Device authentication method and electronic device

Abstract

The present application provides a device authentication method and an electronic device. The method comprises: a first electronic device receives an access request sent by a second electronic device; the first electronic device sends a first authentication request message to the second electronic device; the first electronic device receives first information sent by the second electronic device, the first information being related to the device type of the second electronic device; the first electronic device sends a second authentication request message to a server, the second authentication request message being used for requesting to acquire a device credential of the second electronic device, and the second request message comprising the first information; the first electronic device receives device credential information of the second electronic device sent by the server; and the first electronic device performs device authentication on the second electronic device on the basis of the device credential information of the second electronic device. The solution reduces the requirements for an execution environment and a storage space of the second electronic device during device authentication, thereby providing a more universal device authentication solution and improving the success rate of device authentication.

Description

Device authentication method and electronic device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of the People's Republic of China on April 3, 2024, with application number 202410405314.3 and application name “A device authentication method and electronic device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of Internet technology, and in particular to a device authentication method and an electronic device. Background Art

[0004] As operating systems become more compatible with a wide range of electronic devices, mutual trust and authentication between electronic devices has become a prerequisite for secure and reliable transmission. The primary method for authentication between electronic devices is to exchange authentication credentials. Once authentication is confirmed between the communicating devices, secure encrypted transmission is achieved based on the authentication results, thereby ensuring the security of communication between electronic devices.

[0005] When two electronic devices log in to the same user account, they can perform device authentication. The electronic devices can obtain account credentials bound to the user account from the server. This account credential can be, for example, a preshared key (PSK). The electronic devices can pass the account credentials between each other and authenticate the received account credentials based on the server's public key. After the device authentication is successful, the electronic devices can access each other's resources.

[0006] The device authentication process described above requires the electronic device to have a trusted execution environment (TEE) to receive the account credentials issued by the server, and it also requires the electronic device to have sufficient storage space to store the account credentials. Furthermore, there are security requirements for the electronic device to prevent the leakage of account credentials. Therefore, the current device authentication method has many limitations and is not flexible enough. Summary of the Invention

[0007] The present application provides a device authentication method and an electronic device, which are used to provide a safe and convenient device authentication solution.

[0008] In a first aspect, the present application provides a device authentication method, which can be performed by a first electronic device. The method includes: the first electronic device receives an access request sent by a second electronic device; sends a first authentication request message to the second electronic device; receives first information sent by the second electronic device, the first information being related to the device type of the second electronic device; sends a second authentication request message to a server, the second authentication request message being used to request the acquisition of device credentials of the second electronic device, the second request message including the first information; receives device credential information of the second electronic device sent by the server, the device credential information of the second electronic device being determined by the server based on the first information; and performs device authentication on the second electronic device based on the device credential information of the second electronic device.

[0009] In the above method, when the first electronic device needs to authenticate the second electronic device, the first information sent by the second electronic device to the first electronic device is information used to obtain the device credentials of the second electronic device. The second electronic device stores the first information used to obtain the device credentials, so the requirements for the execution environment and storage space of the second electronic device are relatively low, thereby reducing the performance requirements for the second electronic device during the device authentication process, providing a more universal device authentication solution, and realizing interconnection and interoperability between multiple electronic devices.

[0010] In one possible design, the device credential information of the second electronic device is a first slice of the device credential of the second electronic device; the method further includes: receiving a second slice of the device credential of the second electronic device sent by the second electronic device;

[0011] The device authentication of the second electronic device based on the device credential information of the second electronic device includes: splicing a first slice of the device credential of the second electronic device and a second slice of the device credential of the second electronic device to obtain a complete device credential of the second electronic device; and device authentication of the second electronic device based on the complete device credential of the second electronic device.

[0012] Through this design, the first electronic device can obtain the first slice and the second slice of the device credentials of the second electronic device from the server and the second electronic device respectively, and splice the first slice and the second slice to obtain the complete device credentials of the second electronic device, so that other electronic devices can still achieve device authentication of the second electronic device without the need for the second electronic device to store the complete device credentials.

[0013] In one possible design, the device credential information of the second electronic device is a first slice of the device credential of the second electronic device;

[0014] The device authentication of the second electronic device based on the device credential information of the second electronic device includes: sending a first slice of the device credential of the second electronic device to the second electronic device, receiving the complete device credential of the second electronic device sent by the second electronic device, where the complete device credential of the second electronic device is obtained by the second electronic device concatenating the first slice of the device credential of the second electronic device and the second slice of the device credential of the second electronic device; and device authentication of the second electronic device based on the complete device credential of the second electronic device.

[0015] Through this design, the second electronic device can store the second slice of the device credentials of the second electronic device without storing the complete device credentials. The first electronic device can assist the second electronic device in obtaining the first slice of the device credentials of the second electronic device from the server. The second electronic device obtains the complete device credentials of the second electronic device based on the stored second slice and the received first slice. The second electronic device sends the complete device credentials of the second electronic device to the first electronic device, so that the first electronic device authenticates the second electronic device. This solution has low requirements on the execution environment of the second electronic device and improves the success rate of device authentication.

[0016] In one possible design, the first information includes at least one of a device identification of the second electronic device, a device credential index value of the second electronic device, and a second slice of the device credential of the second electronic device.

[0017] Through this design, the first information in this application can be flexibly set to various types of information that have a corresponding relationship with the device credentials of the second electronic device, thereby providing a variety of ways to obtain the device credentials of the second electronic device.

[0018] In one possible design, the device credential information of the second electronic device is the complete device credential of the second electronic device.

[0019] Through this design, the first electronic device can also obtain the complete device credentials of the second electronic device from the server based on the first information, so as to reduce the number of communications between the first electronic device and the second electronic device and improve the efficiency of device authentication.

[0020] In one possible design, the second electronic device is an electronic device that does not have a trusted execution environment TEE.

[0021] Through this design, the device authentication method provided in this application can be used to authenticate electronic devices that do not have TEE, and realize the interconnection and interoperability between electronic devices that do not have TEE and other electronic devices.

[0022] In one possible design, the method also includes: sending an access request to the second electronic device; receiving a third authentication request message sent by the second electronic device; and sending device credentials of the first electronic device to the second electronic device based on the device type of the second electronic device, where the device credentials of the first electronic device are used by the second electronic device to perform device authentication on the first electronic device.

[0023] Through this design, the first electronic device can determine the device credentials of the first electronic device used for device authentication based on the device type of the second electronic device, thereby using different device credentials for device authentication for different types of electronic devices, realizing device authentication between multiple types of electronic devices, and further realizing intercommunication between multiple types of electronic devices.

[0024] In one possible design, the device credentials of the first electronic device sent to the second electronic device based on the device type of the second electronic device include: determining the first device credential type corresponding to the device type of the second electronic device based on a preset correspondence between the device type of the receiving electronic device and the device credential type; and sending the device credentials of the first electronic device to the second electronic device based on the first device credential type.

[0025] Through this design, the first electronic device can pre-store the correspondence between the device type of the receiving electronic device and the device credential type, so that when the first electronic device sends the device credential of the first electronic device to the second electronic device, the device credential of the first electronic device to be sent to the second electronic device can be determined according to the device type of the second electronic device, so as to ensure that the second electronic device can perform device authentication on the first electronic device based on the received device credential of the first electronic device, thereby improving the success rate of device authentication.

[0026] In one possible design, the device credentials of the first electronic device are a one-time credential or a personal identification PIN code.

[0027] Through this design, the present application can design the device credentials of the first electronic device to be a one-time credential. For example, when the second electronic device is a public device, the first electronic device can send the one-time credential of the first electronic device to the second electronic device to prevent the risk of public devices leaking device credentials. The present application can also design the device credentials of the first electronic device to be a PIN code. For example, when the second electronic device is a screenless, low-sensitivity device, the first electronic device can send the PIN code as the device credential of the first electronic device to the second electronic device to simplify the device authentication process and improve the success rate of device authentication.

