Data processing method and related apparatus

Abstract

Provided in the embodiments of the present application is a data processing method. The method comprises: acquiring target information of a device, wherein the target information is obtained by means of mapping a physical feature of the device which has an unclonable characteristic; on the basis of the target information, obtaining first indication information and a first public key of the device by means of key generation algorithms; and sending the first indication information and the first public key, wherein the first indication information is associated with the first public key. In the present application, the target information, which is obtained by means of mapping a physical feature of the device which has an unclonable characteristic, is used to generate device indication information and the public key, the device indication information and the public key can be used when identity authentication (which may also be referred to as device identity challenge) of the device is subsequently performed; and the target information can uniquely indicate information of the device, and therefore the credibility is higher.

Description

A data processing method and related device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on March 29, 2024, with application number 202410392404.3 and application name “A data processing method and related devices”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communications, and more particularly, to a data processing method and related devices. Background Art

[0003] In the field of information communications technology (ICT), mutual authentication is required between devices and between devices and network management systems. Certificates are widely used in the industry for identity authentication and establishing secure channels. Due to the complexity of certificate management, network incidents caused by expired certificates are frequent, and the cost of certificate management is increasing year by year.

[0004] In the existing technology, in order to solve the problem of device identity authentication, a manufacturer-preset device identity certificate solution is usually adopted. The device manufacturer pre-sets a certificate issued by the device manufacturer's public key infrastructure (PKI) for the device during the production stage to verify the identity of the device.

[0005] However, in the existing technology, the credibility of identity authentication depends on the credibility of the identity certificate issued by the device manufacturer's PKI, which leads to low credibility of identity authentication. Summary of the Invention

[0006] In a first aspect, the present application provides a data processing method, comprising: obtaining target information of a device, wherein the target information is obtained by mapping physical characteristics on the device that have an unclonable characteristic; obtaining first indication information and a first public key of the device through a key generation algorithm based on the target information; and sending the first indication information and the first public key, wherein the first indication information and the first public key are associated with each other.

[0007] Among them, the target information can be obtained by mapping the physical characteristics of the device with unclonable characteristics through a physical unclonable function. This mapping can use its inherent physical structure to uniquely identify it. Any input stimulus will output a unique and unpredictable response. The physical unclonable function is a hardware function implementation circuit that relies on chip characteristics and has uniqueness and randomness. By extracting the process parameter deviations inevitably introduced during the device manufacturing process, a function function that uniquely corresponds between the stimulus signal and the response signal is achieved. Optionally, the target information is physical unclonable function (PUF) information. Physical unclonable functions can be divided into non-electronic PUF, analog circuit PUF, and digital circuit PU according to the implementation method. PUF information can be CRP, which has uniqueness, reliability, unclonability, unpredictability, tamper-proofness, and randomness.

[0008] The first indication information and the first public key may be sent, wherein the first indication information and the first public key are associated with each other. The so-called association here can be understood as indicating that the first indication information and the first public key are associated with the same device when the information is sent.

[0009] In an embodiment of the present application, target information obtained by mapping physical features with unclonable characteristics on the device is used to generate device indication information and a public key. The device indication information and the public key can be used in subsequent device identity authentication (or, it can be called a device identity challenge). Since the target information can uniquely indicate the information of the device, it has a higher degree of credibility.

[0010] In addition, physical characteristics with non-clonable properties can be considered as attributes of the device itself. When the device needs to regenerate and upload identity information (for example, credential update when the credentials expire, or secondary online), it is only necessary to re-extract the target information on the device side to generate key information. The method is the same as the first registration. Compared with the existing technology that requires the manufacturer to reissue the certificate and import it to update the credentials, the embodiment of the present application simplifies the overall process.

[0011] In a possible implementation, the target information is Physical Unclonable Function (PUF) information.

[0012] In a possible implementation, obtaining the first indication information and the first public key of the device through a key generation algorithm according to the target information includes: obtaining the key of the target information through a first key generation algorithm according to the target information; obtaining the first indication information of the device through a second key generation algorithm according to the key of the target information and a first random number; obtaining the first public key through the second key generation algorithm according to the key of the target information and a second random number; sending the first indication information and the first public key includes: sending the first indication information, the first public key, the first random number and the second random number, wherein the first indication information, the first public key, the first random number and the second random number are associated with each other.

[0013] Since the public and private keys and device indication information are obtained through random numbers, in scenarios such as re-authentication and secondary online access, there is no need to re-determine the identity information (such as reissuing the PKI certificate) as in existing technologies. You only need to obtain a new random number and regenerate the public and private keys and device indication information based on the target information, which simplifies the processing flow.

[0014] In a possible implementation, the target information includes first target information and second target information; the first target information is generated based on a first random number, and the second target information is generated based on a second random number; obtaining the first indication information and the first public key of the device through a key generation algorithm based on the target information includes: obtaining the first key of the target information through a first key generation algorithm based on the first target information; obtaining the second key of the target information through the first key generation algorithm based on the second target information; obtaining the first indication information of the device through a second key generation algorithm based on the first key of the target information; obtaining the first public key through the second key generation algorithm based on the second key of the target information; sending the first indication information and the first public key includes: sending the first indication information, the first public key, a first random number and a second random number, wherein the first indication information, the first public key, the first random number and the second random number are associated.

[0015] 2N pairs of challenges (random numbers) are directly generated by the device itself and used to derive the device identity. The original OS-level random number generation is sinked to the device (for example, the device's chip), further improving security.

