Key authentication method and apparatus, electronic device, and storage medium

Abstract

The present application provides a key authentication method and apparatus, an electronic device, and a storage medium. The key authentication method provided in the present application comprises: on the basis of a key authentication request sent by a user terminal, determining user information, wherein the key authentication request comprises the user information and an initial key; determining whether or not the initial key matches a first key, wherein the first key is used for determining whether the user terminal has a registration requirement for a pre-shared key; and if the initial key matches the first key, registering a first pre-shared key for the user terminal, and binding the first pre-shared key with the user information.

Description

Key authentication method, device, electronic device and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on August 30, 2023, with application number 202311108714.X and invention name “A key authentication method, device and electronic device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to a key authentication method, device, electronic device and storage medium. Background Art

[0004] Before a terminal device can access the Internet, it is usually necessary to authenticate the user's identity to restrict unauthorized users from accessing the network and ensure the security of network operation.

[0005] Currently, there are two user authentication methods: 802.1x protocol authentication and Web authentication. However, some terminal devices with wireless network cards, such as cameras, game consoles, smart TVs, medical tablets, and printers, lack graphical interfaces and may not support either 802.1x or Web authentication. Therefore, to ensure that these terminal devices securely connect to the enterprise intranet according to unified authentication rules, pre-shared key (PSK) authentication can be used.

[0006] PSK authentication is a wireless network-based security authentication method. When using PSK for user authentication, the device administrator must create a unique PSK for each client and assign the PSK to the user. When the user connects to the wireless network, the user's identity is authenticated based on the PSK entered by the client.

[0007] Summary of the Invention

[0008] Each exemplary embodiment of the present application provides a key authentication method, device, electronic device and storage medium, and the specific technical solutions are as follows.

[0009] In a first aspect, the present application provides a key authentication method, comprising:

[0010] Determining user information based on a key authentication request sent by a user terminal; wherein the key authentication request includes the user information and an initial key;

[0011] Determining whether the initial key matches a first key; wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key; and

[0012] When the initial key matches the first key, a first pre-shared key is registered for the user terminal, and the first pre-shared key is bound to the user information.

[0013] Based on the above method, users can register based on key requests, which can avoid the need to manually bind the pre-shared key with user information in advance when registering, thereby simplifying the registration process.

[0014] In a possible implementation, before determining whether the initial key matches the first key, the method further includes:

[0015] Determining whether the user information is bound to a pre-shared key; and

[0016] When the user information is not bound to a pre-shared key, it is determined whether the initial key matches the first key.

[0017] Based on the above implementation, users can register based on key requests, which can avoid the service authentication end switching back and forth between registration signals and authentication signals when new users pre-acquire Internet access permissions, and realize the function of pre-shared key registration and authentication based on the same signal.

[0018] In a possible implementation, when the user information is bound to a pre-shared key, determining whether the initial key matches a second pre-shared key bound to the user information; and

[0019] When the initial key matches the second pre-shared key bound to the user information, an authentication message associated with the second pre-shared key is sent to the user terminal.

[0020] In a possible implementation, the authentication information associated with the second pre-shared key includes at least one of authorized virtual local area network information and quality of service information.

[0021] In a possible implementation, when the initial key does not match the second pre-shared key bound to the user information, a feedback message indicating an initial key authentication error is sent to the user terminal.

[0022] In a possible implementation, the feedback message includes an error type of the initial key authentication error.

[0023] In this embodiment, the user terminal may adjust the initial key based on the error type in the feedback message and re-authenticate.

[0024] In a possible implementation, determining whether the initial key matches the second pre-shared key bound to the user information includes:

[0025] Determining an encryption parameter value based on the key authentication request;

[0026] Encrypting the initial key according to the encryption parameter value to obtain a first encryption key;

[0027] encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key; and

[0028] When the first encryption key matches the second encryption key, it is determined that the initial key matches the second pre-shared key.

[0029] In a possible implementation, when the initial key does not match the first key, the method further includes:

[0030] determining whether the initial key matches the second key, wherein the second key is a pre-shared key in a set of pre-shared keys; and

[0031] When the initial key matches the second key, the second key is bound to the user information, and an authentication message associated with the second key is sent to the user terminal.

[0032] In this embodiment, by polling and comparing the initial key with each second key, dynamic binding of the pre-shared key and the current user information can be achieved, that is, the function of one code for multiple machines, and the efficiency of authenticating the user identity can be improved.

[0033] In a possible implementation, determining whether the initial key matches the second key includes:

[0034] Determining an encryption parameter value based on the key authentication request;

[0035] Encrypting the initial key according to the encryption parameter value to obtain a third encryption key;

[0036] Determining the second key from a set pre-shared key set;

[0037] encrypting the second key according to the encryption parameter value to obtain a fourth encryption key;

[0038] determining whether the third encryption key matches the fourth encryption key;

[0039] When the third encryption key matches the fourth encryption key, the second key is bound to the user information, and the authentication message associated with the second key is sent to the user terminal.

