A device access method, apparatus, device, and storage medium

Abstract

The application discloses a device access method and device, equipment and storage medium, through verifying the consistency of device stable information, variable device fingerprint difference and environment fingerprint association in the device access authentication stage respectively, and setting corresponding device fingerprint update constraints for the variable device fingerprint, the update of the variable device fingerprint feature information can be verified in compliance on the basis of ensuring the safety of device access, so that the device is misjudged as an abnormal device when the to-be-accessed device is subjected to legal firmware upgrading or configuration adjustment, and the safety of device access and the accuracy of authentication are considered.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a device access method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] With the increasing number of IoT devices, edge nodes, industrial terminals, and power communication terminals, device access authentication has gradually evolved from traditional account passwords, certificates, or static identifier authentication to device fingerprint authentication. In existing technologies, device fingerprint authentication typically involves collecting characteristic information that identifies the device to form a device fingerprint. When a device requests network access or resource access, the current device fingerprint is compared with a pre-registered device fingerprint to determine if the device is legitimate. However, in real-world access scenarios, device fingerprints are not entirely static. For example, when a device undergoes a legitimate firmware upgrade or configuration adjustment, changes in its device fingerprint can easily lead to legitimate devices being misidentified as abnormal devices, affecting the accuracy of device access authentication. Summary of the Invention

[0003] This invention provides a device access method, apparatus, device, and storage medium to solve the technical problem that when a device undergoes a legitimate firmware upgrade or configuration adjustment, a legitimate device is easily misjudged as an abnormal device, affecting the accuracy of device access authentication.

[0004] To address the aforementioned technical problems, a first aspect of this invention provides a device access method, comprising: Receive zero-knowledge access proof sent by the device to be accessed; wherein, the zero-knowledge access proof includes at least device stability information consistency proof information, variable device fingerprint difference proof information, and environmental fingerprint association proof information; When the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints, an update proof request is sent to the device to be connected; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; When the zero-knowledge update proof is received from the device to be accessed and the zero-knowledge update proof is verified, the access registration information of the device to be accessed is updated based on the new variable device fingerprint registration commitment value, and an access token is sent to the device to be accessed.

[0005] As a preferred embodiment, before receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: When an access request is received from the device to be accessed, an access proof request is sent to the device to be accessed; wherein, the access proof request is used to instruct the device to be accessed to generate the zero-knowledge access proof based on the current device fingerprint digest value and its corresponding private salt, the environment fingerprint digest value and its corresponding private salt, and fingerprint registration information; the device fingerprint digest value includes a stable device fingerprint digest value and a variable device fingerprint digest value; The device stability information consistency proof information includes commitment value consistency proof information and stable device fingerprint consistency proof information; the commitment value consistency proof information is used to indicate the consistency between each verification commitment value and each registration commitment value in the access registration information; each verification commitment value is generated based on the private salt, the stable device fingerprint registration digest value, the variable device fingerprint registration digest value, and the environment fingerprint registration digest value in the fingerprint registration information.

[0006] As a preferred embodiment, after receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: Based on the first access proof binding information in the access proof request, the second access proof binding information in the zero-knowledge access proof is verified; wherein, the first access proof binding information includes at least an access random variable, a target access resource identifier, a current access policy identifier, a communication channel identifier, a resource gateway identifier, and a proof constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; When the first access proof binding information is consistent with the second access proof binding information, it is determined that the zero-knowledge access proof has passed the information binding verification, and the device stability information consistency proof information, the variable device fingerprint difference proof information, and the environment fingerprint association proof information are verified based on the access registration information and the verification rules; wherein, the access registration information includes at least the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, and the environment fingerprint registration commitment value.

[0007] As a preferred embodiment, the method further includes: When a registration request from the device to be accessed is received, registration instruction information is sent to the device to be accessed; wherein, the registration instruction information includes at least a fingerprint feature collection strategy, a proof constraint, and a device fingerprint update constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; the fingerprint feature collection strategy is used to instruct the device to be accessed to collect stable device fingerprint feature information, variable device fingerprint feature information, and environmental fingerprint feature information; When the device registration information fed back by the device to be accessed in response to the registration instruction information is received, the device registration information is written into the access registration information, and an access registration information version identifier corresponding to the device registration information is generated; wherein, the device registration information includes at least a stable device fingerprint registration commitment value, a variable device fingerprint registration commitment value, an environmental fingerprint registration commitment value, a device pseudo-identifier of the device to be accessed, the proof constraint, and the device fingerprint update constraint; The stable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the stable device fingerprint feature information it generates and the stable device fingerprint registration digest value; The variable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the variable device fingerprint feature information it generates and the variable device fingerprint registration digest value; The environmental fingerprint registration commitment value is generated by the device to be connected based on the private salt and environmental fingerprint registration digest value corresponding to the environmental fingerprint feature information it generates.

[0008] As a preferred embodiment, the updated verification information includes at least the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and updated compliance proof information; The original variable device fingerprint registration commitment value correspondence is used to indicate that the variable device fingerprint registration commitment value in the current access registration information has a correspondence with the private salt and variable device fingerprint registration digest value corresponding to the variable device fingerprint feature information before the update; The correspondence between the new variable device fingerprint registration commitment value and the new private salt and new variable device fingerprint registration digest value corresponding to the updated variable device fingerprint feature information is used to indicate that the new variable device fingerprint registration commitment value corresponds to the new variable device fingerprint feature information. The updated compliance proof information is used to indicate whether the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration digest value complies with the device fingerprint update constraints.

[0009] As a preferred embodiment, after receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: When the device stability information consistency proof information passes verification, but the environment fingerprint association proof information fails verification, or when it is detected that the device to be accessed generates at least two zero-knowledge access proofs with different communication channel identifiers under the same access registration information, a review request is sent to the device to be accessed; wherein, the review request is used to instruct the device to be accessed to regenerate at least one of the zero-knowledge access proof and the zero-knowledge update proof and provide feedback.

[0010] As a preferred embodiment, the access token includes at least the device pseudo-identifier of the device to be accessed, the target access resource identifier, the resource gateway identifier, the current access policy identifier, the proof constraint, the current access registration information version identifier of the device to be accessed, the proof digest value corresponding to the zero-knowledge access proof, the token validity period, and the access authentication type.

[0011] A second aspect of the present invention provides a device access apparatus, comprising: The zero-knowledge access certificate receiving module is used to receive the zero-knowledge access certificate sent by the device to be accessed; wherein, the zero-knowledge access certificate includes at least the device stability information consistency certificate information, the variable device fingerprint difference certificate information, and the environmental fingerprint association certificate information; The update proof request module is used to send an update proof request to the device to be connected when the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; The access token sending module is used to update the access registration information of the device to be accessed based on the new variable device fingerprint registration commitment value when it receives the zero-knowledge update proof from the device to be accessed and the zero-knowledge update proof passes verification, and then sends an access token to the device to be accessed.

[0012] A second aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the device access method described in any of the first aspects.

[0013] A third aspect of the present invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the device access method described in any of the first aspects.

