and authentication key userAuthKey are stored in the first client's security chip to ensure they cannot be stolen by malicious programs on the client. The data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication. Using the data encryption key and authentication key, the first client can perform secure end-to-end data transmission with other clients in the trust circle.

[0073] In an exemplary embodiment, the first client can also perform signature verification on the signed data encryption key and authentication key clientSign based on the pre-saved encryption machine signature public key hsmSignPubKey. After the signature verification is successful, the above-mentioned decryption process is then performed.

[0074] This disclosure, during the client authentication process, not only sets a data encryption key for end-to-end data encryption and decryption within the client's trust circle, but also sets an authentication key for client authentication. This authentication process is simple and requires no complex encryption protocols. Simultaneously, it avoids the problem of synchronizing the client's public key across multiple devices, simplifies the implementation of the synchronization mechanism, and improves system efficiency and security.

[0075] Figure 2 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 1 . Figure 10 This is an interactive diagram illustrating a second client authentication process according to an exemplary embodiment of this disclosure. The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminal devices, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer or a computer cluster consisting of multiple computers.

[0076] like Figure 2 , 10 As shown, in some embodiments, the authentication method for the second client of this disclosure includes:

[0077] In step S210, a second client public key and a second client private key corresponding to the second client are generated.

[0078] In this embodiment of the disclosure, when there are no pre-authenticated clients in the trust circle, i.e., when the second client is the first registered and authenticated client, the second client can perform client authentication using the authentication method provided in this embodiment of the disclosure. Similar to the aforementioned step S110, the second client generates a set of public-private key pairs, including: a second client public key clientPubKey2 and a second client private key clientPriKey2. It should be noted that the public-private key pairs are generated independently by each client, and the public-private key pairs of the first client and the second client do not necessarily use the same public-private key pairs.

[0079] In an exemplary embodiment, the second client may also request a temporary random number (nonce) from the server. Its function is similar to that of step S110 described above, and will not be repeated here.

[0080] In step S220, an authentication request from the second client is sent to the encryption machine; the authentication request from the second client includes at least the second device key and the second client public key.

[0081] In this embodiment, similar to step S130 described above, the second client sends its authentication request to the encryption machine. The difference lies in that the authentication request from the second client includes at least: a second device key and a second client public key (clientPubKey2). Since this second client is the first client to register and authenticate, it does not include verification code information from already authenticated clients.

[0082] In an exemplary embodiment, the authentication request of the second client can be generated through the following process.

[0083] The second authentication information is generated based on the hash values ​​of the second device information, authentication verification information, the second device key, and the second client public key; the second device information corresponds to the second client.

[0084] The second authentication information is encrypted using the client's public key of the encryption machine to obtain the encrypted second authentication information;

[0085] Based on the encrypted second authentication information and the second client public key, an authentication request for the second client is generated.

[0086] In this embodiment, the second client obtains the second device information, authentication verification information, the hash value of the second device key and the second client public key, respectively. The related concepts are similar to those in step S130 described above and will not be repeated here.

[0087] The second client concatenates the second device information, authentication verification information, second device key, and hash value of the second client public key obtained above to generate the second authentication information clientTicket2.

[0088] The second authentication information clientTicket2 is encrypted using the encryption machine client public key hsmClientPubKey to obtain the encrypted second authentication information encClientTicket2.

[0089] Based on the encrypted second authentication information encClientTicket2 and the second client public key clientPubKey2, an authentication request for the second client is generated to package the second authentication information encClientTicket2 and the second client public key clientPubKey2 and upload them to the encryption machine.

[0090] It should be noted that the information contained in the second authentication information encClientTicket2 can be adjusted according to the actual application needs. As long as the authentication request of the second client includes at least the second device key and the second client public key, it should be considered as being within the protection scope of this disclosure.

[0091] In step S230, in response to the successful authentication of the second client's authentication request, the authentication feedback information of the second client returned by the encryption machine is received.

[0092] In this embodiment, the encryption machine performs relevant authentication verification based on the authentication request from the second client to confirm whether the authentication request from the second client is successful. When the encryption machine determines that the authentication request from the second client is successful, it returns authentication feedback information to the second client. This authentication verification can be based on the authentication verification information to prevent replay attacks; alternatively, it can be based on the hash value of the second client's public key to ensure that the public key is not tampered with.

[0093] In this embodiment of the disclosure, in response to the successful authentication request from the second client, the encryption machine randomly generates a data encryption key masterKey and an authentication key userAuthKey. Based on the second client's public key clientPubKey2 in the authentication request, the encryption machine encrypts the data encryption key masterKey and the authentication key userAuthKey respectively, obtaining the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey. Then, the encryption machine signs the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey using its private key hsmSignPriKey, obtaining the signed data encryption key and authentication key, denoted as clientSign.

[0094] In step S240, the authentication feedback information of the second client is decrypted using the second client's private key to obtain the data encryption key and the authentication key.

[0095] In this embodiment, the second client, using the second client private key clientPriKey2 generated in step S210, decrypts the encrypted data encryption key encMasterKey and authentication key encUserAuthKey in the authentication feedback information of the second client based on the RSA algorithm, to obtain the corresponding data encryption key masterKey and authentication key userAuthKey. The data encryption key masterKey and authentication key userAuthKey are stored in the second client's security chip to ensure they cannot be stolen by malicious programs on the client. These data encryption keys and authentication keys are used for secure end-to-end data transmission between the second client and related clients within the trust circle after the second client's registration and authentication.