[0016] In one possible implementation, obtaining the first indication information and the first public key of the device by using a key generation algorithm according to the target information includes:

[0017] Obtaining, according to the target information, a key and key auxiliary information of the target information through a first key generation algorithm;

[0018] Obtaining the first indication information and the first public key of the device through a second key generation algorithm according to the key of the target information;

[0019] The sending the first indication information and the first public key includes:

[0020] The first indication information, the first public key, and the key auxiliary information are sent, wherein the first indication information, the first public key, and the key auxiliary information are associated.

[0021] In a possible implementation, obtaining the first indication information and the first public key of the device through a key generation algorithm based on the target information includes: obtaining the first indication information, the first public key and the first private key of the device through a key generation algorithm based on the target information.

[0022] In a possible implementation, after sending the first indication information and the first public key, the method further includes:

[0023] When performing identity authentication of the device, obtaining the target information;

[0024] Obtaining a second key of the target information through a key reconstruction algorithm according to the target information;

[0025] Obtaining, according to the second key, second indication information and a second private key of the device through the second key generation algorithm;

[0026] Sign the second indication information and the second private key, and send a signature result obtained by the signature.

[0027] In one possible implementation, the method further includes:

[0028] A certificate is received after the signature result is verified and passed the verification.

[0029] In one possible implementation, the method further includes: receiving a first random number and a second random number;

[0030] The obtaining, according to the second key and using the second key generation algorithm, the second indication information and the second private key of the device includes:

[0031] Obtaining second indication information of the device through the second key generation algorithm according to the second key and the first random number;

[0032] The second private key is obtained according to the second key and the second random number through the second key generation algorithm.

[0033] In a possible implementation, the method further includes: receiving a first random number and a second random number; the target information includes first target information and second target information; the first target information is generated according to the first random number, and the second target information is generated according to the second random number;

[0034] The step of obtaining the second key of the target information by a key reconstruction algorithm according to the target information includes:

[0035] Obtaining a second key of the first target information through a key reconstruction algorithm according to the first target information;

[0036] Obtaining a second key for the second target information by a key reconstruction algorithm according to the second target information;

[0037] The obtaining, according to the second key and using the second key generation algorithm, the second indication information and the second private key of the device includes:

[0038] Obtaining second indication information of the device using the second key generation algorithm according to the second key;

[0039] The second private key is obtained according to the second key through the second key generation algorithm.

[0040] In one possible implementation, the method further includes: receiving key assistance information;

[0041] The step of obtaining the second key of the target information by a key reconstruction algorithm according to the target information includes:

[0042] A second key of the target information is obtained according to the target information and the key auxiliary information through a key reconstruction algorithm.

[0043] In one possible implementation, the method further includes: receiving temporary information (nonce);

[0044] The signing the second indication information and the second private key includes:

[0045] Sign the second indication information, the second private key, and the temporary information.

[0046] Taking the target information as PUF information as an example, in the embodiment of the present application, device identity authentication is implemented based on the physical characteristics of the device, and combined with ACME, automatic application and issuance of device certificates can be realized. In addition, the device identity authentication information can be flexibly updated, and there is no risk of expiration of identity credentials when the device is used and put online for the second time. The device identity authentication information can be registered during the production stage or on the existing network. When the strength of the public and private key cryptography corresponding to the certificate does not meet the security requirements, the key can be updated and re-registered at any time. In addition, multiple groups of CRPs (challenge response pairs) of strong PUF or multiple pairs of identity and public and private key information derived from PUF are used to construct multiple identity authentication relationships, reducing the risk of credential leakage and the scope of impact after leakage. In addition, it is also applicable to the automatic application of certificates for software network elements and the issuance of other credentials.

[0047] In a second aspect, the present application provides a data processing device, comprising:

[0048] an acquisition module, configured to acquire target information of a device, wherein the target information is obtained by mapping physical features of the device that have an unclonable characteristic;

[0049] a processing module, configured to obtain, according to the target information, first indication information and a first public key of the device through a key generation algorithm;

[0050] The transceiver module is configured to send the first indication information and the first public key, wherein the first indication information and the first public key are associated with each other.

[0051] In a possible implementation, the target information is Physical Unclonable Function (PUF) information.

[0052] In a possible implementation, the processing module is specifically configured to:

[0053] Obtaining a key for the target information through a first key generation algorithm according to the target information;

[0054] Obtaining first indication information of the device through a second key generation algorithm according to the key of the target information and the first random number;

[0055] Obtaining a first public key using the second key generation algorithm according to the key of the target information and the second random number;

[0056] The transceiver module is specifically used for:

[0057] The first indication information, the first public key, the first random number, and the second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated with each other.

[0058] In a possible implementation, the target information includes first target information and second target information; the first target information is generated according to a first random number, and the second target information is generated according to a second random number;

[0059] The processing module is specifically used to:

[0060] Obtaining a first key for the target information by using a first key generation algorithm according to the first target information;

[0061] Obtaining a second key for the target information by using the first key generation algorithm according to the second target information;

[0062] Obtaining first indication information of the device through a second key generation algorithm according to the first key of the target information;

[0063] Obtaining a first public key according to the second key of the target information through the second key generation algorithm;

[0064] The transceiver module is specifically used for:

[0065] The first indication information, the first public key, a first random number, and a second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated.

[0066] In a possible implementation, the processing module is specifically configured to:

[0067] Obtaining, according to the target information, a key and key auxiliary information of the target information through a first key generation algorithm;

[0068] Obtaining the first indication information and the first public key of the device through a second key generation algorithm according to the key of the target information;

[0069] The transceiver module is specifically used for:

[0070] The first indication information, the first public key, and the key auxiliary information are sent, wherein the first indication information, the first public key, and the key auxiliary information are associated.

