WO2016165165A1 - 设备接入的处理方法、设备接入的处理装置和终端 - Google Patents

设备接入的处理方法、设备接入的处理装置和终端 Download PDF

Info

Publication number
WO2016165165A1
WO2016165165A1 PCT/CN2015/078021 CN2015078021W WO2016165165A1 WO 2016165165 A1 WO2016165165 A1 WO 2016165165A1 CN 2015078021 W CN2015078021 W CN 2015078021W WO 2016165165 A1 WO2016165165 A1 WO 2016165165A1
Authority
WO
WIPO (PCT)
Prior art keywords
accessed
terminal
target key
random code
access
Prior art date
Application number
PCT/CN2015/078021
Other languages
English (en)
French (fr)
Inventor
钟焰涛
傅文治
蒋罗
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2016165165A1 publication Critical patent/WO2016165165A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present invention relates to the field of terminal access authentication technologies, and in particular, to a device access processing method, a device access processing device, and a terminal.
  • WBAN Wireless Body Area Network
  • WBAN Wireless Body Area Network
  • it is a network attached to the human body. It is a small, mobile, communication-enabled sensor. And a body main station.
  • wireless body area networks have very broad application prospects in the fields of medical care, health care, and consumer electronics.
  • the device accessing the WBAN must be authenticated.
  • An authentication method is: WBAN body subject (such as terminal) and external access device (such as sensor) perform two-way identity authentication, but the two-way identity authentication process involves encryption and decryption operations, and the calculation required for encryption and decryption operations The amount is very large, and implementation on mobile devices and wearable devices with limited computing power can cause large delays.
  • Another authentication method is: after the sensor collects the ECG signal for a certain period of time, by detecting the signal feature point, intercepting a stable waveform containing the complete physiological signal period information, and generating a template T, the template T is at the device and the body main station.
  • the (mobile terminal) is securely shared, and the sensor can securely transmit the template T to the mobile terminal through a secure ultra-short distance transmission technology, the mobile terminal stores the template T, and registers the user for identity recognition.
  • the method relies on a sensor for collecting ECG signals, which is suitable for medical device networking, and cannot be used by ordinary users (non-medical WBAN users).
  • the last authentication method is: see the body area network as a whole, each sensor node and control The unit is regarded as an antenna, so that the difference of the received signal strengths of different antennas is used to detect whether the distance of the node to be authenticated is close enough, and the authentication node is authenticated based on the principle of close distance trust. However, the method determines that the node to be accessed is close enough to the WBAN by the signal strength, thereby authenticating it, without considering that the attacker may place a malicious attack node around the WBAN user (eg, before and after the seat).
  • the above three authentication methods implement the authentication between the WBAN and the access device under certain conditions, but each has its own defects: or the authentication operation is cumbersome, limited, or insufficient.
  • the invention is based on the above problems, and proposes a new device access processing scheme, which is universal, low in computation, and can effectively perform security authentication on access devices in the wireless body area network.
  • an aspect of the present invention provides a method for processing device access, including: when a terminal receives a device access request from a device to be accessed, sending a first random code to the device to be accessed. After the first random code is received by the device to be accessed, the first target secret is calculated according to the first random code, the pre-stored second random code, and the pre-stored first public key.
  • the device to be accessed accesses the wireless body area network constructed by the terminal. Otherwise, the device to be accessed is prohibited from accessing the wireless body area network constructed by the terminal.
  • the device to be accessed may be configured according to the first random code, the pre-stored second random code, and the first public key according to its own encryption algorithm. Calculating a first target key and transmitting the first target key to the terminal, so that the terminal can calculate according to the first random code, the pre-stored second random code and the second public key according to its own algorithm. And generating a second target password, and comparing with the received first target key, to determine, according to the judgment result, whether the device to be accessed is legal for the terminal to allow access The device, if yes, allows the device to be accessed to access the wireless body area network constructed by the terminal.
  • the device to be accessed is an illegal device, which may pose a threat to the security of the wireless body area network.
  • the access device accesses the wireless body area network constructed by the terminal, so that the security authentication of the access device to the wireless body area network can be efficiently completed through a simple and low computational encryption algorithm, which can effectively avoid illegal waiting.
  • the access device accesses the wireless body area network constructed by the terminal and causes damage to the wireless body area network.
  • the device to be accessed after allowing the device to be accessed to access the wireless body area network constructed by the terminal, calculating a third according to the second random code and the second public key Transmitting the third target key to the device to be accessed, so that the device to be accessed calculates the fourth target according to the second random code and the first public key After the key, determining whether the third target key and the fourth target key are the same, and sending the confirmation information of accessing the wireless body area network to the terminal when the determination result is the same, otherwise, The confirmation information for accessing the wireless body area network is not sent.
  • the third target key may be transmitted to the device to be accessed, so that the device to be accessed is configured according to
  • the fourth target key is compared with the received third target key, and the comparison result is the third target key and the first target key. If the four target keys are the same, the device to be accessed will re-confirm that the correct wireless body area network is accessed, and the confirmation message will be sent to the terminal to complete the access.
  • the device to be accessed may be incorrectly connected to the wrong wireless body area network, that is, the wireless body area network constructed by the terminal is not the wireless that the device to be accessed needs to access.
  • the device to be accessed does not send the confirmation information to the terminal, and does not access the wireless body area network.
  • Access device access process Accuracy, which not only prevents the illegal access device from accessing the wireless body area network constructed by the current terminal, improves the security of the wireless body area network access, and prevents the device to be accessed from being mistakenly accessed by the wrong wireless body area network. Therefore, the accuracy of the access process of the device to be accessed is improved.
  • the two-way authentication process does not need to limit the type of the access device, the two-way authentication method has high versatility and is applicable to various types.
  • the device to be accessed is authenticated.
  • the method further includes: when the device to be accessed is a device to be accessed that the terminal is allowed to access, the first public key and the second public key are the same, And an algorithm used when the to-be-accessed device calculates the first target key and the fourth target key, and an algorithm used by the terminal to calculate the second target key and the third target key The algorithm is the same.
  • the access security authentication of the wireless body area network cannot be successfully performed, and the wireless body area network constructed by the terminal cannot be accessed, so that the security of the access device to access the wireless body area network can be ensured to the greatest extent.
  • the first public key and the second public key include, but are not limited to, a password set by a user, a password, and the like.
  • the calculation method for obtaining the target key preferably employs a cryptographic hash function.
  • the method further includes: when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, sending a prompt signal; and when the device to be accessed accesses
  • the terminal communicates with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the user is informed of the access status of the device to be accessed by sending the prompt information to the user, and the access status of the access device is effectively monitored.
  • a more convenient communication method for the terminal and the access device according to the current environment of the access device and the terminal, such as WIFI, Bluetooth, infrared, NFC, wired network, wireless network, and the like.
  • the method for processing device access in any one of the foregoing technical solutions includes at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the device to be accessed includes at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • a general mobile device a wearable device, a wearable sensor, and a medical device.
  • the devices to be accessed include, but are not limited to, ordinary mobile devices, wearable devices, wearable sensors, and medical devices, all of which can communicate with the terminal through the wireless body area network. Letters can be used to improve user convenience.
  • Another aspect of the present invention provides a device for accessing a device, including: a sending unit, when the terminal receives a device access request from a device to be accessed, sending a first random code to the device to be accessed After the first random code is received by the device to be accessed, the first target secret is calculated according to the first random code, the pre-stored second random code, and the pre-stored first public key.
  • the processing unit when the determination result is yes, allows the device to be accessed to access the wireless body area network constructed by the terminal; otherwise, the device to be accessed is prohibited from accessing the wireless body area network constructed by the terminal. .
  • the device to be accessed may be configured according to the first random code, the pre-stored second random code, and the first public key according to its own encryption algorithm. Calculating a first target key and transmitting the first target key to the terminal, so that the terminal can calculate according to the first random code, the pre-stored second random code and the second public key according to its own algorithm. And a second target password is compared with the received first target key, so as to determine, according to the judgment result, whether the device to be accessed is a legal device that the terminal is allowed to access, and if yes, allow the to-be-accessed
  • the device is connected to the wireless body area network constructed by the terminal.
  • the device to be accessed is an illegal device, which may pose a threat to the security of the wireless body area network.
  • the domain network can effectively implement the security authentication of the access device to enter the wireless body area network through a simple and low-computation encryption algorithm, which can effectively avoid illegal access.
  • Preparation of access terminal constructs a wireless body area network may cause a breakdown of the wireless body area network.
  • the calculating unit is further configured to: after allowing the device to be accessed to access the wireless body area network constructed by the terminal, according to the second random code and the second Generating a third target key; the sending unit is further configured to: send the third target key to the device to be accessed, so that the device to be accessed is according to the second After calculating the fourth target key by using the random code and the first public key, determining whether the third target key and the fourth target key are the same, and when the determination result is the same, Terminal sending The acknowledgment information of the wireless body area network is accessed, otherwise, the acknowledgment information for accessing the wireless body area network is not sent.
  • the third target key may be transmitted to the device to be accessed, so that the device to be accessed is configured according to
  • the fourth target key is compared with the received third target key, and the comparison result is the third target key and the first target key. If the four target keys are the same, the device to be accessed will re-confirm that the correct wireless body area network is accessed, and the confirmation message will be sent to the terminal to complete the access.
  • the device to be accessed may be incorrectly connected to the wrong wireless body area network, that is, the wireless body area network constructed by the terminal is not the wireless that the device to be accessed needs to access.
  • the device to be accessed does not send the confirmation information to the terminal, and does not access the wireless body area network.
  • Access device access process Accuracy, which not only prevents the illegal access device from accessing the wireless body area network constructed by the current terminal, improves the security of the wireless body area network access, and prevents the device to be accessed from being mistakenly accessed by the wrong wireless body area network. Therefore, the accuracy of the access process of the device to be accessed is improved.
  • the two-way authentication process does not need to limit the type of the access device, the two-way authentication method has high versatility and is applicable to various types.
  • the device to be accessed is authenticated.