[0096] In an exemplary embodiment, the second client can also perform signature verification on the signed data encryption key and authentication key clientSign based on the pre-saved encryption machine signature public key hsmSignPubKey. After the signature verification passes, the aforementioned decryption process is then performed.

[0097] Figure 3 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 2 .like Figure 3 As shown, in some embodiments, the authentication method for the second client of this disclosure includes:

[0098] In step S310, a second client public key and a second client private key corresponding to the second client are generated.

[0099] In this embodiment of the disclosure, when there is no pre-authenticated client in the trust circle, that is, when the second client is the first registered and authenticated client, the second client can perform client authentication through the authentication method provided in this embodiment of the disclosure. Similar to the aforementioned step S210, the second client generates a set of public and private key pairs, including: a second client public key clientPubKey2 and a second client private key clientPriKey2.

[0100] In an exemplary embodiment, the second client may also request a temporary random number (nonce) from the server. Its function is similar to that of step S210 described above, and will not be repeated here.

[0101] In step S320, the data encryption key and the authentication key are generated.

[0102] In this embodiment of the disclosure, as described above Figure 2Unlike the embodiment shown, the data encryption key masterKey and authentication key userAuthKey are not generated by the encryption machine, but are randomly generated by the second client during the second client's registration and authentication.

[0103] In step S330, an authentication request from the second client is sent to the encryption machine; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key.

[0104] In this embodiment of the disclosure, similar to the aforementioned step S220, the second client sends its authentication request to the encryption machine. The difference lies in that, in addition to the second device key and the second client public key clientPubKey2, the authentication request of the second client also includes the data encryption key masterKey and the authentication key userAuthKey.

[0105] In an exemplary embodiment, the authentication request of the second client can be generated through the following process.

[0106] The second authentication information is generated based on the second device information, authentication verification information, second device key, data encryption key, authentication key, and hash value of the second client public key; the second device information corresponds to the second client.

[0107] The second authentication information is encrypted using the client's public key of the encryption machine to obtain the encrypted second authentication information;

[0108] Based on the encrypted second authentication information and the second client public key, an authentication request for the second client is generated.

[0109] In this embodiment, the generation process of the authentication request for the second client is similar to the aforementioned step S220, except that the generated data encryption key masterKey and authentication key userAuthKey are added to the second authentication information. Other parts similar to the aforementioned step S220 will not be repeated here.

[0110] In step S340, in response to the successful authentication of the second client's authentication request, the encryption machine returns authentication success information for the second client.

[0111] In this embodiment, the encryption machine performs relevant authentication verification based on the authentication request from the second client to confirm whether the authentication request from the second client is successful. When the encryption machine determines that the authentication request from the second client is successful, it returns authentication success information to the second client. This authentication verification can be based on the authentication verification information to prevent replay attacks; alternatively, it can be based on the hash value of the second client's public key to ensure that the public key is not tampered with.

[0112] The difference from step S230 above is that, in response to the successful authentication request from the second client, the encryption machine saves the data encryption key masterKey and the authentication key userAuthKey uploaded in the authentication request. The authentication success information returned by the encryption machine is only used to indicate that the authentication request has passed; it does not need to include the encrypted data encryption key and authentication key.

[0113] In step S350, the data encryption key and authentication key are saved based on the authentication success information.

[0114] In this embodiment, the second client stores the data encryption key masterKey and the authentication key userAuthKey in its security chip based on the successful authentication information to ensure they are not stolen by malicious programs on the client. These data encryption key and authentication key are then used for secure end-to-end data transmission between the second client and other clients within the trust circle after the second client's registration and authentication.

[0115] This disclosure provides an authentication process for a client to create a trust circle. During this authentication process, the data encryption key and authentication key can be randomly generated by an encryption device, or they can be randomly generated by an initially registered second client. By setting these data encryption and authentication keys, the information that the trust circle needs to store is simplified; only the client's device key, data encryption key, and authentication key need to be stored, without needing to store the client's public key information. This avoids the security issues associated with synchronizing the public key of a new device across devices within the trust circle.

[0116] Figure 4 This is a flowchart of a client authentication method according to an exemplary embodiment of the present disclosure. Figure 2 . Figure 9 This is an interactive diagram illustrating a first client authentication process according to an exemplary embodiment of this disclosure. The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminal devices, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer cluster consisting of one or more computers.

[0117] like Figure 4 , 9 As shown, in some embodiments, the client authentication method of this disclosure includes:

[0118] In step S410, an authentication request from a first client is received; the authentication request from the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to the second client; the second client is an authenticated client.

[0119] In this embodiment of the disclosure, the user possesses an authenticated client (second client) and needs to authenticate an unauthenticated client (first client) to join the trusted circle of the authenticated client, thereby enabling secure data synchronization between devices. The client authentication method provided in this embodiment can be applied to encryption machines.

[0120] In this embodiment of the disclosure, the encryption device receives an authentication request from a first client. This authentication request can be sent from the first client to the encryption device as described in step S130 above. The first client's authentication request includes at least: a first device key, verification code information, and a first client public key clientPubKey1. The first device key is the device key corresponding to the first client (unauthenticated client). The verification code information is the verification code corresponding to the second client (authenticated client).

[0121] In an exemplary embodiment, the device key is a key used to identify the client device. Different client devices within the same trust circle can have different device keys. The device key can be a device unlock key, which is a key set by the user to unlock the device, such as an unlock password. The device key can also be a device recovery key, which is a string of characters randomly generated by a program on the device and used to recover the device.