[0071] In a possible implementation, the processing module is specifically configured to:

[0072] According to the target information, first indication information, a first public key, and a first private key of the device are obtained through a first key generation algorithm.

[0073] In a possible implementation, after sending the instruction information and the public key, the obtaining module is further configured to:

[0074] When performing identity authentication of the device, obtaining the target information;

[0075] The processing module is further configured to obtain a second key of the target information through a key reconstruction algorithm according to the target information;

[0076] Obtaining, according to the second key, second indication information and a second private key of the device through the second key generation algorithm;

[0077] Sign the second indication information and the second private key, and send a signature result obtained by the signature.

[0078] In a possible implementation, the transceiver module is further configured to receive a certificate obtained after verifying the signature result and passing the verification.

[0079] In a possible implementation, the transceiver module is further configured to receive a first random number and a second random number;

[0080] The processing module is specifically used to:

[0081] Obtaining second indication information of the device through the second key generation algorithm according to the second key and the first random number;

[0082] The second private key is obtained according to the second key and the second random number through the second key generation algorithm.

[0083] In a possible implementation, the transceiver module is further configured to: receive a first random number and a second random number; the target information includes first target information and second target information; the first target information is generated based on the first random number, and the second target information is generated based on the second random number;

[0084] The processing module is specifically used to:

[0085] Obtaining a second key of the first target information through a key reconstruction algorithm according to the first target information;

[0086] Obtaining a second key for the second target information by a key reconstruction algorithm according to the second target information;

[0087] Obtaining second indication information of the device using the second key generation algorithm according to the second key;

[0088] The second private key is obtained according to the second key through the second key generation algorithm.

[0089] In a possible implementation, the transceiver module is further configured to: receive key auxiliary information;

[0090] The processing module is specifically used to:

[0091] A second key of the target information is obtained according to the target information and the key auxiliary information through a key reconstruction algorithm.

[0092] In a possible implementation, the transceiver module is further configured to: receive temporary information (nonce);

[0093] The processing module is specifically used to:

[0094] Sign the second indication information, the second private key, and the temporary information.

[0095] In a third aspect, an embodiment of the present application provides a data processing device, which may include a memory, a processor, and a bus system, wherein the memory is used to store programs, and the processor is used to execute the programs in the memory to perform the first aspect and any optional method thereof.

[0096] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer executes the above-mentioned first aspect and any optional method thereof.

[0097] In a fifth aspect, an embodiment of the present application provides a computer program, which, when executed on a computer, enables the computer to execute the above-mentioned first aspect and any optional method thereof.

[0098] In a sixth aspect, the present application provides a chip system comprising a processor configured to support a data processing device in implementing the functions described in the aforementioned aspects, such as transmitting or processing the data or information described in the aforementioned methods. In one possible design, the chip system further comprises a memory configured to store program instructions and data necessary for executing or training the device. The chip system may consist solely of a chip or may include a chip and other discrete components. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] 1A to 1C are schematic diagrams of application scenarios of embodiments of the present application;

[0100] 2 to 8 are flowcharts of a data processing method according to an embodiment of the present application;

[0101] FIG9 is a schematic diagram of the structure of a data processing device provided by this embodiment;

[0102] FIG10 is a schematic structural diagram of a terminal device provided in an embodiment of the present application;

[0103] FIG11 is a schematic diagram of a structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0104] The following describes the embodiments of the present invention in conjunction with the accompanying drawings. The terms used in the embodiments of the present invention are only used to explain the specific embodiments of the present invention, and are not intended to limit the present invention.

[0105] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0106] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0107] As used herein, the terms "substantially," "about," and similar terms are used as terms of approximation, not as terms of degree, and are intended to take into account the inherent variations in measurements or calculations that one of ordinary skill in the art would recognize. Furthermore, the use of "may" when describing embodiments of the present invention refers to "one or more possible embodiments." As used herein, the terms "use," "using," and "used" may be considered synonymous with the terms "utilize," "utilizing," and "utilized," respectively. Additionally, the term "exemplary" is intended to refer to an example or illustration.

[0108] To facilitate understanding, the following first introduces the relevant terms involved in the embodiments of this application.

[0109] (1) Physically unclonable functions (PUF):

[0110] When a stimulus is input into a PUF (also referred to as PUF information in the embodiments of this application), the PUF circuit utilizes process variations during chip production that are difficult to predict and clone, generating a response, generally called a challenge response pair (CRP). Although the chip designs are identical, each chip is affected by process variations in different ways. Therefore, the response to the same stimulus on different chips will be different, making the CRP difficult to predict and clone. PUF is unique, reliable, unclonable, unpredictable, tamper-resistant, and random.

[0111] (2) Automatic certificate management environment (ACME):

[0112] ACME is a communication protocol that automatically issues, installs, renews, and revokes public key infrastructure (PKI) certificates without any human intervention. ACME automates the interaction between certificate authorities (CAs) and web servers or devices that host PKI certificates. ACME was originally created by the Internet Security Research Group specifically for its own certificate service, Let'sEncrypt, to issue domain-validated certificates (DV certificates). Multiple CAs are now increasingly adopting the ACME protocol to issue different types of certificates, such as extended validation certificates (EV certificates) and organization-validated certificates (OV certificates).

[0113] 1A to 1C , which illustrate several application scenarios of embodiments of the present application.

