Online verification method and apparatus for device manufacturer, and storage medium

Abstract

Provided in the present invention are an online verification method and apparatus for a device manufacturer, and a storage medium. The method comprises: acquiring a first random character string set by a user and a second random character string generated by a device to be verified; sending the first random character string and the second random character string to a verification server; receiving a third random character string, a timestamp and a verification hash value, which are generated by the verification server on the basis of the first random character string and a second random character; generating a local hash value on the basis of the first random character string and the second random character, and checking the local hash value and the received verification hash value; sending the received third random character string back to the verification server; and determining whether the third random character string received by the verification server is consistent with the generated third random character string, and if the third random character string received by the verification server is consistent with the generated third random character string, the device to be verified passing manufacturer verification. The technical solution in the embodiments of the present invention can provide a strict and reliable verification means by means of asymmetric encryption technology, thereby ensuring that a user can verify information of a device manufacturer.

Description

A device manufacturer online verification method, device and storage medium Technical Field

[0001] The present invention relates to the fields of network security and equipment security, and in particular to an online verification method, device and storage medium for equipment manufacturers. Background Art

[0002] In current cybersecurity and industrial security, attackers can exploit the appearance and functionality of carefully crafted Trojans to gain network access, threatening network security. Devices requiring network access must undergo authentication before they can access the network. Currently, users lack awareness of device manufacturer authentication. Users primarily obtain device manufacturer information through information such as procurement source, supplier declarations, packaging, appearance, logos, and serial numbers, logging in, and accessing web management pages or command-line interfaces.

[0003] If a disguised device accesses the network without verification, it will pose a huge security risk to users.

[0004] Summary of the Invention

[0005] To achieve the above objectives, the present invention proposes a device manufacturer online verification method, apparatus and storage medium to ensure that users can verify device manufacturer information while ensuring that device firmware and other information have not been maliciously tampered with.

[0006] An embodiment of the present invention proposes an online device manufacturer verification method, comprising: obtaining initial data, obtaining a first random string set by a user, and a second random string generated by the device to be verified; sending initial data, encrypting the first and second random strings and sending them to a verification server; receiving verification data, receiving a third random string and a timestamp generated by the verification server by decrypting the first and second random characters and then encrypting them, as well as a verification hash value obtained by hashing the first, second, third random strings, and timestamp; verifying the verification data, generating a local hash value based on the obtained first and second random characters and verifying it with the received and decrypted verification hash value; returning verification data, encrypting the received third random string and sending it back to the verification server; and receiving a verification result, receiving the verification result generated by the verification server. Multiple asymmetric encrypted transmission verifications of random strings ensure that users can verify device manufacturer information.

[0007] In one embodiment, the device model, the first random string, and the second random string are encrypted with the public key of the verification server before being sent. Through asymmetric encryption, the authenticity, integrity, and non-repudiation of the verification information are improved.

[0008] In one embodiment, the verification server decrypts the received device model, first random string, and second random string using its private key to generate a third random string and time, and hashes the first, second, third random strings, and timestamp to obtain a verification hash value. The third random string, timestamp, and verification hash value are then encrypted using the public key of the device to be verified and sent. Asymmetric encryption improves the authenticity, integrity, and non-repudiation of the verification information.

[0009] In one embodiment, the received third random string, timestamp, and verification hash value of the first random string, second random string, third random string, and timestamp are decrypted using the private key of the device to be verified. Asymmetric encryption improves the authenticity, integrity, and non-repudiation of the verification information.

[0010] In one embodiment, the received third random character string is encrypted with the public key of the verification server before being sent. Through asymmetric encryption, the authenticity, integrity and non-repudiation of the verification information are improved.

[0011] In one embodiment, the third random string received by the verification server is decrypted using the verification server's private key; a determination is made as to whether the third random string received and decrypted by the verification server is consistent with the generated third random string. If so, the device to be verified has passed manufacturer verification. Asymmetric encryption improves the authenticity, integrity, and non-repudiation of verification information.

