Trackside device identity authentication method, system, device, and storage medium

Abstract

A trackside device identity authentication method, a system, a device, and a storage medium. The method comprises: acquiring a registration request of a trackside device and encrypted data carried in the registration request; decrypting the encrypted data to obtain a security chip ID of the trackside device, performing validity verification on the security chip ID, and when the validity verification succeed, registering the trackside device; after registration is completed, generating first authentication data on the basis of a first random number and sending same to the trackside device, the first authentication data being used for triggering the trackside device to encrypt the first authentication data by using an initial authentication key to obtain second authentication data; acquiring the second authentication data uploaded by the trackside device, and performing correctness verification on the second authentication data by using the initial authentication key to obtain confirmation information; and sending the confirmation information to the trackside device.

Description

Trackside equipment authentication methods, systems, equipment and storage media Technical Field

[0001] This application belongs to the field of communication security technology, and in particular relates to a method, system, device and storage medium for trackside equipment identity authentication. Background Technology

[0002] With the continuous advancement of information technology, especially the rapid development of computer and network technologies, the design and implementation of rail transit signaling systems are undergoing profound changes. Currently, most rail transit signaling systems employ networked control systems, with each subsystem relatively independent, responsible for specific signal processing and control tasks. However, with the emergence and maturity of cloud computing technology, and the significant improvement in network bandwidth and stability, rail transit signaling systems are gradually evolving towards a two-tiered cloud-based control architecture. In this new architecture, the underlying trackside equipment is responsible for collecting real-time data such as train operating status and signal light status, and transmitting this data to the cloud via a high-speed network. The cloud control center is responsible for centrally processing and analyzing this data, generating control commands, and then distributing them to the various trackside devices via the network. Since trackside equipment is exposed outdoors, it is vulnerable to cyberattacks. Therefore, it is necessary to establish a trackside equipment authentication mechanism to prevent unauthorized devices from accessing the network.

[0003] In related technologies, trackside equipment uses PKI-based two-way authentication technology for identity verification. The basic principle and process of PKI two-way authentication are as follows:

[0004] 1. Client initiates connection: The client initiates an HTTPS connection request and sends the SSL protocol version information to the server.

[0005] 2. Server responds and sends certificate: The server sends its local public key certificate (server.crt) to the client.

[0006] 3. Client verifies server certificate:

[0007] Check the validity period of the certificate.

[0008] Check if the certificate has been revoked.

[0009] Verify the credibility of the certificate.

[0010] Verify that the subject name in the certificate matches the service domain name requested for access.

[0011] 4. Server requests client certificate: If two-way authentication is enabled, the server will request the client to provide "the client's certificate" in the ServerHello message.

[0012] 5. The client sends a certificate to the server: The client selects an appropriate certificate in response to the server's request and sends it to the server.

[0013] 6. Server verifies client certificate: The server uses the root certificate (root.crt) to decrypt the client's public key certificate, obtain the client's public key, and verify the validity of the client certificate.

[0014] 7. Encrypted Communication: Once both parties have passed the verification, the client and server will use a shared key (the key exchanged via public key encryption) to encrypt subsequent communication.

[0015] 8. Certificate Revocation Check: During the certificate verification process, it is also necessary to check whether the certificate has been revoked. This is usually achieved through CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol).

[0016] The related technologies have the following technical problems:

[0017] 1. The trackside equipment has limited processing capabilities. Performing complex public key calculations is very time-consuming, and each complete TLS handshake consumes a large amount of resources, resulting in prolonged response times.

[0018] 2. Existing PKI two-way authentication technology has high network bandwidth requirements and is not suitable for the current situation of low network bandwidth between central equipment and trackside equipment.

[0019] 3. PKI two-way authentication technology requires configuring and managing digital certificates for each trackside device, and the authentication process is complex and not easy to implement in distributed trackside devices. Summary of the Invention

[0020] This application provides a method, system, device, and storage medium for authentication of trackside devices, aiming to solve the technical problems existing in the above-mentioned related technologies, such as the time-consuming execution of complex public key calculations, the large amount of resources consumed in each complete TLS handshake leading to extended response time, high network bandwidth requirements, and unsuitability for the current situation of low network bandwidth between central devices and trackside devices; as well as the technical problems of needing to configure and manage digital certificates for each trackside device, resulting in a complex authentication process that is not easy to implement in distributed trackside devices.