  • the method further includes: when the device to be accessed is a device to be accessed that the terminal is allowed to access, the first public key and the second public key are the same, And an algorithm used when the to-be-accessed device calculates the first target key and the fourth target key, and an algorithm used by the terminal to calculate the second target key and the third target key The algorithm is the same.
  • the first public key and the second public key include, but are not limited to, a password set by a user, a password, and the like.
  • the calculation method for obtaining the target key preferably employs a cryptographic hash function.
  • the method further includes: a prompting unit, when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, issuing a prompt signal; and a control unit, when the After the access device accesses the wireless body area network, the terminal is controlled to communicate with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • a prompting unit when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, issuing a prompt signal
  • a control unit when the After the access device accesses the wireless body area network, the terminal is controlled to communicate with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the user is informed of the access status of the device to be accessed by sending the prompt information to the user, and the access status of the access device is effectively monitored.
  • a more convenient communication method for the terminal and the access device according to the current environment of the access device and the terminal, such as WIFI, Bluetooth, infrared, NFC, wired network, wireless network, and the like.
  • the processing device for accessing the device according to any one of the preceding claims comprises at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the device to be accessed comprises at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • a general mobile device a wearable device, a wearable sensor, and a medical device.
  • the devices to be accessed include, but are not limited to, ordinary mobile devices, wearable devices, wearable sensors, and medical devices, and all devices that can communicate with the terminal through the wireless body area network to improve user convenience are provided. can.
  • a third aspect of the invention provides a terminal comprising a communication bus, an input device, an output device, a memory, and a processor, wherein:
  • the communication bus is configured to implement connection communication between the input device, the output device, the memory, and the processor;
  • the input device is configured to receive a device access request, a second random code, and a first target key
  • the output device is configured to send a first random code, a pre-stored second random code, and a pre-stored first public key;
  • the memory stores a set of program codes, and the processor calls the program generation stored in the memory Code, used to do the following:
  • the processor is further configured to perform the following operations:
  • the device to be accessed is a device to be accessed that the terminal is allowed to access
  • the first public key and the second public key are the same
  • the The algorithm used by the access device to calculate the first target key and the fourth target key is the same as the algorithm used by the terminal to calculate the second target key and the third target key.
  • the processor is further configured to:
  • the terminal and the to-be-accessed device accesses the wireless body area network
  • the terminal and the to-be-accessed device communicates by at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the device to be accessed includes at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the versatility of the access authentication method of the wireless body area network can be improved, and the access device in the wireless body area network can be efficiently and securely authenticated while reducing the amount of access authentication calculation.
  • FIG. 1 is a flow chart showing a processing method of device access according to an embodiment of the present invention
  • FIG. 2 shows a schematic block diagram of a processing device for device access in accordance with one embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 4 is a block diagram showing the structure of a WBAN according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart diagram of a processing method of device access according to another embodiment of the present invention.
  • FIG. 6 is a flow chart showing a configuration of a primary station according to an embodiment of the present invention.
  • FIG. 7 is a schematic flow chart showing a configuration of a device to be accessed according to an embodiment of the present invention.
  • FIG. 8 is a flow chart showing a process of mutual authentication between a primary station and a device to be accessed according to an embodiment of the present invention
  • FIG. 9 is a block diagram showing the structure of a terminal according to another embodiment of the present invention.
  • FIG. 1 is a flow chart showing a processing method of device access according to an embodiment of the present invention.
  • a method for processing device access includes: Step 102: When a terminal receives a device access request from a device to be accessed, the terminal sends a request to the device to be accessed. After the first random code is received, the first random code is calculated according to the first random code, the pre-stored second random code, and the pre-stored first public key.
  • Step 104 receiving the second random code and the first target key from the device to be accessed, according to Calculating a second target key by using the first random code, the second random code, and the pre-stored second public key; and step 106, determining whether the second target key and the first target key are If the result of the determination is yes, the device to be accessed is allowed to access the wireless body area network constructed by the terminal. Otherwise, the device to be accessed is prohibited from accessing the wireless body area network constructed by the terminal.
  • the device to be accessed may be configured according to the first random code, the pre-stored second random code, and the first public key according to its own encryption algorithm. Calculating a first target key and transmitting the first target key to the terminal, so that the terminal can calculate according to the first random code, the pre-stored second random code and the second public key according to its own algorithm.
  • the device to be accessed is allowed to access the wireless body area network constructed by the terminal. Otherwise, the device to be accessed is an illegal device, which may pose a threat to the security of the wireless body area network. Therefore, the device to be accessed is prohibited from accessing the wireless body area network constructed by the terminal, so that the access device can be efficiently accessed into the wireless body area network through a simple and low computational encryption algorithm. Security certification, can effectively avoid the illegal wireless body area network access devices to be built and the access terminal damage to the wireless body area network.
  • the device to be accessed calculates the first according to the second random code and the first public key
  • the third target key is determined to be the same as the fourth target key, and when the determination result is the same, sending the confirmation information of accessing the wireless body area network to the terminal, Otherwise, the confirmation information for accessing the wireless body area network is not sent.
  • the third target key may be transmitted to the device to be accessed, so that the device to be accessed is configured according to
  • the fourth target key is compared with the received third target key, and the comparison result is the third target key and the first target key. If the four target keys are the same, the device to be accessed will re-confirm that the correct wireless body area network is accessed, and the confirmation message will be sent to the terminal to complete the access.
  • the device to be accessed may be incorrectly connected to the wrong wireless body area network, that is, the wireless body area network constructed by the terminal is not the wireless that the device to be accessed needs to access.
  • the device to be accessed does not send the confirmation information to the terminal, and does not access the wireless body area network.
  • Access device access process Accuracy, which not only prevents the illegal access device from accessing the wireless body area network constructed by the current terminal, improves the security of the wireless body area network access, and prevents the device to be accessed from being mistakenly accessed by the wrong wireless body area network. Therefore, the accuracy of the access process of the device to be accessed is improved.
  • the two-way authentication process does not need to limit the type of the access device, the two-way authentication method has high versatility and is applicable to various types.
  • the device to be accessed is authenticated.
  • the method further includes: when the device to be accessed is a device to be accessed that the terminal is allowed to access, the first public key and the second public key are the same, And an algorithm used when the to-be-accessed device calculates the first target key and the fourth target key, and an algorithm used by the terminal to calculate the second target key and the third target key The algorithm is the same.
  • the wireless body area network so as to ensure the security of the access device to access the wireless body area network to the greatest extent.
  • the first public key and the second public key include, but are not limited to, a password set by a user, a password, and the like.
  • the calculation method for obtaining the target key preferably employs a cryptographic hash function.
  • the method further includes: when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, sending a prompt signal; and when the device to be accessed accesses
  • the terminal communicates with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the user is informed of the access status of the device to be accessed by sending the prompt information to the user, and the access status of the access device is effectively monitored.
  • a more convenient communication method for the terminal and the access device according to the current environment of the access device and the terminal, such as WIFI, Bluetooth, infrared, NFC, wired network, wireless network, and the like.
  • the method for processing device access in any one of the foregoing technical solutions includes at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the device to be accessed includes at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • a general mobile device a wearable device, a wearable sensor, and a medical device.
  • the devices to be accessed include, but are not limited to, ordinary mobile devices, wearable devices, wearable sensors, and medical devices, and all devices that can communicate with the terminal through the wireless body area network to improve user convenience are provided. can.
  • FIG. 2 shows a schematic block diagram of a processing device for device access in accordance with one embodiment of the present invention.
  • the device 200 for accessing a device includes: a sending unit 202, when the terminal receives a device access request from a device to be accessed, to the to-be-accessed The device sends a first random code, so that after the first random code is received by the device to be accessed, according to the first random code, the pre-stored second random code, and the pre-stored first public key, Calculating a first target key, and transmitting the first target key to the terminal;
  • the receiving unit 204 receives the second random code and the first target key from the device to be accessed, and the calculating unit 206 is configured according to the first random code, the second random code, and pre-stored a second public key, calculating a second target key; the determining unit determining whether the second target key is the same as the first target key; and the processing unit 208, when the determination result is yes, allowing the The device to be accessed accesses the wireless body area network constructed by the terminal. Otherwise, the device to
  • the device to be accessed may be configured according to the first random code, the pre-stored second random code, and the first public key according to its own encryption algorithm. Calculating a first target key and transmitting the first target key to the terminal, so that the terminal can calculate according to the first random code, the pre-stored second random code and the second public key according to its own algorithm. And a second target password is compared with the received first target key, so as to determine, according to the judgment result, whether the device to be accessed is a legal device that the terminal is allowed to access, and if yes, allow the to-be-accessed
  • the device is connected to the wireless body area network constructed by the terminal.
  • the device to be accessed is an illegal device, which may pose a threat to the security of the wireless body area network.
  • the domain network can effectively implement the security authentication of the access device to enter the wireless body area network through a simple and low-computation encryption algorithm, which can effectively avoid illegal access.
  • Preparation of access terminal constructs a wireless body area network may cause a breakdown of the wireless body area network.
  • the calculating unit 206 is further configured to: after allowing the device to be accessed to access the wireless body area network constructed by the terminal, according to the second random code and the first a second public key, the third target key is calculated; the sending unit is further configured to: send the third target key to the device to be accessed, so that the device to be accessed is according to the first After calculating the fourth target key by using the second random code and the first public key, determining whether the third target key is the same as the fourth target key, and when the determination result is the same, The terminal sends the acknowledgment information for accessing the wireless body area network, otherwise, the acknowledgment information for accessing the wireless body area network is not sent.
  • the third target key may be transmitted to the device to be accessed, so that the device to be accessed is configured according to a second random code and a first public key
  • the fourth target is dense