[0028] In one possible design, the method also includes: receiving a first request message sent by a third electronic device, the first request message being used to request the first electronic device to assist the third electronic device in obtaining the device credentials of the third electronic device; sending a second request message to the server, the second request message being used to request the server to obtain the device credentials of the third electronic device; receiving the device credentials of the third electronic device sent by the server; and sending the device credentials of the third electronic device to the third electronic device.

[0029] Through this design, for a third electronic device that cannot directly obtain device credentials from the server, the first electronic device can assist the third electronic device in obtaining the device credentials of the third electronic device from the server to ensure that the third electronic device can obtain and store its own device credentials, so as to realize device authentication of the third electronic device by other electronic devices, and then the third electronic device can access other electronic devices.

[0030] In a second aspect, the present application provides an electronic device comprising multiple functional modules; the multiple functional modules interact with each other to implement the method performed by the first electronic device in the first aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation.

[0031] In a third aspect, the present application provides an electronic device comprising at least one processor and at least one memory, wherein the at least one memory stores computer program instructions. When the electronic device is running, the at least one processor executes the method executed by the first electronic device in the above-mentioned first aspect and its various embodiments.

[0032] In a fourth aspect, the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method executed by the first electronic device in any of the above aspects and its various embodiments.

[0033] In a fifth aspect, the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a computer, the computer executes the method executed by the first electronic device in any of the above aspects and its various embodiments.

[0034] In a sixth aspect, the present application further provides a chip, which is used to read a computer program stored in a memory and execute the method executed by the first electronic device in any of the above aspects and its various embodiments.

[0035] In a seventh aspect, the present application further provides a chip system, comprising a processor for supporting a computer device in implementing the method executed by the first electronic device in any of the above aspects and various embodiments thereof. In one possible design, the chip system further comprises a memory for storing the necessary programs and data for the computer device. The chip system may be composed of a chip, or may include a chip and other discrete devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] FIG1 is a schematic diagram of a method for device authentication based on a user account;

[0037] FIG2 is a schematic diagram of a device authentication scenario provided in an embodiment of the present application;

[0038] FIG3 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0039] FIG4 is a software structure block diagram of an electronic device provided in an embodiment of the present application;

[0040] FIG5 is a schematic diagram of a device credential issuance method provided in an embodiment of the present application;

[0041] FIG6 is a schematic diagram of a device authentication provided in an embodiment of the present application;

[0042] FIG7 is a schematic diagram of a device authentication method provided in an embodiment of the present application;

[0043] FIG8 is a schematic diagram of a device authentication method provided in an embodiment of the present application;

[0044] FIG9 is a schematic diagram of another device authentication method provided in an embodiment of the present application;

[0045] FIG10 is a flowchart of a device authentication method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the embodiments of the present application will be further described in detail below with reference to the accompanying drawings. In the description of the embodiments of the present application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0047] It should be understood that in the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can represent: a, b, c, a and b, a and c, b and c, or a, b and c, where a, b, c can be single or multiple.

[0048] As operating systems develop, they can be compatible with various types of electronic devices, such as Hongmeng. As ecological development becomes more and more compatible with electronic devices, mutual trust and authentication between electronic devices becomes a prerequisite for safe and reliable transmission.

[0049] Figure 1 is a schematic diagram of a method for device authentication based on a user account. Figure 1 takes the device authentication of a first electronic device and a second electronic device as an example. The server in Figure 1 may be a server that provides authentication cloud services, such as an electronic device manufacturer server, an application server, etc. Referring to Figure 1 , user account A has been logged into the second electronic device. The second electronic device may authenticate the first electronic device by performing the following steps:

[0050] Step 1: A first electronic device logs in to user account A or user account B associated with user account A.

[0051] Step 2: The first electronic device can request to download the account credentials bound to user account A from the server

[0052] The account credentials of user account A may include an account signature and a server public key.

[0053] Step 3: The second electronic device can authenticate the first electronic device based on user A's account credentials.

[0054] Specifically, the first electronic device can use the server's public key to encrypt the account signature and then send the encrypted account signature to the second electronic device. The second electronic device stores the account credentials bound to user account A, which were previously issued to the second electronic device by the server. After receiving the encrypted account signature from the first electronic device, the second electronic device can use the server's public key to decrypt the encrypted account signature and then verify the account signature. If the verification is successful, it means that the second electronic device has successfully authenticated the first electronic device.

[0055] Step 4: The second electronic device authorizes the first electronic device to access the resource.

[0056] After the second electronic device successfully authenticates the first electronic device, the second electronic device may display authorization request information. For example, the authorization request information displayed by the second electronic device in step 4 of Figure 1 may include the resources the first electronic device requests access to, as well as "Reject" and "Agree" controls. After the user confirms authorization in the authorization request information displayed by the second electronic device, the first electronic device may access the relevant resources. The first and second electronic devices can be networked and transmit data encrypted via a distributed soft bus, thereby ensuring the security of data transmission.

[0057] The device authentication method described above has requirements for the security environment and performance of electronic devices, which results in limitations in this device authentication method. The device authentication method shown in Figure 1 may have the following problems:

[0058] 1. If the electronic device does not have TEE, it cannot receive account credentials.

[0059] In the device authentication method introduced above, both the first electronic device and the second electronic device need to have a TEE environment. Otherwise, the server will not send the user credentials to the electronic device, and the electronic device cannot perform device authentication if it cannot obtain the account credentials.

[0060] 2. If the storage space of the electronic device is small, the account credentials of the user account cannot be stored.

[0061] In some examples, the electronic device may be an Internet of Things (IoT) thin device, which may have a small storage space, such as a read-only memory (ROM) space, and may not be able to store the account credentials of the user account.

[0062] 3. If the device authentication scenario is not related to the user account, the above device authentication method is no longer applicable.

[0063] It can be seen from the introduction of the above device authentication method that the above device authentication method is device authentication based on a user account and cannot be applied to device authentication scenarios unrelated to a user account.

[0064] 4. If the electronic device cannot access the Internet, it will not be able to receive the account credentials sent by the server.

[0065] If the electronic device cannot access the network, the electronic device cannot interact with the server, and the electronic device cannot receive the account credentials sent by the server.

[0066] 5. If the first electronic device or the second electronic device is a public device, there is a security risk that the account credentials of the user account may be leaked.

[0067] In daily usage scenarios, users may need to log in to their user accounts on public devices. In order to authenticate the device, the server will send the user account's account credentials to the public device. After the user finishes using the public device, the user account's account credentials are still stored in the public device, and the public device will also be provided to other people for use. This poses a security risk of leaking the user account's account credentials.

[0068] 6. If the first electronic device or the second electronic device is a screenless device, the authorization process is difficult to carry out.

[0069] Through the introduction of the above device authentication method, it can be seen that after the second electronic device successfully authenticates the first electronic device, the second electronic device can display authorization request information to authorize the first electronic device to access resources. However, when the second electronic device is a screenless device, it is difficult to perform the authorization process.

[0070] In addition, in some other device authentication methods, personal identification numbers (PIN) codes can be exchanged between electronic devices to complete device authentication. For example, when a first electronic device requests a second electronic device to perform device authentication, the second electronic device can display a PIN code, and the user can enter the PIN code in the first electronic device. If the PIN code entered by the user is consistent with the PIN code displayed by the second electronic device, the device authentication is successful. In this method, if the electronic device is a screenless device, device authentication based on a PIN code is also difficult to achieve.

[0071] In summary, the current device authentication method has many limitations and is not flexible enough.