[0114] Among them, Figure 1A shows the process when the network element device is first connected to the network. First, the installation and deployment of the network management and the import of the certificate application are completed. The network element device automatically applies for a complete certificate when connected to the CA. The network management and the network element device use their respective certificates to complete identity authentication and establish a secure channel. Figure 1B shows the process of automatically connecting to the CA to complete the certificate update after the network element device certificate expires. Figure 1C shows a schematic diagram of the device going online for the second time, where the secondary online can be divided into two situations: 1. Secondary online after the certificate expires. The scenario at this time is the same as the certificate expiration update scenario. 2. The device is migrated and switches to a different CA to issue the certificate. The scenario at this time is the same as the device joining the network scenario.

[0115] In the field of information communications technology (ICT), mutual authentication is required between devices and between devices and network management systems. Certificates are widely used in the industry for identity authentication and establishing secure channels. Due to the complexity of certificate management, network incidents caused by expired certificates are frequent, and the cost of certificate management is increasing year by year.

[0116] In the existing technology, in order to solve the problem of device identity authentication, a manufacturer-preset device identity certificate solution is usually adopted. The device manufacturer pre-sets a certificate issued by the device manufacturer's public key infrastructure (PKI) for the device during the production stage to verify the identity of the device.

[0117] However, in the existing technology, the credibility of identity authentication depends on the credibility of the identity certificate issued by the device manufacturer's PKI, which leads to low credibility of identity authentication.

[0118] In order to solve the above problems, the present invention provides a data processing method. The model training method of the present invention is described in detail below with reference to the accompanying drawings.

[0119] Refer to Figure 2, which is a flow chart of a data processing method provided in an embodiment of the present application. As shown in Figure 2, a data processing method provided in an embodiment of the present application may include steps 201 to 203, and these steps are described in detail below.

[0120] 201. Obtain target information of a device, where the target information is obtained by mapping physical features on the device that have an unclonable characteristic.

[0121] Among them, the target information can be obtained by mapping the physical characteristics of the device with unclonable characteristics through a physical unclonable function. This mapping can use its inherent physical structure to uniquely identify it. Any input stimulus will output a unique and unpredictable response. The physical unclonable function is a hardware function implementation circuit that relies on chip characteristics and has uniqueness and randomness. By extracting the process parameter deviations inevitably introduced during the device manufacturing process, a function function that uniquely corresponds between the stimulus signal and the response signal is achieved. Optionally, the target information is physical unclonable function (PUF) information. Physical unclonable functions can be divided into non-electronic PUF, analog circuit PUF, and digital circuit PU according to the implementation method. PUF information can be CRP, which has uniqueness, reliability, unclonability, unpredictability, tamper-proofness, and randomness.

[0122] 202. Obtain first indication information and a first public key of the device through a key generation algorithm according to the target information;

[0123] 203. Send the first indication information and the first public key, where the first indication information and the first public key are associated with each other.

[0124] In one possible implementation, the first key and key auxiliary information of the target information can be obtained based on the target information through a first key generation algorithm; the first indication information and the first public key of the device can be obtained based on the target information through a second key generation algorithm.

[0125] In a possible implementation, the first indication information, the first public key, and the first private key of the device may be obtained according to the target information through a first key generation algorithm.

[0126] 3 , the key auxiliary information may be the public parameter P, the first key generation algorithm may be the key generation algorithm in FIG3 , the second key generation algorithm may be the KDF in FIG3 , and the first indication information (KeyID1), the first public key (PK1) and the first private key (SK1) may be obtained through the second key generation algorithm.

[0127] More specifically, in a possible implementation, a key for the target information may be obtained using a first key generation algorithm based on the target information; first indication information of the device may be obtained using a second key generation algorithm based on the key for the target information and a first random number; and a first public key may be obtained using the second key generation algorithm based on the key for the target information and a second random number.

[0128] In one possible implementation, the first indication information and the first public key may be sent, wherein the first indication information and the first public key are associated with each other. The so-called association here can be understood as indicating that the first indication information and the first public key are associated with the same device when the information is sent.

[0129] In one possible implementation, the first indication information, the first public key, the first random number, and the second random number may be sent. The so-called association here may be understood as indicating that the first indication information, the first public key, the first random number, and the second random number are associated with the same device when the information is sent.

[0130] In a possible implementation, the first indication information, the first public key, and the key auxiliary information may be sent, wherein the first indication information, the first public key, and the key auxiliary information are associated.

[0131] In one possible implementation, the sending object of the above-mentioned sending action can be a device management platform, such as a public website or a blockchain platform, etc., which is not limited in the embodiment of the present application.

[0132] Referring to Figure 3, during the device identity registration phase, the PUF value can be read, and the PUF key and auxiliary information can be generated through the key generation algorithm. Combining the PUF key and N pairs of random numbers generated by the random number generator, the Key Derivation Function (KDF) derivation algorithm is used to derive N pairs of credential information (KeyID,<PK,SK> ), where KeyID identifies the device, and public and private keys serve as the public and private keys for the production certificate (optional). The public parameters of the key generation algorithm, along with the public key, device ID, random number, and other information, are uploaded to the online device management platform to complete device credential registration.

[0133] In an embodiment of the present application, target information obtained by mapping physical features with unclonable characteristics on the device is used to generate device indication information and a public key. The device indication information and the public key can be used in subsequent device identity authentication (or, it can be called a device identity challenge). Since the target information can uniquely indicate the information of the device, it has a higher degree of credibility.