[0012] An embodiment of the present invention proposes an online device manufacturer verification apparatus, comprising: an initial data acquisition module configured to acquire a first random string set by a user and a second random string generated by the device to be verified; an initial data sending module configured to encrypt the first and second random strings and send them to a verification server; a verification data receiving module configured to receive a third random string and a timestamp generated by the verification server by decrypting the first and second random characters and then encrypting them, as well as a verification hash value obtained by hashing the first, second, third random strings, and timestamp; a verification data verification module configured to generate a local hash value based on the acquired first and second random characters and verify it with the received and decrypted verification hash value; a verification data return module configured to encrypt the received third random string and send it back to the verification server; and a verification result receiving module configured to receive the verification result generated by the verification server. Multiple asymmetric encrypted transmission verifications of random strings ensure that users can verify device manufacturer information.

[0013] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.

[0014] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.

[0015] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.

[0017] FIG1 is a flow chart of a method 100 for online verification of a device manufacturer according to an embodiment of the present invention.

[0018] FIG2 is a schematic structural diagram of an online verification apparatus 200 for a device manufacturer according to an embodiment of the present invention.

[0019] FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0020] FIG. 4 is a schematic diagram of a data transmission process 400 according to an embodiment of the present invention.

[0021] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION

[0022] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0023] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0024] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0025] All information about the device being verified can be forged through malicious means. Using legitimate device packaging or even the outer shell, a malicious forged device can appear indistinguishable from a legitimate device. Even in certain situations, an attacker can reconstruct the legitimate device's firmware or built-in hypervisor and inject code with attack capabilities.

[0026] Asymmetric encryption (public-key encryption) uses different keys for encryption and decryption. In this encryption technique, each user possesses a pair of keys: a public key and a private key. The public key is used for encryption, and the private key is used for decryption. The public key is publicly available, while the private key must be kept private by the user. The key to the viability and security of asymmetric encryption is that it is practically impossible for anyone to derive or calculate the user's private key using the public key.

[0027] In an embodiment of the present invention, considering the possibility that the device to be verified may be disguised, in order to provide a more effective device manufacturer verification method, an apparatus and a storage medium for online verification of a device manufacturer are proposed in an embodiment of the present invention.

[0028] FIG1 is a flow chart of a device manufacturer online verification method 100 according to an embodiment of the present invention. As shown in FIG1 , the method 100 may include:

[0029] In one embodiment, before executing the online verification method, the device to be verified is connected to a low-risk network partition.

[0030] After obtaining a device, the user can select a low-risk network partition to connect the device to the network. At this point, the device has not yet passed authentication and cannot be considered a trusted device. Therefore, there must be no other devices in the partition that could become attack targets.

[0031] Step S101: Acquire initial data, obtain a first random string set by a user and a second random string generated by a device to be verified.

[0032] In one embodiment, the device model of the device to be verified is also obtained.

[0033] The second random string will be stored in the device until it is replaced by a new random string the next time an attempt is made to authenticate the device.

[0034] Step S102: Send initial data, encrypt the first random character string and the second random character string, and then send them to the verification server.

[0035] In one embodiment, the device model, the first random character string, and the second random character string are encrypted using a public key of a verification server and then sent.

[0036] The device accesses the verification server published by the device manufacturer through a preset URL and sends an authentication request.

[0037] Step S103: Receive verification data, receive a third random string and a timestamp generated by decrypting the first random string and the second random string and then encrypting them, and a verification hash value obtained by hashing the first random string, the second random string, the third random string, and the timestamp.

[0038] In one embodiment, the verification server decrypts the received device model, first random string and second random string using the private key of the verification server to generate a third random string and time, and performs hash calculation on the first random string, second random string, third random string and timestamp to obtain a verification hash value; and encrypts the third random string, timestamp and verification hash value using the public key of the device to be verified and sends them.

[0039] After receiving the device authentication request, the server uses the private key to decrypt the request and obtain the device model, the first random string set by the user, and the second random string generated by the device. After the device passes the authentication, it generates the corresponding data.

[0040] Step S104 : verifying the verification data, generating a local hash value based on the obtained first random character string and the second random character, and verifying the local hash value with the received and decrypted verification hash value.