[0040] In a possible implementation, when the third encryption key does not match the fourth encryption key, the next candidate pre-shared key in the pre-shared key set is selected as the second key.

[0041] In a possible implementation, when the initial key does not match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

[0042] In a possible implementation, registering a first pre-shared key for the user terminal and binding the first pre-shared key with the user information includes:

[0043] Determining the registration information sent by the user terminal;

[0044] When determining that the registration information satisfies a preset registration rule, registering the first pre-shared key for the user terminal; and

[0045] The first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0046] In this embodiment, by setting the first pre-shared key registration approval mechanism, it is possible to prevent users that do not meet the pre-shared key registration requirements from registering pre-shared keys, thereby improving the security of pre-shared key registration for users.

[0047] In a possible implementation, when it is determined that the registration information does not meet the registration rules, a prompt is provided for manual review.

[0048] In a possible implementation, registering a first pre-shared key for the user terminal includes:

[0049] Sending a receiving message to the user terminal, wherein the receiving message includes at least one of the following information: a registered role, a name of the registered role, a jump address, and a public key; and

[0050] Receive registration information sent by the user terminal, and determine the first pre-shared key based on the registration information and a set random generation algorithm.

[0051] In a possible implementation, after the first pre-shared key is registered for the user terminal, a logoff request is sent to the user terminal, where the logoff request is used to request the user terminal to disconnect the registration connection.

[0052] In a second aspect, the present application provides a key authentication device, comprising:

[0053] A key query module, configured to determine user information in a key authentication request sent by a user terminal; wherein the key authentication request includes the user information and an initial key;

[0054] a key authentication module, configured to determine whether the initial key sent by the user terminal matches a key in a service authentication terminal key set, wherein the service authentication terminal key set includes a first key, and the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key; and

[0055] When the initial key matches the first key, a first pre-shared key is registered for the user terminal, and the first pre-shared key is bound to the user information.

[0056] In a possible implementation, the key authentication module is further configured to:

[0057] Determining whether the user information is bound to a pre-shared key; and

[0058] When the user information is not bound to a pre-shared key, it is determined whether the initial key matches the first key.

[0059] In a possible implementation, the key authentication module is further configured to:

[0060] When the initial key does not match the first key, determining whether the initial key matches a second key, wherein the second key is a pre-shared key in a set of pre-shared keys;

[0061] When the initial key matches the second key, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal; and

[0062] When the initial key does not match the second key, a first feedback message indicating that the initial key authentication fails is sent to the user terminal.

[0063] In one possible implementation, the key authentication module is specifically configured to:

[0064] The key authentication module is specifically used for:

[0065] Determining the registration information sent by the user terminal;

[0066] Determining whether the registration information satisfies a preset registration rule; and

[0067] When it is determined that the registration information satisfies the registration rule, the first pre-shared key is registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0068] In a third aspect, the present application provides an electronic device, comprising:

[0069] Memory for storing computer programs;

[0070] The processor is configured to implement the steps of the above-mentioned key authentication method when executing the computer program stored in the memory.

[0071] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned key authentication method are implemented.

[0072] In a fifth aspect, the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned key authentication method.

[0073] For each of the above-mentioned aspects from the second to the fifth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or the various possible solutions in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For those of ordinary skill in the art, drawings of other embodiments can be obtained based on these drawings without creative work. The drawings herein are incorporated into and constitute a part of the specification, illustrating embodiments consistent with the present application and, together with the specification, are used to explain the principles of the present application.

[0075] FIG1 is a flowchart of a key authentication method provided in an embodiment of the present application.

[0076] FIG2 is a schematic diagram of the key authentication system architecture provided in an embodiment of the present application.

[0077] FIG3 is a flowchart of an initial key authentication provided by an embodiment of the present application.

[0078] FIG4 is a flowchart of a first pre-shared key registration approval process provided by an embodiment of the present application.

[0079] FIG5 is a flowchart of a key authentication method provided in an embodiment of the present application.

[0080] FIG6 is a schematic structural diagram of a key authentication device provided in an embodiment of the present application.

[0081] FIG7 is a schematic structural diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0082] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent the following two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0083] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0084] Before a terminal device can access the Internet, it is usually necessary to authenticate the user's identity to restrict unauthorized users from accessing the network and ensure the security of network operation.

[0085] Currently, there are two user authentication methods: 802.1x protocol authentication and Web authentication. However, some terminal devices with wireless network cards, such as cameras, game consoles, smart TVs, medical tablets, and printers, lack graphical user interfaces and may not support either 802.1x protocol authentication or Web authentication. Therefore, to ensure that these terminal devices securely connect to the enterprise intranet according to unified authentication rules, pre-shared key authentication can be used.