[0072] Based on the above problems, an embodiment of the present application provides a device authentication method to provide a safe and convenient device authentication solution. Figure 2 is a schematic diagram of a device authentication scenario provided by an embodiment of the present application. Referring to Figure 2, the device authentication scenario may include a first electronic device and a second electronic device. Figure 2 shows the modules of the electronic device involved in the device authentication method provided by an embodiment of the present application. Taking the first electronic device as an example, the first electronic device may include an application (APP), an identity service (IS) module, a device management (DM) module, a device authentication (DA) module and a data bus (DBUS). The APP can be used to request the device credentials of the first electronic device from the server, and the IS module can be an independent management service module established for saving device credentials. The IS module can be specifically used for importing, exporting, querying, monitoring changes in device credential attributes and verifying device credentials; the DM module is used to discover devices and report devices that need to be authenticated to the APP, and the DA module is used to authenticate devices based on device credentials.

[0073] Optionally, the device authentication scenario shown in FIG2 may further include a server, which may be used to provide a device authentication cloud service. The server may be a single server or a server cluster consisting of multiple servers, which is not limited in this embodiment of the present application.

[0074] In the device authentication method provided in an embodiment of the present application, a first electronic device receives an access request sent by a second electronic device and sends a first authentication request message to the second electronic device, the first authentication request message being used to request device authentication of the second electronic device; the first electronic device receives first information sent by the second electronic device, the first information being related to the device type of the second electronic device; the first electronic device sends a second authentication request message to a server, the second authentication request message being used to request device credentials of the second electronic device, the second authentication request message including the first information; the first electronic device receives device credential information of the second electronic device sent by the server, the device credentials of the second electronic device being determined by the server based on the first information. The first electronic device authenticates the second electronic device based on the device credential information of the second electronic device. In this manner, when the first electronic device needs to authenticate the second electronic device, the second electronic device sends to the first electronic device information for obtaining the device credentials of the second electronic device, such as a device credential index value, a device identifier, a device credential slice, etc. Based on the solution provided in an embodiment of the present application, the second electronic device stores the information for obtaining the device credentials, which places lower requirements on the execution environment and storage space of the second electronic device, reduces the performance requirements on the second electronic device during the device authentication process, and provides a more universal device authentication solution for achieving interoperability between multiple electronic devices.

[0075] The following describes electronic devices and embodiments for using such electronic devices. The electronic devices of the embodiments of the present application may be tablet computers, mobile phones, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), wearable devices, etc. They may also be IoT devices such as smart speakers and smart air conditioners. The embodiments of the present application do not impose any restrictions on the specific type of electronic devices.

[0076] In some embodiments of the present application, the electronic device may also be a portable terminal device that also includes other functions such as a personal digital assistant and / or a music player. Or portable terminal devices with other operating systems.

[0077] FIG3 is a schematic diagram of the structure of an electronic device 100 provided in an embodiment of the present application. As shown in FIG3, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display 194, and a subscriber identification module (SIM) card interface 195.

[0078] The processor 110 may include one or more processing units. For example, the processor 110 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU). The different processing units may be independent devices or integrated into one or more processors. The controller may serve as the nerve center and command center of the electronic device 100. The controller may generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. The processor 110 may also include memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a high-speed cache memory. This memory may store instructions or data that have just been used or are being recycled by the processor 110. If the processor 110 needs to use the instruction or data again, it can directly retrieve it from the memory. This avoids duplicate accesses, reduces the processor 110's waiting time, and thus improves system efficiency.

[0079] The USB interface 130 is an interface that complies with USB standards and specifications, and may be a Mini USB interface, a Micro USB interface, a USB Type-C interface, or the like. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and peripheral devices. The charging management module 140 is used to receive charging input from the charger. The power management module 141 is used to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the external memory, the display 194, the camera 193, and the wireless communication module 160.

[0080] The wireless communication functionality of electronic device 100 can be implemented using antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, a modem processor, and a baseband processor. Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In other embodiments, the antennas can be used in conjunction with a tuning switch.

[0081] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0082] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, frequency modulate it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0083] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with a network and other devices through wireless communication technologies. The wireless communication technologies may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0084] The display screen 194 is used to display the display interface of the application, such as displaying the display page of the application installed on the electronic device 100. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a MiniLED, a MicroLed, a Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include one or N display screens 194, where N is a positive integer greater than one.

[0085] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, and then passes the electrical signal to the ISP for conversion into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0086] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the electronic device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, and the software code of at least one application, etc. The data storage area can store data generated during the use of the electronic device 100 (such as captured images, recorded videos, etc.). In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0087] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device. The external memory card communicates with the processor 110 via the external memory interface 120 to implement data storage functions. For example, files such as pictures and videos can be stored on the external memory card.

[0088] The electronic device 100 can implement audio functions such as music playback and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0089] Among them, the sensor module 180 may include a pressure sensor 180A, an acceleration sensor 180B, a touch sensor 180C, etc.

[0090] The pressure sensor 180A is used to sense the pressure signal and convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be disposed on the display screen 194 .

[0091] Touch sensor 180C, also known as a "touch panel," can be disposed on display screen 194. The touch sensor 180C and display screen 194 form a touch screen, also known as a "touch screen." Touch sensor 180C is used to detect touch operations applied thereto or in the vicinity thereof. The touch sensor can transmit the detected touch operations to an application processor to determine the type of touch event. Visual output related to the touch operations can be provided via display screen 194. In other embodiments, touch sensor 180C can also be disposed on the surface of electronic device 100, at a location different from that of display screen 194.

[0092] The buttons 190 include a power button, a volume button, etc. The button 190 can be a mechanical button. It can also be a touch button. The electronic device 100 can receive button input and generate key signal input related to the user settings and function control of the electronic device 100. The motor 191 can generate a vibration prompt. The motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization. The indicator 192 can be an indicator light, which can be used to indicate the charging status, power changes, and can also be used to indicate messages, missed calls, notifications, etc. The SIM card interface 195 is used to connect the SIM card. The SIM card can be inserted into the SIM card interface 195 or pulled out from the SIM card interface 195 to achieve contact and separation with the electronic device 100.

[0093] It is understood that the components shown in FIG3 do not constitute a specific limitation on the electronic device 100. The electronic device may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. In addition, the combination / connection relationship between the components in FIG3 may also be adjusted and modified.

[0094] Figure 4 is a block diagram of the software structure of an electronic device provided in an embodiment of the present application. As shown in Figure 4, the software structure of the electronic device can be a layered architecture. For example, the software can be divided into several layers, each with a clear role and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the operating system is divided into four layers, from top to bottom, namely, the application layer, the application framework layer (framework, FWK), the runtime (runtime) and system library, and the kernel layer.

[0095] The application layer may include a series of application packages. As shown in Figure 4, the application layer may include a camera, settings, skin module, user interface (UI), third-party applications, etc. Among them, third-party applications may include gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. In an embodiment of the present application, the application layer may include a target installation package of a target application that the electronic device requests to download from a server, and the function files and layout files in the target installation package are adapted to the electronic device.

[0096] The application framework layer provides an application programming interface (API) and programming framework for applications in the application layer. The application framework layer may include some predefined functions. As shown in Figure 4, the application framework layer may include a window manager, content provider, view system, telephony manager, resource manager, and notification manager.

[0097] The window manager manages windowed applications. It can determine the display size, determine whether a status bar is present, lock the screen, and take screenshots. Content providers store and retrieve data and make it accessible to applications. This data can include video, images, audio, incoming and outgoing calls, browsing history and bookmarks, and phone books.

[0098] The view system includes visual controls, such as those for displaying text and images. The view system is used to build applications. A display interface can consist of one or more views. For example, a display interface containing a text notification icon might include a view for displaying text and a view for displaying images.

[0099] The phone manager is used to provide communication functions for electronic devices, such as call status management (including answering, hanging up, etc.).