  • the key is compared with the received third target key. If the comparison result is that the third target key is the same as the fourth target key, the device to be accessed will re-confirm that the correct wireless body area network is accessed.
  • the acknowledgment message is sent to the terminal to complete the access.
  • the judgment result is that the third target key is different from the fourth target key, it indicates that the device to be accessed may be incorrectly connected to the wrong wireless domain.
  • the network that is, the wireless body area network constructed by the terminal is not the wireless body area network that the access device really needs to access, the device to be accessed will not send the confirmation information to the terminal, nor will it access the network.
  • the wireless body area network can implement the two-way authentication of the access authentication process of the device to be accessed through the above process, and improve the accuracy of the access process of the device to be accessed, so as to prevent the illegal access device from accessing the current terminal.
  • the wireless body area network improves the security of the wireless body area network access, and prevents the device to be accessed from being mistakenly accessed by the wrong wireless body area network, thereby improving the accuracy of the access process of the device to be accessed, of course, Treat the authentication process does not require the type of access device is defined, therefore, the bidirectional authentication method having high versatility, is suitable for various types of security authentication device to be accessed.
  • the method further includes: when the device to be accessed is a device to be accessed that the terminal is allowed to access, the first public key and the second public key are the same, And an algorithm used when the to-be-accessed device calculates the first target key and the fourth target key, and an algorithm used by the terminal to calculate the second target key and the third target key The algorithm is the same.
  • the access security authentication of the wireless body area network cannot be successfully performed, and the wireless body area network constructed by the terminal cannot be accessed, so that the security of the access device to access the wireless body area network can be ensured to the greatest extent.
  • the first public key and the second public key include, but are not limited to, a password set by a user, a password, and the like.
  • the calculation method for obtaining the target key preferably employs a cryptographic hash function.
  • the method further includes: a prompting unit 210, when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, sends a prompt signal; and the control unit 212 After the access device accesses the wireless body area network, the terminal is controlled to communicate with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • a prompting unit 210 when the terminal allows or prohibits the device to be accessed from accessing the wireless body area network, sends a prompt signal
  • the control unit 212 After the access device accesses the wireless body area network, the terminal is controlled to communicate with the to-be-accessed device by using at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the user is informed of the access status of the device to be accessed by sending the prompt information to the user, and the access status of the access device is effectively monitored.
  • a more convenient communication method for the terminal and the access device according to the current environment of the access device and the terminal, such as WIFI, Bluetooth, infrared, NFC, wired network, wireless network, and the like.
  • the processing device for accessing the device according to any one of the preceding claims comprises at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the device to be accessed comprises at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • a general mobile device a wearable device, a wearable sensor, and a medical device.
  • the devices to be accessed include, but are not limited to, ordinary mobile devices, wearable devices, wearable sensors, and medical devices, and all devices that can communicate with the terminal through the wireless body area network to improve user convenience are provided. can.
  • FIG. 3 shows a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • a terminal 300 includes the processing device 200 accessed by the device according to any one of the above aspects, and therefore, the terminal has any one of the above technical solutions.
  • the same technical effects of the processing device 200 accessed by the device are not described herein.
  • FIG. 4 is a schematic structural diagram of a WBAN according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart showing a processing method of device access according to another embodiment of the present invention
  • FIG. 7 is a flow diagram showing a configuration of a device to be accessed according to an embodiment of the present invention
  • FIG. 8 shows a primary station and an embodiment according to an embodiment of the present invention.
  • the WBAN is a network attached to the human body, and is composed of a small movable, communication-capable sensor and a sensor.
  • the body main station is composed.
  • the body main station is usually a device with strong computing and storage capabilities such as a smartphone or a tablet.
  • the processing scheme of the device access in this embodiment includes three processes: a general access process of the device to be accessed (as shown in FIG. 5): a configuration process of the primary station (as shown in FIG. 6), and a device to be accessed.
  • the configuration process (as shown in Figure 7) and the access authentication process of the device to be accessed (as shown in Figure 8).
  • the parameters and symbols used in the scheme include: h: cryptographic hash function; s: secret value, that is, public key, including but not limited to a user-set password, password, and the like.
  • the following three processes are specifically described:
  • the general access process of the device to be accessed includes:
  • Step 502 configuring a primary station (usually a mobile device such as a smart phone or a tablet computer with strong computing and storage capabilities), that is, configuring necessary authentication parameters for the primary station;
  • a primary station usually a mobile device such as a smart phone or a tablet computer with strong computing and storage capabilities
  • Step 504 Configure the access device.
  • Step 506 Perform security authentication on the access device.
  • the master station configuration process includes the following steps:
  • step 602 the user inputs a secret value s for the primary station.
  • step 604 the primary station performs other necessary WBAN parameters to complete the initialization operation.
  • the configuration of the device to be accessed includes the following steps:
  • Step 702 When determining the WBAN to be accessed to the current body primary station, the user inputs the same secret value s as the primary station configuration process for the device to be accessed.
  • step 704 the device to be accessed performs other necessary WBAN parameters to complete initialization.
  • the access authentication process is as follows:
  • access authentication is started.
  • the access authentication process involves three message interactions, as shown in Figure 8.
  • the body primary station receives the device to be accessed by the device to be accessed.
  • the body primary station selects a random code a and sends a random code a to the device to be accessed.
  • the device to be accessed adopts cryptography according to the received random code a, the pre-stored random code b and the secret value s.
  • the body main station determines whether the calculated second target key c2 and the received first target key c1 are In the same way, when it is determined that c1 and c2 are different, the device to be accessed is prohibited from accessing the WBAN; when it is determined that c1 and c2 are the same, the device to be accessed is allowed to access the WBAN to complete the authentication of the identity of the device to be accessed (in this implementation). In an example, since the device to be accessed has the same public key and the same encryption algorithm that are not missing in the encryption calculation, the device to be accessed is a legal device that the body subject allows access, c1 and c2. the same).
  • the device to be accessed When it is judged that d1 and d2 are the same, the device to be accessed will re-confirm that the correct wireless body area network is accessed, and the confirmation information is sent to the terminal to complete the access.
  • the device to be accessed may be incorrectly connected to the wrong wireless body area network, that is, the wireless body area network constructed by the body main station is not the wireless body area network that the access device really needs to access.
  • the device to be accessed will not send confirmation information to the terminal, nor will it send
  • the wireless body area network is accessed to complete the authentication of the body main station identity, thereby achieving mutual authentication between the body primary station and the device to be accessed (of course, in this embodiment, due to the device to be accessed and the body
  • the main body has the same public key and the same encryption algorithm that are not missing in the encryption calculation. Therefore, the device to be accessed is a legal device that the body subject allows access, and d1 is the same as d2.
  • the same secret value s is preset by the legal to-be-accessed devices allowed to access the body primary station and the body primary station, and the cryptography is controlled by using the same encryption algorithm.
  • the function h can ensure that in the process of the wireless body area network constructed by the device to be accessed, only the legal device to be accessed can calculate the same target key as the terminal, and smoothly pass the wireless domain.
  • the access security authentication of the network, and the illegal access device does not have the same public key that is not available in the same encryption calculation as the terminal, and does not have the same encryption algorithm as the body main station.
  • FIG. 9 is a schematic structural diagram of another terminal according to an embodiment of the present invention.
  • the terminal may include: at least one input device 903, at least one output device 904, At least one processor 901, such as a CPU, a memory 905, and at least one bus 902, the processor 901 can be coupled to the processing device accessed by the device shown in FIG. 2.
  • the bus 902 is used to connect the input device 903, the output device 904, the processor 901, and the memory 905.
  • the input device 903 may specifically be a communication interface of the terminal, such as a network interface, and the network interface may include a standard wired interface or a wireless interface (such as a WI-FI interface), and is configured to receive a device access request, a second random code, and First target key.
  • a network interface such as a network interface
  • the network interface may include a standard wired interface or a wireless interface (such as a WI-FI interface), and is configured to receive a device access request, a second random code, and First target key.
  • the output device 904 may specifically be a communication interface of the terminal, such as a network interface.
  • the network interface may include a standard wired interface or a wireless interface (such as a WI-FI interface), and is configured to send the first random code and the second pre-stored. A random code and a pre-stored first public key.
  • the above memory 905 may be a high speed RAM memory or a non-volatile memory such as a disk memory.
  • the memory 905 is further configured to store a set of program codes, and the processor 901 is configured to call the program code stored in the memory 905, and perform the following operations:
  • the first random code is sent to the device to be accessed by the output device 904, so that the device to be accessed receives the device.
  • the first random code calculating a first target key according to the first random code, the pre-stored second random code, and the pre-stored first public key, and the first target key Send to the terminal.
  • the processor 901 may further perform the following operations:
  • the third target key to the device to be accessed, so that the device to be accessed calculates the first according to the second random code and the first public key.
  • the third target key is determined to be the same as the fourth target key, and when the determination result is the same, sending the confirmation information of accessing the wireless body area network to the terminal, Otherwise, the confirmation information for accessing the wireless body area network is not sent.
  • the device to be accessed is a device to be accessed that is allowed to be accessed by the terminal
  • the first public key and the second public key are the same
  • the algorithm used by the ingress device to calculate the first target key and the fourth target key is the same as the algorithm used by the terminal to calculate the second target key and the third target key.
  • processor 901 can also perform the following operations:
  • the terminal After the device to be accessed accesses the wireless body area network, the terminal communicates with the device to be accessed through at least one of WIFI, Bluetooth, infrared, NFC, wired network, and wireless network.
  • the device to be accessed may include at least one of a general mobile device, a wearable device, a wearable sensor, and a medical device.
  • the terminal introduced in the embodiment of the present invention may be used to implement some or all of the processes in the method embodiments introduced in conjunction with FIG. 1, FIG. 5 or FIG.
  • the present invention proposes a new device access processing scheme, which is universal, low in computation, and efficient for access devices in a wireless body area network. Conduct safety certification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本发明提出了一种设备接入的处理方法、一种处理装置和一种终端，其中，处理方法包括：终端接收到来自待接入设备的设备接入请求时，向待接入设备发送第一随机码，待接入设备接收到第一随机码后，根据第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将第一目标密钥发送至终端；接收来自待接入设备的第二随机码和第一目标密钥，根据第一随机码、第二随机码和预存储的第二公共密钥，计算出第二目标密钥；判断第二目标密钥与第一目标密钥是否相同，若是，允许待接入设备接入无线体域网，否则，禁止接入无线体域网。本发明的技术方案通用、计算量低、且能高效地对无线体域网中的接入设备进行安全认证。