[0122] In an exemplary embodiment, unlike the client's device key, the verification code information is a temporarily valid verification method, and the verification code information is randomly generated. This verification code information can be generated by the second client and synchronized to the encryption device for subsequent authentication, or it can be generated by the encryption device or the server and sent to the second client. Depending on the method of generating the verification code information, it can also be cached in the encryption device in different ways. This disclosure does not limit the specific method by which the encryption device obtains the verification code information.

[0123] In an exemplary embodiment, a validity period can be set for the verification code information. The verification code information becomes invalid upon the expiration of the validity period. For example, the validity period is five minutes.

[0124] In an exemplary embodiment, the authentication request of the first client may further include: first device information, authentication verification information, and a hash value of the first client public key. The first device information refers to information representing the first client device, such as user ID and device information. The authentication verification information is information used for authentication verification, such as the aforementioned temporary random number (nonce). The hash value of the first client public key is a hash value obtained by hashing the first client public key clientPubKey1. This hash value can be used to verify the first client public key clientPubKey1 to ensure that the public key has not been tampered with.

[0125] In step S420, the second master key information and the verification code information corresponding to the second client are obtained; the second master key information includes at least: the second device key, the data encryption key and the authentication key.

[0126] In this embodiment, on one hand, the encryption device obtains the second master key information encMasterTicket2 corresponding to the second client. The second master key information encMasterTicket2 includes at least: a second device key, a data encryption key masterKey, and an authentication key userAuthKey. On the other hand, depending on the method used to generate the verification code information, the encryption device can also pre-cache the verification code information in different ways.

[0127] In an exemplary embodiment, the second master key information encMasterTicket2 is pre-stored in the encryption device. The encryption device obtains the corresponding second master key information encMasterTicket2 based on the verification code information. Through the second master key information encMasterTicket2, the second device key, the data encryption key masterKey, and the authentication key userAuthKey are obtained.

[0128] In an exemplary embodiment, the second master key information, encMasterTicket2, is pre-stored on the server. The encryption machine obtains the corresponding second master key information, encMasterTicket2, from the server based on the verification code information. The encryption machine decrypts the second master key information, encMasterTicket2, using the encryption machine service private key, hsmServerPriKey, and obtains the second device key, data encryption key, masterKey, and authentication key, userAuthKey, from it. The encryption machine service private key, hsmServerPriKey, is a public-private key pair used for encrypting and decrypting data stored on the server by the encryption machine. The encryption machine service public key, hsmServerPubKey, is pre-stored on the server. The corresponding encryption machine service private key, hsmServerPriKey, is stored in the encryption machine.

[0129] In an exemplary embodiment, the verification code information is generated by a second client. The encryption machine obtains the verification code information directly or indirectly from the second client through a pre-set communication method for subsequent authentication.

[0130] In an exemplary embodiment, the verification code information is generated by an encryption machine or a server. The encryption machine temporarily stores the verification code information upon generation for subsequent authentication.

[0131] In step S430, in response to the fact that the verification code information in the authentication request of the first client is consistent with the obtained verification code information, the authentication request of the first client is successfully authenticated.

[0132] In this embodiment of the disclosure, if the verification code information in the authentication request is consistent with the obtained verification code information, the authentication request of the first client is successfully authenticated, the first client can be added to the trust circle, and the data encryption key masterKey and authentication key userAuthKey of the trust circle are sent to it.

[0133] In an exemplary embodiment, the encrypted first authentication information encClientTicket1 in the authentication request is decrypted using the encryption machine client private key hsmClientPriKey to obtain the first authentication information clientTicket1. After successful authentication verification, the verification code information is obtained from the first authentication information clientTicket1.

[0134] In step S440, based on the first device key, data encryption key, and authentication key, a first master key information corresponding to the first client is generated and saved.

[0135] In this embodiment of the disclosure, in response to the successful authentication of the first client's authentication request, the encryption machine generates and saves first master key information corresponding to the first client based on the first device key, data encryption key, and authentication key. This first master key information can be stored in the encryption machine or on the server. By saving the first master key information corresponding to the first client, the first client is added to the trust circle.

[0136] In an exemplary embodiment, the encryption machine generates first key information MasterTicket1 based on the first device key, and the data encryption key masterKey and authentication key userAuthKey obtained from the second master key information encMasterTicket2. The encryption machine then encrypts the first key information MasterTicket1 using the encryption machine service public key hsmServerPubKey based on the RSA algorithm to obtain the first master key information encMasterTicket1.

[0137] In an exemplary embodiment, in addition to the first device key, the data encryption key masterKey, and the authentication key userAuthKey, the encryption machine can also add the first device information to the first key information MasterTicket1. Then, based on the first key information MasterTicket1, it encrypts the first master key information encMasterTicket1 using the encryption machine service public key hsmServerPubKey.

[0138] In step S450, authentication feedback information is sent to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client's public key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

[0139] In this embodiment of the disclosure, in response to the successful authentication request from the first client, the encryption device sends authentication feedback information to the first client. This authentication feedback information includes at least: a data encryption key `masterKey` encrypted using the first client's public key `clientPubKey1` and an authentication key `userAuthKey`. The data encryption key `masterKey` is distributed to the security chip of each client device for end-to-end data encryption and decryption. The authentication key `userAuthKey`, along with the data encryption key `masterKey`, is distributed to the security chip of each client device for client authentication. The data encryption key `masterKey` and the authentication key `userAuthKey` are shared by all client devices within the trust circle; only devices that have successfully joined the trust circle through authentication can receive both the data encryption key `masterKey` and the authentication key `userAuthKey`.