[0100] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0101] The Notification Manager allows applications to display notifications in the status bar. These messages can be displayed briefly and then disappear automatically without user interaction. For example, the Notification Manager is used to notify users of completed downloads and message reminders. The Notification Manager can also display notifications in the top status bar of the system as icons or scrolling text, such as notifications from background applications, or as dialog windows on the screen. Examples include text messages in the status bar, beeps, vibrations on electronic devices, and flashing indicator lights.

[0102] The runtime includes the core library and the virtual machine. The runtime is responsible for the scheduling and management of the operating system.

[0103] The core library consists of two parts: one containing the Java language's callable functions and the other containing the operating system's core libraries. The application layer and application framework layer run in a virtual machine. The virtual machine executes the Java files in the application layer and application framework layer as binary files. The virtual machine manages object lifecycles, stack management, thread management, security and exception management, and garbage collection.

[0104] The system library can include multiple functional modules, such as a surface manager, media libraries, a 3D graphics processing library (e.g., OpenGL ES), a 2D graphics engine (e.g., SGL), and an image processing library.

[0105] The surface manager is used to manage the display subsystem and provide fusion of 2D and 3D layers for multiple applications.

[0106] The media library supports playback and recording of a variety of common audio and video formats, as well as static image files. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0107] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0108] A 2D graphics engine is a drawing engine for 2D drawings.

[0109] The kernel layer is the layer between hardware and software. The kernel layer includes at least display driver, camera driver, audio driver, and sensor driver.

[0110] The hardware layer can include various sensors, such as accelerometers, gyroscopes, touch sensors, etc.

[0111] It should be noted that the structure shown in Figures 3 and 4 is only an example of the electronic device provided in the embodiment of the present application, and cannot limit the electronic device provided in the embodiment of the present application. In specific implementations, the electronic device may have more or fewer devices or modules than in the structure shown in Figures 3 or 4.

[0112] The following is an introduction to the device authentication method provided in the embodiment of the present application.

[0113] The device authentication method provided in the embodiment of the present application can be applied to the device authentication scenario shown in Figure 2. Before electronic devices access resources with each other, they need to perform device authentication on the opposite device. For example, in Figure 2, before the first electronic device accesses the second electronic device, the second electronic device needs to perform device authentication on the first electronic device; similarly, before the second electronic device accesses the first electronic device, the first electronic device also needs to perform device authentication on the second electronic device. It can be seen from the above introduction that different electronic devices have different performance and types. A single authentication method is not applicable to various types of electronic devices. In the embodiment of the present application, the authentication method supported by the electronic device can be determined according to the performance and type of the electronic device. Therefore, the device authentication method provided in the embodiment of the present application can be applied to the device authentication process of various types of electronic devices, thereby realizing the interconnection and interoperability of multiple types of electronic devices.

[0114] First, the device credentials for device authentication provided in the embodiment of the present application are introduced. In the embodiment of the present application, the device credentials can be any one of a certificate, a one-time (OT) credential, and a PIN code. In the device authentication method provided in the embodiment of the present application, each electronic device corresponds to a device credential, and the device credential can be used by other electronic devices to authenticate the electronic device. The server can generate the device credential of the electronic device and send the generated device credential to the electronic device, and the electronic device can store the device credential of the electronic device.

[0115] As can be seen from the above introduction, some electronic devices may not be able to connect to the mobile network, then the server can send the device credentials of such electronic devices to the master device associated with the electronic device, and the master device then sends the device credentials of the electronic device to the electronic device. For example, Figure 5 is a schematic diagram of a device credential distribution method provided in an embodiment of the present application. Referring to Figure 5, a communication connection can be established between the first electronic device and the second electronic device, and the communication connection can be, for example, a Bluetooth connection, a wireless fidelity (Wi-Fi) connection, a StarFlash connection, etc. When the second electronic device cannot interact with the server through the mobile network, the second electronic device can send a request message to the first electronic device to request the first electronic device to assist the second electronic device in obtaining the device credentials of the second electronic device, and the first electronic device can send a request message to the server to request to obtain the device credentials of the second electronic device. After the server generates the device credentials of the second electronic device, it can send the device credentials of the second electronic device to the first electronic device, and the first electronic device sends the device credentials of the second electronic device to the second electronic device through the communication connection between the first electronic device and the second electronic device. For example, referring to Figure 5, the DM module of the first electronic device can discover the second electronic device. When it is determined that the second electronic device cannot obtain the device credentials of the second electronic device, the first electronic device can request the device credentials of the second electronic device from the server through the APP, and the APP can send the obtained device credentials of the second electronic device to the IS module of the first electronic device. The IS module of the first electronic device can send the device credentials of the second electronic device to the IS module of the second electronic device, and the IS module of the second electronic device can store the device credentials of the second electronic device.

[0116] The device authentication method provided in the embodiment of the present application can be applied to device authentication between various types of electronic devices. For example, the second electronic device can be a device without TEE, a public device, or a screenless device.

[0117] In the device authentication method provided in the embodiment of the present application, when the second electronic device is an electronic device without a TEE and the first electronic device needs to perform device authentication on the second electronic device, since the second electronic device cannot provide a secure storage environment, the server cannot send the complete device credentials of the second electronic device to the second electronic device. In this case, the server can store the correspondence between the device identification, device credential index value and device credentials of the second electronic device, and the server can send the device credential index value of the second electronic device to the second electronic device, and the second electronic device can store the device credential index value of the second electronic device; or the server can split the device credentials of the second electronic device and send part of the device credentials of the second electronic device to the second electronic device, and the second electronic device can store part of the device credentials. For example, the server can split the device credentials of the second electronic device into two slices: a first slice and a second slice, and the server can send the second slice of the device credentials of the second electronic device to the second electronic device, and the second electronic device can store the second slice of the device credentials of the second electronic device.

[0118] When a first electronic device performs device authentication on a second electronic device that does not have a TEE, the first electronic device needs to obtain the device credentials of the second electronic device. In an embodiment of the present application, the first electronic device can obtain a first slice and a second slice of the device credentials of the second electronic device respectively, and concatenate the first slice and the second slice to synthesize the complete device credentials of the second electronic device; or the first electronic device can also obtain the complete device credentials of the second electronic device.

[0119] In an optional embodiment, the second electronic device may send first information for obtaining the device credentials of the second electronic device to the first electronic device, wherein the first information may include at least one of a device identifier of the second electronic device, an index value of the device credentials of the second electronic device, and a second slice of the device credentials of the second electronic device. The first electronic device may obtain the first slice from the server based on the first information, and the first electronic device may obtain the second slice of the device credentials of the second electronic device from the second electronic device. The first electronic device concatenates the first slice and the second slice to synthesize the complete device credentials of the second electronic device.

[0120] In another optional implementation, the second electronic device may send the first information to the first electronic device, and the first electronic device may obtain the complete device credentials of the second electronic device from the server based on the first information.

[0121] In another optional implementation, the second electronic device can send the device identification of the second electronic device or the device credential index value of the second electronic device to the first electronic device. The first electronic device can then obtain the first slice from the server based on the device identification of the second electronic device or the device credential index value of the second electronic device. The first electronic device sends the first slice to the second electronic device. The second electronic device concatenates the first slice and the second slice to obtain the complete device credential of the second electronic device. The second electronic device sends the complete device credential of the second electronic device to the first electronic device.