[0134] In addition, physical characteristics with non-clonable properties can be considered as attributes of the device itself. When the device needs to regenerate and upload identity information (for example, credential update when the credentials expire, or secondary online), it is only necessary to re-extract the target information on the device side to generate key information. The method is the same as the first registration. Compared with the existing technology that requires the manufacturer to reissue the certificate and import it to update the credentials, the embodiment of the present application simplifies the overall process.

[0135] In a possible implementation, the target information includes first target information and second target information; the first target information is generated based on a first random number, and the second target information is generated based on a second random number; the first key of the target information can be obtained based on the first target information through a first key generation algorithm; the second key of the target information can be obtained based on the second target information through the first key generation algorithm; the first indication information of the device can be obtained based on the first key of the target information through a second key generation algorithm; and the first public key can be obtained based on the second key of the target information through the second key generation algorithm.

[0136] Since the public and private keys and device indication information are obtained through random numbers, in scenarios such as re-authentication and secondary online access, there is no need to re-determine the identity information (such as reissuing the PKI certificate) as in existing technologies. You only need to obtain a new random number and regenerate the public and private keys and device indication information based on the target information, which simplifies the processing flow.

[0137] Exemplarily, the above can be a device identity generation process based on strong PUF, in which 2N pairs of challenges (random numbers) are directly generated by the device itself for deriving the device identity, and the original OS-level random number generation is sunk into the device (for example, the device's chip), further improving security.

[0138] For example, referring to FIG4, FIG4 is a schematic diagram of a process of generating a device identity based on strong PUF, wherein in the device identity registration stage, 2N pairs of challenges are generated after the chip is powered on, 2N pairs of PUF responses are generated through the 2N pairs of challenges, and N pairs of information (KeyID,<PK,SK> ), where the KeyID identifies the device, and the public and private keys serve as the public and private keys for the production certificate (optional). 2) The public parameters of the key generation algorithm, along with the public key, device ID, random number, and other information, are uploaded to the online device management platform to complete device identity registration.

[0139] In one possible implementation, after sending the first indication information and the first public key, the target information may be obtained during device identity authentication. Based on the target information, a second key for the target information may be obtained using a key reconstruction algorithm. Based on the second key, a second indication information and a second private key for the device may be obtained using a second key generation algorithm. The second indication information and the second private key may be signed, and a signature result obtained by the signature may be sent. The signature result may be used for device identity authentication.

[0140] In one possible implementation, a first random number and a second random number may also be received; furthermore, based on the second key and the first random number, the second indication information of the device may be obtained through the second key generation algorithm; and based on the second key and the second random number, the second private key may be obtained through the second key generation algorithm.

[0141] In a possible implementation, when identity authentication occurs during a certificate application process, when the signature passes authentication, a certificate obtained after the signature result is verified and passes the authentication may be received.

[0142] Among them, the certificate in the embodiment of the present application can be but is not limited to a DV certificate, an EV certificate or an OV certificate, etc.

[0143] For example, referring to Figure 5, when verifying the device's identity, the device can be powered on and the PUF value can be retrieved. The online device management platform (this application does not limit the entity that issues the parameters) issues public parameters and challenges to the device. The device can recover the PUF key based on the parameters, power-on value, and key reconstruction algorithm, and regenerate two pairs of public and private keys. The device can sign the challenge and identity information. The device can return the signature as a Response to the management platform. The management platform can verify the device's identity information and challenge signature to complete device authentication.

[0144] In one possible implementation, a first random number and a second random number may be received; the target information includes first target information and second target information; the first target information is generated based on the first random number, and the second target information is generated based on the second random number; based on the first target information, a second key of the first target information may be obtained through a key reconstruction algorithm; based on the second target information, a second key of the second target information may be obtained through a key reconstruction algorithm; based on the second key, second indication information of the device may be obtained through the second key generation algorithm; based on the second key, the second private key may be obtained through the second key generation algorithm.

[0145] For example, referring to FIG6, when performing device authentication based on strong PUF, the challenge value used to derive the public and private keys is generated by the device itself (eg, the chip included in the device), and the online management platform needs to<R11,R12> The PUF value is sent to the device. Specifically, the online device management platform can send public parameters and a challenge to the device. The device can then retrieve the PUF value using the challenge. The device recovers the KeyID and public and private keys based on the parameters, power-on values, and the key reconstruction algorithm. The device signs the challenge and identity information. The device returns the signed Response to the management platform. The management platform verifies the device identity information and the challenge signature to complete device authentication.

[0146] Taking PUF information as the target information, the above authentication process can be applied to the update and revocation of PUF-based device credentials. Specifically, when updating or revoking PUF-based device credentials, it is necessary to first complete device authentication and then re-register the device identity. For details on the process, see PUF-Based Device Authentication and PUF-Based Device Identity Registration. The online management platform needs to provide credential status management capabilities to identify the current credential status. Only currently valid credentials can be used for device authentication.

[0147] For example, referring to Figure 7 , assuming the target information is PUF information, the above authentication process can be applied to a device that, after completing credential registration, automatically applies to a certificate from a CA that supports the PUF challenge method through ACME. The CA redirects the challenge information to the online device management platform, completes device authentication using the PUF, and issues a device certificate. Upon leaving the factory, the device manufacturer registers its identity information with the management platform. This registration information is publicly available. The device can register an account with the ACME server through the ACME client and create a certificate request order. From the challenge list returned by the server, the device selects a PUF-based challenge method. The ACME server redirects the device to the online device management platform using the URL provided by the device and provides a challenge value and device information. The online device management platform issues the public parameters and challenge value to the designated device. The device recovers the PUF key based on the parameters, power-on values, and the key reconstruction algorithm, and signs the challenge and identity information. The device returns a signed response to the management platform. The management platform returns the identity information to the ACME server. The ACME server completes device authentication. After the challenge is completed, the ACME server responds to the client's order and applies for a certificate based on the CRL.