[0014] Compared with the prior art, the beneficial effect of the embodiments of the present invention is that by verifying the consistency of device stability information, the difference of variable device fingerprints and the association of environmental fingerprints during the device access authentication stage, and setting corresponding device fingerprint update constraints for variable device fingerprints, it is possible to perform compliance verification of the update of variable device fingerprint feature information while ensuring the security of device access. This effectively avoids misjudging the device as an abnormal device when the device to be accessed undergoes a legitimate firmware upgrade or configuration adjustment, thus achieving a balance between device access security and authentication accuracy. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the device access method in an embodiment of the present invention; Figure 2 This is a schematic diagram of the device access device in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of the electronic device in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Please see Figure 1 The first aspect of this invention provides a device access method, including the following steps S1 to S3: Step S1: Receive the zero-knowledge access certificate sent by the device to be accessed; wherein the zero-knowledge access certificate includes at least the device stability information consistency certificate, the variable device fingerprint difference certificate, and the environmental fingerprint association certificate. Step S2: When the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints, an update proof request is sent to the device to be connected; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; Step S3: When the zero-knowledge update proof is received from the device to be accessed and the zero-knowledge update proof is verified, the access registration information of the device to be accessed is updated based on the new variable device fingerprint registration commitment value, and an access token is sent to the resource gateway corresponding to the target access resource; wherein, the access token is used to instruct the resource gateway to allow the device to be accessed to access the target access resource.

[0018] It is worth noting that the device access method in this embodiment is executed by the access management terminal. In this embodiment, the device to be accessed can be an IoT terminal, an edge computing node, an industrial control terminal, a power communication terminal, a server node, a gateway node, or other network devices that need to access controlled resources. A trusted execution environment is set up inside the device to be accessed. The trusted execution environment can be implemented by a trusted chip, a trusted execution area, a secure isolation area, a trusted boot chain, or a secure container. The trusted execution environment is used to store the stable device fingerprint registration digest value, the variable device fingerprint registration digest value, the environment fingerprint registration digest value, the stable device fingerprint private salt, the variable device fingerprint private salt, and the environment fingerprint private salt, and is used to execute the generation process of the current stable device fingerprint digest value, the current variable device fingerprint digest value, the current environment fingerprint digest value, the zero-knowledge access proof, and the zero-knowledge update proof. The trusted execution environment does not directly output plaintext data of the device fingerprint feature set to the access management terminal, nor does it directly output plaintext data that can reconstruct the fingerprint feature information corresponding to the current stable device fingerprint digest value, the current variable device fingerprint digest value, and the current environment fingerprint digest value. Furthermore, the current stable device fingerprint digest value, the current variable device fingerprint digest value, and the current environment fingerprint digest value are used as privacy inputs for zero-knowledge access proof generation, and are not submitted to the access management terminal as plaintext verification data. This allows the access management terminal to verify the device's access qualification, but it cannot obtain plaintext data sufficient to reconstruct the device's fingerprint feature set.

[0019] In this embodiment, after receiving the zero-knowledge access certificate sent by the device to be accessed, to prevent the plaintext data of the device fingerprint feature set from being restored, the zero-knowledge access certificate includes device stability information consistency certificate, variable device fingerprint difference certificate, and environmental fingerprint association certificate. The device stability information consistency certificate indicates that the relevant information of relatively stable, infrequently changing devices remains consistent throughout the device access phase, including the consistency of the generation of each registration commitment value corresponding to the stable device fingerprint, variable device fingerprint, and environmental fingerprint, as well as the consistency between the current stable device fingerprint digest value and the stable device fingerprint registration digest value. The variable device fingerprint difference certificate indicates whether the change in the current variable device fingerprint digest value compared to the variable device fingerprint registration digest value conforms to the device fingerprint update constraints. The environmental fingerprint association certificate proves whether an acceptable association relationship is maintained between the current environmental fingerprint digest value and the environmental fingerprint registration digest value.

[0020] It is worth noting that stable device fingerprints are used to characterize the relatively stable and non-transferable basic identity of the device to be connected. The relevant feature information may specifically include: non-transferable hardware features, trusted boot root measurement features, and secure storage measurement features. Non-transferable hardware features may include one or more of the following: unique measurement value of the main control chip, measurement value of the hardware security module, measurement value of the trusted platform module, and measurement value of non-replicable physical features. Trusted boot root measurement features may include one or more of the following: boot loader measurement value, boot chain integrity measurement value, and system kernel boot measurement value. Secure storage measurement features may include one or more of the following: secure storage area state measurement value, secure key container measurement value, and secure configuration area integrity measurement value.

[0021] Variable device fingerprints are used to characterize the device state that may change during legitimate operation, maintenance, upgrades, and configuration adjustments, but should be subject to policy constraints. Specific features include firmware version features, configuration baseline features, interface enumeration features, and driver loading features. Firmware version features may include firmware version number, firmware signature measurement value, and firmware component list summary value. Configuration baseline features may include access control configuration, system service configuration, security policy configuration, and key operating parameter configuration. Interface enumeration features may include the enumeration results of network interfaces, serial interfaces, industrial bus interfaces, and extended interfaces. Driver loading features may include driver component list, driver signature status, and driver loading order.

[0022] Environmental fingerprints are used to characterize the operating and access environments in which a device operates. The relevant feature information can include operating environment baseline features, network location baseline features, and time synchronization baseline features. Operating environment baseline features can include operating system running status, security process status, and running dependency status. Network location baseline features can include access network segment, gateway path, network domain identifier, and network boundary identifier. Time synchronization baseline features can include trusted time source status, time synchronization offset status, and timestamp verification status.

[0023] When the device stability information consistency proof and the environmental fingerprint association proof pass verification, that is, the device stability information is consistent and the association between the current environmental fingerprint digest value and the environmental fingerprint registration digest value is normal, while the variable device fingerprint difference proof indicates that the current variable device fingerprint digest value is not consistent, but meets the preset device fingerprint update constraints, it indicates that the current device to be accessed has undergone a legitimate firmware upgrade or configuration adjustment, and its update information needs to be further verified. Therefore, it is necessary to send an update proof request to the device to be accessed, so as to issue an access token after completing the zero-knowledge update proof verification and updating the variable device fingerprint registration commitment value.

[0024] After the zero-knowledge update proof is verified, the variable device fingerprint registration commitment value of the device to be accessed in the device access registration table is replaced with the new variable device fingerprint registration commitment value indicated by the zero-knowledge update proof to update the access registration information of the device to be accessed. The version identifier of the current access registration information also needs to be updated. Since the update process is completed through the zero-knowledge update proof, this embodiment does not require obtaining the plaintext of the updated variable device fingerprint digest value or the variable device fingerprint private salt, thereby reducing the risk of device fingerprint leakage, association tracking, or replay exploitation. After the access registration information update is completed, an access token is generated and sent to the resource gateway corresponding to the target access resource. The resource gateway receives the access token and performs gateway-side verification on the access request for the target access resource based on the access token, allowing the device to access the target access resource.

[0025] It is worth noting that when the device stability information consistency proof information and the environmental fingerprint association proof information are verified, and the variable device fingerprint difference proof information indicates that the current variable device fingerprint digest value is consistent with the variable device fingerprint registration digest value, then the variable device fingerprint feature information has not changed. Therefore, in this embodiment, an access token is directly generated and sent to the resource gateway corresponding to the target access resource.