[0086] PSK authentication is a wireless network-based security authentication method. When using PSK for user authentication, the device administrator must create a unique PSK for each client and assign the PSK to the user. When the user connects to the wireless network, the user's identity is authenticated based on the PSK entered by the client.

[0087] However, before using PSK authentication for user authentication, the device administrator needs to collect the media access control address (MAC address) information of each terminal device, register the PSK information of the terminal device running the user terminal, and then bind the MAC address information with the PSK information and send the binding result to the terminal device.

[0088] If the above-mentioned PSK authentication method is used to authenticate the identities of multiple users, the users need to enter a unique PSK on the terminal device to which the PSK information has been bound. This limits the use of the PSK, increases the difficulty for the device administrator to maintain the PSK configuration information of multiple sets of terminal devices, and reduces the efficiency of user identity authentication.

[0089] In order to improve the efficiency of authenticating user identities, an exemplary embodiment of the present application provides a key authentication method, which specifically includes: first determining user information in a key authentication request sent by the user terminal, determining whether the user information has been bound to a pre-shared key, and then, when it is determined that the user information is not bound to a pre-shared key, determining whether the initial key sent by the user terminal matches the first key; if so, registering the first pre-shared key for the user terminal, and binding the first pre-shared key to the user information.

[0090] Through the method provided by the exemplary embodiment of the present application, the service authentication end can determine whether the current user end has been bound to a pre-shared key based on the user information of the user end, and then determine the first pre-shared key corresponding to the registered user information of the user end or directly authenticate the pre-shared key; the present application registers and authenticates the pre-shared key based on the same signal, which can avoid switching back and forth between the registration signal and the authentication signal, and improve the efficiency of authenticating the user identity.

[0091] Referring to Figure 1, which is a flowchart of a key authentication method provided in an embodiment of the present application, the method may include the following steps.

[0092] S1, determining user information in a key authentication request sent by a user terminal, and determining whether the user information has been bound to a pre-shared key.

[0093] The method provided in the embodiment of the present application can be applied to the system architecture shown in Figure 2, which includes: a service authentication end, a terminal device, a user end, and an access device, and the method provided in the present application can be run in the service authentication end.

[0094] The following is a brief introduction to the above devices and their respective functions.

[0095] The service authentication end can be an authentication server that performs network authentication on a user terminal or terminal device. The authentication server is connected to the user terminal and responds to authentication service requests sent by the user terminal. The service authentication end can be a network access server, access point (AP), or Ethernet switch, and this application does not impose specific restrictions on this.

[0096] The terminal device can be any type of terminal with a wireless network card, such as a camera, game console, smart TV, medical monitor, medical tablet, printer or any other type of IoT device. This application does not impose any specific restrictions on the type and quantity of the terminal device.

[0097] The user end (client) can run in the terminal device and can provide local services for users. After receiving the initial key entered by the user, it sends an authentication service request to the service authentication end to request network services.

[0098] Access devices are used to remotely access network resources, including access points, routers, multiplexers, and modems, and are used to forward authentication service requests sent by the user end to the service authentication end.

[0099] In an embodiment of the present application, as shown in FIG3 , the user first determines the wireless network to be connected based on the service set identifier (English: Service Set Identifier, abbreviated as SSID) signal (i.e., the name of the wireless signal sent by the access device). The subsequent registration and authentication processes of the pre-shared key in this application are all based on the SSID signal. After the user determines the wireless network, he can connect to the wireless network, which includes a network access point or a WiFi hotspot. The user enters the initial key in the authentication login interface of the user terminal. The initial key includes all pre-shared keys registered by the user terminal, the application key for the user terminal to register the pre-shared key, or the non-application key. After the user enters the initial key, the user terminal can automatically send a key authentication request to the service authentication terminal. In order to authenticate the user terminal, the service authentication terminal first needs to establish a communication connection between the user terminal and the access device before receiving the key authentication request sent by the user terminal, and forward the key authentication request to the service authentication terminal through the access device. This application uses a four-way handshake method to establish a communication connection between the user terminal and the access device. The specific four-way handshake process is as follows.

[0100] (1) The user initiates an encrypted communication request to the access device.

[0101] (2) After receiving the encrypted communication request, the access device sends a feedback message to the user end.

[0102] (3) After receiving the feedback message sent by the access device, the user terminal verifies the access device certificate to determine whether to establish a communication connection with the access device.

[0103] (4) After receiving the random number sent by the user, the access device calculates and generates a session key and sends key information to the user. The key information includes the encryption method (encryption rule), encryption field, random number, etc.

[0104] After establishing a communication connection with the user terminal, the access device can receive a key authentication request sent by the user terminal, and then forward the key authentication request and key information to the service authentication terminal, which then authenticates the user identity. The specific authentication process is as follows.