[0148] In the embodiment of the present application, device identity authentication is implemented based on the physical characteristics of the device, and combined with ACME, automatic application and issuance of device certificates can be achieved. In addition, the device identity authentication information can be flexibly updated, and there is no risk of expiration of the identity credentials when the device is used or put online for the second time. The device identity authentication information can be registered during the production phase or on the existing network. When the strength of the public and private key cryptography corresponding to the certificate does not meet the security requirements, the key can be updated and re-registered at any time. In addition, multiple groups of CRPs (challenge response pairs) of strong PUF or multiple pairs of identity and public and private key information derived from PUF are used to construct multiple identity authentication relationships, reducing the risk of credential leakage and the scope of impact after leakage. In addition, it is also applicable to the automatic application of certificates for software network elements and the issuance of other credentials.

[0149] Taking the certificate application scenario as an example, refer to Figure 8, which is a schematic diagram of an application process of an embodiment of the present application. Among them, it includes: providing device identity information through the physical PUF information of the device. Register the device identity on the bulletin board to prove the device identity in the subsequent online stage. Credential update: Credential update only requires re-extracting PUF information on the device side to generate a key pair, and then registering the public information to the management platform in the same way as the first registration. The traditional solution requires the manufacturer to re-issue the certificate and import it. Secondary online of the device: The process of applying for a certificate for the second time when the device is online is the same as the first time, and there is no risk of expiration of the credentials. When the traditional solution is online for the second time, if the preset credentials expire, it is more complicated to update the credentials, and there is a security risk by ignoring the validity period.

[0150] 9 , which is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. As shown in FIG9 , a data processing device 900 provided in an embodiment of the present application includes:

[0151] An acquisition module 901 is configured to acquire target information of a device, where the target information is obtained by mapping physical features of the device that have an unclonable characteristic.

[0152] For a detailed introduction to the acquisition module 901 , reference may be made to the introduction to the embodiment corresponding to FIG. 2 in the above embodiment, and similarities will not be repeated here.

[0153] The processing module 902 is configured to obtain, according to the target information, first indication information and a first public key of the device through a key generation algorithm;

[0154] For a detailed description of the processing module 902 , reference may be made to the description of the embodiment corresponding to FIG. 2 in the above embodiment, and similarities will not be repeated here.

[0155] The transceiver module 903 is configured to send the first indication information and the first public key, where the first indication information and the first public key are associated with each other.

[0156] For a detailed description of the transceiver module 903 , reference may be made to the description of the embodiment corresponding to FIG. 2 in the above embodiment, and similarities will not be repeated here.

[0157] In a possible implementation, the target information is Physical Unclonable Function (PUF) information.

[0158] In a possible implementation, the processing module 902 is specifically configured to:

[0159] Obtaining a key for the target information through a first key generation algorithm according to the target information;

[0160] Obtaining first indication information of the device through a second key generation algorithm according to the key of the target information and the first random number;

[0161] Obtaining a first public key using the second key generation algorithm according to the key of the target information and the second random number;

[0162] The transceiver module 903 is specifically configured to:

[0163] The first indication information, the first public key, the first random number, and the second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated with each other.

[0164] In a possible implementation, the target information includes first target information and second target information; the first target information is generated according to a first random number, and the second target information is generated according to a second random number;

[0165] The processing module 902 is specifically configured to:

[0166] Obtaining a first key for the target information by using a first key generation algorithm according to the first target information;

[0167] Obtaining a second key for the target information by using the first key generation algorithm according to the second target information;

[0168] Obtaining first indication information of the device through a second key generation algorithm according to the first key of the target information;

[0169] Obtaining a first public key according to the second key of the target information through the second key generation algorithm;

[0170] The transceiver module 903 is specifically configured to:

[0171] The first indication information, the first public key, a first random number, and a second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated.

[0172] In a possible implementation, the processing module 902 is specifically configured to:

[0173] Obtaining, according to the target information, a key and key auxiliary information of the target information through a first key generation algorithm;

[0174] Obtaining the first indication information and the first public key of the device through a second key generation algorithm according to the key of the target information;

[0175] The transceiver module 903 is specifically configured to:

[0176] The first indication information, the first public key, and the key auxiliary information are sent, wherein the first indication information, the first public key, and the key auxiliary information are associated.

[0177] In a possible implementation, the processing module 902 is specifically configured to:

[0178] According to the target information, first indication information, a first public key, and a first private key of the device are obtained through a first key generation algorithm.

[0179] In a possible implementation, after sending the instruction information and the public key, the obtaining module 901 is further configured to:

[0180] When performing identity authentication of the device, obtaining the target information;

[0181] The processing module 902 is further configured to obtain a second key of the target information through a key reconstruction algorithm according to the target information;

[0182] Obtaining, according to the second key, second indication information and a second private key of the device through the second key generation algorithm;

[0183] Sign the second indication information and the second private key, and send a signature result obtained by the signature.

[0184] In a possible implementation, the transceiver module 903 is further configured to receive a certificate obtained after the signature result is verified and passed.

[0185] In a possible implementation, the transceiver module 903 is further configured to receive a first random number and a second random number;

[0186] The processing module 902 is specifically configured to:

[0187] Obtaining second indication information of the device through the second key generation algorithm according to the second key and the first random number;

[0188] The second private key is obtained according to the second key and the second random number through the second key generation algorithm.