[0026] In this embodiment, the device fingerprint update constraints include permissible changes to variable device features, prohibited changes to variable device features, variable device feature update order, and variable device feature update window. Permissible changes to variable device features record the types of variable device feature changes that can be updated through zero-knowledge update proofs, such as signed firmware version upgrades, authorized configuration baseline adjustments, and driver loading changes in a predetermined order. Prohibited changes to variable device features record the types of variable device feature changes that are not allowed to be updated through zero-knowledge update proofs, such as unsigned firmware replacement, unauthorized configuration closure, abnormal expansion of security interfaces, and unauthorized changes in driver loading order. Further, prohibited changes to variable device features may also include one or more of the following: secure boot closure, trusted execution environment closure, unauthorized debug interface opening, unregistered network interface enabling, unsigned driver loading, downgraded access control policy, disabled log collection function, and replacement of secure communication components. When the variable device fingerprint feature update information corresponding to the current variable device feature digest value matches the prohibited changes to variable device features, it is determined that the variable device fingerprint difference proof information does not meet the update conditions, and the replacement of the variable device fingerprint registration commitment value through zero-knowledge update proof is rejected. The variable device fingerprint update order specifies the order in which multiple variable device fingerprints undergo legitimate changes, while the variable device fingerprint update window specifies the allowed time range, maintenance window, or policy effective period for changes to variable device fingerprints. These policy settings allow for the differentiation between controlled changes resulting from legitimate maintenance and abnormal changes that do not comply with security policies.

[0027] The device access method provided in this invention verifies the consistency of device stability information, the difference of variable device fingerprints, and the association of environmental fingerprints during the device access authentication phase, and sets corresponding device fingerprint update constraints for variable device fingerprints. This ensures the security of device access while verifying the compliance of updates to variable device fingerprint feature information, effectively preventing the device from being misjudged as an abnormal device when a legitimate firmware upgrade or configuration adjustment occurs. This achieves a balance between device access security and authentication accuracy.

[0028] As a preferred embodiment, before receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: When an access request is received from the device to be accessed, an access proof request is sent to the device to be accessed; wherein, the access proof request is used to instruct the device to be accessed to generate the zero-knowledge access proof based on the current device fingerprint digest value and its corresponding private salt, the environment fingerprint digest value and its corresponding private salt, and fingerprint registration information; the device fingerprint digest value includes a stable device fingerprint digest value and a variable device fingerprint digest value; The device stability information consistency proof information includes commitment value consistency proof information and stable device fingerprint consistency proof information; the commitment value consistency proof information is used to indicate the consistency between each verification commitment value and each registration commitment value in the access registration information; each verification commitment value is generated based on the private salt, the stable device fingerprint registration digest value, the variable device fingerprint registration digest value, and the environment fingerprint registration digest value in the fingerprint registration information.

[0029] Specifically, upon receiving an access request from a device seeking access to a target resource, an access authentication request must be sent to the device to authenticate it. After receiving the access authentication request, the device seeking access re-collects its current stable device fingerprint feature information, variable device fingerprint feature information, and environmental fingerprint feature information. To ensure consistency in the comparison basis, the current collection process adopts the same fingerprint feature information classification method, normalization rules, and preset sorting rules as in the device registration phase. Then, based on the currently collected stable device fingerprint feature information, stable device fingerprint private salt, variable device fingerprint feature information, variable device fingerprint private salt, environment fingerprint feature information, and environment fingerprint private salt, digest processing is performed to generate the current stable device fingerprint digest value, variable device fingerprint digest value, and environment fingerprint digest value. That is, the current stable device fingerprint digest value is generated by the currently collected stable device fingerprint feature information and stable device fingerprint private salt, the current variable device fingerprint digest value is generated by the currently collected variable device fingerprint feature information and variable device fingerprint private salt, and the current environment fingerprint digest value is generated by the currently collected environment fingerprint feature information and environment fingerprint private salt. Among them, the three types of private salts are stored in the trusted execution environment and are different from each other. The digest processing can adopt hash digest, message authentication digest, or other irreversible digest processing methods. This embodiment does not make specific limitations here.

[0030] Further, in response to the access proof request, the device to be accessed generates a zero-knowledge access proof based on the current device fingerprint digest value and its corresponding private salt, the environment fingerprint digest value and its corresponding private salt, and the fingerprint registration information. The fingerprint registration information includes a stable device fingerprint registration digest value, a variable device fingerprint registration digest value, and an environment fingerprint registration digest value. In this embodiment, the device stability information consistency proof information includes commitment value consistency proof information and stable device fingerprint consistency proof information. The commitment value consistency proof information is used to indicate the consistency between each verification commitment value and each registration commitment value in the access registration information. To avoid leakage of device fingerprints, this proof generation process is completed locally on the device to be accessed. Each verification commitment value is the stable device fingerprint verification commitment value, the variable device fingerprint verification commitment value, and the environment fingerprint verification commitment value. The stable device fingerprint verification commitment value is generated using the stable device fingerprint registration digest value and the stable device fingerprint private salt; the variable device fingerprint verification commitment value is generated using the variable device fingerprint registration digest value and the variable device fingerprint private salt; and the environment fingerprint verification commitment value is generated using the environment fingerprint registration digest value and the environment fingerprint private salt, to prove that each registration commitment value is generated by its corresponding fingerprint registration digest value and its corresponding private salt.

[0031] Furthermore, based on the consistency between the current device fingerprint digest value and the stable device fingerprint registration digest value, stable device fingerprint consistency proof information is generated to indicate whether the current device fingerprint digest value and the stable device fingerprint registration digest value meet the consistency requirements; based on the consistency between the current variable device fingerprint digest value and the variable device fingerprint registration digest value, or the variable device fingerprint feature update information and device fingerprint update constraints, variable device fingerprint difference proof information is generated to indicate whether the current variable device fingerprint digest value is consistent or whether the variable device fingerprint feature update information meets the device fingerprint update constraints; environmental fingerprint association proof information is generated based on whether the current environmental fingerprint digest value and the environmental fingerprint registration digest value have a preset normal association relationship between the operating environment and the access environment.

[0032] It is worth noting that this embodiment has different verification boundaries for stable device fingerprint consistency proof information and variable device fingerprint difference proof information. Stable device fingerprint consistency proof information is used to define that there must be no changes between the current device fingerprint digest value and the stable device fingerprint registration digest value that are not part of the fluctuations in normal device operation. When any of the hardware non-portable features, trusted boot root measurement features, or secure storage measurement features show unauthorized changes, the stable device fingerprint consistency proof information is deemed to fail verification. Variable device fingerprint difference proof information, on the other hand, allows changes to firmware version features, configuration baseline features, interface enumeration features, or driver loading features within the range defined by the variable device feature change permission information, variable device feature update order, and variable device feature update window. Therefore, stable device fingerprint feature information is used to maintain the non-portability of the device's basic identity, while variable device fingerprint feature information is used to adapt to controlled changes caused by legitimate operation and maintenance.

[0033] During normal access and legitimate updates of variable device fingerprints, this embodiment only allows updates to the variable device fingerprint registration commitment value, not the stable device fingerprint registration commitment value. When the stable device fingerprint consistency proof information fails verification, the update process for the variable device fingerprint registration commitment value is not executed; instead, a re-registration or manual review process is initiated. This setting ensures that the basic device identity corresponding to the stable device fingerprint feature information remains stable, preventing attackers from bypassing the stable device fingerprint consistency verification through the variable device fingerprint update process.

