Identity binding and authentication method, system, device and medium for wireless communication device

Abstract

The application discloses a kind of identity binding and authentication method, system, device and medium of wireless communication equipment.The method is executed by the production equipment of production wireless communication equipment, specifically includes: reading the hardware unique identification of wireless communication equipment, and generating equipment identity digest according to hardware unique identification;Generate device public-private key pair, and generate certificate signing request file containing equipment identity digest, device attribute information and device public key;Certificate signing request file is sent to public key infrastructure system;Receive the device certificate and intermediate certificate that public key infrastructure system issues for wireless communication equipment, and write device certificate and intermediate certificate into the secure storage area of wireless communication equipment.The present application realizes the strong binding of digital certificate and equipment hardware unique identification, effectively prevents that device certificate is copied and cloned to other equipment after.

Description

Technical Field

[0001] This invention relates to the field of wireless communication security technology, and in particular to a method, system, device, and medium for identity binding and authentication of wireless communication devices. Background Technology

[0002] As the intelligence level of equipment such as photovoltaic inverters, energy storage systems, and industrial gateways continues to increase, these devices need to achieve functions such as local operation and maintenance, remote monitoring, and cloud platform access through wireless communication. Wireless communication devices (such as USB WiFi modules, Bluetooth modules, and ZigBee modules) are widely used in these industrial devices due to their low cost, flexible deployment, and convenient maintenance.

[0003] Currently, most wireless communication devices on the market adopt a plug-and-play model. The host device only identifies the device through the vendor ID (VID), product ID (PID), or driver loading status, and cannot verify whether the connected module is a legitimate production device. When attackers counterfeit USB wireless communication modules, tamper with firmware, or replace internal identity information, the host cannot distinguish between the original legitimate device and the cloned counterfeit device, and may still identify it as a legitimate device, resulting in security issues such as unauthorized device access, data leakage, or even system attacks. Especially in the new energy industry, devices such as inverters and energy storage controllers are often deployed in unattended outdoor environments, and wireless communication devices are at risk of being disassembled, replaced, or cloned. Summary of the Invention

[0004] This invention provides a method, system, device, and medium for identity binding and authentication of wireless communication devices, in order to solve the technical problem that the identity information of traditional wireless communication devices is easily copied and transferred, resulting in unauthorized access to devices, data leakage, or even system attacks.

[0005] In a first aspect, embodiments of this application provide an identity binding method for a wireless communication device, executed by a production device that manufactures the wireless communication device, the method comprising: Read the hardware unique identifier of the wireless communication device, and generate a device identity digest of the wireless communication device based on the hardware unique identifier; Generate a device public-private key pair for the wireless communication device and generate a certificate signing request file; wherein the certificate signing request file contains at least the device identity digest, device attribute information, and the device public key in the device public-private key pair; Send the certificate signing request file to the public key infrastructure system; Receive the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device, and write the device certificate and intermediate certificate into the secure storage area of ​​the wireless communication device.

[0006] Secondly, embodiments of this application provide an authentication method for wireless communication devices, executed by a master control device pre-configured with the root certificate of a public key infrastructure system, the method comprising: In response to the access of a wireless communication device, read the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device; Using a pre-installed root certificate, verify whether the certificate trust chain consisting of the device certificate and the intermediate certificate is complete; In response to the certificate trust chain verification result being complete, the hardware unique identifier of the wireless communication device is read, and the current identity digest of the wireless communication device is calculated based on the hardware unique identifier; Extract the device identity digest from the device certificate and compare whether the current identity digest is consistent with the device identity digest; Based on the comparison results, determine whether to establish a communication connection with the wireless communication device.

[0007] Thirdly, embodiments of this application provide an identity binding system for a wireless communication device, comprising: a wireless communication device, production equipment for producing the wireless communication device, and a public key infrastructure system; The production equipment includes: The identity information reading module is used to read the hardware unique identifier of the wireless communication device and generate a device identity digest of the wireless communication device based on the hardware unique identifier. A certificate request generation module is used to generate a device public-private key pair for the wireless communication device, generate a certificate signing request file, and send the certificate signing request file to a public key infrastructure system; wherein, the certificate signing request file contains at least the device identity digest, device attribute information, and the device public key in the device public-private key pair; The public key infrastructure system is used to verify the certificate signing request file and, upon successful verification, to issue a device certificate and an intermediate certificate for the wireless communication device. The production equipment further includes a certificate writing module, used to receive the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device, and write the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device.

[0008] Thirdly, embodiments of this application provide an identity authentication system for wireless communication devices, including: a master control device for the wireless communication device and a root certificate of a pre-installed public key infrastructure system; wherein, the master control device includes: The certificate reading module is used to read the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device in response to the access of the wireless communication device; the certificate chain verification module is used to verify whether the certificate trust chain formed by the device certificate and the intermediate certificate is complete using a preset root certificate. The current identity digest calculation module is used to read the hardware unique identifier of the wireless communication device and calculate the current identity digest of the wireless communication device based on the hardware unique identifier in response to the verification result of the certificate trust chain being complete. The first comparison module is used to extract the device identity digest from the device certificate and compare whether the current identity digest is consistent with the device identity digest; The first communication establishment module is used to determine whether to establish a communication connection with the wireless communication device based on the comparison result.

[0009] Fifthly, embodiments of this application provide a production apparatus, the production apparatus comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the identity binding method of the wireless communication device according to any embodiment of the present invention.

[0010] Sixthly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute and implement the identity binding method or the identity authentication method of a wireless communication device according to any embodiment of the present invention.