Description

设备接入的处理方法、设备接入的处理装置和终端
本申请要求于2015年04月17日提交中国专利局，申请号为CN201510184781.9、发明名称为“设备接入的处理方法、设备接入的处理装置和终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及终端接入认证技术领域，具体而言，涉及一种设备接入的处理方法，一种设备接入的处理装置和一种终端。
背景技术
WBAN（Wireless Body Area Network，无线体域网）是以人体为中心的短距离无线网络，具体地说，它是附着在人体上的一种网络，由一套小巧可移动、具有通信功能的传感器和一个身体主站组成。作为一种新兴的技术，无线体域网在医疗、保健、消费类电子等领域有着非常广阔的应用前景。为了防止恶意结点接入WBAN进而对WBAN进行攻击破坏，必须对接入WBAN的设备进行认证。目前，现有技术方案中，主要有三种认证方法：
1）一种认证方法是：WBAN身体主体（如终端）与外部接入设备（如传感器）进行双向身份认证，但该双向身份认证过程中涉及到加解密操作，且加解密操作所需的计算量非常大，在计算能力有限的移动设备和可穿戴设备上实现会造成较大的延迟。
2）另一种认证方法是：通过传感器采集一定时长的心电信号后，通过检测信号特征点，截取一段包含完整生理信号周期信息的稳定波形，生成模板T，模板T在设备与身体主站（移动终端）之间安全共享，传感器可以通过安全的超短距离传输技术将模板T安全传送给移动终端，移动终端存储模板T，并注册用户以进行身份识别。该方法依赖于采集心电信号的传感器，适用于医疗设备组网，普通用户（非医疗WBAN用户）无法使用。
3）最后一种认证方法是：将体域网看成一个整体，每个传感器节点和控 制单元都视作一个天线，从而利用不同天线的接收信号强度差异探测待认证节点的距离是否足够近，基于近距离可信原则对待认证节点进行认证。但是，该方法是通过信号强度确定待接入节点足够靠近WBAN，从而对其认证，没有考虑攻击者可能在WBAN用户身边（如，座位前后）放置恶意攻击节点。
上述三种认证方法在一定条件下实现了WBAN与接入设备间的认证，但各有自己的缺陷：或认证操作比较繁琐，或局限性的，或安全性不够。
因此，如何提高无线体域网的接入认证方法的通用性，且在降低接入认证计算量的同时，对无线体域网中接入设备进行高效、安全的认证，成为亟待解决的问题。
发明内容
本发明正是基于上述问题，提出了一种新的设备接入的处理方案，该方案通用、计算量低、且能高效地对无线体域网中的接入设备进行安全认证。
有鉴于此，本发明的一方面提出了一种设备接入的处理方法，包括：当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在该技术方案中，通过向待接入设备发送一个第一随机码，可以使待接入设备根据第一随机码、预存储的第二随机码和第一公开密钥，按照自身的加密算法计算出一个第一目标密钥，并将第一目标密钥发送至终端，这样，终端就可以根据第一随机码、预存储的第二随机码和第二公开密钥，按照自身的算法计算出一个第二目标密码，并与所接收到的第一目标密钥进行比对，以根据判断结果判断该待接入设备是否为终端允许接入的合法 设备，若是，则允许该待接入设备接入终端构建的无线体域网，否则，说明该待接入设备是非法设备，会对无线体域网的安全性带来威胁，则禁止该待接入设备接入终端构建的无线体域网，从而实现通过简单的、计算量较低的加密算法就可以高效地完成对待接入设备进入无线体域网的安全认证，可以有效地避免非法待接入设备接入终端构建的无线体域网而对该无线体域网造成破坏。
在上述技术方案中，优选地，在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在该技术方案中，在终端根据第二随机码和第二公共密钥，计算出第三目标密钥后，可以将第三目标密钥传送至待接入设备，以使待接入设备根据第二随机码和第一公开密钥，计算出第四目标密钥后，将第四目标密钥与接收到的第三目标密钥进行比对，若比较结果为第三目标密钥与第四目标密钥相同，则待接入设备就会再次确认接入了正确的无线体域网，就会向终端发送确认信息，以完成接入，当然，当判断结果为第三目标密钥与第四目标密钥不相同时，说明待接入设备有可能误接入了错误的无线体域网，也即目前终端所构建的无线体域网并不是待接入设备真正需要接入的无线体域网，则该待接入设备就不会向终端发送确认信息，也不会接入该无线体域网，通过上述过程，可以实现待接入设备的接入认证过程的双向认证，提高待接入设备接入过程的准确性，这样不仅可以防止非法待接入设备接入当前终端构建的无线体域网，提高无线体域网接入安全性，又可以防止待接入设备误接入错误的无线体域网，从而提高待接入设备接入过程的准确性，当然，由于该双向认证过程不需要对待接入设备的类型进行限定，因此，该双向认证方法具有很高的通用性，适用于对各种类型的待接入设备进行安全认证。
在上述技术方案中，优选地，还包括：当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在该技术方案中，通过向终端和终端允许接入的合法待接入设备预置相同的第一公共密钥和所述第二公共密钥，以及控制他们使用相同的加密算法，可以确保在待接入设备接入终端构建的无线体域网的过程中，唯有合法的待接入设备才能计算出与终端相同的目标密钥，进而顺利地通过无线体域网的接入安全认证，而非法待接入设备由于并不具备与终端相同的加密计算中不可以缺少的公共密钥，更不具备与终端相同的加密算法，因此，不可能计算出与终端相同的目标密钥，从而无法顺利地通过无线体域网的接入安全认证，无法接入终端构建的无线体域网，这样就可以实现最大程度地确保待接入设备接入无线体域网的安全性。其中，第一公开密钥和第二公开密钥包括但不限于：用户设定的口令、密码等。用以获得目标密钥的计算方法优选地采用密码学哈希函数。
在上述技术方案中，优选地，还包括：当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在该技术方案中，通过向用户发送提示信息，使得用户了解当前待接入设备的接入状态，以对待接入设备的接入状态进行有效的监控。当然，还可以根据接入设备和终端当前所处的环境，为终端和接入设备选择更为便捷的通信方式，如WIFI、蓝牙、红外、NFC、有线网络、无线网络等。
在上述技术中，优选地，上述任一项技术方案中的设备接入的处理方法，所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
在该技术方案中，待接入设备包括但不限于普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备，所有可以通过无线体域网与终端进行通 信，以提高用户便利性的设备均可。
本发明的另一方面提出了一种设备接入的处理装置，包括：发送单元，当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；接收单元，接收来自所述待接入设备的所述第二随机码和所述第一目标密钥；计算单元，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；判断单元，判断所述第二目标密钥与所述第一目标密钥是否相同；处理单元，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在该技术方案中，通过向待接入设备发送一个第一随机码，可以使待接入设备根据第一随机码、预存储的第二随机码和第一公开密钥，按照自身的加密算法计算出一个第一目标密钥，并将第一目标密钥发送至终端，这样，终端就可以根据第一随机码、预存储的第二随机码和第二公开密钥，按照自身的算法计算出一个第二目标密码，并与所接收到的第一目标密钥进行比对，以根据判断结果判断该待接入设备是否为终端允许接入的合法设备，若是，则允许该待接入设备接入终端构建的无线体域网，否则，说明该待接入设备是非法设备，会对无线体域网的安全性带来威胁，则禁止该待接入设备接入终端构建的无线体域网，从而实现通过简单的、计算量较低的加密算法就可以高效地完成对待接入设备进入无线体域网的安全认证，可以有效地避免非法待接入设备接入终端构建的无线体域网而对该无线体域网造成破坏。
在上述技术方案中，优选地，所述计算单元还用于：在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；所述发送单元还用于：将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送 接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在该技术方案中，在终端根据第二随机码和第二公共密钥，计算出第三目标密钥后，可以将第三目标密钥传送至待接入设备，以使待接入设备根据第二随机码和第一公开密钥，计算出第四目标密钥后，将第四目标密钥与接收到的第三目标密钥进行比对，若比较结果为第三目标密钥与第四目标密钥相同，则待接入设备就会再次确认接入了正确的无线体域网，就会向终端发送确认信息，以完成接入，当然，当判断结果为第三目标密钥与第四目标密钥不相同时，说明待接入设备有可能误接入了错误的无线体域网，也即目前终端所构建的无线体域网并不是待接入设备真正需要接入的无线体域网，则该待接入设备就不会向终端发送确认信息，也不会接入该无线体域网，通过上述过程，可以实现待接入设备的接入认证过程的双向认证，提高待接入设备接入过程的准确性，这样不仅可以防止非法待接入设备接入当前终端构建的无线体域网，提高无线体域网接入安全性，又可以防止待接入设备误接入错误的无线体域网，从而提高待接入设备接入过程的准确性，当然，由于该双向认证过程不需要对待接入设备的类型进行限定，因此，该双向认证方法具有很高的通用性，适用于对各种类型的待接入设备进行安全认证。