[0034] As a preferred embodiment, after receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: Based on the first access proof binding information in the access proof request, the second access proof binding information in the zero-knowledge access proof is verified; wherein, the first access proof binding information includes at least an access random variable, a target access resource identifier, a current access policy identifier, a communication channel identifier, a resource gateway identifier, and a proof constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; When the first access proof binding information is consistent with the second access proof binding information, it is determined that the zero-knowledge access proof has passed the information binding verification, and the device stability information consistency proof information, the variable device fingerprint difference proof information, and the environment fingerprint association proof information are verified based on the access registration information and the verification rules; wherein, the access registration information includes at least the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, and the environment fingerprint registration commitment value.

[0035] Specifically, the access proof request in this embodiment further includes first access proof binding information, which includes at least an access random variable, a target access resource identifier, a current access policy identifier, a communication channel identifier, a resource gateway identifier, and proof constraints. The access random variable is used to prevent the zero-knowledge access proof from being replayed. The target access resource identifier is used to limit the resource object targeted by this access request. The current access policy identifier is used to limit the access control policy applicable to this access request. The communication channel identifier is used to limit the communication connection or security channel corresponding to the proof. The resource gateway identifier is used to limit that this access token can only be verified and used by the resource gateway of the corresponding target access resource. The proof constraints are used to ensure that the device to be accessed and the access management terminal use the same set of zero-knowledge proof constraint files, specifically indicating the generation rules and verification rules for zero-knowledge access proofs and zero-knowledge update proofs.

[0036] Preferably, the zero-knowledge proof constraint file can be configured as a proof circuit file, a constraint script file, or a set of verification rules. The device to be accessed loads the corresponding proof circuit file or constraint script file based on the received proof constraints to generate a zero-knowledge access proof and a zero-knowledge update proof. In this embodiment, after receiving the zero-knowledge access proof and the zero-knowledge update proof, the corresponding set of verification rules is loaded based on the same proof constraints for verification. In one embodiment, to verify the legality of the zero-knowledge access proof and the zero-knowledge update proof, this embodiment also pre-sets a set of proof keys and verification keys, enabling the device to be accessed to generate the zero-knowledge access proof and the zero-knowledge update proof based on the proof keys. This embodiment then verifies the legality of the zero-knowledge access proof and the zero-knowledge update proof based on the verification keys. Therefore, the zero-knowledge access proof and the zero-knowledge update proof are not merely used to express authentication conclusions, but rather to verify the consistency of commitment values, the consistency of stable device fingerprints, the differences in variable device fingerprints, the association of environmental fingerprints, and information binding through executable proof constraints, and to make the replacement process of the variable device fingerprint registration commitment value have verifiable technical constraints. Zero-knowledge access proofs and zero-knowledge update proofs can be implemented using non-interactive zero-knowledge proofs, interactive zero-knowledge proofs, or zero-knowledge proof protocols based on commitment relationships, as long as the verification of the corresponding proof relationship can be completed without disclosing private input.

[0037] Furthermore, during the process of generating the zero-knowledge access certificate, the device to be accessed also needs to bind the first access certificate binding information to form the second access certificate binding information in the zero-knowledge access certificate. By verifying whether the first access certificate binding information and the second access certificate binding information are consistent, the zero-knowledge access certificate can be prevented from being used to access resources, other resource gateways, or other communication channels for other targets. After determining that the zero-knowledge access proof has passed the information binding verification, the device stability information consistency proof, variable device fingerprint difference proof, and environmental fingerprint association proof are verified based on the access registration information and verification rules. Specifically, the stable device fingerprint registration commitment value, variable device fingerprint registration commitment value, and environmental fingerprint registration commitment value in the access registration information can be used to verify whether each registration commitment value corresponding to the stable device fingerprint consistency proof is correct. The verification rules set corresponding verification conclusions for different proof results of the device stability information consistency proof, variable device fingerprint difference proof, and environmental fingerprint association proof. For example, if the commitment value consistency proof indicates that the device to be accessed cannot prove the correspondence between each registration commitment value and the corresponding fingerprint registration digest value and private salt, it indicates that the identity of the device to be accessed is at risk, and the proof verification fails. If the stable device fingerprint consistency proof indicates that the stable device fingerprint is consistent, the proof verification passes. This embodiment will not elaborate further here.

[0038] As a preferred embodiment, the method further includes: When a registration request from the device to be accessed is received, registration instruction information is sent to the device to be accessed; wherein, the registration instruction information includes at least a fingerprint feature collection strategy, a proof constraint, and a device fingerprint update constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; the fingerprint feature collection strategy is used to instruct the device to be accessed to collect stable device fingerprint feature information, variable device fingerprint feature information, and environmental fingerprint feature information; When the device registration information fed back by the device to be accessed in response to the registration instruction information is received, the device registration information is written into the access registration information, and an access registration information version identifier corresponding to the device registration information is generated; wherein, the device registration information includes at least a stable device fingerprint registration commitment value, a variable device fingerprint registration commitment value, an environmental fingerprint registration commitment value, a device pseudo-identifier of the device to be accessed, the proof constraint, and the device fingerprint update constraint; The stable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the stable device fingerprint feature information it generates and the stable device fingerprint registration digest value; The variable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the variable device fingerprint feature information it generates and the variable device fingerprint registration digest value; The environmental fingerprint registration commitment value is generated by the device to be connected based on the private salt and environmental fingerprint registration digest value corresponding to the environmental fingerprint feature information it generates.

[0039] Specifically, in this embodiment, upon receiving a registration request from a device to be accessed, a registration instruction message is sent to the device. The access verification request includes at least a fingerprint feature acquisition strategy, verification constraints, and device fingerprint update constraints. The fingerprint feature acquisition strategy specifies which device fingerprint feature information needs to be collected by the device to be accessed, from which feature source paths, within which acquisition window, the number of times each feature acquisition item is collected, the feature stability level, and rules for handling abnormal acquisition values. In one embodiment, the access verification request also includes a randomly generated registration random variable, used to ensure that the same device generates different device registration information in different registration periods, avoiding the reuse of fixed registration data.

[0040] When collecting fingerprint features of stable devices, variable devices, and the environment, the device to be accessed repeatedly collects the same feature item within at least two collection windows. If a collected value exceeds the feature value range defined by the fingerprint feature collection strategy, or is significantly inconsistent with other collected values ​​within the same collection window, the device to be accessed deletes the abnormal collected value according to the abnormal collected value handling rules. After completing the abnormal collected value processing, the device to be accessed performs normalization processing on the remaining collected values, including converting the same feature item into a normalized feature record. The normalized feature record includes the feature name, feature source path, feature value range, feature stability level, and feature group identifier. The device to be accessed sorts the normalized feature records according to the feature group identifier and a preset sorting rule, forming a sequence of stable device fingerprint feature information records, a sequence of variable device fingerprint feature information records, and a sequence of environment fingerprint feature information records, respectively. Subsequently, the device to be accessed performs summary processing on the sequence of stable device fingerprint feature information records, a sequence of variable device fingerprint feature information records, and a sequence of environment fingerprint feature information records, respectively, generating stable device fingerprint registration summary values, variable device fingerprint registration summary values, and environment fingerprint registration summary values.