[0140] In an exemplary embodiment, the data encryption key masterKey and the authentication key userAuthKey can be generated by the encryption machine or by the client device that was initially registered.

[0141] In an exemplary embodiment, after the encryption machine's authentication request is successfully authenticated, it first obtains the data encryption key masterKey and the authentication key userAuthKey corresponding to the second client. Then, based on the first client public key clientPubKey1 in the authentication request, it encrypts the data encryption key masterKey and the authentication key userAuthKey respectively, obtaining the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey. Finally, it signs the encrypted data encryption key encMasterKey and the authentication key encUserAuthKey using the encryption machine's private signing key hsmSignPriKey, obtaining the signed data encryption key and authentication key, denoted as clientSign.

[0142] This disclosure, during the client authentication process, not only sets a data encryption key for end-to-end data encryption and decryption within the client's trust circle, but also sets an authentication key for client authentication. This authentication process is simple and requires no complex encryption protocols. Simultaneously, it avoids the problem of synchronizing the client's public key across multiple devices, simplifies the implementation of the synchronization mechanism, and improves system efficiency and security.

[0143] Figure 5 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 3 . Figure 10This is an interactive diagram illustrating a second client authentication process according to an exemplary embodiment of this disclosure. The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminal devices, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer or a computer cluster consisting of multiple computers.

[0144] like Figure 5 , 10 As shown, in some embodiments, the authentication method for the second client of this disclosure includes:

[0145] In step S510, an authentication request from a second client is received; the authentication request from the second client includes at least the second device key and the second client public key.

[0146] In this embodiment of the disclosure, when there are no pre-authenticated clients in the trust circle, i.e., the second client is the first registered and authenticated client, the encryption machine can authenticate the second client using the authentication method provided in this embodiment. Similar to step S410 above, the encryption machine receives the authentication request from the second client. The difference lies in that the authentication request from the second client includes at least: a second device key and a second client public key clientPubKey2. Since the second client is the first registered and authenticated client, it does not include the verification code information of already authenticated clients. The second client public key clientPubKey2 is used to generate a public-private key pair for the second client. It should be noted that this public-private key pair is generated independently for each client, and the public-private key pair of the first client and the public-private key pair of the second client do not necessarily use the same public-private key pair.

[0147] In an exemplary embodiment, the authentication request of the second client may further include: second device information, authentication verification information, and a hash value of the second client's public key. The second device information refers to information representing the second client device, such as user ID and device information. The authentication verification information is information used for authentication verification, such as the aforementioned temporary random number (nonce). The hash value of the second client's public key is a hash value obtained by hashing the second client's public key clientPubKey2. This hash value can be used to verify the second client's public key clientPubKey2 to ensure that the public key has not been tampered with.

[0148] In step S520, in response to the successful authentication of the second client's authentication request, the data encryption key and the authentication key are generated.

[0149] In this embodiment of the disclosure, the encryption machine performs relevant authentication verification based on the authentication request from the second client to confirm whether the authentication request from the second client has passed. This authentication verification can be based on the authentication verification information to prevent replay attacks, or it can be based on the hash value of the second client's public key to ensure that the public key is not tampered with.

[0150] In this embodiment of the disclosure, in response to the successful authentication request from the second client, the encryption machine randomly generates a data encryption key masterKey and an authentication key userAuthKey. These data encryption key masterKey and authentication key userAuthKey serve as the shared data encryption key masterKey and authentication key userAuthKey among all clients within the trust circle.

[0151] In step S530, based on the second device key, data encryption key, and authentication key, a second master key information corresponding to the second client is generated and saved.

[0152] In this embodiment, similar to step S440 above, in response to the successful authentication of the second client's authentication request, the encryption machine generates and saves second master key information corresponding to the second client based on the second device key, data encryption key, and authentication key. This second master key information can be stored in the encryption machine or on the server. By saving the second master key information corresponding to the second client, a trust circle is established for the second client. The process of generating the relevant second master key information is similar to the process of generating the first master key information in step S440 above, and will not be described again here.

[0153] In step S540, authentication feedback information is sent to the second client; the authentication feedback information includes at least: the data encryption key and authentication key encrypted with the second client's public key.

[0154] In this embodiment, similar to step S450 above, in response to the successful authentication of the second client's authentication request, the encryption device sends authentication feedback information to the second client. This authentication feedback information includes at least: the data encryption key masterKey encrypted using the second client's public key clientPubKey2 and the authentication key userAuthKey. The process for generating the authentication feedback information for the second client is similar to the process for generating the authentication feedback information for the first client in step S450 above, and will not be described further here.

[0155] Figure 6 This is a flowchart of an authentication method for a second client according to an exemplary embodiment of this disclosure. Figure 4 .like Figure 6As shown, in some embodiments, the authentication method for the second client of this disclosure includes:

[0156] In step S610, an authentication request from a second client is received; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key.

[0157] In this embodiment of the disclosure, when there is no pre-authenticated client in the trust circle, that is, when the second client is the first registered and authenticated client, the encryption machine can perform client authentication for the second client through the authentication method provided in this embodiment of the disclosure.

[0158] As mentioned above Figure 5 Unlike the embodiment shown, the data encryption key masterKey and authentication key userAuthKey are not generated by the encryption machine, but are randomly generated by the second client during the second client's registration and authentication.