[0122] Based on the above introduction, in the embodiment of the present application, the first electronic device can obtain the device credentials of the second electronic device in the following manner:

[0123] Method 1: The first electronic device sends a first authentication request message to the second electronic device, and the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send the device credential index value stored in the second electronic device to the first electronic device. After the first electronic device obtains the device credential index value of the second electronic device, it can send a second authentication request message to the server, and the second authentication request message is used to request device authentication of the second electronic device. The second authentication request message may include the device credential index value of the second electronic device. After the server receives the request message sent by the first electronic device, it can search for the first slice of the device credential of the second electronic device according to the device credential index value of the second electronic device, and send the first slice of the device credential of the second electronic device to the first electronic device. The second electronic device sends the first slice of the device credential of the second electronic device to the first electronic device, and the first electronic device performs string splicing on the first slice and the second slice to obtain the complete device credential of the second electronic device.

[0124] Method 2: The first electronic device sends a first authentication request message to the second electronic device, and the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send a second slice of the device credentials stored in the second electronic device to the first electronic device, and the first electronic device can send a second authentication request message to the server, and the second authentication request message is used to request device authentication of the second electronic device, and the second authentication request message may include a second slice of the device credentials of the second electronic device. After receiving the request message sent by the first electronic device, the server can search for the first slice of the device credentials of the second electronic device based on the second slice of the device credentials of the second electronic device, and send the first slice of the device credentials of the second electronic device to the first electronic device. The first electronic device concatenates the first slice and the second slice to obtain the complete device credentials of the second electronic device.

[0125] Method 3: The first electronic device sends a first authentication request message to the second electronic device, where the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send a second slice of the device credentials stored in the second electronic device to the first electronic device, and the first electronic device can send a second authentication request message to the server, where the second authentication request message is used to request device authentication of the second electronic device. The request message can include the device identification of the second electronic device, and the server can search for the device credentials of the second electronic device based on the device identification of the second electronic device. The server can send the first slice of the device credentials of the second electronic device to the first electronic device. The first electronic device concatenates the first slice and the second slice to obtain the complete device credentials of the second electronic device.

[0126] In this embodiment, there is no order of execution for the step of the first electronic device sending the second authentication request message to the server and the step of the first electronic device sending the first authentication request message to the second electronic device. The first electronic device may first send the first authentication request message to the second electronic device, and then send the second authentication request message to the server; or the first electronic device may first send the second authentication request message to the server, and then send the first authentication request message to the second electronic device; or the first electronic device may simultaneously send the third message to the server and the first authentication request message to the second electronic device. This embodiment of the present application does not limit this.

[0127] Method 4: The first electronic device sends a first authentication request message to the second electronic device, where the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send the device credential index value stored in the second electronic device to the first electronic device. After the first electronic device obtains the device credential index value of the second electronic device, it can send a second authentication request message to the server, where the second authentication request message is used to request device authentication of the second electronic device, and the second authentication request message can include the device credential index value of the second electronic device. After receiving the request message sent by the first electronic device, the server can search for the device credential of the second electronic device based on the device credential index value of the second electronic device, and send the device credential of the second electronic device to the first electronic device.

[0128] Method 5: The first electronic device sends a first authentication request message to the second electronic device, and the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send the second slice of the device credentials stored in the second electronic device to the first electronic device. After the first electronic device obtains the second slice of the device credentials of the second electronic device, it can send a second authentication request message to the server, and the second authentication request message is used to request device authentication of the second electronic device. The second authentication request message may include the second slice of the device credentials of the second electronic device. After receiving the request message sent by the first electronic device, the server can search for the device credentials of the second electronic device based on the second slice of the device credentials of the second electronic device, and send the device credentials of the second electronic device to the first electronic device.

[0129] Method 6: The first electronic device sends a second authentication request message to the server, where the second authentication request message is used to request device authentication of the second electronic device. The second authentication request message may include the device identification of the second electronic device. After receiving the second authentication request message sent by the first electronic device, the server can search for the device credentials of the second electronic device based on the device identification of the second electronic device, and send the device credentials of the second electronic device to the first electronic device. The first electronic device can obtain the device identification of the second electronic device when discovering the second electronic device, or receive the device identification of the second electronic device sent by the second electronic device after sending the authentication request message to the second electronic device.

[0130] Method 7: The first electronic device sends a first authentication request message to the second electronic device, and the first authentication request message is used to request device authentication of the second electronic device. The second electronic device can send the device credential index value stored in the second electronic device to the first electronic device. After the first electronic device obtains the device credential index value of the second electronic device, it can send a second authentication request message to the server, and the second authentication request message is used to request device authentication of the second electronic device. The second authentication request message may include the device credential index value of the second electronic device. After the server receives the second authentication request message sent by the first electronic device, it can search for the first slice of the device credential of the second electronic device according to the device credential index value of the second electronic device, and send the first slice of the device credential of the second electronic device to the first electronic device. The first electronic device sends the first slice of the device credential of the second electronic device to the second electronic device, and the second electronic device concatenates the first slice and the second slice to obtain the complete device credential of the second electronic device. The second electronic device sends the device credential of the second electronic device to the first electronic device.

[0131] Method 8: The first electronic device sends a second authentication request message to the server, where the second authentication request message is used to request device authentication of the second electronic device, and the second authentication request message may include the device identification of the second electronic device. After receiving the request message sent by the first electronic device, the server can search for the first slice of the device credentials of the second electronic device based on the device identification of the second electronic device, and send the first slice of the device credentials of the second electronic device to the first electronic device. The first electronic device sends the first slice of the device credentials of the second electronic device to the second electronic device, and the second electronic device concatenates the first slice and the second slice to obtain the complete device credentials of the second electronic device. The second electronic device sends the device credentials of the second electronic device to the first electronic device.

[0132] It should be noted that since the second electronic device does not have a TEE, in the above-mentioned method 7 and method 8, after the second electronic device generates the device credentials of the second electronic device based on the first slice and the second slice and sends the device credentials of the second electronic device to the first electronic device, it will not continue to save the device credentials of the first slice and the second electronic device, but will still only save the device credential index value of the second electronic device or the second slice.

[0133] In an embodiment of the present application, after obtaining the device credentials of the second electronic device, the first electronic device performs device authentication on the second electronic device based on the device credentials of the second electronic device. Optionally, the first electronic device stores a server public key, and when the first electronic device performs device authentication on the second electronic device based on the device credentials of the second electronic device, the first electronic device can authenticate the device credentials of the second electronic device based on the server public key to obtain a device authentication result.

[0134] For example, when the first electronic device and the second electronic device have the structure shown in Figure 2, the device authentication method provided by the embodiment of the present application can be seen in Figure 6. Referring to Figure 6, Figure 6 takes the example of the first electronic device performing device authentication on the second electronic device. The second electronic device is an electronic device that does not have a TEE. The server can store the correspondence between the device identification, device credential index value and device credential of the second electronic device. The server can send the device credential index value of the second electronic device to the second electronic device; or the server can cut the device credential of the second electronic device into a first slice and a second slice, and the server sends the second slice of the device credential of the second electronic device to the second electronic device. The second electronic device can store the second slice of the device credential of the second electronic device. As shown in Figure 6, the IS module of the second electronic device can store the device credential index value of the second electronic device or the second slice of the device credential of the second electronic device. When other electronic devices perform device authentication on the second electronic device, the IS module can send the device credential index value of the second electronic device or the second slice of the device credential of the second electronic device to the DA module of the second electronic device.

[0135] 6 , when the first electronic device performs device authentication on the second electronic device, the following steps may be included:

[0136] Step a: The first electronic device discovers the second electronic device.

[0137] For example, the DBUS of the first electronic device and the DBUS of the second electronic device can establish a communication connection, such as a Bluetooth connection, a Wi-Fi connection, a StarFlash connection, etc. The DM module of the first electronic device discovers the second electronic device through the DBUS of the first electronic device, and the DM module of the first electronic device can report the information of discovering the second electronic device to the APP.