[0021] The technical solution to the above-mentioned technical problems in this application is as follows: A trackside device authentication method for use in a security gateway, the method comprising:

[0022] Obtain the registration request from the trackside device, and the encrypted data carried in the registration request;

[0023] The encrypted data is decrypted to obtain the security chip ID of the trackside device, and the legality of the security chip ID is verified. Once the legality verification is successful, the trackside device is registered.

[0024] After registration, first authentication data is generated based on a first random number and sent to the trackside device. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data.

[0025] Obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information;

[0026] The confirmation information is sent to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

[0027] By adopting the above technical solution, the beneficial effects of this application are as follows: This application simplifies the authentication process, reduces the complex calculations required by trackside equipment, and enables even equipment with weak processing capabilities to complete the authentication process efficiently. Furthermore, by optimizing the content and frequency of data transmission, it ensures successful authentication even in low-bandwidth environments, thereby reducing the consumption of network resources. Moreover, through centralized management and automated processing, the authentication process becomes more intuitive and convenient, facilitating deployment and maintenance, especially in geographically dispersed environments.

[0028] In some embodiments, the encrypted data described above is generated by encrypting the device information and security chip ID using a test key pre-set by the trackside device, wherein the same test key is pre-set for multiple trackside devices within the jurisdiction using a password management system.

[0029] By adopting the above technical solution, the beneficial effects of this application are as follows: This application ensures that all trackside equipment uses a unified security standard when it is first connected, and at the same time, the verification of the security gateway further ensures that only legitimate equipment can access the system.

[0030] In some embodiments, the above-mentioned verification of the legitimacy of the security chip ID specifically includes:

[0031] The encrypted data is decrypted using a preset authentication parent key to obtain device information and security chip ID;

[0032] The device information and the security chip ID are bound together, and the legality of the security chip ID is verified using a pre-set chip ID information table;

[0033] The security gateway is pre-configured with an authentication parent key using a password management system, and a chip ID information table including the security chip IDs of all trackside devices is also pre-configured.

[0034] By adopting the above technical solution, the beneficial effects of this application are as follows:

[0035] This application ensures that only a secure gateway with the correct authentication parent key can decrypt data sent by trackside devices, increasing the security and accuracy of authentication.

[0036] In some embodiments, the cryptographic management system described above includes a key management system and a key issuance system. The key management system manages and generates the authentication parent key and multiple test keys. The key issuance system sends the authentication parent key to the security gateway and sends the multiple test keys to various trackside devices within the jurisdiction.

[0037] In some embodiments, the above-mentioned registration of the trackside equipment specifically includes:

[0038] Determine whether the trackside equipment has been registered:

[0039] If the trackside device has been registered, then the authentication information and session information of the trackside device are saved;

[0040] If the trackside device is not registered, then register the trackside device, generate registration information, and upload the registration information to the device management system.

[0041] By adopting the above technical solution, the beneficial effects of this application are as follows: this application avoids duplicate registration, saves system resources, and also ensures that each authentication can accurately reflect the latest status of the device.

[0042] In some embodiments, after the above registration is completed, first authentication data is generated based on a first random number and sent to the trackside device. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key. After obtaining the second authentication data, the method further includes:

[0043] A second random number is obtained, and a session key is generated based on the first random number and the second random number. The second random number is generated by the trackside device after receiving the first random number.

[0044] By adopting the above technical solution, the beneficial effects of this application are as follows: This application generates a session key based on a first random number and a second random number for encrypted communication, which greatly improves the security of data transmission.

[0045] In some embodiments, the above-described trackside equipment authentication method further includes:

[0046] After receiving the confirmation information, determine whether the trackside equipment is undergoing its first authentication:

[0047] If the trackside device is authenticating for the first time, a formal authentication key is generated, and the confirmation information and the formal authentication key are sent to the trackside device. The formal authentication key is used to replace the initial authentication key.

[0048] If the trackside device is not being authenticated for the first time, the confirmation information will be sent to the trackside device.

[0049] The beneficial effects of this application by adopting the above technical solution are as follows: after the first successful authentication of the trackside equipment, the application immediately updates the authentication key to a higher level, which enhances the security of long-term use and also provides a basis for possible key rotation in the future.

[0050] Secondly, to address the aforementioned technical problems, this application also provides a trackside equipment authentication system for use in a security gateway, the system comprising:

[0051] The data acquisition module is used to acquire the registration request of the trackside equipment and the encrypted data carried by the registration request;

[0052] The data verification module is used to decrypt the encrypted data to obtain the security chip ID of the trackside device, and to verify the legality of the security chip ID. When the legality verification is successful, the trackside device is registered.