[0041] When generating fingerprint registration commitment values, the device to be connected generates private salts for stable device fingerprints, variable device fingerprints, and environment fingerprints, respectively. The private salt for stable device fingerprints corresponds to the stable device fingerprint registration digest value, the private salt for variable device fingerprints corresponds to the variable device fingerprint registration digest value, and the private salt for environment fingerprints corresponds to the environment fingerprint registration digest value. The device to be connected generates a stable device fingerprint registration commitment value based on the stable device fingerprint registration digest value and its private salt; a variable device fingerprint registration commitment value based on the variable device fingerprint registration digest value and its private salt; and an environment fingerprint registration commitment value based on the environment fingerprint registration digest value and its private salt. These commitment values ​​can be generated through one-way digests, commitment algorithms, or cryptographic commitment mechanisms with concealment. Because different fingerprint levels use different private salts, even if some features in two fingerprint levels are the same or similar, no directly correlated commitment results will be generated.

[0042] After the device to be connected generates its commitment value, it sends back its device registration information. The pseudo-identifier is used to identify the device to be connected, but does not directly expose its true hardware identifier. During the registration phase, the Trusted Execution Environment (TEE) also generates registration environment measurements and sends these measurements along with the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, the environment fingerprint registration commitment value, the pseudo-identifier, proof constraints, and device fingerprint update constraints. The registration environment measurements record the trusted state of the TEE during the registration phase, enabling consistency verification between the execution environment measurements submitted during the subsequent device access phase and these registered environment measurements. Only after the execution environment measurements match the registered environment measurements are zero-knowledge access proofs verified, thus confirming whether the zero-knowledge access proof was generated by the TEE. In this embodiment, the device registration information and registration environment measurements are written into the access registration information, and a current access registration information version identifier is generated for this access registration record. The current access registration information version identifier is used to mark the registration version of the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, and the environment fingerprint registration commitment value in the device access registration table. When the variable device fingerprint registration commitment value is replaced after a subsequent legitimate update, the current access registration information version identifier is updated synchronously so as to identify the commitment value registration version used in different access stages.

[0043] As a preferred embodiment, the updated verification information includes at least the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and updated compliance proof information; The original variable device fingerprint registration commitment value correspondence is used to indicate that the variable device fingerprint registration commitment value in the current access registration information has a correspondence with the private salt and variable device fingerprint registration digest value corresponding to the variable device fingerprint feature information before the update; The correspondence between the new variable device fingerprint registration commitment value and the new private salt and new variable device fingerprint registration digest value corresponding to the updated variable device fingerprint feature information is used to indicate that the new variable device fingerprint registration commitment value corresponds to the new variable device fingerprint feature information. The updated compliance proof information is used to indicate whether the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration digest value complies with the device fingerprint update constraints.

[0044] Specifically, in this embodiment, when generating an update proof request, the current access registration information version identifier is used as the access registration information version identifier before the update. A new access registration information version candidate identifier and update proof request information are generated. The update proof request information includes a randomly generated update random variable, the access registration information version identifier before the update, the new access registration information version candidate identifier, and a variable device feature update window identifier. The update random variable is used to prevent the zero-knowledge update proof from being replayed. The access registration information version identifier before the update is used to indicate the registration version of the commitment value that will be replaced. The new access registration information version candidate identifier is used to indicate the candidate registration version of the commitment value after the update is completed. The variable device feature update window identifier is used to prove that the change in the variable device fingerprint occurred within the update window allowed by the device fingerprint update constraint.

[0045] After receiving the update proof request, the device to be accessed generates a new private salt corresponding to the updated variable device fingerprint feature information and stores it in the trusted execution environment as the new variable device fingerprint private salt. Based on the new variable device fingerprint registration digest value corresponding to the updated variable device fingerprint feature information and this new variable device fingerprint private salt, it generates a new variable device fingerprint registration commitment value. Further, the device to be accessed generates update verification information based on the private salt corresponding to the variable device fingerprint feature information before the update, the variable device fingerprint registration digest value, the new variable device fingerprint registration digest value, the new variable device fingerprint private salt, the original variable device fingerprint registration commitment value, the new variable device fingerprint registration commitment value, and the aforementioned update proof request information. This generates a zero-knowledge update proof according to the generation rules for zero-knowledge update proofs in the proof constraints. The update verification information includes at least the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and update compliance proof information. Specifically, the update compliance proof information indicates that the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration digest value conforms to the variable device feature allowable change information and variable device feature update order in the device fingerprint update constraints. Preferably, the updated verification information also includes updated proof request information bound to proof information, which is used to indicate whether the zero-knowledge update proof is bound to the updated proof request information.

[0046] It is worth noting that the verification rules for zero-knowledge update proofs in the proof constraints specify corresponding verification results for different proof results of the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and the updated compliance proof information. For example, if the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration summary value is within the range of variable device feature prohibition information in the device fingerprint update constraint, then the verification of the proof information is directly determined to be unsuccessful. When any verification in the update verification information fails, this embodiment does not perform the replacement of the variable device fingerprint registration commitment value.

[0047] As a preferred embodiment, after receiving the zero-knowledge access proof sent by the device to be accessed, the method further includes: When the device stability information consistency proof information passes verification, but the environment fingerprint association proof information fails verification, or when it is detected that the device to be accessed generates at least two zero-knowledge access proofs with different communication channel identifiers under the same access registration information, a review request is sent to the device to be accessed; wherein, the review request is used to instruct the device to be accessed to regenerate at least one of the zero-knowledge access proof and the zero-knowledge update proof and provide feedback.

[0048] It is worth noting that the environmental fingerprint association proof information in this embodiment is not used alone as a sufficient condition for allowing access, but is used in conjunction with the device stability information consistency proof information and the variable device fingerprint difference proof information. When the association between the current environmental fingerprint digest value and the environmental fingerprint registration digest value is abnormal, and the current variable device fingerprint difference proof information meets the preset device fingerprint update constraints, this embodiment does not directly perform the replacement of the variable device fingerprint registration commitment value, but first performs a verification proof. In this way, the environmental fingerprint feature information is not used to replace the stable device fingerprint feature information, nor is it used to replace the variable device fingerprint feature information, but is used to assist in identifying whether the device has undergone abnormal migration, cross-network reuse, abnormal channel access, or abnormal changes in the deployment environment.

[0049] Furthermore, when it is detected that a device to be accessed generates at least two zero-knowledge access certificates with different communication channel identifiers under the same access registration information, it indicates that there is a risk that the registration version with the same commitment value is used concurrently by multiple channels, the device fingerprint may be migrated, the certificate may be reused, or the communication channel may be abnormally copied. For the security of device access, verification of the certificate must be performed.

[0050] The verification request sent to the device to be accessed includes randomly generated verification random variables, verification time windows, verification communication channel identifiers, and verification resource ranges as verification instruction information. This instructs the device to regenerate at least one of zero-knowledge access proof and zero-knowledge update proof based on the verification instruction information. The verification time window limits the effective timeframe of the verification operation, the verification communication channel identifier locks the dedicated communication link for this verification operation, and the verification resource range limits the accessible resource range. It can be understood that if there is a legitimate update to the variable device fingerprint feature information, the device to be accessed needs to regenerate the zero-knowledge update proof; otherwise, the device only needs to regenerate the zero-knowledge access proof. If the regenerated zero-knowledge access proof or zero-knowledge update proof fails verification, the access token will be refused, or the corresponding device pseudo-identity will be marked as pending manual verification.

[0051] As a preferred embodiment, the access token includes at least the device pseudo-identifier of the device to be accessed, the target access resource identifier, the resource gateway identifier, the current access policy identifier, the proof constraint, the current access registration information version identifier of the device to be accessed, the proof digest value corresponding to the zero-knowledge access proof, the token validity period, and the access authentication type.