在上述技术方案中，优选地，还包括：当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在该技术方案中，通过向终端和终端允许接入的合法待接入设备预置相同的第一公共密钥和所述第二公共密钥，以及控制他们使用相同的加密算法，可以确保在待接入设备接入终端构建的无线体域网的过程中，唯有合法的待接入设备才能计算出与终端相同的目标密钥，进而顺利地通过无线体域网的接入安全认证，而非法待接入设备由于并不具备与终端相同的加密计算中不可以缺少的公共密钥，更不具备与终端相同的加密算法，因 此，不可能计算出与终端相同的目标密钥，从而无法顺利地通过无线体域网的接入安全认证，无法接入终端构建的无线体域网，这样就可以实现最大程度地确保待接入设备接入无线体域网的安全性。其中，第一公开密钥和第二公开密钥包括但不限于：用户设定的口令、密码等。用以获得目标密钥的计算方法优选地采用密码学哈希函数。
在上述技术方案中，优选地，还包括：提示单元，当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及控制单元，当所述待接入设备接入所述无线体域网后，控制所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在该技术方案中，通过向用户发送提示信息，使得用户了解当前待接入设备的接入状态，以对待接入设备的接入状态进行有效的监控。当然，还可以根据接入设备和终端当前所处的环境，为终端和接入设备选择更为便捷的通信方式，如WIFI、蓝牙、红外、NFC、有线网络、无线网络等。
在上述技术方案中，优选地，上述任一项所述的设备接入的处理装置，所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
在该技术方案中，待接入设备包括但不限于普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备，所有可以通过无线体域网与终端进行通信，以提高用户便利性的设备均可。
本发明的第三方面提出了一种终端，包括通信总线、输入装置、输出装置、存储器以及处理器，其中：
所述通信总线，用于实现所述输入装置、输出装置、存储器以及处理器之间的连接通信；
所述输入装置，用于接收设备接入请求、第二随机码和第一目标密钥；
所述输出装置，用于发送第一随机码、预存储的第二随机码和预存储的第一公共密钥；
所述存储器中存储一组程序代码，且处理器调用存储器中存储的程序代 码，用于执行以下操作：
当通过所述输入装置接收到来自待接入设备的设备接入请求时，通过所述输出装置向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；
通过所述输入装置接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；
判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在上述技术方案中，优选地，所述处理器在允许所述待接入设备接入所述终端构建的无线体域网之后，还用于执行以下操作：
根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；
通过所述输出装置将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在上述技术方案中，优选地，当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在上述技术方案中，优选地，所述处理器还用于执行以下操作：
当所述终端允许或禁止所述待接入设备接入所述无线体域网时，通过所述输出装置发出提示信号；以及
当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设 备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在上述技术方案中，优选地，所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
通过本发明的技术方案，能够提高无线体域网的接入认证方法的通用性，且在降低接入认证计算量的同时，对无线体域网中接入设备进行高效、安全的认证。
附图说明
图1示出了根据本发明的一个实施例的设备接入的处理方法的流程示意图；
图2示出了根据本发明的一个实施例的设备接入的处理装置的示意框图；
图3示出了根据本发明的一个实施例的终端的结构示意图；
图4示出了根据本发明的一个实施例的WBAN的结构示意图；
图5示出了根据本发明的另一个实施例的设备接入的处理方法的流程示意图；
图6示出了根据本发明的一个实施例的主站配置的流程示意图；
图7示出了根据本发明的一个实施例的待接入设备配置的流程示意图；
图8示出了根据本发明的一个实施例的主站与待接入设备之间双向认证过程的流程示意图；
图9示出了根据本发明的另一个实施例的终端的结构示意图。
具体实施方式
为了可以更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的一个实施例的设备接入的处理方法的流程示意图。
如图1所示，根据本发明的一个实施例的设备接入的处理方法，包括：步骤102，当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；步骤104，接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；步骤106，判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在该技术方案中，通过向待接入设备发送一个第一随机码，可以使待接入设备根据第一随机码、预存储的第二随机码和第一公开密钥，按照自身的加密算法计算出一个第一目标密钥，并将第一目标密钥发送至终端，这样，终端就可以根据第一随机码、预存储的第二随机码和第二公开密钥，按照自身的算法计算出一个第二目标密码，并与所接收到的第一目标密钥进行比对，以根据判断结果判断该待接入设备是否为终端允许接入的合法设备，若是（即第二目标密钥与第一目标密钥相同），则允许该待接入设备接入终端构建的无线体域网，否则，说明该待接入设备是非法设备，会对无线体域网的安全性带来威胁，则禁止该待接入设备接入终端构建的无线体域网，从而实现通过简单的、计算量较低的加密算法就可以高效地完成对待接入设备进入无线体域网的安全认证，可以有效地避免非法待接入设备接入终端构建的无线体域网而对该无线体域网造成破坏。
在上述技术方案中，优选地，在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出 第三目标密钥；将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在该技术方案中，在终端根据第二随机码和第二公共密钥，计算出第三目标密钥后，可以将第三目标密钥传送至待接入设备，以使待接入设备根据第二随机码和第一公开密钥，计算出第四目标密钥后，将第四目标密钥与接收到的第三目标密钥进行比对，若比较结果为第三目标密钥与第四目标密钥相同，则待接入设备就会再次确认接入了正确的无线体域网，就会向终端发送确认信息，以完成接入，当然，当判断结果为第三目标密钥与第四目标密钥不相同时，说明待接入设备有可能误接入了错误的无线体域网，也即目前终端所构建的无线体域网并不是待接入设备真正需要接入的无线体域网，则该待接入设备就不会向终端发送确认信息，也不会接入该无线体域网，通过上述过程，可以实现待接入设备的接入认证过程的双向认证，提高待接入设备接入过程的准确性，这样不仅可以防止非法待接入设备接入当前终端构建的无线体域网，提高无线体域网接入安全性，又可以防止待接入设备误接入错误的无线体域网，从而提高待接入设备接入过程的准确性，当然，由于该双向认证过程不需要对待接入设备的类型进行限定，因此，该双向认证方法具有很高的通用性，适用于对各种类型的待接入设备进行安全认证。
在上述技术方案中，优选地，还包括：当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在该技术方案中，通过向终端和终端允许接入的合法待接入设备预置相同的第一公共密钥和所述第二公共密钥，以及控制他们使用相同的加密算法，可以确保在待接入设备接入终端构建的无线体域网的过程中，唯有 合法的待接入设备才能计算出与终端相同的目标密钥，进而顺利地通过无线体域网的接入安全认证，而非法待接入设备由于并不具备与终端相同的加密计算中不可以缺少的公共密钥，更不具备与终端相同的加密算法，因此，不可能计算出与终端相同的目标密钥，从而无法顺利地通过无线体域网的接入安全认证，无法接入终端构建的无线体域网，这样就可以实现最大程度地确保待接入设备接入无线体域网的安全性。其中，第一公开密钥和第二公开密钥包括但不限于：用户设定的口令、密码等。用以获得目标密钥的计算方法优选地采用密码学哈希函数。
在上述技术方案中，优选地，还包括：当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在该技术方案中，通过向用户发送提示信息，使得用户了解当前待接入设备的接入状态，以对待接入设备的接入状态进行有效的监控。当然，还可以根据接入设备和终端当前所处的环境，为终端和接入设备选择更为便捷的通信方式，如WIFI、蓝牙、红外、NFC、有线网络、无线网络等。
在上述技术中，优选地，上述任一项技术方案中的设备接入的处理方法，所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
在该技术方案中，待接入设备包括但不限于普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备，所有可以通过无线体域网与终端进行通信，以提高用户便利性的设备均可。
图2示出了根据本发明的一个实施例的设备接入的处理装置的示意框图。