[0189] In a possible implementation, the transceiver module 903 is further configured to: receive a first random number and a second random number; the target information includes first target information and second target information; the first target information is generated based on the first random number, and the second target information is generated based on the second random number;

[0190] The processing module 902 is specifically configured to:

[0191] Obtaining a second key of the first target information through a key reconstruction algorithm according to the first target information;

[0192] Obtaining a second key for the second target information by a key reconstruction algorithm according to the second target information;

[0193] Obtaining second indication information of the device using the second key generation algorithm according to the second key;

[0194] The second private key is obtained according to the second key through the second key generation algorithm.

[0195] In a possible implementation, the transceiver module 903 is further configured to: receive key auxiliary information;

[0196] The processing module 902 is specifically configured to:

[0197] A second key of the target information is obtained according to the target information and the key auxiliary information through a key reconstruction algorithm.

[0198] In a possible implementation, the transceiver module 903 is further configured to: receive temporary information (nonce);

[0199] The processing module 902 is specifically configured to:

[0200] Sign the second indication information, the second private key, and the temporary information.

[0201] Next, an execution device provided in an embodiment of the present application is introduced. Please refer to Figure 10. Figure 10 is a structural diagram of an execution device provided in an embodiment of the present application. The execution device 1000 can be specifically manifested as a virtual reality VR device, a mobile phone, a tablet, a laptop computer, a smart wearable device, etc., which is not limited here. Specifically, the execution device 1000 includes: a receiver 1001, a transmitter 1002, a processor 1003 and a memory 1004 (wherein the number of processors 1003 in the execution device 1000 can be one or more, and Figure 10 takes one processor as an example), wherein the processor 1003 may include an application processor 10031 and a communication processor 10032. In some embodiments of the present application, the receiver 1001, the transmitter 1002, the processor 1003 and the memory 1004 may be connected via a bus or other means.

[0202] The memory 1004 may include a read-only memory and a random access memory, and provides instructions and data to the processor 1003. A portion of the memory 1004 may also include non-volatile random access memory (NVRAM). The memory 1004 stores processor and operation instructions, executable modules, or data structures, or subsets or extended sets thereof. The operation instructions may include various operation instructions for implementing various operations.

[0203] Processor 1003 controls the operation of the execution device. In specific applications, the various components of the execution device are coupled together via a bus system. In addition to a data bus, the bus system may also include a power bus, a control bus, and a status signal bus. However, for clarity, all bus systems are referred to as a bus system in the figure.

[0204] The methods disclosed in the above embodiments of the present application can be applied to or implemented by processor 1003. Processor 1003 can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits or software instructions in processor 1003. The above processor 1003 can be a general-purpose processor, a digital signal processor (DSP), a microprocessor, or a microcontroller, and can further include an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The processor 1003 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 1004. Processor 1003 reads information from memory 1004 and, in conjunction with its hardware, completes the steps involved in the model inference process in the above method.

[0205] Receiver 1001 can be used to receive input digital or character information and generate signal input related to executing device-related settings and function control. Transmitter 1002 can be used to output digital or character information through the first interface. Transmitter 1002 can also be used to send instructions to the disk pack through the first interface to modify data in the disk pack. Transmitter 1002 can also include a display device such as a display screen.

[0206] The embodiment of the present application also provides a server device. Please refer to Figure 11. Figure 11 is a schematic diagram of the structure of a server provided by the embodiment of the present application. Specifically, the server 1100 is implemented by one or more servers. The server 1100 may have relatively large differences due to different configurations or performance. It may include one or more central processing units (CPUs) 1111 (for example, one or more processors) and memory 1132, and one or more storage media 1130 (for example, one or more mass storage devices) for storing application programs 1142 or data 1144. Among them, the memory 1132 and the storage medium 1130 can be temporary storage or permanent storage. The program stored in the storage medium 1130 may include one or more modules (not shown in the figure), each module may include a series of instruction operations in the server. Furthermore, the central processing unit 1111 can be configured to communicate with the storage medium 1130 to execute a series of instruction operations in the storage medium 1130 on the server 1100.

[0207] The server 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input and output interfaces 1158; or one or more operating systems 1141, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0208] In the embodiment of the present application, the central processing unit 1111 is used to execute the data processing method in the above embodiment.

[0209] An embodiment of the present application also provides a computer program product, which, when running on a computer, enables the computer to execute the steps executed by the aforementioned execution device, or enables the computer to execute the steps executed by the aforementioned training device.

[0210] A computer-readable storage medium is also provided in an embodiment of the present application, which stores a program for signal processing. When the computer-readable storage medium is run on a computer, it enables the computer to execute the steps executed by the aforementioned execution device, or enables the computer to execute the steps executed by the aforementioned training device.

[0211] It should also be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided in this application, the connection relationship between the modules indicates that there is a communication connection between them, which can be specifically implemented as one or more communication buses or signal lines.

[0212] Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memories, special components, etc. In general, all functions performed by computer programs can be easily implemented with corresponding hardware, and the specific hardware structures used to implement the same function can also be diverse, such as analog circuits, digital circuits or special circuits, etc. However, for the present application, software program implementation is a better implementation method in most cases. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer's floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., and includes a number of instructions to enable a computer device (which can be a personal computer, training equipment, or network equipment, etc.) to execute the methods described in each embodiment of the present application.