[0011] The technical solution of this application embodiment reads the hardware unique identifier of the wireless communication device and generates a device identity digest during the production stage. This device identity digest is then written into a certificate signing request file as binding information for the device identity credential. The PKI system issues a device digital certificate containing the device identity digest, and the device digital certificate and intermediate digital certificate chain are written into the secure storage area of ​​the wireless communication device. This establishes an irreplaceable association between the digital certificate and the device's hardware unique identifier, solving the technical problem that traditional wireless communication device identity information is easily copied and ported, leading to unauthorized device access, data leakage, and even system attacks. It achieves a strong binding between the digital certificate and the device's hardware unique identifier, effectively preventing the device certificate from being copied and cloned to other devices. Simultaneously, during the authentication stage, the master control device verifies the integrity of the certificate trust chain before opening network capabilities. It then compares the identity digest calculated from the current hardware unique identifier with the identity digest bound in the certificate. Only after both verifications are successful is a communication connection allowed. This solves the technical problem in existing technologies where the host cannot determine whether the device has been tampered with, achieving mandatory closed-loop identity authentication for external wireless communication modules and avoiding the security risk of unauthenticated network access.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart illustrating an identity binding method for a wireless communication device provided in Embodiment 1 of this application; Figure 2 A flowchart illustrating an authentication method for a wireless communication device provided in Embodiment 1 of this application; Figure 3 This is a schematic diagram of the structure of an identity binding system for a wireless communication device provided in Embodiment 3 of this application; Figure 4 This is a schematic diagram of the structure of an identity authentication system for a wireless communication device provided in Embodiment 4 of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device that implements the identity binding method or the identity authentication method of a wireless communication device according to the embodiments of this application. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] Currently, the authentication of wireless communication devices, taking USB WiFi as an example, mainly faces the following three problems: (1) Lack of hardware identity binding mechanism.

[0018] Existing solutions typically rely solely on the USB device's VID / PID identification, software configuration files, or fixed passwords and pre-shared keys for authentication. However, this information can be easily copied or forged and cannot be strongly linked to the device hardware itself, making it difficult to guarantee the authenticity and uniqueness of the accessed device.

[0019] (2) Decoupling digital certificates from device hardware.

[0020] While some solutions introduce digital certificates for identity authentication, these certificates essentially only represent logical identities and are not bound to specific hardware. Once an attacker copies and burns the certificate of a legitimate device to other devices, the host side will be unable to distinguish between the original legitimate device and the cloned forged device, thus failing to achieve true device-level identity authentication.

[0021] (3) The host cannot detect whether the device has been tampered with.

[0022] Even after an attacker modifies the device's internal configuration parameters, firmware, or identity information, the device can still complete USB enumeration and driver loading normally, and the host will not detect any abnormalities. In this case, the host may still establish a communication connection with the tampered device, thus posing a serious security risk.

[0023] In summary, the current authentication mechanisms for wireless communication devices have significant shortcomings in terms of hardware binding, certificate anti-cloning, and tamper detection, and there is an urgent need to introduce more reliable security enhancement measures.

[0024] To address the aforementioned issues, this application elevates external wireless communication devices from ordinary pluggable peripherals to controlled components with trusted digital identities. Through PKI identity initialization during the production line phase and mandatory identity authentication during device operation, a closed-loop process of "credential trust, hardware binding, and controlled permissions" is achieved.

[0025] Example 1 Figure 1 This is a flowchart illustrating a method for binding the identity of a wireless communication device according to Embodiment 1 of this application. This embodiment is applicable to situations where identity credentials are bound to wireless communication devices during the production line stage. This method can be executed by production equipment within the identity binding system of the wireless communication device. This production equipment can be production line tooling, a programmer, or automated production equipment used to produce the wireless communication device. Figure 1 As shown, the method includes: S110. Read the hardware unique identifier of the wireless communication device and generate a device identity digest of the wireless communication device based on the hardware unique identifier.

[0026] The hardware unique identifier (HUI) is a unique, immutable, or extremely difficult-to-tamper-with identification information embedded in the hardware of a wireless communication device at the time of manufacture. It is used to uniquely identify the wireless communication device globally. The device identity digest is a digital summary value of the HUI, possessing irreversibility and uniqueness. This means that the original HUI cannot be derived from the digest value, and the probability of conflict between digest values ​​calculated from different HUIs is extremely low. The device identity digest is used to subsequently bind certificates to the hardware device, ensuring that the certificate cannot be ported to other hardware devices.

[0027] In this step, the production equipment establishes a communication connection with the wireless communication device being produced, for example, through a communication interface such as a USB interface, JTAG interface, SWD interface, or serial port. The production equipment reads the hardware unique identifier of the wireless communication device. A preset hash algorithm (such as SHA-256, SHA-384, SM3, or other cryptographic hash algorithms) is used to calculate the hardware unique identifier, generating a fixed-length device identity digest.

[0028] As an optional implementation of this step, the hardware unique identifier includes one or a combination of at least two of the following: hardware address, chip unique identifier, and dynamic one-time password serial number.

[0029] Among these, the hardware address is the unique identifier of the network interface controller within the network, such as a Media Access Control (MAC) address. The Unique Identification Number (UID) is a unique serial number programmed into the chip by the chip manufacturer during chip production. The One-Time Programmable (OTP) serial number is a unique number stored in a one-time programmable memory.

[0030] When using two or more combinations, multiple unique hardware identifiers can be concatenated in a predetermined order before digest calculation to further enhance the uniqueness and security of the device identity digest. This combination of multiple unique hardware identifiers effectively prevents identity forgery risks caused by the tampering or duplication of a single identifier.

[0031] S120. Generate a public-private key pair for the wireless communication device and generate a certificate signing request file; wherein the certificate signing request file contains at least a device identity digest, device attribute information, and the device public key from the device public-private key pair.

[0032] The device public-private key pair includes a device private key and a device public key. The device private key is securely stored by the wireless communication device and is not disclosed to external parties. The device public key is used for encrypted verification and certificate issuance. The public-private key pair can be generated using asymmetric encryption algorithms such as RSA, ECC, or SM2. The Certificate Signing Request (CSR) is a standard format file used to apply for a certificate from a certificate authority, containing the applicant's identity information and public key information. Device attribute information describes the device's inherent attributes such as type, model, production batch, production date, production capacity level, and network communication capability parameters, enabling the certificate authority to determine the certificate's scope of use and authorization level based on these attributes when issuing the certificate.

[0033] In this step, the production equipment generates a device public / private key pair locally on the wireless communication device or assists the wireless communication device in generating such a pair. Then, a certificate signing request file is generated, which contains at least the following: the device identity digest of the wireless communication device generated in step S110, the device attribute information of the wireless communication device, and the device public key from the generated device public / private key pair.