如图2所示，根据本发明的一个实施例的设备接入的处理装置200，包括：发送单元202，当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端； 接收单元204，接收来自所述待接入设备的所述第二随机码和所述第一目标密钥；计算单元206，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；判断单元，判断所述第二目标密钥与所述第一目标密钥是否相同；处理单元208，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在该技术方案中，通过向待接入设备发送一个第一随机码，可以使待接入设备根据第一随机码、预存储的第二随机码和第一公开密钥，按照自身的加密算法计算出一个第一目标密钥，并将第一目标密钥发送至终端，这样，终端就可以根据第一随机码、预存储的第二随机码和第二公开密钥，按照自身的算法计算出一个第二目标密码，并与所接收到的第一目标密钥进行比对，以根据判断结果判断该待接入设备是否为终端允许接入的合法设备，若是，则允许该待接入设备接入终端构建的无线体域网，否则，说明该待接入设备是非法设备，会对无线体域网的安全性带来威胁，则禁止该待接入设备接入终端构建的无线体域网，从而实现通过简单的、计算量较低的加密算法就可以高效地完成对待接入设备进入无线体域网的安全认证，可以有效地避免非法待接入设备接入终端构建的无线体域网而对该无线体域网造成破坏。
在上述技术方案中，优选地，所述计算单元206还用于：在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；所述发送单元还用于：将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在该技术方案中，在终端根据第二随机码和第二公共密钥，计算出第三目标密钥后，可以将第三目标密钥传送至待接入设备，以使待接入设备根据第二随机码和第一公开密钥，计算出第四目标密钥后，将第四目标密 钥与接收到的第三目标密钥进行比对，若比较结果为第三目标密钥与第四目标密钥相同，则待接入设备就会再次确认接入了正确的无线体域网，就会向终端发送确认信息，以完成接入，当然，当判断结果为第三目标密钥与第四目标密钥不相同时，说明待接入设备有可能误接入了错误的无线体域网，也即目前终端所构建的无线体域网并不是待接入设备真正需要接入的无线体域网，则该待接入设备就不会向终端发送确认信息，也不会接入该无线体域网，通过上述过程，可以实现待接入设备的接入认证过程的双向认证，提高待接入设备接入过程的准确性，这样不仅可以防止非法待接入设备接入当前终端构建的无线体域网，提高无线体域网接入安全性，又可以防止待接入设备误接入错误的无线体域网，从而提高待接入设备接入过程的准确性，当然，由于该双向认证过程不需要对待接入设备的类型进行限定，因此，该双向认证方法具有很高的通用性，适用于对各种类型的待接入设备进行安全认证。
在上述技术方案中，优选地，还包括：当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在该技术方案中，通过向终端和终端允许接入的合法待接入设备预置相同的第一公共密钥和所述第二公共密钥，以及控制他们使用相同的加密算法，可以确保在待接入设备接入终端构建的无线体域网的过程中，唯有合法的待接入设备才能计算出与终端相同的目标密钥，进而顺利地通过无线体域网的接入安全认证，而非法待接入设备由于并不具备与终端相同的加密计算中不可以缺少的公共密钥，更不具备与终端相同的加密算法，因此，不可能计算出与终端相同的目标密钥，从而无法顺利地通过无线体域网的接入安全认证，无法接入终端构建的无线体域网，这样就可以实现最大程度地确保待接入设备接入无线体域网的安全性。其中，第一公开密钥和第二公开密钥包括但不限于：用户设定的口令、密码等。用以获得目标密钥的计算方法优选地采用密码学哈希函数。
在上述技术方案中，优选地，还包括：提示单元210，当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及控制单元212，当所述待接入设备接入所述无线体域网后，控制所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在该技术方案中，通过向用户发送提示信息，使得用户了解当前待接入设备的接入状态，以对待接入设备的接入状态进行有效的监控。当然，还可以根据接入设备和终端当前所处的环境，为终端和接入设备选择更为便捷的通信方式，如WIFI、蓝牙、红外、NFC、有线网络、无线网络等。
在上述技术方案中，优选地，上述任一项所述的设备接入的处理装置，所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
在该技术方案中，待接入设备包括但不限于普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备，所有可以通过无线体域网与终端进行通信，以提高用户便利性的设备均可。
图3示出了根据本发明的一个实施例的终端的结构示意图。
如图3所示，根据本发明的一个实施例的终端300，包括如上述技术方案中任一项所述的设备接入的处理装置200，因此，该终端具有和上述技术方案中任一项所述的设备接入的处理装置200相同的技术效果，在此不再赘述。
图4示出了根据本发明的一个实施例的WBAN的结构示意图；图5示出了根据本发明的另一个实施例的设备接入的处理方法的流程示意图；图6示出了根据本发明的一个实施例的主站配置的流程示意图；图7示出了根据本发明的一个实施例的待接入设备配置的流程示意图；图8示出了根据本发明的一个实施例的主站与待接入设备之间双向认证过程的流程示意图。
下面结合图4至图8，对本发明的技术方案作进一步说明。
如图4所示，根据本发明的一个实施例的WBAN的结构，WBAN是附着在人体上的一种网络，由一套小巧可移动、具有通信功能的传感器和一个 身体主站组成。身体主站通常为智能手机、平板电脑等计算、存储能力较强的设备。另外，本实施例的设备接入的处理方案包括三个流程：待接入设备的大体接入流程（如图5所示）：主站配置流程（如图6所示）、待接入设备配置流程（如图7所示）、待接入设备的接入认证流程（如图8所示）。该方案使用的参数和符号包括：h：密码学哈希函数；s：秘密值即公开密钥，包含但不限于用户设定的口令、密码之类的值。以下对上述三个流程具体说明：
待接入设备的大体接入流程，包括:
步骤502，对主站（通常为智能手机、平板电脑等计算、存储能力较强的移动设备）进行配置，即为主站配置必要的认证参数；
步骤504，对待接入设备进行配置；
步骤506，对待接入设备进行安全认证。
主站配置流程，具体包含以下步骤：
步骤602，用户为主站输入秘密值s。
步骤604，主站执行其他必要的WBAN参数，以完成初始化操作。
待接入设备配置，具体包含以下步骤：
步骤702，在确定要接入到当前身体主站的WBAN时，用户为待接入设备输入与主站配置过程中相同的秘密值s。
步骤704，待接入设备执行其他必要的WBAN参数，以完成初始化。
接入认证流程如下：
在完成上述的主站配置和待接入设备配置后，开始进行接入认证，接入认证过程共涉及三条消息交互，如图8所示：当身体主站接收到待接入设备发送的设备接入请求时，身体主站选取一随机码a,并发送随机码a至待接入设备，待接入设备根据接收到的随机码a、预存的随机码b及秘密值s,采用密码学哈希函数计算获得目标密钥c1（c1=h（a，b，s））即第一目标密钥，并将第一目标密钥c1及随机码b发送至身体主站，同时身体主站根据自身的随机码a、接收到的随机码b及自身的秘密值s,采用密码学哈希函数计算获得目标密钥c2（c2=h（a，b，s））即第二目标密钥，身体主站通过判断计算所得的第二目标密钥c2与接收到的第一目标密钥c1是否 相同，在判断c1与c2不相同时，禁止待接入设备接入WBAN；在判断c1与c2相同时，允许待接入设备接入WBAN，以完成对待接入设备身份的认证（在本实施例中，由于待接入设备与身体主体具有相同的加密计算中不可以缺少的公共密钥和相同的加密算法，因此，该待接入设备是身体主体允许接入的合法设备，c1与c2相同）。在允许待接入设备接入身体主站构建的无线体域网之后，身体主站根据获得的随机码b及自身的秘密值s，采用密码学哈希函数计算获得目标密钥d1（d1=h（b，s））即第三目标密钥，并将第三目标密钥d1发送至待接入设备，同时待接入设备根据自身随机码b及自身秘密值s，采用密码学哈希函数计算获得目标密钥d2（d2=h（b，s））即第四目标密钥，待接入设备通过判断计算获得第四目标密钥d2与接收到的第三目标密钥d1是否相同，在判断d1与d2相同时，待接入设备就会再次确认接入了正确的无线体域网，就会向终端发送确认信息，以完成接入，当然，在判断d1与d2不相同时，说明待接入设备有可能误接入了错误的无线体域网，也即目前身体主站所构建的无线体域网并不是待接入设备真正需要接入的无线体域网，则该待接入设备就不会向终端发送确认信息，也不会接入该无线体域网，以完成对身体主站身份的认证，从而实现身体主站和待接入设备之间的双向认证（当然，在本实施例中，由于待接入设备与身体主体具有相同的加密计算中不可以缺少的公共密钥和相同的加密算法，因此，该待接入设备是身体主体允许接入的合法设备，d1与d2相同）。
在上述设备接入的处理方案的具体流程中，通过向身体主站和身体主站允许接入的合法待接入设备预置相同的秘密值s，以及控制他们使用相同的加密算法密码学哈希函数h，可以确保在待接入设备接入终端构建的无线体域网的过程中，唯有合法的待接入设备才能计算出与终端相同的目标密钥，进而顺利地通过无线体域网的接入安全认证，而非法待接入设备由于并不具备与终端相同的加密计算中不可以缺少的公共密钥，更不具备与身体主站相同的加密算法，因此，不可能计算出与身体主站相同的目标密钥，从而无法顺利地通过无线体域网的接入安全认证，无法接入身体主站构建的无线体域网，这样就可以实现最大程度地确保待接入设备接入无线体域网的安全性。