[0053] The authentication preparation module is used to generate first authentication data based on a first random number and send it to the trackside device after registration is completed. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data.

[0054] The authentication verification module is used to obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information;

[0055] The authentication and confirmation module is used to send the confirmation information to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

[0056] Thirdly, in order to solve the above-mentioned technical problems, this application also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the trackside device authentication method of this application.

[0057] Fourthly, in order to solve the above-mentioned technical problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the trackside device authentication method of this application.

[0058] Compared with related technologies, this application has the following advantages:

[0059] 1. This application simplifies the certification process and reduces the complex calculations that trackside equipment needs to perform, enabling even equipment with weaker processing capabilities to complete the certification process efficiently.

[0060] 2. This application optimizes the content and frequency of data transmission to ensure successful authentication even in low-bandwidth environments, thereby reducing the consumption of network resources.

[0061] 3. This application makes the certification process more intuitive and simpler through centralized management and automated processing, and is easier to deploy and maintain, especially in geographically dispersed environments.

[0062] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 shows a flowchart of a trackside equipment authentication method according to an embodiment of this application;

[0065] Figure 2 shows a schematic diagram of the structure of a password management system according to an embodiment of this application;

[0066] Figure 3 illustrates a schematic diagram of the certification and registration process for trackside equipment according to an embodiment of this application;

[0067] Figure 4 illustrates a schematic diagram of the device authentication and key negotiation process according to an embodiment of this application;

[0068] Figure 5 shows a schematic diagram of a trackside equipment authentication system according to an embodiment of this application;

[0069] Figure 6 shows a schematic diagram of an electronic device structure according to an embodiment of this application. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0071] Figure 1 shows a flowchart of a trackside device authentication method according to an embodiment of this application. As shown in Figure 1, the trackside device authentication method according to an embodiment of this application is used in a security gateway, and the method includes:

[0072] Obtain the registration request from the trackside device, and the encrypted data carried in the registration request;

[0073] The encrypted data is decrypted to obtain the security chip ID of the trackside device, and the legality of the security chip ID is verified. Once the legality verification is successful, the trackside device is registered.

[0074] After registration, first authentication data is generated based on a first random number and sent to the trackside device. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data.

[0075] Obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information;

[0076] The confirmation information is sent to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

[0077] In summary, this application simplifies the authentication process, reducing the complex calculations required by trackside equipment, enabling even devices with limited processing power to complete the authentication process efficiently. Furthermore, by optimizing the content and frequency of data transmission, it ensures successful authentication even in low-bandwidth environments, thereby reducing network resource consumption. Centralized management and automated processing make the authentication process more intuitive and convenient, facilitating deployment and maintenance, especially in geographically dispersed environments.

[0078] Optionally, the encrypted data is generated by encrypting the device information and security chip ID using a test key pre-set by the trackside device. The same test key is pre-set for multiple trackside devices within the jurisdiction using a password management system.

[0079] In summary, this application ensures that all trackside devices use a uniform security standard upon initial access, and further guarantees that only legitimate devices can access the system through verification by the security gateway.

[0080] Optionally, verifying the legitimacy of the security chip ID specifically includes:

[0081] The encrypted data is decrypted using a preset authentication parent key to obtain device information and security chip ID;

[0082] The device information and the security chip ID are bound together, and the legality of the security chip ID is verified using a pre-set chip ID information table;

[0083] The security gateway is pre-configured with an authentication parent key using a password management system, and a chip ID information table including the security chip IDs of all trackside devices is also pre-configured.

[0084] In summary, this application ensures that only a secure gateway with the correct authentication parent key can decrypt data sent by trackside devices, thereby increasing the security and accuracy of authentication.

[0085] Optionally, the cryptographic management system includes a key management system and a key issuance system. The key management system manages and generates the authentication parent key and multiple test keys. The key issuance system sends the authentication parent key to the security gateway and sends the multiple test keys to various trackside devices within the jurisdiction.

[0086] As shown in Figure 2, in this embodiment, a security chip is integrated into the trackside equipment. The security chip supports multiple cryptographic algorithms such as SM1, SM3, and SM4, and is used for access authentication and secure encryption of data for trackside equipment.

[0087] The security gateway has a built-in encryption card for encrypting and decrypting data from trackside equipment and for dynamic authentication of trackside equipment.