[0034] This step introduces a device identity digest into the certificate signing request file, so that the subsequently issued certificates naturally carry identity information bound to the unique identifier of the hardware, thus achieving a strong association between the certificate and the hardware.

[0035] S130. Send the certificate signing request file to the public key infrastructure system.

[0036] Public Key Infrastructure (PKI) is a security system used to manage certificates, encryption keys, and identity authentication. It includes components such as Certificate Authorities (CAs), Registration Authorities (RAs), and certificate storage and distribution systems.

[0037] A device certificate is a digital proof file containing the device's public key and device identity information, signed by the private key of the root certificate or intermediate certificate. An intermediate certificate is a certificate issued by the root certificate and acts as an intermediary between the protected root certificate and the publicly released device certificate. It is used to establish a trust transfer path from the root certificate to the device certificate, enabling the final holder of the device certificate to verify their identity by tracing back to the root certificate.

[0038] In this step, the production equipment sends the certificate signing request file generated in step S120 to the Public Key Infrastructure (PKI) system via a secure communication channel. Upon receiving the certificate signing request file, the PKI system first verifies it, including but not limited to: whether the certificate signing request file format is correct, whether the signature is valid, whether the device attribute information is complete, and whether the device identity digest conforms to the predetermined format. The PKI system can further verify whether the device type and model in the device attribute information match the production order, and whether the hardware unique identifier corresponding to the device identity digest is within the permitted production range. After successful verification, the PKI system uses its private key to issue device certificates and intermediate certificates for the wireless communication equipment.

[0039] In this embodiment, device certificates and intermediate certificates issued by the Public Key Infrastructure (PKI) for wireless communication devices can be incorporated into the unified management of the PKI system. During subsequent operation and maintenance, the PKI system supports certificate update, rotation, and revocation operations. When verifying certificates, the master device can check the real-time status of the certificate through the Online Certificate Status Protocol (OCSP) or the Certificate Revocation List (CRL). The PKI system also records operation logs throughout the entire certificate lifecycle, providing audit evidence for on-site maintenance, anomaly tracking, and security policy upgrades.

[0040] S140. Receive the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device, and write the device certificate and intermediate certificate into the secure storage area of ​​the wireless communication device.

[0041] In this context, a secure storage area refers to a storage area within a wireless communication device that has access protection mechanisms, ensuring that data in this area cannot be read or modified by external devices without authorization. A secure storage area can be a secure element (SE) within the device, a secure storage area within a trusted execution environment (TEE), or a non-volatile memory with read / write protection mechanisms (such as one-time programmable (OTP) memory, or a flash memory partition protected by secure access control).

[0042] In this step, the production equipment receives the device certificate and intermediate certificate returned by the Public Key Infrastructure (PKI) system, and then writes them to the secure storage area of ​​the wireless communication device. At this point, the wireless communication device has completed the production line identity initialization and possesses a trusted identity based on PKI.

[0043] This step writes the device certificate and intermediate certificate to a secure storage area, which prevents the certificate data from being illegally read, copied, or tampered with, ensuring the integrity and confidentiality of the device identity credentials during subsequent use.

[0044] As an optional implementation of this step, writing the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device includes: writing the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device using segmented storage and structured indexing.

[0045] Specifically, considering that the storage resources of wireless communication devices may be limited, making it difficult to store complete certificate and certificate chain data at once, this implementation divides the device certificate and intermediate certificate into multiple data segments according to a predetermined size. These segments are stored in different physical locations or different storage pages within the secure storage area. A structured index table is also established to record the storage location, length, and order information of each data segment. During certificate retrieval, the data segments are read sequentially through the structured index table and reassembled into complete certificate data.

[0046] The segmented storage provided in this embodiment can effectively utilize the fragmented storage space of the secure storage area, improving the utilization rate of storage resources; the structured index can ensure the accuracy and integrity of certificate data reading. Furthermore, segmented storage increases the difficulty for attackers to steal complete certificate data, further enhancing security.

[0047] As an optional implementation of this application, the method further includes: Symmetric encryption is performed on the device identity digest and the device attribute information of the wireless communication device to obtain the device identity information ciphertext. The encrypted device identity information is written into the secure storage area of ​​the wireless communication device for authentication of the wireless communication device before the resource-constrained master control device establishes a communication connection with the wireless communication device.

[0048] Specifically, for some resource-constrained master control devices (such as low-cost MCU microcontrollers), their processing power, memory resources, or storage space are limited, which may prevent them from supporting complete PKI certificate parsing and verification operations. To adapt to such resource-constrained scenarios, this implementation generates an additional lightweight authentication data during the production stage: the production equipment uses a symmetric encryption algorithm (such as AES-128, AES-256, SM4, and other national cryptographic symmetric encryption algorithms) to encrypt the device identity digest and device attribute information, generating ciphertext of the device identity information, and uses a symmetric key shared with the master control device for encryption protection. This symmetric key can be jointly negotiated and determined by the production equipment and the master control device during production line initialization, or it can be a key derived from the unique identifier of the master control device. The encrypted ciphertext of the device identity information is written to the secure storage area of ​​the wireless communication device. In the subsequent authentication stage, the resource-constrained master control device does not need to perform complete certificate parsing and verification. Without exposing the specific key and algorithm details, it only needs to read the ciphertext of the device identity information, decrypt it using the shared symmetric key to obtain the device identity digest, and then compare it with the digest calculated from the current hardware unique identifier to complete the authentication.

[0049] For example, symmetric encryption of the device identity digest and device attribute information of a wireless communication device can be achieved by concatenating or combining the device identity digest and device attribute information according to a predetermined format to form plaintext to be encrypted, and then encrypting the plaintext using a symmetric encryption algorithm to obtain the ciphertext of the identity information. The key suitable for symmetric encryption can be determined in one of the following ways: for example, during the production initialization phase, a symmetric key is jointly negotiated and determined by the production equipment and the master control equipment, and this key is pre-installed in the production equipment and each master control equipment during production. Alternatively, a symmetric key can be generated using the unique identifier of the wireless communication device or master control equipment (such as the device serial number, master control equipment ID, etc.) combined with a key derivation function (KDF).