[0105] The service authentication end determines the user information from the key authentication request. The user information can be a unique identifier that identifies the user, such as a Media Access Control (MAC) address. Based on the user information, such as the terminal device information, the service authentication end determines whether the current terminal device is bound to a pre-shared key.

[0106] Based on the user information, the service authentication terminal can determine whether the user information is bound to a pre-shared key. In an exemplary embodiment of the present application, this can be determined by establishing a mapping relationship between the user information and the pre-shared key. Different user information can be bound to the same pre-shared key. In this case, a pre-shared key can support use by multiple user terminals, increasing the number of user terminals. This application does not specifically limit the amount of user information that can be bound to a pre-shared key.

[0107] When the service authentication end determines that the user information has been bound to the pre-shared key, it determines that the current user end does not need to register the pre-shared key and directly authenticates the current user end with the pre-shared key. The service authentication end determines whether the initial key matches the second pre-shared key bound to the user information.

[0108] In an embodiment of the present application, the steps for authenticating the pre-shared key for a user terminal that has been bound to a pre-shared key are as follows.

[0109] The service authentication end receives the key authentication request and parses the key information in the key authentication request to obtain encryption parameter values ​​such as the encryption method (encryption rule), encryption field, and random number. The service authentication end then uses the initial key received from the user end as the target pre-shared key and encrypts the target pre-shared key according to the encryption parameter values ​​to obtain a first encryption key. In this embodiment of the present application, the initial key is the pre-shared key to be authenticated.

[0110] The service authentication end determines a second pre-shared key that matches the user information in the set pre-shared key set based on the user information. Each pre-shared key in the pre-shared key set records the corresponding user information. For example, pre-shared key 1 corresponds to user information 1, and pre-shared key 2 corresponds to user information 2. No further details are given here.

[0111] After determining the second pre-shared key that matches the user information, the second pre-shared key can be encrypted using the same encryption parameter value as the target pre-shared key to obtain a second encryption key, and then a determination is made as to whether the first encryption key matches the second encryption key. The determination as to whether the first encryption key matches the second encryption key can be made based on a first value of the first encryption key and a second value of the second encryption key. If the first value and the second value are the same, then the first encryption key and the second encryption key are determined to match; otherwise, the first encryption key and the second encryption key are determined to not match.

[0112] When the service authentication end determines that the first encryption key matches the second encryption key, it may send an authentication message related to the second pre-shared key to the access device. After receiving the authentication message related to the second pre-shared key, the access device forwards the authentication message related to the second pre-shared key to the user end. The authentication message may be an Accept message, which includes authorization attributes such as the authorized virtual local area network (VLAN) and quality of service (QOS).

[0113] When the service authentication end determines that the first encryption key and the second encryption key fail to match, it can send a feedback message of a target pre-shared key authentication error to the access device. After receiving the feedback information of the target pre-shared key authentication error, the access device forwards the feedback message of the target pre-shared key authentication error to the user end. The feedback message can be a reject message. Based on the reject message, the user end can determine the error type of the key authentication error. For example, if the error type is an error in the input initial key, the user end re-enters the initial key according to the error type and authenticates the pre-shared key again.

[0114] Through the above method, the service authentication end can directly authenticate the pre-shared key to the user end that has been bound to the pre-shared key, thereby improving the efficiency of user identity authentication.

[0115] S2: When it is determined that the user information is not bound to the pre-shared key, determine whether the initial key sent by the user terminal matches the first key.

[0116] In an exemplary embodiment of the present application, when the service authentication end determines that the user information is not bound to the pre-shared key, it determines whether the initial key matches the first key based on the received initial key. The first key is the application key for the pre-shared key set by the service authentication end. The service authentication end can determine whether the current user end has a registration requirement for the pre-shared key based on the first key. In actual usage scenarios, such as in hotel scenarios, the first key can be the public key provided in the customer's room card. The application key can be a character sequence (string) consisting of letters and numbers, for example: x123456x. This application does not impose specific restrictions on the character combination method of the application key and the number of application keys set.

[0117] The service authentication end determines whether the initial key matches the first key in the following steps.

[0118] Parse the encryption parameter values ​​such as encryption method (encryption rule), encryption field, random number, etc. in the key authentication request.

[0119] The initial key is encrypted according to the above encryption parameter value to obtain a first encryption value, and then a first key is selected from the first key set to determine whether the first key is equal to the first encryption value. If so, it is determined that the current user terminal has a registration requirement for a pre-shared key; if not, the next first key is selected from the first key set, and the above steps are repeated until all the first keys in the first key set are polled.

[0120] If a first key equal to the first encrypted value exists in the first key set, that is, the initial key matches the first key, a first pre-shared key is registered for the user terminal and the first pre-shared key is bound to the user information. If a first key equal to the first encrypted value does not exist in the first key set, that is, the initial key fails to match the first key, the initial key may be matched with a second key or a second feedback message indicating that the initial key authentication failed may be sent to the user terminal.