[0138] In an embodiment of the present application, the first electronic device determines that it is necessary to perform device authentication on the second electronic device. If the first electronic device discovers the second electronic device, the second electronic device sends an access request to the first electronic device, then the first electronic device determines that it is necessary to perform device authentication on the second electronic device. At this time, the first electronic device needs to obtain the device credentials of the second electronic device, then the first electronic device can send a first authentication request message to the second electronic device, and the first authentication request message is used to request device authentication for the second electronic device.

[0139] In an optional embodiment, a first electronic device receives an access request sent by a second electronic device, and the access request may include information indicating that the second electronic device does not have a TEE. For example, the access request may include device type information of the second electronic device. The first electronic device may determine that the second electronic device is an electronic device without a TEE based on the device type information of the second electronic device, or the access request may also include other information indicating that the second electronic device does not have a TEE. This embodiment of the present application is not limited to this.

[0140] In an optional embodiment, as shown in (a) of FIG6 , the first electronic device may obtain the first slice and the second slice of the device credential of the second electronic device and determine the device credential of the second electronic device to complete device authentication. This embodiment includes the following steps:

[0141] Step b: The second electronic device sends the second slice of the device credentials of the second electronic device to the first electronic device.

[0142] Step c: The first electronic device obtains a first slice of the device credentials of the second electronic device from the server.

[0143] Optionally, the first electronic device can obtain the first slice of the device credentials of the second electronic device from the server based on at least one of the device identification of the second electronic device, the device credential index value of the second electronic device and the second slice of the device credentials of the second electronic device.

[0144] Step d: The first electronic device obtains the device credential of the second electronic device based on the first slice and the second slice, and the first electronic device performs device authentication on the second electronic device based on the device credential of the second electronic device.

[0145] For example, referring to (a) in Figure 6, the IS module of the first electronic device can send a first slice of the device credentials of the second electronic device obtained from the server to the DA module of the first electronic device, and the DA module of the second electronic device can send a second slice of the device credentials of the second electronic device to the DA module of the first electronic device. The DA module of the first electronic device can synthesize the device credentials of the second electronic device based on the first slice and the second slice, and perform device authentication on the second electronic device based on the device credentials of the second electronic device.

[0146] In another optional embodiment, as shown in (b) of FIG6 , the first electronic device may obtain the complete device credentials of the second electronic device from the server to complete device authentication. This embodiment includes the following steps:

[0147] Step e: The second electronic device sends the device credential index value of the second electronic device to the first electronic device.

[0148] Step f: The first electronic device obtains the device credential of the second electronic device from the server according to the device credential index value of the second electronic device.

[0149] Step g: The first electronic device performs device authentication on the second electronic device according to the device credentials of the second electronic device.

[0150] For example, referring to (b) in Figure 6, the DA module of the second electronic device can send the device credential index value of the second electronic device to the DA module of the first electronic device, the DA module of the first electronic device sends the device credential index value of the second electronic device to the IS module of the first electronic device, the IS module of the first electronic device sends the device credential index value of the second electronic device to the APP of the first electronic device, the APP of the first electronic device obtains the device credential of the second electronic device from the server according to the device credential index value of the second electronic device, the IS module of the first electronic device can send the device credential of the second electronic device obtained from the server to the DA module of the first electronic device, and the DA module of the first electronic device performs device authentication on the second electronic device according to the device credential of the second electronic device.

[0151] In another optional embodiment, as shown in (c) of Figure 6, the first electronic device may obtain a first slice of the device credential of the second electronic device from the server and send the first slice to the second electronic device. The first electronic device then obtains the device credential of the second electronic device from the second electronic device to complete device authentication. This embodiment includes the following steps:

[0152] Step h: The first electronic device obtains a first slice of the device credentials of the second electronic device from the server.

[0153] Optionally, the first electronic device may obtain a first slice of the device credentials of the second electronic device from the server based on the device credential index value of the second electronic device or the device identification of the second electronic device.

[0154] Step i: The first electronic device sends a first slice of the device credentials of the second electronic device to the second electronic device.

[0155] Step j: The second electronic device synthesizes the first slice and the second slice to obtain the device credential of the second electronic device.

[0156] Step k: The second electronic device sends the device credential of the second electronic device to the first electronic device.

[0157] Step 1: The first electronic device performs device authentication on the second electronic device based on the device credentials of the second electronic device.

[0158] For example, referring to (c) in Figure 6, the IS module of the first electronic device can send the first slice of the device credentials of the second electronic device obtained from the server to the DA module of the first electronic device, and the DA module of the first electronic device can send the first slice of the device credentials of the second electronic device to the DA module of the second electronic device. The IS module of the second electronic device can send the second slice of the device credentials of the second electronic device to the DA module of the first electronic device, and the DA module of the second electronic device can synthesize the device credentials of the second electronic device based on the first slice and the second slice, and the DA module of the second electronic device can send the device credentials of the second electronic device to the DA module of the first electronic device, and the DA module of the first electronic device performs device authentication on the second electronic device based on the device credentials of the second electronic device.

[0159] Optionally, in the embodiment shown in Figure 6, the server public key is stored in the first electronic device. When the first electronic device authenticates the second electronic device based on the device credentials of the second electronic device, it can authenticate the device credentials of the second electronic device based on the server public key to obtain a device authentication result.

[0160] It should be noted that, in the embodiment shown in Figure 6, (a) in Figure 6 corresponds to method 1 to method 3 in which the first electronic device obtains the device credentials of the second electronic device in the above embodiment, (b) in Figure 6 corresponds to method 4 in the above embodiment, and (c) in Figure 6 corresponds to method 7 to method 8 in the above embodiment. The device interaction processes corresponding to other methods are similar to the processes in the embodiment shown in Figure 6. For example, method 5 and method 6 can refer to the process shown in (b) in Figure 6, and the embodiments of this application will not go into details about this.

[0161] Through the above implementation, the second electronic device that does not have a TEE can store part of the device credentials. When the first electronic device performs device authentication on the second electronic device, it can obtain part of the device credentials of the second electronic device from the server and the second electronic device respectively, and then obtain the complete device credentials of the second electronic device to complete the device authentication of the second electronic device; or the second electronic device that does not have a TEE can use the device credential index value. When the first electronic device performs device authentication on the second electronic device, the second electronic device can send the device credential index value of the second electronic device to the first electronic device, so that the first electronic device can obtain the device credentials of the second electronic device from the server according to the device credential index value of the second electronic device to complete the device authentication of the second electronic device; the above method provides a device authentication method for a TEE-free device, which enables intercommunication between a TEE-free electronic device and other electronic devices.

[0162] In an embodiment of the present application, the second electronic device may also perform device authentication on the first electronic device. Specifically, the first electronic device may send the device credentials of the first electronic device to the second electronic device. For example, in the above step e, the first electronic device may send the device credentials of the first electronic device at the same time as sending the first slice to the second electronic device, or the first electronic device may send the device credentials of the first electronic device to the second electronic device at other times. This embodiment of the present application does not limit this. The server public key is stored in the second electronic device. When the second electronic device performs device authentication on the first electronic device based on the device credentials of the first electronic device, it can authenticate the device credentials of the first electronic device based on the server public key to obtain a device authentication result.

[0163] In the device authentication method provided in the embodiment of the present application, when a first electronic device requests access to a second electronic device, the first electronic device sends an access request to the second electronic device. At this time, the second electronic device needs to obtain the device credentials of the first electronic device to perform device authentication on the first electronic device. For example, after receiving the access request, the second electronic device can send a third authentication request message to the first electronic device. The third authentication request message is used to request device authentication on the first electronic device. In the embodiment of the present application, the first electronic device can determine the device credentials of the first electronic device to be sent to the second electronic device based on the device type of the second electronic device, and the second electronic device can perform device authentication on the first electronic device based on the device credentials of the first electronic device.