[0050] This implementation method significantly reduces the authentication overhead of the main control device while ensuring security, enabling the solution of this invention to be adapted to a wide range of application scenarios, from high-performance processors to low-end MCUs.

[0051] The technical solution of this application embodiment involves reading the unique hardware identifier of a wireless communication device through production equipment and generating a device identity digest based on the unique hardware identifier; generating a public-private key pair for the wireless communication device and generating a certificate signing request file; wherein the certificate signing request file at least includes the device identity digest, device attribute information, and the device public key from the device public-private key pair; sending the certificate signing request file to a public key infrastructure system; receiving the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device; and writing the device certificate and intermediate certificate into the secure storage area of ​​the wireless communication device. By reading the immutable unique hardware identifier of the wireless communication device during the production stage and generating a device identity digest, and then including this digest as a mandatory field in the certificate signing request file, a strong cryptographic association is established between the device certificate ultimately issued by the PKI system and the specific hardware physical entity. Since the issuance of the device certificate depends on the certificate signing request containing the hardware digest, and the certificate is stored in a secure area after being written, even if an attacker obtains the device certificate of a legitimate device, the certificate cannot pass subsequent identity verification on a cloned device due to the lack of a corresponding unique hardware identifier. This mechanism addresses the shortcomings of existing technologies, such as the decoupling of device certificates from device hardware and their easy copying and portability, by fundamentally resolving the issue of device certificates being decoupled from device hardware and thus enabling trusted identity binding at the device level.

[0052] In addition, this application embodiment utilizes the standardized certificate chain mechanism (device certificate and intermediate certificate) of the PKI system to give wireless communication devices a trusted digital identity that conforms to international / domestic security standards. This not only enhances the device's own anti-counterfeiting capabilities, but also provides a standard and scalable credential basis for mutual trust authentication with the main control device in subsequent actual operation, significantly reducing the risk of data leakage and system intrusion caused by device identity forgery.

[0053] Example 2 Figure 2 This is a flowchart of an identity authentication method for a wireless communication device provided in Embodiment 2 of the present invention. The method in this embodiment can be executed by a master control device in the identity authentication system of the wireless communication device. The master control device has a pre-installed root certificate of the Public Key Infrastructure (PKI) system. The master control device can be a photovoltaic inverter, energy storage controller, industrial gateway, or IoT host device, etc., that needs to access the wireless communication device. The relationship between this embodiment and Embodiment 1 is as follows: Embodiment 1 describes the process of identity binding of the wireless communication device during the production stage, while this embodiment describes the process of identity authentication when the bound wireless communication device connects to the master control device in actual use scenarios. The two embodiments cooperate to form a complete closed-loop process of production line binding and operational authentication.

[0054] like Figure 2 As shown, the method includes: S210, In response to access by a wireless communication device, read the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device.

[0055] In this embodiment, the wireless communication device has been pre-written with the device certificate, intermediate certificate and device identity digest in the secure storage area by the identity binding method described in Embodiment 1 before leaving the factory.

[0056] In this step, the master control device continuously monitors its communication interface (e.g., USB interface) for any new wireless communication devices connecting. Upon detecting a new wireless communication device, the master control device establishes a basic communication connection with it and then initiates a read request to the device's secure storage area to obtain the pre-stored device certificate and intermediate certificate for subsequent authentication. To ensure the integrity and tamper-proofing of the certificate data, the master control device can perform format verification and signature verification preprocessing on the certificate data after reading.

[0057] S220. Using the pre-installed root certificate, verify whether the certificate trust chain consisting of the device certificate and intermediate certificates is complete.

[0058] In this step, the master device establishes a communication connection with the Public Key Infrastructure (PKI) system and pre-configures the PKI root certificate (i.e., the root CA certificate in the PKI system). This root certificate serves as a trust anchor, representing the certificate issuing source trusted by the master device. The master device uses this root certificate to perform certificate trust chain verification on the device certificate and intermediate certificates read in step S210. The certificate trust chain verification process is as follows: starting with the device certificate, it verifies level by level whether the signature of each certificate was issued by the private key of its parent certificate, until tracing back to the root certificate.

[0059] Specifically, the master control device first verifies the validity of the device certificate signature using the public key of the intermediate certificate; then it verifies the validity of the intermediate certificate signature using the public key of the root certificate; finally, it confirms that the root certificate itself is trustworthy. During the verification process, the master control device also checks whether the validity period of each certificate is within the valid time frame, whether the certificate status has been revoked, and whether the certificate's purpose extension field is allowed for device authentication. If all the above verifications pass, the certificate trust chain is considered complete; if any level of verification fails (including invalid certificate signature, expired certificate, revoked certificate, mismatched certificate purpose, etc.), the certificate trust chain is considered incomplete.

[0060] S230. In response to the certificate trust chain verification result being complete, read the hardware unique identifier of the wireless communication device and calculate the current identity digest of the wireless communication device based on the hardware unique identifier.

[0061] It should be noted that the unique hardware identifier in this step is the same physical identifier as the unique hardware identifier read by the production equipment in step S110 of Embodiment 1.

[0062] In this step, when the certificate trust chain verification result shows that the certificate trust chain is complete, the master control device continues to perform hardware identity binding verification. After reading the hardware unique identifier, the master control device calculates the hardware unique identifier using the same preset digest algorithm (e.g., SHA-256, SHA-384, SM3, etc.) as in Example 1 to obtain the current identity digest. This current identity digest represents the real-time hardware identity information of the currently accessed wireless communication device. If the hardware of the wireless communication device has not been replaced or tampered with after production line binding, the currently calculated identity digest should be consistent with the device identity digest generated during production line binding; if the wireless communication device has been cloned or tampered with (e.g., the hardware board has been replaced but the original device's certificate has been copied), the currently calculated identity digest will be inconsistent with the device identity digest bound in the certificate, and thus can be identified by the master control device.

[0063] As one specific execution method for this step, the master device can read the hardware unique identifier from the registers or dedicated storage area of ​​the wireless communication device by sending a read command. For different types of hardware unique identifiers, the master device may need to read them through different read interfaces or commands. For example, the MAC address can be obtained by reading the network interface controller register, and the chip UID can be obtained by reading a read-only register at a specific address.