[0159] Based on this, the authentication request of the second client includes at least: a second device key, a data encryption key masterKey, an authentication key userAuthKey, and a second client public key clientPubKey2. Since this second client is the first client to register and authenticate, it does not include the device key of already authenticated clients. The second client public key clientPubKey2 is the public key used to generate a public-private key pair for the second client.

[0160] In an exemplary embodiment, the authentication request of the second client may further include: second device information, authentication verification information, and the hash value of the second client's public key.

[0161] In step S620, in response to the successful authentication of the second client's authentication request, a second master key information corresponding to the second client is generated and saved based on the second device key, data encryption key, and authentication key.

[0162] In this embodiment of the disclosure, the encryption machine performs relevant authentication verification based on the authentication request from the second client to confirm whether the authentication request from the second client has passed. This authentication verification can be based on the authentication verification information to prevent replay attacks, or it can be based on the hash value of the second client's public key to ensure that the public key is not tampered with.

[0163] In this embodiment of the disclosure, similar to step S530 described above, in response to the successful authentication of the second client's authentication request, the encryption machine generates and saves second master key information corresponding to the second client based on the second device key, data encryption key, and authentication key. This second master key information can be stored in the encryption machine or on the server.

[0164] In step S630, an authentication success message is sent to the second client.

[0165] In this embodiment of the disclosure, the encryption machine performs relevant authentication verification based on the authentication request from the second client to confirm whether the authentication request from the second client is successful. When the encryption machine determines that the authentication request from the second client is successful, it returns authentication success information to the second client.

[0166] The difference from step S540 above is that, in response to the successful authentication request from the second client, the encryption machine saves the data encryption key masterKey and the authentication key userAuthKey uploaded in the authentication request. The authentication success information returned by the encryption machine is only used to indicate that the authentication request has passed; it does not need to include the encrypted data encryption key and authentication key.

[0167] This disclosure provides an authentication process for a client to create a trust circle. During this authentication process, the data encryption key and authentication key can be randomly generated by an encryption device, or they can be randomly generated by an initially registered second client. By setting these data encryption and authentication keys, the information that the trust circle needs to store is simplified; only the client's device key, data encryption key, and authentication key need to be stored, without needing to store the client's public key information. This avoids the security issues associated with synchronizing the public key of a new device across devices within the trust circle.

[0168] Figure 7 This is a flowchart of a verification code information acquisition method according to an exemplary embodiment of the present disclosure. Figure 1 . Figure 11 This is an interactive diagram illustrating the verification code information acquisition process according to an exemplary embodiment of this disclosure. The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminal devices, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer or a computer cluster consisting of multiple computers.

[0169] like Figure 7 , 11 As shown, in some embodiments, the aforementioned step S420 of this disclosure example may include:

[0170] In step S710, the verification code upload information uploaded by the second client is received; the verification code upload information includes at least: verification code information encrypted with the authentication key; the verification code information is generated by the second client.

[0171] In this embodiment, the verification code information is generated by a second client and uploaded to the encryption machine by the second client. This verification code upload information includes at least: verification code information encrypted using the authentication key userAuthKey and the AES_GCM encryption algorithm.

[0172] In an exemplary embodiment, the second client generates the verification code information in response to a verification code request sent by the first client.

[0173] In an exemplary embodiment, the verification code upload information can be uploaded directly from the second client to the encryption machine, or it can be uploaded to the server for temporary storage first, and then the encryption machine can retrieve the temporarily stored verification code upload information from the server in response to the authentication request of the first client.

[0174] In an exemplary embodiment, the second client may also request a temporary random number (nonce) from the server. Its function is similar to that of step S110 described above, and will not be repeated here.

[0175] In an exemplary embodiment, the second client can concatenate the second device information, authentication verification information, and verification code information to generate concatenated verification code information captchaTicket. Using the authentication key userAuthKey and based on the AES_GCM encryption algorithm, the concatenated verification code information captchaTicket is encrypted to obtain the encrypted verification code information encCaptchaTicket. Based on the encrypted verification code information encCaptchaTicket, the verification code upload information is generated.

[0176] In step S720, the second master key information corresponding to the second client is obtained.

[0177] In this embodiment of the disclosure, the encryption machine obtains the second master key information corresponding to the second client, as described in step S420 above.

[0178] In step S730, the encrypted verification code information is decrypted using the authentication key in the second master key information to obtain the verification code information.

[0179] In this embodiment, the encryption device obtains the second device key, the data encryption key masterKey, and the authentication key userAuthKey through the second master key information encMasterTicket2. It then decrypts the encrypted verification code information encCaptchaTicket using the authentication key userAuthKey to obtain the concatenated verification code information captchaTicket. After successful authentication, the verification code information is retrieved from the concatenated verification code information captchaTicket.

[0180] Figure 8 This is a flowchart of a verification code information acquisition method according to an exemplary embodiment of the present disclosure. Figure 2 The method of this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminals, and may also include server-side components such as local servers and cloud servers, which can be deployed in a computer or a computer cluster consisting of multiple computers.

[0181] like Figure 8 As shown, in some embodiments, the aforementioned step S420 of this disclosure example may include:

[0182] In step S810, a verification code request sent by the second client is received.

[0183] In this embodiment of the disclosure, the encryption device or server receives a verification code request sent by the second client. This verification code request is used to request the encryption device to generate and distribute verification code information.

[0184] In step S820, the verification code information is generated in response to the verification code request sent by the second client.