[0164] In an optional implementation, after discovering the second electronic device, the first electronic device may obtain the device type information of the second electronic device, and determine the device type of the second electronic device based on the device type information of the second electronic device. For example, after discovering the second electronic device, the first electronic device may establish a communication connection with the second electronic device, and the first electronic device may send an access request to the second electronic device through the communication connection, and the second electronic device may send the device type information of the second electronic device to the first electronic device. The first electronic device may store a preset correspondence between the device type of the receiving electronic device and the device credential type. For example, the preset correspondence between the device type of the receiving electronic device and the device credential type may include: public devices corresponding to one-time credentials, screenless low-sensitivity devices corresponding to PIN codes, and screenless high-sensitivity devices corresponding to one-time credentials. The first electronic device may determine the first device credential type corresponding to the device type of the second electronic device, and send the device credential of the first electronic device to the second electronic device based on the first device credential type.

[0165] In an embodiment of the present application, when the second electronic device is a public device, the device credentials of the first electronic device determined by the first electronic device are one-time (OT) credentials corresponding to the first electronic device. As can be seen from the above introduction to the device credentials, the OT credentials are a temporary credential generated by the server and are only used for the device authentication process between the first electronic device and the second electronic device. Therefore, there is no need to worry about the impact of device credential leakage on user data. When the second electronic device is a screenless device, the device credentials of the first electronic device determined by the first electronic device are a PIN code or the OT credentials corresponding to the first electronic device, thereby simplifying the device authentication process and realizing the interconnection between the electronic device and the screenless device. The device authentication method provided in the embodiment of the present application when the second electronic device is an electronic device of different types is further introduced below:

[0166] 1. The second electronic device is a public device

[0167] In some embodiments, the second electronic device is a public device. Before the first electronic device accesses the second electronic device, the second electronic device performs device authentication on the first electronic device. In this scenario, the second electronic device can perform device authentication on the first electronic device based on the OT credentials of the first electronic device.

[0168] FIG7 is a schematic diagram of a device authentication method provided in an embodiment of the present application. Referring to FIG7 , the method may include the following steps:

[0169] Step a: The first electronic device discovers the second electronic device.

[0170] For example, the DBUS of the first electronic device and the DBUS of the second electronic device can establish a communication connection, such as a Bluetooth connection, a Wi-Fi connection, a StarFlash connection, etc. The DM module of the first electronic device discovers the second electronic device through the DBUS of the first electronic device, and the DM module of the first electronic device can report the information of discovering the second electronic device to the APP.

[0171] In an embodiment of the present application, the second electronic device determines that it is necessary to perform device authentication on the first electronic device. If the first electronic device discovers the second electronic device, the first electronic device sends an access request to the second electronic device, then the second electronic device determines that it is necessary to perform device authentication on the first electronic device. At this time, the second electronic device needs to obtain the device credentials of the first electronic device, then the second electronic device can send a third authentication request message to the first electronic device, and the third authentication request message is used to request device authentication on the first electronic device.

[0172] Step b. The first electronic device obtains the OT credential corresponding to the first electronic device from the server.

[0173] In an optional implementation, when the first electronic device determines that the device credentials of the first electronic device need to be sent to the second electronic device, the first electronic device sends a request message to the server, where the request message is used to request to obtain the device credentials of the first electronic device.

[0174] Optionally, when the first electronic device determines that the second electronic device is a public device, the request message sent by the first electronic device to the server can be used to request the OT credentials corresponding to the first electronic device. After receiving the request message sent by the first electronic device, the server can generate the OT credentials corresponding to the first electronic device, and send the OT credentials corresponding to the first electronic device to the electronic device; or the request message sent by the first electronic device can include the device type or device identification of the second electronic device. After receiving the request message sent by the first electronic device, the server can generate the OT credentials corresponding to the first electronic device when determining that the second electronic device is a public device based on the device type or device identification of the second electronic device, and send the OT credentials corresponding to the first electronic device to the first electronic device.

[0175] Step c: The first electronic device sends the OT credential corresponding to the first electronic device to the second electronic device.

[0176] Step d: The second electronic device performs device authentication on the first electronic device based on the OT credentials corresponding to the first electronic device.

[0177] Optionally, step c can be performed by the DA module of the second electronic device. After receiving the OT credential corresponding to the first electronic device, the IS module of the second electronic device can send the OT credential corresponding to the first electronic device to the DA module.

[0178] In a specific implementation, the server public key is stored in the second electronic device. When the second electronic device authenticates the first electronic device based on the OT credentials corresponding to the first electronic device, it can authenticate the OT credentials corresponding to the first electronic device based on the server public key to obtain a device authentication result.

[0179] It should be noted that the second electronic device will not continue to store the OT credentials of the first electronic device after the OT credentials of the first electronic device are used up. That is to say, after the second electronic device completes the device authentication and data transmission with the first electronic device, it will delete the OT credentials of the first electronic device. For example, after the first electronic device goes offline, the DM module of the second electronic device can determine that the first electronic device has gone offline, and the DM module can send a notification message to the IS module to notify the IS module to delete the OT credentials corresponding to the first electronic device. Through this design, the storage space of the second electronic device can be saved while ensuring the information security of the first electronic device.

[0180] Additionally, optionally, the example may further include the following steps:

[0181] Step e: The second electronic device and the first electronic device negotiate to obtain a transmission key based on the OT credential, and the first electronic device and the second electronic device perform data encryption transmission based on the transmission key.

[0182] When the data transmission between the first electronic device and the second electronic device is completed, the second electronic device deletes the transmission key. The next time the first electronic device accesses the second electronic device, device authentication is required again to further ensure the security of the user device interacting with the public device.

[0183] 2. The second electronic device is a screenless device.

[0184] In some examples, the second electronic device is a screenless device and cannot provide a convenient user interaction method. For example, if the second electronic device is a smart lamp, smart curtain, etc., for such devices, the device authentication method provided in the embodiment of the present application can be simplified.

[0185] FIG8 is a schematic diagram of a device authentication method provided by an embodiment of the present application. Referring to FIG8 , the second electronic device is a screenless device, and the second electronic device is capable of accessing a network and interacting with a server. The server may store a correspondence between the screenless device and its master device. When a first electronic device requests access to a second electronic device, and the first electronic device determines that the second electronic device is a screenless device, the first electronic device sends an authorization request message to the second electronic device. The second electronic device may send an authorization request message to the server. After receiving the authorization request message from the second electronic device, the server may determine the master device corresponding to the second electronic device. For example, if the server determines that the master device corresponding to the second electronic device is a third electronic device, the server may send an authorization request message to the third electronic device. After receiving the authorization request message, the third electronic device may display authorization information, such as "The first electronic device requests access to the second electronic device. Do you accept?" The user may confirm the authorization in the third electronic device. The third electronic device sends a confirmation authorization message to the server, which in turn sends a confirmation authorization message to the second electronic device. The second electronic device then sends a confirmation authorization message to the first electronic device, thereby completing device authentication between the first and second electronic devices and allowing the first electronic device to access the second electronic device.

[0186] Optionally, if the second electronic device has established a communication connection with the third electronic device, such as a Bluetooth connection, a Wi-Fi connection, or a StarFlash connection, the second electronic device can also send an authorization request message to the third electronic device through the communication connection between the second electronic device and the third electronic device, without having to obtain authorization from the third electronic device through the server.

[0187] Figure 9 is a schematic diagram of another device authentication method provided by an embodiment of the present application. Referring to Figure 9, the first electronic device and the second electronic device can interact through short-range communication, such as the first electronic device and the second electronic device exchanging data through a Bluetooth connection. When the first electronic device accesses the second electronic device, the first electronic device sends an access request to the second electronic device. At this time, the second electronic device needs to obtain the device credentials of the first electronic device. The second electronic device sends a third authentication request message to the first electronic device. The third authentication request message is used to request device authentication of the first electronic device. The first electronic device sends the device credentials of the first electronic device to the second electronic device based on the device type of the second electronic device, so that the second electronic device authenticates the first electronic device.