[0052] It's worth noting that the proof digest value corresponding to the zero-knowledge access proof is generated based on a one-way digest processing of the zero-knowledge access proof. It's used to identify this access proof in the access token and access audit log, but the complete zero-knowledge access proof does not need to be stored in the access token. Access authentication types include direct access authentication and updated access authentication. Under direct access authentication, the current variable device fingerprint digest value has not yet reached the state requiring an update commitment value relative to the variable device fingerprint registration digest value, and an access token is issued directly. Under updated access authentication, the variable device fingerprint feature update information corresponding to the current variable device fingerprint digest value has already met the update requirement, and an access token needs to be issued after completing the zero-knowledge update proof verification and updating the variable device fingerprint registration commitment value.

[0053] After receiving the access token, the resource gateway verifies the resource gateway identifier, target access resource identifier, current access policy identifier, proof constraint, current access registration information version identifier, and token validity period within the access token. The resource gateway identifier ensures that the access token can only be used by the resource gateway corresponding to the target access resource. The target resource identifier ensures that the access token can only access the specified target resource. The proof constraint ensures that the zero-knowledge proof constraint file corresponding to the access token has not been replaced. The current access registration information version identifier ensures that the device registration status verified by the resource gateway is consistent with the registration version of the commitment value used when issuing the access token. The token validity period limits the usage time of the access token. The token digest value of the access token is generated by performing one-way digest processing on the access token and written to the access audit record. After successful verification, the resource gateway establishes a session access channel corresponding to the target access resource.

[0054] In this embodiment, an access audit record is generated for each access request. The access audit record includes at least the device pseudo-identifier, the target access resource identifier, the proof constraint, the current access registration information version identifier, the proof digest value corresponding to the zero-knowledge access proof, the token digest value of the access token, the access authentication type, the review status, and the digest value of the previous access audit record. Preferably, this embodiment performs one-way digest processing on the digest value of the previous access audit record and the current access audit record to generate the digest value of the current access audit record. Through this chained digest recording method, instances of deleted, inserted, or tampered audit records can be detected during subsequent audits.

[0055] When the execution environment measurement value is inconsistent with the registered environment measurement value, zero-knowledge access proof verification fails, stable device fingerprint consistency proof information verification fails, the variable device fingerprint feature update information corresponding to the current variable device fingerprint digest value hits the variable device feature prohibition information, or the environment fingerprint association proof information verification fails and review fails, an access token is refused to be generated, and an access failure audit record is generated. The access failure audit record includes the device pseudo-identifier, target access resource identifier, proof constraint, current access registration information version identifier, failure reason identifier, and the digest value of the previous access audit record. The failure reason identifier can be used to record one or more of the following: inconsistent execution environment measurement value, proof verification failure, stable device fingerprint anomaly, variable device feature prohibition of change, environment fingerprint anomaly, communication channel anomaly, or token generation failure. This embodiment can include the access failure audit record and the normal access audit record together in a chained digest record for subsequent tracing of abnormal access requests.

[0056] It is worth noting that when the access authentication type is the updated access authentication type, the access token also includes the proof digest value corresponding to the zero-knowledge update proof. This digest value is generated by performing one-way digest processing on the zero-knowledge update proof and is used to identify the updated proof in the access audit record.

[0057] This invention can be applied to industrial IoT devices, power communication terminals, edge computing nodes, campus gateways, industrial control gateways, and network access scenarios requiring joint authentication of device identity and access resources. The target access resource can be a device management platform, industrial data service interface, operation and maintenance control interface, configuration distribution interface, or business data interface. By jointly processing device identity verification, target resource access, communication channel constraints, and resource gateway verification, this invention can adapt to access management scenarios involving multiple devices, multiple resources, and multiple gateways.

[0058] To illustrate the technical advantages of the embodiments of the present invention compared to existing device fingerprint network access methods, two sets of access authentication schemes were constructed and compared in an exemplary test environment. The first set of access authentication schemes adopted a holistic device fingerprint verification scheme similar to the holistic device fingerprint network access approach in the background art, i.e., collecting device information to generate a holistic device fingerprint, and then controlling device network access after fingerprint verification by the access management terminal. The second set adopted the device access method of the embodiments of the present invention. The test devices consisted of a batch of edge gateway terminals, with a total of 100 devices. The target access resource was an industrial data service interface, and the total number of access requests was 2000. During the test, scenarios such as legitimate firmware upgrades, legitimate configuration adjustments, slight changes in network location, illegal device duplication, replay of access data, and cross-resource reuse of access results were set. The test network was an isolated industrial Ethernet test environment, and the resource gateway and the access management terminal were connected through a secure channel. Legitimate firmware upgrades are performed using signed and verified firmware packages. Legitimate configuration adjustments are performed using pre-registered configuration templates. Illegal device copying is simulated by copying device configuration files but not the non-migratable hardware features. Replay access data scenarios involve resubmitting previously generated historical access certificates and tokens. Cross-target resource reuse scenarios involve submitting the access certificate generated for the first target access resource to the resource gateway corresponding to the second target access resource for verification. Table 1 below shows the comparative data generated under the above test conditions.

[0059] Table 1 Comparison of Device Access Authentication Schemes As can be seen from the data in the table, under the scenario of legitimate device access, the embodiments of the present invention jointly complete authentication through device stability information consistency proof information, variable device fingerprint difference proof information, and environmental fingerprint association proof information. This can reduce the probability of legitimate devices being falsely rejected due to firmware upgrades or configuration adjustments while maintaining access security. In the scenario of illegally copied devices, since the stable device fingerprint feature information includes hardware non-transferable features, trusted boot root measurement features, and secure storage measurement features, and the zero-knowledge access proof requires proof that the current stable device fingerprint digest value meets the consistency requirements of the stable device fingerprint, illegally copied devices are unlikely to pass authentication. In the scenarios of replaying access data and cross-target resource reuse, since information binding verification requires writing access random quantities, target access resource identifiers, current access policy identifiers, communication channel identifiers, resource gateway identifiers, and proof constraints into the zero-knowledge access proof, the generated zero-knowledge access proof is difficult to reuse in other access random quantities, other target access resources, other communication channels, or other resource gateways.

[0060] Furthermore, to illustrate the technical effectiveness of the variable device fingerprint update mechanism, devices undergoing legitimate firmware upgrades or legitimate configuration adjustments were selected for specific testing in the test environment. The test settings included: legitimate firmware version upgrades, authorized adjustments to configuration baseline features, unchanged interface enumeration features, and driver loading features changing according to the variable feature update order. The access management terminal determined whether the variable device fingerprint feature update information corresponding to the current variable device fingerprint digest value was updatable based on the device fingerprint update constraints, and verified the legality of the new variable device fingerprint registration commitment value through zero-knowledge update proof. The test results are shown in Table 2 below.

[0061] Table 2. Test Results of the Zero-Knowledge Update Scheme As can be seen from the test data above, this embodiment of the invention completes the replacement of the variable device fingerprint registration commitment value through zero-knowledge update proof. Without exposing the current variable device fingerprint digest value and the new variable device fingerprint private salt, the access management terminal can verify whether the changes in the variable device fingerprint conform to the variable device feature allowable change information, the variable device feature update order, and the variable device feature update window. Compared with schemes requiring manual re-registration or complete re-collection, this embodiment of the invention can reduce access interruptions after legitimate maintenance and avoid the replay of update proof request information.