[0185] In this embodiment of the disclosure, in response to the verification code request, the encryption machine randomly generates the verification code information and temporarily stores the verification code information in the encryption machine or on the server.

[0186] In step S830, a verification code delivery message is sent to the second client; the verification code delivery message includes at least: verification code information encrypted with the authentication key.

[0187] In this embodiment of the disclosure, in response to the verification code request, the encryption device sends verification code distribution information to the second client. This verification code distribution information includes at least: verification code information encrypted with the authentication key. The process of encrypting the verification code information with the authentication key to obtain the encrypted verification code information is similar to the aforementioned step S710 and will not be described further here.

[0188] This disclosure provides a method for obtaining verification code information. This verification code information can be generated by a second client, an encryption machine, or a server. Verifying the first client using temporarily randomly generated verification code information can improve the security of the authentication process.

[0189] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0190] Figure 12 This is a frame of a client authentication device illustrated according to an exemplary embodiment of the present disclosure. Figure 1 The device in this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminals. It can also include server-side components such as local servers and cloud servers, which can be deployed in a computer cluster consisting of one or more computers.

[0191] like Figure 12 As shown, the client authentication device 1200 may include: a public-private key pair generation unit 1210, a verification code acquisition unit 1220, an authentication request sending unit 1230, an authentication feedback information receiving unit 1240, and a key acquisition unit 1250.

[0192] The public-private key pair generation unit 1210 is used to generate a first client public key and a first client private key corresponding to the first client.

[0193] The verification code acquisition unit 1220 is used to acquire verification code information corresponding to the second client; the second client is an authenticated client;

[0194] The authentication request sending unit 1230 is used to send the authentication request of the first client to the encryption machine; the authentication request of the first client includes at least: a first device key, the verification code information and a first client public key; the first device key is a device key corresponding to the first client;

[0195] The authentication feedback information receiving unit 1240 is used to receive the authentication feedback information of the first client returned by the encryption machine in response to the successful authentication of the first client's authentication request based on the second device key.

[0196] The key acquisition unit 1250 is used to decrypt the authentication feedback information of the first client using the first client's private key to obtain a data encryption key and an authentication key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

[0197] In some exemplary embodiments of this disclosure, the authentication request sending unit 1230 is further configured to generate first authentication information based on first device information, authentication verification information, first device key, verification code information, and the hash value of the first client public key; the first device information corresponds to the first client; the first authentication information is encrypted using the encryption machine client public key to obtain encrypted first authentication information; and an authentication request for the first client is generated based on the encrypted first authentication information and the first client public key.

[0198] In some exemplary embodiments of this disclosure, the authentication request sending unit 1230 is further configured to perform slow hashing, salting, and / or SRP algorithm processing on the first device key and the verification code information.

[0199] In some exemplary embodiments of this disclosure, the client authentication device 1200 is further configured to generate a second client public key and a second client private key corresponding to the second client; send an authentication request of the second client to the encryption machine; the authentication request of the second client includes at least: the second device key and the second client public key; in response to the successful authentication of the second client's authentication request, receive authentication feedback information of the second client returned by the encryption machine; and decrypt the authentication feedback information of the second client using the second client private key to obtain the data encryption key and the authentication key.

[0200] In some exemplary embodiments of this disclosure, the client authentication device 1200 is further configured to generate a second client public key and a second client private key corresponding to the second client; generate the data encryption key and the authentication key; send an authentication request from the second client to the encryption machine; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key; in response to successful authentication of the second client's authentication request, receive authentication success information from the encryption machine; and save the data encryption key and the authentication key based on the authentication success information.

[0201] Figure 13 This is a frame of a client authentication device illustrated according to an exemplary embodiment of the present disclosure. Figure 2 The device in this embodiment can be applied to electronic devices, including smart speakers, smartphones, and smart tablet terminals. It can also include server-side components such as local servers and cloud servers, which can be deployed in a computer cluster consisting of one or more computers.

[0202] like Figure 13As shown, the client authentication device 1300 may include: an authentication request receiving unit 1310, a verification code information acquisition unit 1320, an authentication confirmation unit 1330, a first master key information generation unit 1340, and an authentication feedback information sending unit 1350.

[0203] The authentication request receiving unit 1310 is configured to receive an authentication request from a first client; the authentication request from the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to a second client; the second client is an authenticated client;

[0204] The verification code information acquisition unit 1320 is used to acquire the second master key information corresponding to the second client and the verification code information; the second master key information includes at least: the second device key, the data encryption key and the authentication key;

[0205] The authentication confirmation unit 1330 is used to respond that the verification code information in the authentication request of the first client is consistent with the obtained verification code information, and the authentication request of the first client is successfully authenticated.

[0206] The first master key information generation unit 1340 is used to generate and save the first master key information corresponding to the first client based on the first device key, the data encryption key and the authentication key.

[0207] The authentication feedback information sending unit 1350 is used to send authentication feedback information to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client's public key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

[0208] In some exemplary embodiments of this disclosure, the first master key information generation unit 1340 is further configured to generate first key information based on first device information, first device key, data encryption key and authentication key; the first device information corresponds to the first client; and the first key information is encrypted using the encryption machine service public key to obtain the first master key information.

[0209] In some exemplary embodiments of this disclosure, the client authentication device 1300 is further configured to receive an authentication request from a second client; the authentication request from the second client includes at least: the second device key and the second client public key; in response to successful authentication of the second client's authentication request, the data encryption key and the authentication key are generated; based on the second device key, the data encryption key, and the authentication key, a second master key information corresponding to the second client is generated and stored; authentication feedback information is sent to the second client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the second client public key.