[0064] S240. Extract the device identity digest from the device certificate and compare the current identity digest with the device identity digest to see if they are consistent.

[0065] In this embodiment, the device identity digest is the identity binding information generated in step S110 of Embodiment 1 and written into the certificate signing request file in step S120, which is included in the device certificate by the public key infrastructure system when issuing the certificate.

[0066] In this step, the master control device parses the device certificate read in step S210 and extracts the device identity digest from specific extended fields or custom fields of the device certificate. The master control device compares the current identity digest calculated in step S230 with the device identity digest extracted from the device certificate byte by byte to determine whether they are completely consistent. If they are completely consistent, it means that the hardware identity of the currently accessed wireless communication device matches the hardware identity bound to the certificate, and the device has not been replaced or cloned; if they are inconsistent, it means that the hardware identity of the currently accessed wireless communication device does not match the hardware identity bound to the certificate, and the device may have been cloned, replaced, or tampered with.

[0067] S250. Determine whether to establish a communication connection with the wireless communication device based on the comparison results.

[0068] In this step, the master control device decides whether to establish a communication connection with the wireless communication device based on the comparison results. If the comparison results are consistent, it means that the wireless communication device has passed the dual verification of certificate trust chain verification and hardware identity binding verification, and its identity is trustworthy. The master control device allows the establishment of a communication connection with the wireless communication device and opens its network communication capabilities. If the comparison results are inconsistent, it means that the wireless communication device has failed the identity verification, and the master control device refuses to establish a communication connection with the wireless communication device and does not open its network communication capabilities.

[0069] Through a dual verification mechanism, only wireless communication devices that have been legally manufactured, bound, and have not been tampered with can access the main control device and use network communication functions, effectively ensuring system security.

[0070] As an optional implementation of this step, determining whether to establish a communication connection with the wireless communication device based on the comparison result includes: refusing to establish a communication connection with the wireless communication device in response to the comparison result being inconsistent; and controlling the wireless communication device to enter a communication mode and establishing a communication connection with the wireless communication device in the communication mode in response to the comparison result being consistent.

[0071] Specifically, when the comparison results are consistent, the master control device sends a mode switching command to the wireless communication device, controlling the wireless communication device to switch from the current authentication mode to the communication mode. In the communication mode, the network communication function of the wireless communication device is enabled, and it can perform normal network communication operations such as WiFi connection and data transmission and reception; in the authentication mode, the wireless communication device only responds to authentication-related commands and does not enable the network communication function.

[0072] By separating the identity authentication mode and the communication mode, a security mechanism of authentication before network connection is achieved. Even if the wireless communication device is intercepted by an attacker during the identity authentication process, no network communication credentials or business data will be leaked.

[0073] As a further refinement of the above implementation method, the wireless communication device is provided with management firmware and network communication firmware; after power-on, the wireless communication device runs the management firmware and enters the authentication mode.

[0074] Specifically, the management firmware is a dedicated piece of firmware code within the wireless communication device, responsible for management functions such as authentication, security management, certificate updates, and firmware upgrades. The network communication firmware is another dedicated piece of firmware code, responsible for network communication functions such as WiFi connection establishment, network protocol stack operation, and data transmission and reception. Internally, these two firmware sets can be two independent firmware images stored in different storage areas, or two functional modules within the same firmware image, switched between using a state machine. Upon power-on, the wireless communication device runs the management firmware by default. At this time, the device only opens communication interfaces related to authentication (such as certificate reading and status query interfaces), does not load the network communication firmware, and does not enable WiFi radio frequency and network protocol stack, thus physically preventing unauthorized network access.

[0075] Accordingly, controlling the wireless communication device to enter the communication mode includes: sending a communication mode switching instruction to the management firmware of the wireless communication device, wherein the communication mode switching instruction is used to instruct the management firmware to start the network communication firmware so that the wireless communication device enters the communication mode.

[0076] Specifically, after confirming successful authentication, the master control device sends a communication mode switching command to the management firmware of the wireless communication device. Upon receiving the switching command, the management firmware performs an internal state switch, loads and starts the network communication firmware, enabling the wireless communication device to enter communication mode. Through this dual-firmware architecture and mode switching mechanism, strictly controlled access is achieved, enhancing the overall security of the system.

[0077] In this embodiment, a master control device with a pre-installed root certificate of the public key infrastructure system responds to access by reading the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device. Using the pre-installed root certificate, it verifies the integrity of the certificate trust chain formed by the device certificate and intermediate certificate. If the verification result of the certificate trust chain is complete, it reads the unique hardware identifier of the wireless communication device and calculates the current identity digest of the wireless communication device based on the unique hardware identifier. It extracts the device identity digest from the device certificate and compares the current identity digest with the device identity digest. Based on the comparison result, it determines whether to establish a communication connection with the wireless communication device. During the device access phase, a dual mandatory verification logic of trusted certificate trust chain verification and hardware entity binding verification is constructed. The pre-installed root certificate is used to verify the integrity of the device certificate and intermediate chain, ensuring that the credentials held by the access device are valid credentials issued by a legitimate PKI system. Furthermore, it forcibly reads the real-time hardware identifier of the current access device and calculates its digest, comparing it with the original digest bound in the certificate. The dual matching mechanism of logical credentials and physical entities ensures that even if an attacker copies the certificate and firmware from a legitimate device to another piece of hardware, the cloned device's unique hardware identifier will differ from the original device's, resulting in a mismatch between the calculated current digest and the binding digest in the certificate. The master control device will then directly refuse communication. This mechanism precisely addresses the pain point in existing technologies where the host cannot determine whether a device has been tampered with or cloned. It effectively prevents hardware replacement attacks and firmware tampering attacks, ensuring that only modules certified by the original manufacturer and whose hardware has not been illegally replaced can obtain network communication permissions. This safeguards the security of the master control device, which is particularly significant for the edge access side of critical infrastructure such as new energy power plants and energy storage systems.

[0078] Furthermore, the dual-mode decoupled control of management firmware and network communication firmware introduced in this embodiment ensures that after the device powers on, it preferentially remains in management mode, responding only to authentication commands. Network services are only enabled after the master control device completes all verifications and switches via commands. This design physically and logically eliminates the possibility of the device communicating via the network without identity verification, placing security defenses at the forefront and achieving true zero-trust access control.