[0088] The key management system interacts with the cryptographic control machine, which is used to generate, store, encrypt, and decrypt keys. The key management system manages the symmetric keys generated by the cryptographic control machine and supports functions such as secure key storage, import / export, backup, and recovery.

[0089] The key issuance system interacts with an issuance cryptographic machine, which decrypts the ciphertext of the key issued by the key issuance system. The key issuance system issues keys offline, retrieves the ciphertext from the key management system, decrypts it using the issuance cryptographic machine, and then exports the plaintext key to the key issuance device. The key issuance device is used to load the initial key and write initial data in a secure production environment before the security gateway / security chip leaves the factory. Data during the issuance process exists in ciphertext form.

[0090] Optionally, registering the trackside equipment specifically includes:

[0091] Determine whether the trackside equipment has been registered:

[0092] If the trackside device has been registered, then the authentication information and session information of the trackside device are saved;

[0093] If the trackside device is not registered, then register the trackside device, generate registration information, and upload the registration information to the device management system.

[0094] In summary, this application avoids duplicate registration, saves system resources, and ensures that each authentication accurately reflects the latest status of the device.

[0095] As shown in Figure 3, in this embodiment, after the security chip ID is verified, the identity authentication and key negotiation process of the trackside device is initiated, and the identity authentication of the trackside device begins.

[0096] Optionally, after registration, first authentication data is generated based on a first random number and sent to the trackside device. This first authentication data triggers the trackside device to encrypt the first authentication data using an initial authentication key. After obtaining the second authentication data, the process further includes:

[0097] A second random number is obtained, and a session key is generated based on the first random number and the second random number. The second random number is generated by the trackside device after receiving the first random number.

[0098] In summary, this application generates a session key based on a first random number and a second random number for encrypted communication, which greatly improves the security of data transmission.

[0099] Optional, also includes:

[0100] After receiving the confirmation information, determine whether the trackside equipment is undergoing its first authentication:

[0101] If the trackside device is authenticating for the first time, a formal authentication key is generated, and the confirmation information and the formal authentication key are sent to the trackside device. The formal authentication key is used to replace the initial authentication key.

[0102] If the trackside device is not being authenticated for the first time, the confirmation information will be sent to the trackside device.

[0103] In summary, this application updates the authentication key to a higher level immediately after the first successful authentication of the trackside device, enhancing the security for long-term use and providing a basis for possible key rotation in the future.

[0104] As shown in Figure 4, in this embodiment, a random number R1 is taken as the first random number in the security gateway, and a random number R2 is taken as the second random number in the trackside device. In the trackside device, the random number R1 is encrypted using the initial authentication key to obtain the second authentication data E1. The second authentication data E1, the random number R2, and the security chip ID are sent to the security gateway. The security gateway verifies the correctness of the received data. Both the security gateway and the trackside device generate session keys using the random numbers R1 and R2.

[0105] Based on the same principle as the method shown in Figure 1, this application embodiment also provides a trackside equipment identity authentication system, as shown in Figure 5, for use in a security gateway. The system includes:

[0106] The data acquisition module is used to acquire the registration request of the trackside equipment and the encrypted data carried by the registration request;

[0107] The data verification module is used to decrypt the encrypted data to obtain the security chip ID of the trackside device, and to verify the legality of the security chip ID. When the legality verification is successful, the trackside device is registered.

[0108] The authentication preparation module is used to generate first authentication data based on a first random number and send it to the trackside device after registration is completed. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data.

[0109] The authentication verification module is used to obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information;

[0110] The authentication and confirmation module is used to send the confirmation information to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

[0111] The trackside equipment authentication system of this application can execute the trackside equipment authentication method provided in this application. The implementation principle is similar. The actions performed by each module and unit in the trackside equipment authentication system in each embodiment of this application are corresponding to the steps in the trackside equipment authentication method in each embodiment of this application. For detailed functional descriptions of each module of the trackside equipment authentication system, please refer to the descriptions in the corresponding trackside equipment authentication methods shown above. They will not be repeated here.

[0112] The aforementioned trackside equipment authentication system can be a computer program (including program code) running on a computer device, such as an application software; the application software can be used to execute the corresponding steps in the method provided in the embodiments of this application.

[0113] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the modules themselves.

[0114] Based on the same principles as the methods shown in the embodiments of this application, the embodiments of this application also provide an electronic device, which may include, but is not limited to: a processor and a memory; a memory for storing computer programs; and a processor for executing the methods shown in any embodiment of this application by invoking the computer programs.