[0210] In some exemplary embodiments of this disclosure, the client authentication device 1300 is further configured to receive an authentication request from a second client; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key; in response to successful authentication of the second client's authentication request, a second master key information corresponding to the second client is generated and stored based on the second device key, the data encryption key, and the authentication key; and authentication success information is sent to the second client.

[0211] In some exemplary embodiments of this disclosure, the verification code information acquisition unit 1320 is further configured to receive verification code upload information uploaded by the second client; the verification code upload information includes at least: verification code information encrypted with the authentication key; the verification code information is generated by the second client; obtaining second master key information corresponding to the second client; and decrypting the encrypted verification code information with the authentication key in the second master key information to obtain the verification code information.

[0212] In some exemplary embodiments of this disclosure, the verification code information acquisition unit 1320 is further configured to receive a verification code request sent by the second client; generate the verification code information in response to the verification code request sent by the second client; and send verification code delivery information to the second client; the verification code delivery information includes at least: verification code information encrypted with the authentication key.

[0213] In some exemplary embodiments of this disclosure, the verification code information is configured with a valid time; in response to the expiration of the valid time, the verification code information becomes invalid.

[0214] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0215] Figure 14This is a block diagram illustrating an electronic device according to an exemplary embodiment of the present disclosure. For example, device 1400 may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness device, personal digital assistant, etc.

[0216] Reference Figure 14 The device 1400 may include one or more of the following components: a processing component 1402, a memory 1404, a power supply component 1406, a multimedia component 1408, an audio component 1410, an input / output (I / O) interface 1412, a sensor component 1414, and a communication component 1416.

[0217] Processing component 1402 typically controls the overall operation of device 1400, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 1402 may include one or more processors 1420 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 1402 may include one or more modules to facilitate interaction between processing component 1402 and other components. For example, processing component 1402 may include a multimedia module to facilitate interaction between multimedia component 1408 and processing component 1402.

[0218] Memory 1404 is configured to store various types of data to support the operation of device 1400. Examples of this data include instructions for any application or method operating on device 1400, contact data, phonebook data, messages, pictures, videos, etc. Memory 1404 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0219] Power supply assembly 1406 provides power to various components of device 1400. Power supply assembly 1406 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to device 1400.

[0220] Multimedia component 1408 includes a screen that provides an output interface between the device 1400 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 1408 includes a front-facing camera and / or a rear-facing camera. When the device 1400 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0221] Audio component 1410 is configured to output and / or input audio signals. For example, audio component 1410 includes a microphone (MIC) configured to receive external audio signals when device 1400 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 1404 or transmitted via communication component 1416. In some embodiments, audio component 1410 also includes a speaker for outputting audio signals.

[0222] I / O interface 1412 provides an interface between processing component 1402 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0223] Sensor assembly 1414 includes one or more sensors for providing status assessments of various aspects of device 1400. For example, sensor assembly 1414 may detect the on / off state of device 1400, the relative positioning of components such as the display and keypad of device 1400, changes in the position of device 1400 or a component of device 1400, the presence or absence of user contact with device 1400, the orientation or acceleration / deceleration of device 1400, and temperature changes of device 1400. Sensor assembly 1414 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 1414 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 1414 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0224] Communication component 1416 is configured to facilitate wired or wireless communication between device 1400 and other devices. Device 1400 can access wireless networks based on communication standards, such as WiFi, 3G, 4G, 5G, other communication standards, or combinations thereof. In some embodiments of this disclosure, communication component 1416 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In some embodiments of this disclosure, communication component 1416 further includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0225] In some embodiments of this disclosure, the apparatus 1400 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0226] In some embodiments of this disclosure, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1404 including instructions, which can be executed by a processor 1420 of the device 1400 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0227] In some embodiments of this disclosure, a non-transitory computer-readable storage medium, when instructions in the storage medium are executed by a processor of a mobile terminal, enables the mobile terminal to perform a client authentication method.

[0228] In some embodiments of this disclosure, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement a client authentication method.

[0229] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the following claims.

[0230] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A client authentication method characterized by, The method includes: Generate a first client public key and a first client private key corresponding to the first client; Obtain the verification code information corresponding to the second client; the second client is an authenticated client; The authentication request of the first client is sent to the encryption device; the authentication request of the first client includes at least: a first device key, the verification code information, and a first client public key; the first device key is the device key corresponding to the first client; In response to the successful authentication of the first client's authentication request based on the verification code information, the system receives the authentication feedback information of the first client returned by the encryption machine. The authentication feedback information of the first client is decrypted using the first client's private key to obtain a data encryption key and an authentication key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

2. The method according to claim 1, characterized in that, Sending the authentication request from the first client to the encryption machine further includes: First authentication information is generated based on the first device information, authentication verification information, the first device key, the verification code information, and the hash value of the first client public key; the first device information corresponds to the first client. The first authentication information is encrypted using the encryption machine client's public key to obtain the encrypted first authentication information; Based on the encrypted first authentication information and the first client public key, an authentication request for the first client is generated.

3. The method according to claim 2, characterized in that, The step of generating first authentication information based on the first device information, authentication verification information, the first device key, the verification code information, and the hash value of the first client public key further includes: The first device key and the verification code information are processed using slow hashing, salting, and / or SRP algorithms.