[0121] Through the above method, a pre-shared key can be registered for a user terminal that has a pre-shared key registration requirement, thereby improving the efficiency of authenticating the user identity.

[0122] S3: Register a first pre-shared key for the user terminal and bind the first pre-shared key to the user information.

[0123] In an embodiment of the present application, when the service authentication end determines that there is a first key matching the first encryption value in the first key set, it can register a first pre-shared key for the current user end. The specific steps of registering the first pre-shared key are as follows.

[0124] The service authentication end returns an Accept message to the access device. The Accept message contains authorization attributes such as the registered role, the name of the registered role, the jump address, and the public key. The public key can be the same as the initial key entered by the user.

[0125] The access device redirects the terminal to the configured portal registration page based on the authorization attributes (such as the registration role, name, and public key) in the received Accept message. The user enters registration information on the portal registration page. This information may include the user's name, email address, and mobile phone number, but this application does not impose specific restrictions on this information.

[0126] The service authentication end generates a first pre-shared key for the user based on the registration information input by the user and a set random generation algorithm. This application does not impose any specific restrictions on the number of first pre-shared keys.

[0127] In order to improve the security of registering the first pre-shared key, the embodiment of the present application adds an approval mechanism for registering the first pre-shared key when registering the first pre-shared key for the user terminal. The registration approval process of the first pre-shared key can be specifically referred to in Figure 4.

[0128] The service authentication end first determines the registration information sent by the user end, and then determines whether the registration information needs to be approved based on the approval mode indication of the key authentication administrator. Specifically, whether the registration information needs to be approved can be determined by setting an approval mode flag, an approval field, or any other method on the service authentication end. The approval mode indication is used to modify the values ​​in the approval mode flag and the approval field. For example, assuming that the service authentication end is set with an approval mode flag, the value in the approval mode flag is 1, indicating that the registration information needs to be approved; the value in the approval mode flag is 0, indicating that the registration information does not need to be approved. The value of the approval mode flag can also be other numerical values. This application does not impose specific restrictions on the value of the approval mode flag when registration information approval is required.

[0129] When the service authentication end determines that the registration information needs to be approved, for example, when determining that the key authentication administrator's approval mode indication indicates that the approval mode flag is set to 1, it determines to enable registration approval mode. First, the user's identity is verified. Specifically, it can be determined whether the registration information entered by the user satisfies the established registration rules. For example, if the user's name suffix in the registration information is .DS, and the established registration rules only allow users with suffixes of .DS, .QF, or .AB to register a pre-shared key, then a first pre-shared key is registered for the current user, the first pre-shared key is sent to the user, and the first pre-shared key is bound to the user information.

[0130] If the registration information entered by the user does not meet the preset registration rules or the user's suffix name cannot be extracted from the registration information, a manual review can be performed to determine whether to register a pre-shared key for the current user. If the registration information fails the manual review, a message indicating that the pre-shared key registration failed is sent to the user. If the registration information passes the manual review, a first pre-shared key is registered for the current user, the first pre-shared key is sent to the user, and the first pre-shared key is bound to the user information.

[0131] In an embodiment of the present application, when the service authentication end determines that no approval is required for the registration information, for example, when the key authentication administrator's approval mode indication indicates that the approval mode flag is set to 0, the service authentication end determines that no identity verification is required for the current user end. The service authentication end automatically registers a first pre-shared key for the user end, sends the first pre-shared key to the user end, and binds the first pre-shared key to the current user information.

[0132] After the service authentication end reviews the pre-shared key registration corresponding to the user end, it can send a request for the current user end to go offline to the access device, requesting the current user end to disconnect the pre-shared key registration connection with the service authentication end, and release system resources to ensure the registration of the pre-shared key for the next user end or improve the authentication processing efficiency.

[0133] By adopting the above-mentioned method, a user terminal that does not meet the pre-shared key registration requirements can be prevented from registering the pre-shared key, thereby improving the security of registering the pre-shared key for the user terminal.

[0134] In an embodiment of the present application, if the initial key fails to match the first key, the service authentication end may forward a second feedback message indicating the failure of initial key authentication to the user end via the access device. Based on the received second feedback message, the user end may resend the initial key to the service authentication end and apply for registration of the pre-shared key.

[0135] In an embodiment of the present application, if the initial key fails to match the first key, the service authentication end may further match the initial key with the second key.

[0136] The steps for matching the initial key with the second key are as follows.

[0137] The service authentication terminal determines whether the initial key matches the second key, where the second key is any pre-shared key required for network authentication of the user terminal, i.e., the second key is any pre-shared key in a set of pre-shared keys set by the service authentication terminal. If the initial key and the second key match, the service authentication terminal may bind the second key to the user information and send an authentication message associated with the second key to the user terminal. If the initial key and the second key do not match, the service authentication terminal may forward a first feedback message indicating the failure of initial key authentication to the user terminal via the access device.