本发明实施例还提供了一种终端，图9为本发明实施例中另一种终端的结构示意图，如图所示，所述终端可以包括：至少一个输入装置903，至少一个输出装置904，至少一个处理器901，例如CPU，存储器905和至少一个总线902，处理器901可以结合图2所示的设备接入的处理装置。
其中，上述总线902用于连接上述输入装置903、输出装置904、处理器901和存储器905。
其中，上述输入装置903具体可为终端的通信接口，例如网络接口，网络接口可以包括标准的有线接口或者无线接口（如WI-FI接口），用于接收设备接入请求、第二随机码和第一目标密钥。
其中，上述输出装置904具体可为终端的通信接口，例如网络接口，网络接口可以包括标准的有线接口或者无线接口（如WI-FI接口），用于发送第一随机码、预存储的第二随机码和预存储的第一公共密钥。
上述存储器905可以是高速RAM存储器，也可为非不稳定的存储器（non-volatile memory），例如磁盘存储器。上述存储器905还用于存储一组程序代码，处理器901用于调用存储器905中存储的程序代码，执行如下操作：
当通过所述输入装置903接收到来自待接入设备的设备接入请求时，通过所述输出装置904向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端。
通过所述输入装置903接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥。
判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
在可选实施例中，所述处理器901在允许所述待接入设备接入所述终端构建的无线体域网之后，还可以执行以下操作：
根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥。
通过所述输出装置904将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
在可选实施例中，当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
在可选实施例中，所述处理器901还可以执行以下操作：
当所述终端允许或禁止所述待接入设备接入所述无线体域网时，通过所述输出装置904发出提示信号；以及
当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
在可选实施例中，所述待接入设备可以包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
具体的，本发明实施例中介绍的终端可以用以实施本发明结合图1、图5或图8介绍的方法实施例中的部分或全部流程。
以上结合附图详细说明了本发明的技术方案，本发明提出了一种新的设备接入的处理方案，该方案通用、计算量低、且能高效地对无线体域网中的接入设备进行安全认证。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种设备接入的处理方法，其特征在于，包括：
    当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；
    接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；
    判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
  2. 根据权利要求1所述的设备接入的处理方法，其特征在于，
    在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；
    将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
  3. 根据权利要求1所述的设备接入的处理方法，其特征在于，还包括：
    当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
  4. 根据权利要求1所述的设备接入的处理方法，其特征在于，还包括：
    当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及
    当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
  5. 根据权利要求1至4中任一项所述的设备接入的处理方法，其特征在于，
    所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
  6. 一种设备接入的处理装置，其特征在于，包括：
    发送单元，当终端接收到来自待接入设备的设备接入请求时，向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；
    接收单元，接收来自所述待接入设备的所述第二随机码和所述第一目标密钥；
    计算单元，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；
    判断单元，判断所述第二目标密钥与所述第一目标密钥是否相同；
    处理单元，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
  7. 根据权利要求6所述的设备接入的处理装置，其特征在于，
    所述计算单元还用于：
    在允许所述待接入设备接入所述终端构建的无线体域网之后，根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；
    所述发送单元还用于：
    将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述 无线体域网的确认信息。
  8. 根据权利要求6所述的设备接入的处理装置，其特征在于，还包括：
    当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
  9. 根据权利要求6所述的设备接入的处理装置，其特征在于，还包括：
    提示单元，当所述终端允许或禁止所述待接入设备接入所述无线体域网时，发出提示信号；以及
    控制单元，当所述待接入设备接入所述无线体域网后，控制所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式通信。
  10. 根据权利要求6至9中任一项所述的设备接入的处理装置，其特征在于，
    所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
  11. 一种终端，其特征在于，所述终端包括通信总线、输入装置、输出装置、存储器以及处理器，其中：
    所述通信总线，用于实现所述输入装置、输出装置、存储器以及处理器之间的连接通信；
    所述输入装置，用于接收设备接入请求、第二随机码和第一目标密钥；
    所述输出装置，用于发送第一随机码、预存储的第二随机码和预存储的第一公共密钥；
    所述存储器中存储一组程序代码，且处理器调用存储器中存储的程序代码，用于执行以下操作：
    当通过所述输入装置接收到来自待接入设备的设备接入请求时，通过所述输出装置向所述待接入设备发送第一随机码，以使所述待接入设备接收到所述第一随机码后，根据所述第一随机码、预存储的第二随机码和预 存储的第一公共密钥，计算出第一目标密钥，并将所述第一目标密钥发送至所述终端；
    通过所述输入装置接收来自所述待接入设备的所述第二随机码和所述第一目标密钥，根据所述第一随机码、所述第二随机码和预存储的第二公共密钥，计算出第二目标密钥；
    判断所述第二目标密钥与所述第一目标密钥是否相同，在判断结果为是时，允许所述待接入设备接入所述终端构建的无线体域网，否则，禁止所述待接入设备接入所述终端构建的无线体域网。
  12. 根据权利要求11所述的终端，其特征在于，所述处理器在允许所述待接入设备接入所述终端构建的无线体域网之后，还用于执行以下操作：
    根据所述第二随机码和所述第二公共密钥，计算出第三目标密钥；
    通过所述输出装置将所述第三目标密钥发送至所述待接入设备，以使所述待接入设备根据所述第二随机码和所述第一公共密钥，计算出第四目标密钥后，判定所述第三目标密钥与所述第四目标密钥是否相同，并在判定结果为相同时，向所述终端发送接入所述无线体域网的确认信息，否则，不发送接入所述无线体域网的确认信息。
  13. 根据权利要求11所述的终端，其特征在于，当所述待接入设备为所述终端允许接入的待接入设备时，所述第一公共密钥和所述第二公共密钥相同，以及所述待接入设备计算所述第一目标密钥和所述第四目标密钥时使用的算法与所述终端计算所述第二目标密钥和所述第三目标密钥时使用的算法相同。
  14. 根据权利要求11所述的终端，其特征在于，所述处理器还用于执行以下操作：
    当所述终端允许或禁止所述待接入设备接入所述无线体域网时，通过所述输出装置发出提示信号；以及
    当所述待接入设备接入所述无线体域网后，所述终端与所述待接入设备通过WIFI、蓝牙、红外、NFC、有线网络、无线网络中的至少一种方式 通信。
  15. 根据权利要求11至14中任一项所述的终端，其特征在于，
    所述待接入设备包括：普通移动设备、可穿戴设备、可穿戴式传感器和医疗设备中的至少一种设备。
PCT/CN2015/078021 2015-04-17 2015-04-30 设备接入的处理方法、设备接入的处理装置和终端 WO2016165165A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510184781.9A CN105636032B (zh) 2015-04-17 2015-04-17 设备接入的处理方法、设备接入的处理装置和终端
CN201510184781.9 2015-04-17