[0041] In one embodiment, the received third random string, timestamp, and verification hash value of the first random string, second random string, third random string, and timestamp are decrypted using a private key of the device to be verified.

[0042] After the device receives the information from the verification server, it uses the private key to decrypt it to obtain the timestamp and the third random string, and calculates the hash value based on the first random string and the second random string saved by the device, and compares the calculated hash value with the hash value returned by the server to confirm the legitimacy of the server.

[0043] Step S105: Return verification data, encrypt the received third random character string and send it back to the verification server.

[0044] In one embodiment, the received third random character string is encrypted using the public key of the verification server and then sent.

[0045] Step S106: accepting the verification result, receiving the verification result generated by the verification server.

[0046] In one embodiment, the third random string received by the verification server is decrypted using the private key of the verification server; and it is determined whether the third random string received and decrypted by the verification server is consistent with the generated third random string. If they are consistent, the device to be verified passes the manufacturer verification.

[0047] If the decrypted string is consistent with the locally stored third random string, it means that the device is trusted.

[0048] Users can access the device manufacturer's server to obtain device authentication information, which includes: a first random string set by the user; a second random string generated by the device; the authentication time; the device model; the device serial number; and the device authentication history.

[0049] FIG4 is a schematic diagram of a data transmission process 400 according to an embodiment of the present invention.

[0050] FIG2 is a schematic diagram of the structure of an online verification device 200 for a device manufacturer according to an embodiment of the present invention. As shown in FIG2 , the device 200 may include:

[0051] In one embodiment, before performing device verification, the device to be verified is connected to a low-risk network partition.

[0052] After obtaining a device, the user can select a low-risk network partition to connect the device to the network. At this point, the device has not yet passed authentication and cannot be considered a trusted device. Therefore, there must be no other devices in the partition that could become attack targets.

[0053] The initial data acquisition module 201 is configured to: acquire a first random character string set by a user and a second random character string generated by the device to be verified.

[0054] In one embodiment, the device model of the device to be verified is also obtained.

[0055] The second random string will be stored in the device until it is replaced by a new random string the next time an attempt is made to authenticate the device.

[0056] The initial data sending module 202 is configured to encrypt the first random character string and the second random character string and send them to the verification server.

[0057] In one embodiment, the device model, the first random character string, and the second random character string are encrypted using a public key of a verification server and then sent.

[0058] The device accesses the verification server published by the device manufacturer through a preset URL and sends an authentication request.

[0059] The verification data receiving module 203 is configured to: receive a third random string and a timestamp generated by decrypting the first random string and the second random character and then encrypting them, and a verification hash value obtained by hashing the first random string, the second random string, the third random string and the timestamp.

[0060] In one embodiment, the verification server decrypts the received device model, first random string and second random string using the private key of the verification server to generate a third random string and time, and performs hash calculation on the first random string, second random string, third random string and timestamp to obtain a verification hash value; and encrypts the third random string, timestamp and verification hash value using the public key of the device to be verified and sends them.

[0061] After receiving the device authentication request, the server uses the private key to decrypt the request and obtain the device model, the first random string set by the user, and the second random string generated by the device. After the device passes the authentication, it generates the corresponding data.

[0062] The verification data verification module 204 is configured to generate a local hash value based on the obtained first random character string and the second random character and verify the local hash value with the received and decrypted verification hash value.

[0063] In one embodiment, the received third random string, timestamp, and verification hash value of the first random string, second random string, third random string, and timestamp are decrypted using a private key of the device to be verified.

[0064] After the device receives the information from the verification server, it uses the private key to decrypt it to obtain the timestamp and the third random string, and calculates the hash value based on the first random string and the second random string saved by the device, and compares the calculated hash value with the hash value returned by the server to confirm the legitimacy of the server.

[0065] The verification data return module 205 is configured to encrypt the received third random character string and send the encrypted character string back to the verification server.

[0066] In one embodiment, the received third random character string is encrypted using the public key of the verification server and then sent.