[0138] The specific process of determining whether the initial key matches the second key is as follows.

[0139] The service authentication end first parses the encryption parameter value in the key authentication request sent by the user end, and then encrypts the initial key according to the encryption parameter value to obtain a third encryption key. The third encryption key can be the same as the first encryption key, and this application does not impose any specific restrictions on this.

[0140] The service authentication end selects any one of the pre-shared key candidates from the set pre-shared key set, uses the pre-shared key as the second key, and then encrypts the second key according to the encryption parameter value to obtain a fourth encryption key.

[0141] Determine whether the third encryption key matches the fourth encryption key. If so, bind the second key to the user information and send an authentication message associated with the second key to the user. The authentication message associated with the second key may be an Accept message, which is not described here.

[0142] If the third encryption key fails to match the fourth encryption key, the next candidate pre-shared key in the set of pre-shared keys is selected and used as the second key. The second key is encrypted according to the encryption parameter value to obtain a fifth encryption key, and a determination is made as to whether the fifth encryption key matches the third encryption key. If the fifth encryption key matches the third encryption key, the second key is bound to the user information, and an authentication message associated with the second key is sent to the user terminal. If the fifth encryption key fails to match the third encryption key, the next candidate pre-shared key in the set of pre-shared keys is selected as the second key.

[0143] By comparing the initial key with each candidate pre-shared key in the pre-shared key set, it is possible to determine whether a second key that matches the initial key exists. Although the current user information is not bound to a pre-shared key, the initial key may have been obtained from another user terminal that has registered a pre-shared key. Therefore, when the service authentication terminal determines that the initial key matches the second key, it can bind the second key to the current user information. This allows for dynamic binding of the user terminal and the pre-shared key during the pre-shared key authentication process, enabling a single pre-shared key to be used by multiple users (one code for multiple devices).

[0144] If there is no second key matching the initial key in the pre-shared key set, that is, when the initial key fails to match the second key, the service authentication end may send a first feedback message to the access device indicating that the initial key authentication failed. The first feedback message is a feedback message used to prompt the user that the initial key entered does not match the application key used to register the pre-shared key nor does it match the pre-shared key registered by other user terminals. After receiving the first feedback message, the access device forwards the first feedback message to the user terminal. The first feedback message may be a Reject message. The user terminal may re-enter the initial key based on the Reject message, determine to submit a registration request for the pre-shared key to the service authentication end, or determine to obtain a registered pre-shared key from other user terminals, and use the registered pre-shared key to authenticate the pre-shared key, so as to obtain Internet access permission from the service authentication end.

[0145] In one possible embodiment, upon receiving the initial key, the service authentication end may first determine whether the initial key matches the second key. If the initial key matches the second key, the initial key is used as the registered pre-shared key and pre-shared key authentication is performed on the initial key. If the initial key does not match the second key, the service authentication end further determines whether the initial key matches the first key.

[0146] If the initial key matches the first key, the first pre-shared key is registered for the current user terminal. If the initial key fails to match the first key, a feedback message indicating that the initial key authentication failed is sent to the access device. This application does not impose any specific restrictions on the order in which the initial key matches the first key or the second key.

[0147] In an embodiment of the present application, for the pre-shared key authentication process of first determining whether the initial key matches the second key and then determining whether the initial key matches the first key, you can refer to the above steps of first determining whether the initial key matches the first key and then determining whether the initial key matches the second key, and make adaptive adjustments according to actual application requirements, which will not be repeated here.

[0148] In one possible implementation, the service authentication terminal is integrated with the access device. For example, both the service authentication terminal and the access device are installed on an access point (AP). In this case, the same device can perform both access and authentication functions, simplifying deployment. This integrated configuration is suitable for smaller networks.

[0149] In one possible implementation, the service authentication terminal is separately provided from the access device. One service authentication terminal is connected to multiple access devices to provide authentication services for the multiple access devices. At this time, PSK information will no longer be configured on the access device, but PSK information will be configured on the service authentication terminal, reducing the maintenance of PSK configuration information in the later stage. When expanding on the basis of the original network, there is no need to configure PSK information on the access device, which facilitates network expansion. In addition, the number of PSK keys that can be configured on the access device is limited. When multiple access devices are uniformly authenticated by the service authentication terminal, the number of keys of the access device can be expanded, and the number of access users can be increased. The service authentication terminal is separately provided from the access device, which is suitable for larger networks.