[0079] As an optional implementation of this application, the method further includes: When the main control device has limited resources, the encrypted identity information stored in the secure storage area of ​​the wireless communication device is read; the encrypted identity information is decrypted to obtain the device identity digest; Read the hardware unique identifier of the wireless communication device, calculate the current identity digest of the wireless communication device based on the hardware unique identifier, and compare whether the current identity digest is consistent with the device identity digest; Based on the comparison results, determine whether to establish a communication connection with the wireless communication device.

[0080] This implementation is primarily designed for resource-constrained master control device scenarios. Some master control devices (such as low-cost MCU microcontrollers) may lack sufficient computing power, memory space, or storage space to perform complete PKI operations such as certificate parsing, certificate trust chain verification, and certificate revocation checks. To adapt to such scenarios, this implementation provides a lightweight identity authentication method.

[0081] In this method, the master control device does not perform the certificate reading and certificate trust chain verification steps S210 to S220. Instead, it directly reads the pre-stored encrypted identity information in the secure storage area of ​​the wireless communication device. This encrypted identity information is the encrypted data written by the production device in the optional implementation of Embodiment 1, and its content consists of a symmetrically encrypted device identity digest and device attribute information. The master control device uses the symmetric key shared with the production device to decrypt the encrypted identity information, obtain the device identity digest, then reads the hardware unique identifier of the wireless communication device and calculates the current identity digest, compares the two, and allows or denies the establishment of a communication connection based on the comparison result.

[0082] It should be understood that the step of determining whether to establish a communication connection with the wireless communication device based on the comparison result in this embodiment is the same as step S250 in this embodiment, and will not be described again in this embodiment.

[0083] This implementation method eliminates the need for certificate parsing and asymmetric cryptographic operations, requiring only symmetric decryption and digest calculation. It features low computational overhead and minimal memory usage, enabling efficient operation on resource-constrained master control devices while still maintaining hardware identity binding verification to prevent device replacement or cloning. Optionally, after successful lightweight verification, the master control device can also assign appropriate network access levels to the wireless communication device based on its device type and capability level as defined in its device attribute information.

[0084] As an optional implementation of this invention, in response to the incomplete verification result of the certificate trust chain or the inconsistent authentication result, the master control device further performs at least one of the following operations: recording a security event log, issuing a security alarm, or placing the wireless communication device in a restricted working mode.

[0085] Specifically, when certificate trust chain verification fails (e.g., invalid certificate signature, expired certificate, revoked certificate, etc.) or identity binding verification fails (the current identity digest does not match the identity digest bound to the certificate), it indicates that the currently accessing wireless communication device poses a security risk, potentially being a cloned, tampered, or unauthorized device. While refusing to establish a communication connection, the master control device can also perform a series of security response operations to enhance the system's security defense capabilities: Record security event logs: The main control device writes relevant information about failure events (including but not limited to failure time, failure type, device identification information, access port information, etc.) to the local log storage area or remote security audit server for subsequent security auditing, anomaly tracing and attack source analysis.

[0086] Issuing security alerts: The main control device issues security alerts to operation and maintenance personnel through audible and visual alarms, network alarm message push, email notification, SMS notification, or reporting alarm events to the cloud platform, indicating that suspicious devices have accessed the network, so that operation and maintenance personnel can conduct on-site investigation and emergency response in a timely manner.

[0087] The wireless communication device is placed in a restricted operating mode: the main control device allows the wireless communication device to maintain basic electrical connectivity, but places it in a restricted operating mode. In this mode, the main control device supplies power to the wireless communication device, but all data communication interfaces are disabled or current-limited. The radio frequency function of the wireless communication device is forcibly shut down, allowing it only to respond to basic status query commands and preventing any network communication. This restricted operating mode serves two purposes: firstly, it isolates suspicious devices to prevent them from posing further security threats; secondly, it facilitates on-site diagnosis and analysis by maintenance personnel.

[0088] Through the above-described security response operations, this implementation method can not only refuse access when an abnormal device is detected, but also record security events, issue alarms, and isolate devices, forming a complete security defense closed loop and further improving the security and maintainability of the system.

[0089] Example 3 Figure 3 This is a schematic diagram of the structure of an identity binding system for a wireless communication device provided in Embodiment 3 of this application. Figure 3 As shown, the system includes: a wireless communication device 10, a production equipment 20 for producing the wireless communication device 10, and a public key infrastructure system 30; The production equipment 20 includes: The identity information reading module is used to read the hardware unique identifier of the wireless communication device 10 and generate a device identity digest of the wireless communication device 10 based on the hardware unique identifier. A certificate request generation module is used to generate a device public-private key pair for the wireless communication device 10, generate a certificate signing request file, and send the certificate signing request file to the public key infrastructure system 30; wherein, the certificate signing request file includes at least the device identity digest, device attribute information, and the device public key in the device public-private key pair; The public key infrastructure system 30 is used to verify the certificate signing request file, and after the verification is successful, to issue the device certificate and intermediate certificate of the wireless communication device 10. The production equipment 20 further includes a certificate writing module, used to receive the device certificate and intermediate certificate issued by the public key infrastructure system 30, and write the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device 10.

[0090] This embodiment organically integrates wireless communication devices, production equipment, and public key infrastructure systems into a collaborative identity binding system, constructing an automated, batch-implementable, trusted initialization closed loop for the production line. In this system, production equipment acts as an execution agent, wireless communication devices as identity carriers, and the public key infrastructure system as a root of trust. The three parties collaborate to achieve full-process automation from hardware feature acquisition, key pair generation, certificate request submission to secure writing.

[0091] Compared to existing production line initialization methods that rely on manual configuration or simple password writing, this system utilizes the automatic verification and issuance capabilities of the public key infrastructure system to ensure that every wireless communication module leaving the factory has a unique and irrefutable digital identity. Since the entire process requires no manual intervention in the generation and writing of sensitive keys and certificate data, it effectively avoids the risks of key leakage and malicious tampering of identity information during the production line process.