[0062] Please see Figure 2 A second aspect of the present invention provides a device access apparatus 100, comprising: The zero-knowledge access proof receiving module 11 is used to receive the zero-knowledge access proof sent by the device to be accessed; wherein, the zero-knowledge access proof includes at least device stability information consistency proof information, variable device fingerprint difference proof information, and environmental fingerprint association proof information; The update proof request module 12 is used to send an update proof request to the device to be connected when the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; The access token sending module 13 is used to update the access registration information of the device to be accessed based on the new variable device fingerprint registration commitment value when it receives the zero-knowledge update proof from the device to be accessed and the zero-knowledge update proof passes verification, and to send an access token to the resource gateway corresponding to the target access resource; wherein, the access token is used to instruct the resource gateway to allow the device to be accessed to access the target access resource.

[0063] As a preferred embodiment, before the device receives the zero-knowledge access certificate sent by the device to be accessed, it is further configured to: When an access request is received from the device to be accessed, an access proof request is sent to the device to be accessed; wherein, the access proof request is used to instruct the device to be accessed to generate the zero-knowledge access proof based on the current device fingerprint digest value and its corresponding private salt, the environment fingerprint digest value and its corresponding private salt, and fingerprint registration information; the device fingerprint digest value includes a stable device fingerprint digest value and a variable device fingerprint digest value; The device stability information consistency proof information includes commitment value consistency proof information and stable device fingerprint consistency proof information; the commitment value consistency proof information is used to indicate the consistency between each verification commitment value and each registration commitment value in the access registration information; each verification commitment value is generated based on the private salt, the stable device fingerprint registration digest value, the variable device fingerprint registration digest value, and the environment fingerprint registration digest value in the fingerprint registration information.

[0064] As a preferred embodiment, after receiving the zero-knowledge access certificate sent by the device to be accessed, the device is further configured to: Based on the first access proof binding information in the access proof request, the second access proof binding information in the zero-knowledge access proof is verified; wherein, the first access proof binding information includes at least an access random variable, a target access resource identifier, a current access policy identifier, a communication channel identifier, a resource gateway identifier, and a proof constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; When the first access proof binding information is consistent with the second access proof binding information, it is determined that the zero-knowledge access proof has passed the information binding verification, and the device stability information consistency proof information, the variable device fingerprint difference proof information, and the environment fingerprint association proof information are verified based on the access registration information and the verification rules; wherein, the access registration information includes at least the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, and the environment fingerprint registration commitment value.

[0065] As a preferred embodiment, the device is further used for: When a registration request from the device to be accessed is received, registration instruction information is sent to the device to be accessed; wherein, the registration instruction information includes at least a fingerprint feature collection strategy, a proof constraint, and a device fingerprint update constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; the fingerprint feature collection strategy is used to instruct the device to be accessed to collect stable device fingerprint feature information, variable device fingerprint feature information, and environmental fingerprint feature information; When the device registration information fed back by the device to be accessed in response to the registration instruction information is received, the device registration information is written into the access registration information, and an access registration information version identifier corresponding to the device registration information is generated; wherein, the device registration information includes at least a stable device fingerprint registration commitment value, a variable device fingerprint registration commitment value, an environmental fingerprint registration commitment value, a device pseudo-identifier of the device to be accessed, the proof constraint, and the device fingerprint update constraint; The stable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the stable device fingerprint feature information it generates and the stable device fingerprint registration digest value; The variable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the variable device fingerprint feature information it generates and the variable device fingerprint registration digest value; The environmental fingerprint registration commitment value is generated by the device to be connected based on the private salt and environmental fingerprint registration digest value corresponding to the environmental fingerprint feature information it generates.

[0066] As a preferred embodiment, the updated verification information includes at least the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and updated compliance proof information; The original variable device fingerprint registration commitment value correspondence is used to indicate that the variable device fingerprint registration commitment value in the current access registration information has a correspondence with the private salt and variable device fingerprint registration digest value corresponding to the variable device fingerprint feature information before the update; The correspondence between the new variable device fingerprint registration commitment value and the new private salt and new variable device fingerprint registration digest value corresponding to the updated variable device fingerprint feature information is used to indicate that the new variable device fingerprint registration commitment value corresponds to the new variable device fingerprint feature information. The updated compliance proof information is used to indicate whether the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration digest value complies with the device fingerprint update constraints.

[0067] As a preferred embodiment, after receiving the zero-knowledge access certificate sent by the device to be accessed, the device is further configured to: When the device stability information consistency proof information passes verification, but the environment fingerprint association proof information fails verification, or when it is detected that the device to be accessed generates at least two zero-knowledge access proofs with different communication channel identifiers under the same access registration information, a review request is sent to the device to be accessed; wherein, the review request is used to instruct the device to be accessed to regenerate at least one of the zero-knowledge access proof and the zero-knowledge update proof and provide feedback.

[0068] As a preferred embodiment, the access token includes at least the device pseudo-identifier of the device to be accessed, the target access resource identifier, the resource gateway identifier, the current access policy identifier, the proof constraint, the current access registration information version identifier of the device to be accessed, the proof digest value corresponding to the zero-knowledge access proof, the token validity period, and the access authentication type.

[0069] The device access device 100 provided in this embodiment of the invention verifies the consistency of device stability information, the difference of variable device fingerprints, and the association of environmental fingerprints during the device access authentication stage, and sets corresponding device fingerprint update constraints for variable device fingerprints. This enables compliance verification of the update of variable device fingerprint feature information while ensuring device access security, effectively avoiding misjudging the device as an abnormal device when the device to be accessed undergoes a legitimate firmware upgrade or configuration adjustment, thus achieving a balance between device access security and authentication accuracy.

[0070] Please see Figure 3 The second aspect of the present invention provides an electronic device 200, including a memory 22, a processor 21, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the device access method described in any embodiment of the first aspect.

[0071] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device 200.

[0072] The electronic device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the electronic device 200 and does not constitute a limitation on the electronic device 200. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the electronic device 200 may also include input / output devices, network access devices, buses, etc.

[0073] The processor 21 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor 21 can be any conventional processor 21. The processor 21 is the control center of the electronic device 200, connecting various parts of the electronic device 200 via various interfaces and lines.

[0074] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the electronic device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0075] A third aspect of the present invention provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the device access method described in any embodiment of the first aspect.

[0076] Wherein, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0077] The device access method, apparatus, device, and storage medium provided in this invention have the following advantages: (1) By verifying the consistency of device stability information, the difference of variable device fingerprints and the association of environmental fingerprints during the device access authentication stage, and setting corresponding device fingerprint update constraints for variable device fingerprints, it is possible to verify the compliance of the update of variable device fingerprint feature information while ensuring the security of device access. This effectively avoids misjudging the device as an abnormal device when the device to be accessed undergoes a legitimate firmware upgrade or configuration adjustment, thus achieving a balance between device access security and authentication accuracy.

[0078] (2) By registering the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value and the environmental fingerprint registration commitment value respectively, subsequent verification can be completed without saving the plaintext data of the device fingerprint feature set, thereby reducing the risk of device fingerprint leakage and cross-resource association.

[0079] (3) By using zero-knowledge access proof, the consistency of commitment value, consistency of stable device fingerprint, difference of variable device fingerprint, association of environmental fingerprint and information binding are verified simultaneously, so that the access authentication result is bound to the target access resource, access policy, communication channel and resource gateway, preventing access proof from being replayed, migrated or reused across resources.