[0150] In summary, the method provided by the exemplary embodiment of the present application can realize the registration and authentication of the pre-shared key based on the same signal, thereby avoiding the back-and-forth switching of the registration signal and the authentication signal by the service authentication end when the new user pre-acquires Internet access permission. By adding an approval mechanism for registering the first pre-shared key, it is possible to prevent user terminals that do not meet the pre-shared key registration requirements from registering the pre-shared key, thereby improving the security of registering the pre-shared key for the user terminal. By matching the initial key with each candidate pre-shared key in the pre-shared key set, it is possible to realize the dynamic binding function of the pre-shared key and the current user information during the pre-shared key authentication process, thereby increasing the number of user terminals to which a pre-shared key can be applied and improving the efficiency of authenticating the user identity.

[0151] Please refer to Figure 5, which is a flowchart of a key authentication method provided in an embodiment of the present application. The key authentication method includes: S51, determining user information based on a key authentication request sent by a user terminal, wherein the key authentication request includes user information and an initial key.

[0152] S52: Determine whether the initial key matches the first key, where the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key.

[0153] S53: When the initial key matches the first key, register a first pre-shared key for the user terminal and bind the first pre-shared key to the user information.

[0154] Based on the above method, users can register based on the initial key, which can avoid the need to manually bind the pre-shared key with user information in advance when registering, thereby simplifying the registration process.

[0155] Based on the method provided in the above embodiment, the embodiment of the present application further provides a key authentication device. FIG6 is a schematic structural diagram of a key authentication device in the embodiment of the present application, and the device includes:

[0156] The key query module 501 is used to determine the user information in the key authentication request sent by the user terminal and determine whether the user information has been bound to the pre-shared key;

[0157] a key authentication module 502 configured to, when determining that the user information is not bound to a pre-shared key, determine whether the initial key sent by the user terminal matches a first key, wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key;

[0158] If so, register a first pre-shared key for the user terminal and bind the first pre-shared key to the user information.

[0159] In a possible implementation, the key authentication module 502 is specifically configured to:

[0160] Determining whether the initial key matches the second key, wherein the second key is any pre-shared key required for network authentication of the user terminal;

[0161] If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal;

[0162] If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0163] In a possible implementation, the key authentication module 502 is specifically configured to:

[0164] Parsing the encryption parameter value in the key authentication request;

[0165] Encrypting the initial key according to the encryption parameter value to obtain a third encryption key;

[0166] Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key;

[0167] encrypting the second key according to the encryption parameter value to obtain a fourth encryption key;

[0168] determining whether the third encryption key matches the fourth encryption key;

[0169] If yes, binding the second key to the user information and sending the authentication message associated with the second key to the user terminal;

[0170] If not, the next candidate pre-shared key in the pre-shared key set is selected.

[0171] In a possible implementation, if the initial key fails to match the first key, a second feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0172] In a possible implementation, the key authentication module 502 is specifically configured to:

[0173] Determining the registration information sent by the user terminal;

[0174] Determining whether to approve the registration information;

[0175] If so, determining whether the registration information satisfies a preset registration rule; if it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information;

[0176] If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0177] In a possible implementation, the key query module 501 is further configured to:

[0178] Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key;

[0179] Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key;

[0180] Determining the second pre-shared key from the set pre-shared key set;

[0181] Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key;

[0182] determining whether the first encryption key matches the second encryption key;

[0183] If yes, sending an authentication message associated with the second pre-shared key to the user terminal;

[0184] If not, a feedback message indicating that the target pre-shared key authentication is incorrect is sent to the user terminal.

[0185] Based on the same inventive concept, an embodiment of the present application further provides an electronic device that can implement the functions of the aforementioned key authentication device. Referring to FIG. 7 , the electronic device includes:

[0186] At least one processor 601, and a memory 602 connected to at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiments of the present application. FIG7 takes the connection between the processor 601 and the memory 602 via the bus 600 as an example. The bus 600 is represented by a bold line in FIG7. The connection method between other components is only for schematic illustration and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG7 only uses a bold line to represent it, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.

[0187] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can perform the key authentication method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement the functions of each module in the apparatus shown in FIG6.

[0188] Among them, the processor 601 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 602 and calling data stored in the memory 602, the various functions of the device and processing data.

[0189] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0190] The processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the key authentication method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0191] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (RAM), a static random access memory (SRAM), a programmable read-only memory (PROM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0192] By designing and programming the processor 601, the code corresponding to the key authentication method described in the aforementioned embodiment can be embedded in the chip, thereby enabling the chip to execute the steps of the key authentication method of the embodiment shown in FIG1 during operation. Designing and programming the processor 601 is well known to those skilled in the art and will not be described in detail here.

[0193] Based on the same inventive concept, an embodiment of the present application further provides a storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer executes the key authentication method discussed above.

[0194] In some possible implementations, various aspects of the address generation method provided in the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps in the key authentication method according to various exemplary embodiments of the present application described above in this specification.

[0195] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0196] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0197] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0198] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0199] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A key authentication method, comprising: Determine user information based on a key authentication request sent by a user terminal; wherein the key authentication request includes the user information and an initial key; Determining whether the initial key matches a first key; wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key; and When the initial key matches the first key, a first pre-shared key is registered for the client, and the first pre-shared key is bound to the user information.