[0092] Optionally, the certificate writing module is specifically used for: The device certificate and the intermediate certificate are written into the secure storage area of ​​the wireless communication device 10 using segmented storage and structured indexing.

[0093] Optionally, the production equipment 20 further includes: The ciphertext generation module is used to perform symmetric encryption on the device identity digest and the device attribute information of the wireless communication device 10 to obtain the device identity information ciphertext. The encrypted writing module is used to write the encrypted device identity information into the secure storage area of ​​the wireless communication device 10, and to authenticate the wireless communication device 10 before the resource-constrained master control device establishes a communication connection with the wireless communication device 10.

[0094] Optionally, the hardware unique identifier includes one or a combination of at least two of the following: hardware address, chip unique identifier, and dynamic one-time password serial number.

[0095] The identity binding system for wireless communication devices provided in this application embodiment can execute the identity binding method for wireless communication devices provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0096] Example 4 Figure 4 This is a schematic diagram of the structure of an identity authentication system for a wireless communication device provided in Embodiment 4 of the present invention. Figure 4 As shown, the system includes: a wireless communication device 10, a public key infrastructure system 30, and a master control device 40, wherein the master control device 40 is pre-installed with the root certificate of the public key infrastructure system 30.

[0097] The main control device 40 includes: The certificate reading module is used to read the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device 10 in response to the access of the wireless communication device 10. The certificate chain verification module is used to verify whether the certificate trust chain consisting of the device certificate and the intermediate certificate is complete using a pre-set root certificate. The current identity digest calculation module is used to read the hardware unique identifier of the wireless communication device in response to the verification result of the certificate trust chain being complete, and to calculate the current identity digest of the wireless communication device 10 based on the hardware unique identifier. The first comparison module is used to extract the device identity digest from the device certificate and compare whether the current identity digest is consistent with the device identity digest; The first communication establishment module is used to determine whether to establish a communication connection with the wireless communication device 10 based on the comparison result.

[0098] This embodiment constructs a runtime mandatory authentication system through the interaction and cooperation between a wireless communication device and a master control device with a pre-installed public key infrastructure system root certificate. In this system, the master control device no longer passively accepts the self-declaration of devices, but actively acts as a verifier, using its locally pre-installed root certificate to initiate a two-phase challenge to the access device, including certificate chain verification and hardware binding verification. This system architecture ensures that the security authentication logic is completely dominated and controlled by the master control device. Even if the wireless communication device is reverse-engineered or attempts to forge response data, the attacker cannot pass both verifications simultaneously due to the lack of private key signing capability corresponding to the master control device's root certificate and the correct hardware identification, greatly improving the overall robustness of the system.

[0099] Optionally, the main control device 40 further includes: The ciphertext reading module is used to read the ciphertext of identity information stored in the secure storage area of ​​the wireless communication device 10 when the resources of the main control device 10 are limited; the ciphertext decryption module is used to decrypt the ciphertext of identity information to obtain the device identity digest. The second comparison module is used to read the hardware unique identifier of the wireless communication device, calculate the current identity digest of the wireless communication device based on the hardware unique identifier, and compare whether the current identity digest is consistent with the device identity digest. The second communication establishment module is used to determine whether to establish a communication connection with the wireless communication device 10 based on the comparison result.

[0100] Optionally, the first communication establishment module or the second communication establishment module includes: A communication rejection unit is configured to refuse to establish a communication connection with the wireless communication device 10 in response to a discrepancy in the comparison results. A communication establishment unit is configured to, in response to the comparison result being consistent, control the wireless communication device to enter a communication mode and establish a communication connection with the wireless communication device 10 in the communication mode.

[0101] Optionally, the wireless communication device 10 is equipped with management firmware and network communication firmware; after power-on, the wireless communication device runs the management firmware and enters the authentication mode.

[0102] Optionally, the communication establishment unit is specifically used for: A communication mode switching instruction is sent to the management firmware of the wireless communication device 10. The communication mode switching instruction is used to instruct the management firmware to start the network communication firmware so that the wireless communication device 10 enters the communication mode.

[0103] Optionally, the main control device 40 further includes: The security event response module is used to respond to the incomplete verification result of the certificate trust chain or the inconsistent comparison result. The main control device also performs at least one of the following operations: recording a security event log, issuing a security alarm, and putting the wireless communication device 10 into a restricted working mode.

[0104] The wireless communication device authentication system provided in this application embodiment can execute the wireless communication device authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0105] Example 5 Figure 5A schematic diagram of an electronic device 50 that can be used to implement embodiments of the present invention is shown. In one embodiment, the electronic device 50 is a production device 20 that performs an identity binding method for a wireless communication device. In another embodiment, the electronic device 50 is a master control device 40 that performs an identity authentication method for a wireless communication device. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the invention described and / or claimed herein.

[0106] like Figure 5 As shown, the electronic device 50 includes at least one processor 51 and a memory, such as a read-only memory (ROM) 52 and a random access memory (RAM) 53, communicatively connected to the at least one processor 51. The memory stores computer programs executable by the at least one processor. The processor 51 can perform various appropriate actions and processes based on the computer program stored in the ROM 52 or loaded from storage unit 58 into the RAM 53. The RAM 53 can also store various programs and data required for the operation of the electronic device 50. The processor 51, ROM 52, and RAM 53 are interconnected via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0107] Multiple components in electronic device 50 are connected to I / O interface 55, including: input unit 56, such as keyboard, mouse, etc.; output unit 57, such as various types of monitors, speakers, etc.; storage unit 58, such as disk, optical disk, etc.; and communication unit 59, such as network card, modem, wireless transceiver, etc. Communication unit 59 allows electronic device 50 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0108] Processor 51 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 51 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 51 performs the various methods and processes described above, such as identity binding methods or authentication methods for wireless communication devices.

[0109] In some embodiments, the identity binding method or authentication method of a wireless communication device may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 58. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 50 via ROM 52 and / or communication unit 59. When the computer program is loaded into RAM 53 and executed by processor 51, one or more steps of the identity binding method of the wireless communication device described above may be performed. Alternatively, in other embodiments, processor 51 may be configured to perform the identity binding method or authentication method of the wireless communication device by any other suitable means (e.g., by means of firmware).