[0188] In one embodiment, when the first electronic device determines that the second electronic device is a screenless, low-sensitivity device, the first electronic device can randomly generate a PIN code and use the generated PIN code as the device credential of the first electronic device. For example, the first electronic device can generate a 128-bit PIN code, and the first electronic device sends the PIN code to the second electronic device. After the second electronic device receives the PIN code sent by the first electronic device, the second electronic device completes the authentication of the first electronic device.

[0189] In another embodiment, when the first electronic device determines that the second electronic device is a screenless high-sensitivity device, the first electronic device requests the server to obtain the OT credentials corresponding to the first electronic device. After the server generates the OT credentials corresponding to the first electronic device, the server sends the OT credentials corresponding to the first electronic device to the first electronic device. The first electronic device sends the OT credentials corresponding to the first electronic device to the second electronic device. After the second electronic device receives the OT credentials sent by the first electronic device, the authentication of the first electronic device by the second electronic device is completed.

[0190] It should be noted that the low-sensitivity device in the above embodiment can be a screenless device with low sensitivity to access rights or security, and the high-sensitivity device can be a screenless device with high sensitivity to access rights or security. In implementation, the first electronic device can determine whether the second electronic device is a low-sensitivity device or a high-sensitivity device based on the device type of the second electronic device.

[0191] Through the above method, the first electronic device can determine the device credentials of the first electronic device used for device authentication based on the device type of the second electronic device, thereby using different device credentials for device authentication for different types of electronic devices, realizing device authentication between multiple types of electronic devices, and further realizing intercommunication between multiple types of electronic devices.

[0192] Based on the same concept, the embodiment of the present application also provides a device authentication method, which can be performed by a first electronic device. Figure 10 is a flowchart of a device authentication method provided by an embodiment of the present application. Referring to Figure 10, the method includes the following steps:

[0193] S1001: The first electronic device receives an access request sent by the second electronic device.

[0194] S1002: The first electronic device sends a first authentication request message to the second electronic device.

[0195] S1003: The first electronic device receives first information sent by the second electronic device.

[0196] The first information is related to the device type of the second electronic device, and the first information is used to obtain the device credentials of the second electronic device.

[0197] S1004: The first electronic device sends a second authentication request message to the server.

[0198] The second authentication request message is used to request the device credentials of the second electronic device, and the second request message includes the first information.

[0199] S1005: The first electronic device receives the device credential information of the second electronic device sent by the server.

[0200] Among them, the device credential information of the second electronic device is determined by the server based on the first information. For example, the server can store the correspondence between the device credential information of the second electronic device and the first information. After receiving the first information, the server can search for the device credential information of the second electronic device corresponding to the first information based on the first information.

[0201] S1006: The first electronic device performs device authentication on the second electronic device according to the device credential information of the second electronic device.

[0202] It should be noted that, when implementing the device authentication method shown in FIG. 10 of the present application, reference may be made to the above embodiments of the present application, and repeated descriptions will be omitted.

[0203] Based on the above embodiments, the present application also provides an electronic device, which includes multiple functional modules; the multiple functional modules interact with each other to implement the functions performed by the first electronic device in each method described in the embodiments of the present application. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation. For example, the multiple functional modules in the first electronic device can be the IS module, DM module, DA module, and DBUS shown in Figure 2, wherein the functions of each module can be referred to the above embodiments, and the repeated parts will not be repeated.

[0204] Based on the above embodiments, the present application also provides an electronic device, which includes at least one processor and at least one memory, wherein the at least one memory stores computer program instructions. When the electronic device is running, the at least one processor executes the functions performed by the first electronic device in each method described in the embodiments of the present application.

[0205] Based on the above embodiments, the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the methods described in the embodiments of the present application.

[0206] Based on the above embodiments, the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a computer, the computer executes the methods described in the embodiments of the present application.

[0207] Based on the above embodiments, the present application further provides a chip, which is used to read a computer program stored in a memory to implement the various methods described in the embodiments of the present application.

[0208] Based on the above embodiments, the present application provides a chip system, which includes a processor for supporting a computer device to implement the various methods described in the embodiments of the present application. In one possible design, the chip system also includes a memory for storing the necessary programs and data for the computer device. The chip system can be composed of a chip or can include a chip and other discrete devices.

[0209] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0210] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each flow and / or box in the flow chart and / or block diagram, as well as the combination of the flow chart and / or box in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flow charts and / or one or more boxes in the block diagram.

[0211] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0212] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0213] Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of protection of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A device authentication method, characterized in that: Applied to a first electronic device, the method includes: receiving an access request sent by a second electronic device; Sending a first authentication request message to the second electronic device; receiving first information sent by the second electronic device, where the first information is related to a device type of the second electronic device; Sending a second authentication request message to the server, where the second authentication request message is used to request obtaining the device credential of the second electronic device, and the second request message includes the first information; receiving device credential information of the second electronic device sent by the server, where the device credential information of the second electronic device is determined by the server according to the first information; Device authentication is performed on the second electronic device according to the device credential information of the second electronic device.

2. The method according to claim 1, wherein The device credential information of the second electronic device is a first slice of the device credential of the second electronic device; The method further comprises: receiving a second slice of the device credentials of the second electronic device sent by the second electronic device; The performing device authentication on the second electronic device according to the device credential information of the second electronic device includes: concatenating the first slice of the device credential of the second electronic device and the second slice of the device credential of the second electronic device to obtain a complete device credential of the second electronic device; Device authentication is performed on the second electronic device based on the complete device credentials of the second electronic device.

3. The method according to claim 1, wherein The device credential information of the second electronic device is a first slice of the device credential of the second electronic device; The performing device authentication on the second electronic device according to the device credential information of the second electronic device includes: Send a first slice of the device credentials of the second electronic device to the second electronic device, and receive the complete device credentials of the second electronic device sent by the second electronic device, where the complete device credentials of the second electronic device are obtained by concatenating the first slice of the device credentials of the second electronic device and the second slice of the device credentials of the second electronic device by the second electronic device; perform device authentication on the second electronic device based on the complete device credentials of the second electronic device.

4. The method according to any one of claims 1 to 3, wherein The first information includes at least one of a device identification of the second electronic device, a device credential index value of the second electronic device, and a second slice of the device credential of the second electronic device.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: sending an access request to the second electronic device; receiving a third authentication request message sent by the second electronic device; The device credential of the first electronic device is sent to the second electronic device based on the device type of the second electronic device. The device credential of the first electronic device is used by the second electronic device to perform device authentication on the first electronic device.

6. The method according to claim 5, wherein The device credential of the first electronic device sent to the second electronic device based on the device type of the second electronic device includes: According to the preset correspondence between the device type and the device credential type of the receiving electronic device, the first device credential type corresponding to the device type of the second electronic device is determined; and the device credential of the first electronic device is sent to the second electronic device according to the first device credential type.

7. The method according to claim 5 or 6, wherein: The device credential of the first electronic device is a one-time credential or a personal identification PIN code.

8. The method according to any one of claims 1 to 7, wherein: The method further comprises: receiving a first request message sent by a third electronic device, where the first request message is used to request the first electronic device to assist the third electronic device in obtaining a device credential of the third electronic device; Sending a second request message to the server, where the second request message is used to request the server to obtain the device credential of the third electronic device; receiving the device credential of the third electronic device sent by the server; The device credential of the third electronic device is sent to the third electronic device.

9. An electronic device, characterized in that: The system comprises at least one processor coupled to at least one memory, and the at least one processor is configured to read a computer program stored in the at least one memory to execute the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 8.

Images