2. The method of claim 1, wherein: Before determining whether the initial key matches the first key, the method further includes: Determining whether the user information has been bound to a pre-shared key; and The determining whether the initial key matches the first key comprises: When the user information is not bound to a pre-shared key, it is determined whether the initial key matches the first key.

3. The method of claim 2, wherein: After determining whether the user information has been bound to a pre-shared key, the method further includes: When the user information is bound to a pre-shared key, determining whether the initial key matches a second pre-shared key bound to the user information; and When the initial key matches the second pre-shared key bound to the user information, an authentication message associated with the second pre-shared key is sent to the user terminal.

4. The method of claim 3, wherein: The authentication information associated with the second pre-shared key includes at least one of authorized virtual local area network information and quality of service information.

5. The method of claim 3, wherein: After determining whether the initial key matches the second pre-shared key bound to the user information, the method further includes: When the initial key does not match the second pre-shared key bound to the user information, a feedback message of the initial key authentication error is sent to the user terminal.

6. The method of claim 5, wherein: The feedback message includes the error type of the initial key authentication error.

7. The method of claim 3, wherein: The determining whether the initial key matches the second pre-shared key bound to the user information includes: Determining an encryption parameter value based on the key authentication request; Encrypting the initial key according to the encryption parameter value to obtain a first encryption key; encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key; and When the first encryption key matches the second encryption key, it is determined that the initial key matches the second pre-shared key.

8. The method of claim 1, wherein: After determining whether the initial key matches the first key, the method further includes: When the initial key does not match the first key, determining whether the initial key matches the second key, wherein the second key is a pre-shared key in a pre-shared key set; and When the initial key matches the second key, the second key is bound to the user information, and an authentication message associated with the second key is sent to the user terminal.

9. The method of claim 8, wherein: The determining whether the initial key matches the second key comprises: Determining an encryption parameter value based on the key authentication request; Encrypting the initial key according to the encryption parameter value to obtain a third encryption key; Obtaining the second key from the pre-shared key set; encrypting the second key according to the encryption parameter value to obtain a fourth encryption key; and When the third encryption key matches the fourth encryption key, the second key is bound to the user information, and the authentication message associated with the second key is sent to the user terminal.

10. The method of claim 9, wherein: The determining whether the initial key matches the second key further includes: When the third encryption key does not match the fourth encryption key, a next pre-shared key to be selected in the pre-shared key set is selected as the second key.

11. The method of claim 1, wherein: The method further comprises: When the initial key does not match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

12. The method of claim 1, wherein: The registering a first pre-shared key for the user terminal and binding the first pre-shared key with the user information includes: Determining the registration information sent by the user terminal; When it is determined that the registration information satisfies a preset registration rule, registering the first pre-shared key for the user terminal; and The first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

13. The method of claim 1, wherein: The registering a first pre-shared key for the user terminal comprises: Sending a receiving message to the user terminal, the receiving message including at least one of the following information: a registered role, a name of the registered role, a jump address, and a public key; and The registration information sent by the user terminal is received, and the first pre-shared key is determined based on the registration information and a set random generation algorithm.

14. The method of claim 1, wherein: The method further comprises: After registering the first pre-shared key for the client, a logoff request is sent to the client, wherein the logoff request is used to request the client to disconnect the registration connection.

15. A key authentication device, comprising: A key query module, used to determine user information in a key authentication request sent by a user terminal; That In the example, the key authentication request includes the user information and the initial key; a key authentication module, configured to determine whether the initial key sent by the user terminal matches a key in a service authentication terminal key set, wherein the service authentication terminal key set includes a first key, and the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key; and When the initial key matches the first key, a first pre-shared key is registered for the client, and the first pre-shared key is bound to the user information.

16. The device of claim 15, wherein: The key authentication module is also used for: Determining whether the user information has been bound to a pre-shared key; and When the user information is not bound to a pre-shared key, it is determined whether the initial key matches the first key.

17. The device of claim 15, wherein: The key authentication module is also used for: Determining whether the initial key matches a second key in the service authentication end key set, wherein the second key is a pre-shared key in the pre-shared key set; When the initial key matches the second key, binding the second key to the user information, and sending an authentication message associated with the second key to the user terminal; and When the initial key does not match the second key, a first feedback message indicating that the initial key authentication fails is sent to the user terminal.

18. The device of claim 15, wherein: The key authentication module is specifically used for: Determining the registration information sent by the user terminal; Determining whether the registration information satisfies a preset registration rule; and When it is determined that the registration information satisfies the registration rule, the first pre-shared key is registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

19. An electronic device comprising: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 14 when executing the computer program stored in the memory.

20. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 14 are implemented.

Images