[0080] (4) The variable device fingerprint registration commitment value is replaced by zero-knowledge update proof, so that the device can continue to access the target access resources after a legitimate firmware upgrade or configuration adjustment, while not exposing the current variable device fingerprint digest value and the new variable device fingerprint private salt.

[0081] (5) By linking the current access registration information version identifier, access token and access audit record, each access request, commitment value update, token issuance and gateway verification is traceable, which facilitates subsequent security audit and anomaly review.

[0082] (6) By combining the information prohibition of changes to variable device features, the verification status and the access failure audit record, risks such as unauthorized firmware replacement, security policy downgrade, abnormal trusted execution environment, abnormal communication channel and cross-resource reuse can be rejected or verified, thereby forming a more complete security closed loop.

[0083] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A device access method, characterized in that, include: Receive zero-knowledge access proof sent by the device to be accessed; wherein, the zero-knowledge access proof includes at least device stability information consistency proof information, variable device fingerprint difference proof information, and environmental fingerprint association proof information; When the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints, an update proof request is sent to the device to be connected; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; When the zero-knowledge update proof is received from the device to be accessed, and the zero-knowledge update proof is verified, the access registration information of the device to be accessed is updated based on the new variable device fingerprint registration commitment value, and an access token is sent to the resource gateway corresponding to the target access resource; wherein, the access token is used to instruct the resource gateway to allow the device to be accessed to access the target access resource.

2. The device access method as described in claim 1, characterized in that, Before receiving the zero-knowledge access certificate sent by the device to be accessed, the method further includes: When an access request is received from the device to be accessed, an access proof request is sent to the device to be accessed; wherein, the access proof request is used to instruct the device to be accessed to generate the zero-knowledge access proof based on the current device fingerprint digest value and its corresponding private salt, the environment fingerprint digest value and its corresponding private salt, and fingerprint registration information; the device fingerprint digest value includes a stable device fingerprint digest value and a variable device fingerprint digest value; The device stability information consistency proof information includes commitment value consistency proof information and stable device fingerprint consistency proof information; the commitment value consistency proof information is used to indicate the consistency between each verification commitment value and each registration commitment value in the access registration information; each verification commitment value is generated based on the private salt, the stable device fingerprint registration digest value, the variable device fingerprint registration digest value, and the environment fingerprint registration digest value in the fingerprint registration information.

3. The device access method as described in claim 2, characterized in that, After receiving the zero-knowledge access certificate sent by the device to be accessed, the method further includes: Based on the first access proof binding information in the access proof request, the second access proof binding information in the zero-knowledge access proof is verified; wherein, the first access proof binding information includes at least an access random variable, a target access resource identifier, a current access policy identifier, a communication channel identifier, a resource gateway identifier, and a proof constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; When the first access proof binding information is consistent with the second access proof binding information, it is determined that the zero-knowledge access proof has passed the information binding verification, and the device stability information consistency proof information, the variable device fingerprint difference proof information, and the environment fingerprint association proof information are verified based on the access registration information and the verification rules; wherein, the access registration information includes at least the stable device fingerprint registration commitment value, the variable device fingerprint registration commitment value, and the environment fingerprint registration commitment value.

4. The device access method as described in claim 1, characterized in that, The method further includes: When a registration request from the device to be accessed is received, registration instruction information is sent to the device to be accessed; wherein, the registration instruction information includes at least a fingerprint feature collection strategy, a proof constraint, and a device fingerprint update constraint; the proof constraint is used to indicate the generation rules and verification rules of the zero-knowledge access proof and the zero-knowledge update proof; the fingerprint feature collection strategy is used to instruct the device to be accessed to collect stable device fingerprint feature information, variable device fingerprint feature information, and environmental fingerprint feature information; When the device registration information fed back by the device to be accessed in response to the registration instruction information is received, the device registration information is written into the access registration information, and an access registration information version identifier corresponding to the device registration information is generated; wherein, the device registration information includes at least a stable device fingerprint registration commitment value, a variable device fingerprint registration commitment value, an environmental fingerprint registration commitment value, a device pseudo-identifier of the device to be accessed, the proof constraint, and the device fingerprint update constraint; The stable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the stable device fingerprint feature information it generates and the stable device fingerprint registration digest value; The variable device fingerprint registration commitment value is generated by the device to be accessed based on the private salt corresponding to the variable device fingerprint feature information it generates and the variable device fingerprint registration digest value; The environmental fingerprint registration commitment value is generated by the device to be connected based on the private salt and environmental fingerprint registration digest value corresponding to the environmental fingerprint feature information it generates.

5. The device access method as described in claim 4, characterized in that, The updated verification information includes at least the original variable device fingerprint registration commitment value correspondence, the new variable device fingerprint registration commitment value correspondence, and updated compliance proof information; The original variable device fingerprint registration commitment value correspondence is used to indicate that the variable device fingerprint registration commitment value in the current access registration information has a correspondence with the private salt and variable device fingerprint registration digest value corresponding to the variable device fingerprint feature information before the update; The correspondence between the new variable device fingerprint registration commitment value and the new private salt and new variable device fingerprint registration digest value corresponding to the updated variable device fingerprint feature information is used to indicate that the new variable device fingerprint registration commitment value corresponds to the new variable device fingerprint feature information. The updated compliance proof information is used to indicate whether the variable device fingerprint feature update information corresponding to the new variable device fingerprint registration digest value complies with the device fingerprint update constraints.

6. The device access method as described in claim 3, characterized in that, After receiving the zero-knowledge access certificate sent by the device to be accessed, the method further includes: When the device stability information consistency proof information passes verification, but the environment fingerprint association proof information fails verification, or when it is detected that the device to be accessed generates at least two zero-knowledge access proofs with different communication channel identifiers under the same access registration information, a review request is sent to the device to be accessed; wherein, the review request is used to instruct the device to be accessed to regenerate at least one of the zero-knowledge access proof and the zero-knowledge update proof and provide feedback.

7. The device access method as described in claim 3, characterized in that, The access token includes at least the device pseudo-identifier of the device to be accessed, the target access resource identifier, the resource gateway identifier, the current access policy identifier, the proof constraint, the current access registration information version identifier of the device to be accessed, the proof digest value corresponding to the zero-knowledge access proof, the token validity period, and the access authentication type.

8. A device access device, characterized in that, include: The zero-knowledge access certificate receiving module is used to receive the zero-knowledge access certificate sent by the device to be accessed; wherein, the zero-knowledge access certificate includes at least the device stability information consistency certificate information, the variable device fingerprint difference certificate information, and the environmental fingerprint association certificate information; The update proof request module is used to send an update proof request to the device to be connected when the device stability information consistency proof information and the environmental fingerprint association proof information pass verification, and the variable device fingerprint difference proof information meets the preset device fingerprint update constraints; wherein, the update proof request is used to instruct the device to be connected to provide a zero-knowledge update proof; the zero-knowledge update proof is used to indicate the new variable device fingerprint registration commitment value and its corresponding update verification information; The access token sending module is used to update the access registration information of the device to be accessed based on the new variable device fingerprint registration commitment value when it receives the zero-knowledge update proof from the device to be accessed and the zero-knowledge update proof passes verification, and then sends an access token to the resource gateway corresponding to the target access resource; wherein, the access token is used to instruct the resource gateway to allow the device to be accessed to access the target access resource.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the device access method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the device access method according to any one of claims 1 to 7.

Images