[0110] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0111] In some embodiments, the identity binding method or authentication method of a wireless communication device may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on the host device 60 via ROM 62 and / or communication unit 69. When the computer program is loaded into RAM 63 and executed by processor 61, one or more steps of the authentication method of the wireless communication device described above may be performed. Alternatively, in other embodiments, processor 61 may be configured to execute the identity binding method or authentication method of the wireless communication device by any other suitable means (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0114] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0115] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0116] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0117] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0118] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0119] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for binding the identity of a wireless communication device, characterized in that, The method, performed by production equipment that manufactures the wireless communication device, includes: Read the hardware unique identifier of the wireless communication device, and generate a device identity digest of the wireless communication device based on the hardware unique identifier; Generate a public-private key pair for the wireless communication device and generate a certificate signing request file; wherein the certificate signing request file contains at least the device identity digest, device attribute information, and the device public key from the public-private key pair; Send the certificate signing request file to the public key infrastructure system; Receive the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device, and write the device certificate and intermediate certificate into the secure storage area of ​​the wireless communication device.

2. The method according to claim 1, characterized in that, Writing the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device includes: The device certificate and the intermediate certificate are written into the secure storage area of ​​the wireless communication device using segmented storage and structured indexing.

3. The method according to claim 1 or 2, characterized in that, Also includes: Symmetric encryption is performed on the device identity digest and the device attribute information of the wireless communication device to obtain the device identity information ciphertext. The encrypted device identity information is written into the secure storage area of ​​the wireless communication device for authentication of the wireless communication device before the resource-constrained master control device establishes a communication connection with the wireless communication device.

4. The method according to claim 1, characterized in that, The hardware unique identifier includes one or a combination of at least two of the following: hardware address, chip unique identifier, and dynamic one-time password serial number.

5. A method for authenticating the identity of a wireless communication device, characterized in that, The method, executed by the master control device of the root certificate of the pre-installed public key infrastructure system, includes: In response to the access of a wireless communication device, the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device are read; and the certificate trust chain formed by the device certificate and the intermediate certificate is verified to be complete using a preset root certificate. In response to the certificate trust chain verification result being complete, the hardware unique identifier of the wireless communication device is read, and the current identity digest of the wireless communication device is calculated based on the hardware unique identifier; Extract the device identity digest from the device certificate and compare whether the current identity digest is consistent with the device identity digest; Based on the comparison results, determine whether to establish a communication connection with the wireless communication device.

6. The method according to claim 5, characterized in that, The method further includes: When the resources of the main control device are limited, read the encrypted identity information stored in the secure storage area of ​​the wireless communication device; The encrypted identity information is decrypted to obtain the device identity digest; Read the hardware unique identifier of the wireless communication device, calculate the current identity digest of the wireless communication device based on the hardware unique identifier, and compare whether the current identity digest is consistent with the device identity digest; Based on the comparison results, determine whether to establish a communication connection with the wireless communication device.

7. The method according to claim 5 or 6, characterized in that, Determining whether to establish a communication connection with the wireless communication device based on the comparison results includes: If the comparison results are inconsistent, then the communication connection with the wireless communication device is refused. If the comparison results are consistent, the wireless communication device is controlled to enter the communication mode and a communication connection is established with the wireless communication device in the communication mode.

8. The method according to claim 7, characterized in that, The wireless communication device is equipped with management firmware and network communication firmware; after power-on, the wireless communication device runs the management firmware and enters the authentication mode. Accordingly, controlling the wireless communication device to enter communication mode includes: A communication mode switching instruction is sent to the management firmware of the wireless communication device. The communication mode switching instruction is used to instruct the management firmware to start the network communication firmware so that the wireless communication device enters the communication mode.

9. The method according to claim 5, characterized in that, The method further includes: In response to an incomplete verification result of the certificate trust chain or an inconsistent comparison result, the master control device further performs at least one of the following operations: Record security event logs, issue security alerts, and place the wireless communication device in a restricted operating mode.

10. An identity binding system for a wireless communication device, characterized in that, include: Wireless communication equipment, production equipment for producing the wireless communication equipment, and public key infrastructure system; The production equipment includes: The identity information reading module is used to read the hardware unique identifier of the wireless communication device and generate a device identity digest of the wireless communication device based on the hardware unique identifier. A certificate request generation module is used to generate a device public-private key pair for the wireless communication device, generate a certificate signing request file, and send the certificate signing request file to a public key infrastructure system; wherein, the certificate signing request file contains at least the device identity digest, device attribute information, and the device public key in the device public-private key pair; The public key infrastructure system is used to verify the certificate signing request file and, upon successful verification, to issue a device certificate and an intermediate certificate for the wireless communication device. The production equipment further includes a certificate writing module, used to receive the device certificate and intermediate certificate issued by the public key infrastructure system for the wireless communication device, and write the device certificate and the intermediate certificate into the secure storage area of ​​the wireless communication device.

11. An authentication system for a wireless communication device, characterized in that, include: The system comprises a wireless communication device, a public key infrastructure (PKI) system, and a master control device, wherein the master control device has a pre-installed root certificate of the PKI system; and the master control device includes: The certificate reading module is used to read the device certificate and intermediate certificate stored in the secure storage area of ​​the wireless communication device in response to the access of the wireless communication device. The certificate chain verification module is used to verify whether the certificate trust chain consisting of the device certificate and the intermediate certificate is complete using a pre-set root certificate. The current identity digest calculation module is used to read the hardware unique identifier of the wireless communication device and calculate the current identity digest of the wireless communication device based on the hardware unique identifier in response to the verification result of the certificate trust chain being complete. The first comparison module is used to extract the device identity digest from the device certificate and compare whether the current identity digest is consistent with the device identity digest; The first communication establishment module is used to determine whether to establish a communication connection with the wireless communication device based on the comparison result.

12. A production equipment, characterized in that, The production equipment includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the identity binding method of the wireless communication device according to any one of claims 1-4.

13. A master control device, characterized in that, The main control device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the authentication method of the wireless communication device according to any one of claims 5-9.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the identity binding method of the wireless communication device according to any one of claims 1-4 or execute the identity authentication method of the wireless communication device according to any one of claims 5-9.

Images