[0067] The verification result receiving module 206 is configured to receive the verification result generated by the verification server.

[0068] In one embodiment, the third random string received by the verification server is decrypted using the private key of the verification server; and it is determined whether the third random string received and decrypted by the verification server is consistent with the generated third random string. If they are consistent, the device to be verified passes the manufacturer verification.

[0069] If the decrypted string is consistent with the locally stored third random string, it means that the device is trusted.

[0070] Users can access the device manufacturer's server to obtain device authentication information, which includes: a first random string set by the user; a second random string generated by the device; the authentication time; the device model; the device serial number; and the device authentication history.

[0071] The present invention also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in FIG3 , the electronic device 300 includes a processor 310 and a memory 320. The memory 320 stores instructions, wherein the instructions, when executed by the processor 310, implement the method 100 described above.

[0072] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.

[0073] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.

[0074] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0075] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0076] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0077] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A device manufacturer online verification method (100), characterized in that: The method comprises: Acquire initial data (S101), acquire a first random string set by a user and a second random string generated by a device to be verified; Sending initial data (S102), encrypting the first random string and the second random string and sending them to the verification server; Receiving verification data (S103), receiving a third random string and a timestamp generated by the verification server by decrypting the first random string and the second random string and then encrypting them, and a verification hash value obtained by performing a hash calculation on the first random string, the second random string, the third random string and the timestamp; Verifying verification data (S104), generating a local hash value based on the first random character string and the second random character obtained, and verifying the local hash value with the received and decrypted verification hash value; Return verification data (S105), encrypt the received third random character string and send it back to the verification server; Accepting the verification result (S106), receiving the verification result generated by the verification server.

2. The method according to claim 1, wherein: The method further comprises: before executing the method, connecting the device to be verified to a low-risk network partition.

3. The method according to claim 1, wherein: The obtaining of initial data (S101) further includes: obtaining a device model of the device to be verified.

4. The method according to claim 3, wherein: The sending of the initial data (S102) further includes: encrypting the device model, the first random character string and the second random character string with a public key of the verification server and then sending them.

5. The method according to claim 4, wherein: The receiving verification data (S103) further comprises: The verification server decrypts the received device model, the first random string, and the second random string using the private key of the verification server to generate a third random string and time, and performs hash calculation on the first random string, the second random string, the third random string, and the timestamp to obtain a verification hash value; The third random character string, timestamp and verification hash value are encrypted with the public key of the device to be verified and then sent.

6. The method according to claim 5, wherein: Verifying the verification data (S104) further includes: decrypting the received third random string, timestamp, and verification hash value of the first random string, second random string, third random string, and timestamp using the private key of the device to be verified.

7. The method according to claim 6, wherein: Returning verification data (S105) further includes: encrypting the received third random character string using the public key of the verification server and then sending the encrypted character string.

8. The method according to claim 7, wherein: Completing device verification (S106) further includes: decrypting the third random string received by the verification server using the private key of the verification server, and determining whether the third random string received and decrypted by the verification server is consistent with the generated third random string. If they are consistent, the device to be verified has passed the manufacturer verification.

9. An online verification device (200) for equipment manufacturers, characterized in that: The device comprises: An initial data acquisition module (201) is configured to: acquire a first random string set by a user and a second random string generated by a device to be verified; The initial data sending module (202) is configured to: encrypt the first random string and the second random string and send them to the verification server; A verification data receiving module (203) is configured to: receive a third random character string and a timestamp generated by decrypting the first random character string and the second random character string and then encrypting the third random character string, and a verification hash value obtained by performing a hash calculation on the first random character string, the second random character string, the third random character string and the timestamp; A verification data verification module (204) is configured to: generate a local hash value based on the first random character string and the second random character obtained, and verify it with the received and decrypted verification hash value; The verification data returning module (205) is configured to: encrypt the received third random character string and send it back to the verification server; The verification result receiving module (206) is configured to receive the verification result generated by the verification server.

10. An electronic device (300), comprising: at least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions, which, when executed by the at least one processor (310), causes the processor (310) to perform the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images