4. The method according to claim 1, characterized in that, The authentication method for the second client includes: Generate a second client public key and a second client private key corresponding to the second client; Send the authentication request of the second client to the encryption machine; the authentication request of the second client includes at least: the second device key and the second client public key; In response to the successful authentication of the second client's authentication request, the system receives the authentication feedback information of the second client returned by the encryption machine. The authentication feedback information of the second client is decrypted using the second client's private key to obtain the data encryption key and the authentication key.

5. The method according to claim 1, characterized in that, The authentication method for the second client includes: Generate a second client public key and a second client private key corresponding to the second client; Generate the data encryption key and the authentication key; Send the authentication request of the second client to the encryption machine; the authentication request of the second client includes at least: the second device key, the data encryption key, the authentication key and the second client public key; In response to the successful authentication of the second client's authentication request, the encryption machine returns a successful authentication message for the second client. Based on the successful authentication information, save the data encryption key and authentication key.

6. A client authentication method, characterized in that, The method includes: The system receives an authentication request from a first client; the authentication request from the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to the second client; the second client is an authenticated client. Obtain the second master key information and the verification code information corresponding to the second client; the second master key information includes at least: the second device key, the data encryption key, and the authentication key; If the verification code information in the authentication request of the first client is consistent with the obtained verification code information, the authentication request of the first client is successful. Based on the first device key, data encryption key, and authentication key, generate and save the first master key information corresponding to the first client; Send authentication feedback information to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client's public key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

7. The method according to claim 6, characterized in that, The step of generating and saving the first master key information corresponding to the first client based on the first device key, data encryption key, and authentication key includes: First key information is generated based on first device information, first device key, data encryption key, and authentication key; the first device information corresponds to the first client. The first key information is obtained by encrypting the first key information using the public key of the encryption machine service.

8. The method according to claim 6, characterized in that, The authentication method for the second client includes: Receive an authentication request from a second client; the authentication request from the second client includes at least: the second device key and the second client public key; Upon successful authentication of the second client's authentication request, the data encryption key and the authentication key are generated; Based on the second device key, data encryption key, and authentication key, generate and save the second master key information corresponding to the second client; Send authentication feedback information to the second client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the second client's public key.

9. The method according to claim 6, characterized in that, The authentication method for the second client includes: Receive an authentication request from a second client; the authentication request from the second client includes at least: the second device key, the data encryption key, the authentication key, and the second client public key; In response to the successful authentication of the second client's authentication request, a second master key information corresponding to the second client is generated and saved based on the second device key, data encryption key, and authentication key; Send authentication success information to the second client.

10. The method according to claim 6, characterized in that, The step of obtaining the second master key information corresponding to the second client and the verification code information includes: The system receives verification code upload information uploaded by the second client; the verification code upload information includes at least: verification code information encrypted with the authentication key; the verification code information is generated by the second client. Obtain the second master key information corresponding to the second client; The encrypted verification code information is decrypted using the authentication key in the second master key information to obtain the verification code information.

11. The method according to claim 6, characterized in that, The method further includes: Receive the verification code request sent by the second client; In response to the verification code request sent by the second client, the verification code information is generated; Send verification code delivery information to the second client; the verification code delivery information includes at least: verification code information encrypted with the authentication key.

12. The method according to claim 6, characterized in that, The verification code information is set with a corresponding validity period; In response to the expiration of the validity period, the verification code information is invalidated.

13. A client authentication device, characterized in that, include: A public-private key pair generation unit is used to generate a first client public key and a first client private key corresponding to the first client. The verification code acquisition unit is used to acquire the verification code information corresponding to the second client; The second client is an authenticated client; An authentication request sending unit is used to send the authentication request of the first client to the encryption machine; The authentication request of the first client includes at least: a first device key, the verification code information, and a first client public key; the first device key is a device key corresponding to the first client; The authentication feedback information receiving unit is used to receive the authentication feedback information of the first client returned by the encryption machine in response to the successful authentication of the first client's authentication request based on the verification code information. The key acquisition unit is used to decrypt the authentication feedback information of the first client using the first client's private key to obtain a data encryption key and an authentication key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

14. A client authentication device, characterized in that, include: An authentication request receiving unit is used to receive authentication requests from the first client. The authentication request of the first client includes at least: a first device key, verification code information, and a first client public key; the first device key is a device key corresponding to the first client; the verification code information is a verification code corresponding to the second client; and the second client is an authenticated client. The verification code information acquisition unit is used to acquire the second master key information corresponding to the second client and the verification code information; the second master key information includes at least: the second device key, the data encryption key and the authentication key; The authentication confirmation unit is used to respond that if the verification code information in the authentication request of the first client is consistent with the obtained verification code information, the authentication request of the first client is successfully authenticated. The first master key information generation unit is used to generate and save the first master key information corresponding to the first client based on the first device key, the data encryption key and the authentication key; An authentication feedback information sending unit is used to send authentication feedback information to the first client; the authentication feedback information includes at least: the data encryption key and the authentication key encrypted with the first client's public key; the data encryption key is used for end-to-end data encryption and decryption; the authentication key is used for client authentication.

15. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to implement the client authentication method according to any one of claims 1 to 12.

16. A non-transitory computer-readable storage medium, wherein when instructions in the storage medium are executed by a processor of a mobile terminal, the mobile terminal is enabled to perform the client authentication method of any one of claims 1 to 12.

17. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the client authentication method as described in any one of claims 1 to 12.

Images