[0115] In one optional embodiment, an electronic device is provided, as shown in FIG6. The electronic device shown in FIG6 includes a processor and a memory. The processor and the memory are connected, such as via a bus. Optionally, the electronic device may further include a transceiver, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver is not limited to one, and the structure of the electronic device does not constitute a limitation on the embodiments of this application.

[0116] The memory stores application code (computer program) that executes the solution of this application, and its execution is controlled by the processor. The processor executes the application code stored in the memory to implement the content shown in the foregoing method embodiments.

[0117] The electronic device may also be a terminal device. The electronic device shown in Figure 6 is merely an example and should not impose any limitations on the function and scope of use of the embodiments of this application.

[0118] This application provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the corresponding content in the aforementioned method embodiments.

[0119] According to another aspect of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various embodiments described above.

[0120] It should be understood that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0121] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the method shown in the above embodiments.

[0122] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A method for authenticating trackside equipment, wherein, For use in a security gateway, the method includes: Obtain the registration request from the trackside device, and the encrypted data carried in the registration request; The encrypted data is decrypted to obtain the security chip ID of the trackside device, and the legality of the security chip ID is verified. Once the legality verification is successful, the trackside device is registered. After registration, first authentication data is generated based on a first random number and sent to the trackside device. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data. Obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information; The confirmation information is sent to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

2. The trackside equipment authentication method according to claim 1, wherein, The encrypted data is generated by encrypting the device information and security chip ID using a test key pre-set on the trackside device. The same test key is pre-set on multiple trackside devices within the jurisdiction using a password management system.

3. The trackside equipment authentication method according to claim 2, wherein, The specific steps for verifying the legitimacy of the security chip ID include: The encrypted data is decrypted using a preset authentication parent key to obtain device information and security chip ID; The device information and the security chip ID are bound together, and the legality of the security chip ID is verified using a pre-set chip ID information table; The security gateway is pre-configured with an authentication parent key using a password management system, and a chip ID information table including the security chip IDs of all trackside devices is also pre-configured.

4. The trackside equipment authentication method according to claim 3, wherein, The cryptographic management system includes a key management system and a key issuance system. The key management system manages and generates the authentication parent key and multiple test keys. The key issuance system sends the authentication parent key to the security gateway and sends the multiple test keys to various trackside devices within the jurisdiction.

5. The method for authenticating trackside equipment according to claim 1, wherein, Registering the trackside equipment specifically includes: Determine whether the trackside equipment has been registered: If the trackside device has been registered, then the authentication information and session information of the trackside device are saved; If the trackside device is not registered, then register the trackside device, generate registration information, and upload the registration information to the device management system.

6. The method for authenticating trackside equipment according to claim 1, wherein, After registration, first authentication data is generated based on a first random number and sent to the trackside device. This first authentication data triggers the trackside device to encrypt the first authentication data using an initial authentication key. After obtaining the second authentication data, the process further includes: A second random number is obtained, and a session key is generated based on the first random number and the second random number. The second random number is generated by the trackside device after receiving the first random number.

7. The method for authenticating trackside equipment according to claim 1, wherein, Also includes: After receiving the confirmation information, determine whether the trackside equipment is undergoing its first authentication: If the trackside device is authenticating for the first time, a formal authentication key is generated, and the confirmation information and the formal authentication key are sent to the trackside device. The formal authentication key is used to replace the initial authentication key. If the trackside device is not being authenticated for the first time, the confirmation information will be sent to the trackside device.

8. A trackside equipment authentication system, wherein, For use in a security gateway, the system includes: The data acquisition module is used to acquire the registration request of the trackside equipment and the encrypted data carried by the registration request; The data verification module is used to decrypt the encrypted data to obtain the security chip ID of the trackside device, and to verify the legality of the security chip ID. When the legality verification is successful, the trackside device is registered. The authentication preparation module is used to generate first authentication data based on a first random number and send it to the trackside device after registration is completed. The first authentication data is used to trigger the trackside device to encrypt the first authentication data using an initial authentication key to obtain second authentication data. The authentication verification module is used to obtain the second authentication data uploaded by the trackside device, and use the initial authentication key to verify the correctness of the second authentication data to obtain confirmation information; The authentication and confirmation module is used to send the confirmation information to the trackside device; the confirmation information is used to trigger the completion of the identity authentication of the trackside device.

9. An electronic device, wherein, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-7.

10. A computer storage medium, wherein, The computer storage medium stores a computer program, which, when executed by a processor, implements the method of any one of claims 1-7.

Images