Publications (1)

Publication Number Publication Date
WO2016165165A1 true WO2016165165A1 (zh) 2016-10-20

Family

ID=56050422

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/078021 WO2016165165A1 (zh) 2015-04-17 2015-04-30 设备接入的处理方法、设备接入的处理装置和终端

Country Status (2)

Country Link
CN (1) CN105636032B (zh)
WO (1) WO2016165165A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021051387A1 (zh) * 2019-09-20 2021-03-25 中国科学院深圳先进技术研究院 无线体域网及其密钥生成方法、分配方法和相关装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106792667B (zh) * 2016-12-23 2020-12-18 北京光年无限科技有限公司 一种用于机器人的网络接入认证方法以及机器人

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020073322A1 (en) * 2000-12-07 2002-06-13 Dong-Gook Park Countermeasure against denial-of-service attack on authentication protocols using public key encryption
CN1665183A (zh) * 2005-03-23 2005-09-07 西安电子科技大学 Wapi认证机制中的密钥协商方法
CN1708018A (zh) * 2004-06-04 2005-12-14 华为技术有限公司 一种无线局域网移动终端接入的方法
CN101378320A (zh) * 2008-09-27 2009-03-04 北京数字太和科技有限责任公司 一种认证方法和认证***

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8467532B2 (en) * 2010-01-04 2013-06-18 Tata Consultancy Services Limited System and method for secure transaction of data between a wireless communication device and a server
CN103338448A (zh) * 2013-06-07 2013-10-02 国家电网公司 一种基于量子密钥分发的无线局域网安全通信方法
CN104486759B (zh) * 2014-12-15 2018-11-23 北京极科极客科技有限公司 一种无障碍接入无线网络的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020073322A1 (en) * 2000-12-07 2002-06-13 Dong-Gook Park Countermeasure against denial-of-service attack on authentication protocols using public key encryption
CN1708018A (zh) * 2004-06-04 2005-12-14 华为技术有限公司 一种无线局域网移动终端接入的方法
CN1665183A (zh) * 2005-03-23 2005-09-07 西安电子科技大学 Wapi认证机制中的密钥协商方法
CN101378320A (zh) * 2008-09-27 2009-03-04 北京数字太和科技有限责任公司 一种认证方法和认证***

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021051387A1 (zh) * 2019-09-20 2021-03-25 中国科学院深圳先进技术研究院 无线体域网及其密钥生成方法、分配方法和相关装置
US11212672B2 (en) 2019-09-20 2021-12-28 Shenzhen Institutes Of Advanced Technology Chinese Academy Of Sciences Wireless body area network, key generation method and key distribution method in the wireless body area network, and related device

Also Published As

Publication number Publication date
CN105636032A (zh) 2016-06-01
CN105636032B (zh) 2019-12-10

Similar Documents

Publication Publication Date Title
CN109923830B (zh) 用于配置无线网络接入设备的***和方法
US10651984B2 (en) Method for controlling access to an in-vehicle wireless network
US8745392B2 (en) Two-way authentication between two communication endpoints using a one-way out-of band (OOB) channel
US20180248694A1 (en) Assisted device provisioning in a network
CN107637039B (zh) 执行所有者转移的***和转移设备所有权的方法和***
KR20160129839A (ko) 블루투스 인터페이스를 갖는 인증 장치
KR20160021763A (ko) 사용자 신원 인증 방법, 단말, 및 서버
CN107005927A (zh) 用户设备ue的接入方法、设备及***
EP3032845A1 (en) Hearing device configured to authenticate a mode request and related method
US11206496B2 (en) Hearing device with service mode and related method
WO2018120836A1 (zh) 一种终端配对方法、装置及***、终端及计算机可读存储介质
US10938806B2 (en) Communication method and device
US20210103491A1 (en) Techniques for repairing an inoperable auxiliary device using another device
CN111130769A (zh) 一种物联网终端加密方法及装置
CN105325021B (zh) 用于远程便携式无线设备认证的方法和装置
WO2016165165A1 (zh) 设备接入的处理方法、设备接入的处理装置和终端
US20240073020A1 (en) Digital key pairing method, pairing system, and vehicle
CN106656946B (zh) 一种动态鉴权方法及装置
CN115334480A (zh) 蓝牙周边与中央设备以及验证方法
CN106713222A (zh) 一种无线局域网络的接入认证方法、服务器和认证***
WO2016177104A1 (zh) 一种数据传输装置方法和装置、及双头线
WO2024120671A1 (en) Onboarding a household appliance to a network with the assistance of a household appliance connected to the network
JP2013042335A (ja) 通信システム及びプログラム
DK201470778A1 (en) Hearing device with service mode and related method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15888869

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 09.04.2018)

122 Ep: pct application non-entry in european phase

Ref document number: 15888869

Country of ref document: EP

Kind code of ref document: A1