[0213] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0214] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, a computer, a training device or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website, a computer, a training device or a data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

Claims

1. A data processing method, characterized in that: The method comprises: Obtaining target information of a device, where the target information is obtained by mapping physical features of the device that have an unclonable characteristic; Obtaining, according to the target information, first indication information and a first public key of the device through a key generation algorithm; The first indication information and the first public key are sent, wherein the first indication information and the first public key are associated with each other.

2. The method according to claim 1, characterized in that The target information is Physical Unclonable Function (PUF) information.

3. The method according to claim 1 or 2, characterized in that The obtaining, according to the target information, first indication information and a first public key of the device through a key generation algorithm includes: Obtaining a key for the target information through a first key generation algorithm according to the target information; Obtaining first indication information of the device through a second key generation algorithm according to the key of the target information and the first random number; Obtaining a first public key using the second key generation algorithm according to the key of the target information and the second random number; The sending the first indication information and the first public key includes: The first indication information, the first public key, the first random number, and the second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated with each other.

4. The method according to claim 1 or 2, characterized in that The target information includes first target information and second target information; the first target information is generated according to a first random number, and the second target information is generated according to a second random number; The obtaining, according to the target information, first indication information and a first public key of the device through a key generation algorithm includes: Obtaining a first key for the target information by using a first key generation algorithm according to the first target information; Obtaining a second key for the target information by using the first key generation algorithm according to the second target information; Obtaining first indication information of the device through a second key generation algorithm according to the first key of the target information; Obtaining a first public key according to the second key of the target information through the second key generation algorithm; The sending the first indication information and the first public key includes: The first indication information, the first public key, a first random number, and a second random number are sent, wherein the first indication information, the first public key, the first random number, and the second random number are associated.

5. The method according to any one of claims 1 to 4, characterized in that: The obtaining, according to the target information, first indication information and a first public key of the device through a key generation algorithm includes: Obtaining, according to the target information, a key and key auxiliary information of the target information through a first key generation algorithm; Obtaining the first indication information and the first public key of the device through a second key generation algorithm according to the key of the target information; The sending the first indication information and the first public key includes: The first indication information, the first public key, and the key auxiliary information are sent, wherein the first indication information, the first public key, and the key auxiliary information are associated.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining, according to the target information, first indication information and a first public key of the device through a key generation algorithm includes: According to the target information, a first indication information, a first public key and a first private key of the device are obtained through a key generation algorithm.

7. The method according to any one of claims 1 to 6, characterized in that: After sending the first indication information and the first public key, the method further includes: When performing identity authentication of the device, obtaining the target information; Obtaining a second key of the target information through a key reconstruction algorithm according to the target information; Obtaining, according to the second key, second indication information and a second private key of the device through the second key generation algorithm; Sign the second indication information and the second private key, and send a signature result obtained by the signature.

8. The method according to claim 7, characterized in that The method further comprises: A certificate is received after the signature result is verified and passed the verification.

9. The method according to claim 7 or 8, characterized in that The method further includes: receiving a first random number and a second random number; The obtaining, according to the second key and using the second key generation algorithm, the second indication information and the second private key of the device includes: Obtaining second indication information of the device through the second key generation algorithm according to the second key and the first random number; The second private key is obtained according to the second key and the second random number through the second key generation algorithm.

10. The method according to claim 7 or 8, characterized in that The method further includes: receiving a first random number and a second random number; the target information includes first target information and second target information; the first target information is generated according to the first random number, and the second target information is generated according to the second random number; The step of obtaining the second key of the target information by a key reconstruction algorithm according to the target information includes: Obtaining a second key of the first target information through a key reconstruction algorithm according to the first target information; Obtaining a second key for the second target information by a key reconstruction algorithm according to the second target information; The obtaining, according to the second key and using the second key generation algorithm, the second indication information and the second private key of the device includes: Obtaining second indication information of the device using the second key generation algorithm according to the second key; The second private key is obtained according to the second key through the second key generation algorithm.

11. The method according to any one of claims 7 to 10, characterized in that: The method further comprises: receiving key assistance information; The step of obtaining the second key of the target information by a key reconstruction algorithm according to the target information includes: A second key of the target information is obtained according to the target information and the key auxiliary information through a key reconstruction algorithm.

12. The method according to any one of claims 7 to 10, characterized in that: The method further includes: receiving temporary information (nonce); The signing the second indication information and the second private key includes: Sign the second indication information, the second private key, and the temporary information.

13. A data processing device, characterized in that: The device comprises: an acquisition module, configured to acquire target information of a device, wherein the target information is obtained by mapping physical features of the device that have an unclonable characteristic; a processing module, configured to obtain, according to the target information, first indication information and a first public key of the device through a key generation algorithm; The transceiver module is configured to send the first indication information and the first public key, wherein the first indication information and the first public key are associated with each other.

14. A computer storage medium, characterized in that The computer storage medium stores one or more instructions that, when executed by one or more computers, cause the one or more computers to perform the operations of the method of any one of claims 1 to 12.

15. A computer program product, characterized in that The method comprises computer-readable instructions, which, when executed on a computer device, cause the computer device to execute the method according to any one of claims 1 to 12.

16. A system, characterized in that: It includes at least one processor and at least one memory; the processor and the memory are connected via a communication bus and communicate with each other; The at least one memory is used to store code; The at least one processor is configured to execute the code to perform the method according to any one of claims 1 to 12.

17. A chip, characterized in that: The system comprises at least one processing unit and an interface circuit, wherein the interface circuit is used to provide program instructions or data to the at least one processing unit, and the at least one processing unit is used to execute the program instructions to implement the method according to any one of claims 1 to 12.

Images