WO2019015500A1 - 入网认证方法、装置及*** - Google Patents

入网认证方法、装置及*** Download PDF

Info

Publication number
WO2019015500A1
WO2019015500A1 PCT/CN2018/094933 CN2018094933W WO2019015500A1 WO 2019015500 A1 WO2019015500 A1 WO 2019015500A1 CN 2018094933 W CN2018094933 W CN 2018094933W WO 2019015500 A1 WO2019015500 A1 WO 2019015500A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal device
network
dynamic password
network access
authentication
Prior art date
Application number
PCT/CN2018/094933
Other languages
English (en)
French (fr)
Inventor
殷鸿展
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to US16/632,316 priority Critical patent/US11616775B2/en
Publication of WO2019015500A1 publication Critical patent/WO2019015500A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/61—Time-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the present application relates to the field of network technologies, and in particular, to a method, device, and system for network access authentication.
  • NAC Network Admission Control
  • the 802.1X is a commonly used network authentication technology for the NAC system.
  • the Extensible Authentication Protocol (EAP) authentication methods adopted by the 802.1X include: EAP-MD5, EAP-PEAP, EAP-TLS, EAP-TTLS, and EAP-LEAP.
  • EAP-TLS authentication method is a certificate-based two-way authentication method, which has advantages in security and practicability, and thus has become the preferred network authentication method for many enterprises.
  • the EAP-TLS authentication method requires a digital certificate to verify the identity of the device.
  • problems such as unsupported or incapable of using digital certificates often occur, and the network access authentication cannot be completed. Therefore, there is a need for a network access authentication scheme that is compatible with various devices and meets the requirements of device identification and security.
  • aspects of the present application provide a network authentication method, device, and system for performing network access authentication on a terminal device to meet device identification, security, and the like, and to solve device compatibility problems.
  • the embodiment of the present application provides a network authentication method, including:
  • the user name and the dynamic password are provided to the terminal device, so that the terminal device generates an network access authentication request and sends the network authentication request to the authentication server for network access authentication.
  • the embodiment of the present application further provides a network authentication method, including:
  • the user name and the dynamic password provided by the network management client are encrypted by a device ID of the terminal device, and the dynamic password is determined by the device ID and a current time step The value is obtained by encrypting, and the device ID is generated by the authentication server for the terminal device;
  • the embodiment of the present application further provides a network authentication method, including:
  • An embodiment of the present application further provides an electronic device, including: a memory and a processor;
  • the memory is configured to store a program
  • the processor coupled to the memory, for executing the program in the memory for:
  • the user name and the dynamic password are provided to the terminal device, so that the terminal device generates an network access authentication request and sends the network authentication request to the authentication server for network access authentication.
  • the embodiment of the present application further provides a terminal device, including: a memory, a processor, and a communication component;
  • the memory is configured to store a program
  • the processor coupled to the memory, for executing the program in the memory for:
  • the communication component is configured to send a network access command to the network management client, to indicate that the network management client provides the terminal device with a user name and a dynamic password required for accessing the network;
  • the user name and the dynamic password provided by the network management client are encrypted by a device ID of the terminal device, and the dynamic password is determined by the device ID and a current time step The value is obtained by encrypting, and the device ID is generated by the authentication server for the terminal device;
  • the communication component is configured to send the network access command to the network management client, and send the network access authentication request to the authentication server.
  • the embodiment of the present application further provides an authentication server, including: a memory, a communication component, and a processor;
  • the memory is configured to store a program
  • the communication component is configured to receive a network access authentication request sent by the terminal device, where the network access authentication request includes a username and a dynamic password;
  • the processor coupled to the memory, for executing the program in the memory for:
  • the embodiment of the present application further provides an authentication system, including: a terminal device, a network access management client, and an authentication server;
  • the terminal device is configured to send a network access instruction to the network management client in response to the network access triggering operation, acquire a user name and a dynamic password provided by the network management client, and generate, according to the user name and the dynamic password, Entering a network authentication request, and sending the network access authentication request to the authentication server;
  • the network management client is configured to acquire the device ID and the user name according to the network access instruction, and use the seed key agreed with the authentication server to time the device ID and the current time step Encrypting the value to obtain the dynamic password; and providing the username and the dynamic password to the terminal device; the username is encrypted by the device ID;
  • the authentication server is configured to receive the network access authentication request, where the network access authentication request includes the user name and the dynamic password; and perform the terminal device according to the device ID decrypted from the user name. Credibility verification; and performing validity verification on the terminal device according to the credibility verification result, the device ID, and the dynamic password.
  • the network management client encrypts the user name by using the device ID of the terminal device, and encrypts the dynamic password by using the device ID and the time value within the time step, so that the terminal device uses the user name and the dynamic password.
  • Conduct network access certification Since the device ID is uniquely assigned by the authentication server to the terminal device, the terminal device has an identity function.
  • the device identity can be identified according to the device ID in the user name, and the digital certificate is not needed, which solves the problem that the terminal device cannot complete the network authentication because it does not support or cannot use the digital certificate, and is applicable to each
  • the types of devices perform network access authentication; on the other hand, compared to static domain passwords, network authentication based on dynamic passwords combined with device IDs provides higher security and meets security requirements.
  • FIG. 1 is a schematic structural diagram of an exemplary network access authentication system according to an exemplary embodiment of the present application
  • FIG. 2 is a schematic flowchart of a network management client registering with an authentication server according to another exemplary embodiment of the present application
  • FIG. 3 is a schematic structural diagram of an exemplary network access authentication system according to still another exemplary embodiment of the present application.
  • FIG. 4 is a schematic flowchart diagram of an exemplary network access authentication method according to still another exemplary embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a network access authentication method described from the perspective of a network access management client according to another exemplary embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart of a network authentication method described from the perspective of a terminal device according to another exemplary embodiment of the present application.
  • FIG. 7 is a schematic flowchart diagram of a network authentication method described from the perspective of an authentication server according to another exemplary embodiment of the present application.
  • FIG. 8a is a schematic structural diagram of an exemplary network access management apparatus according to still another exemplary embodiment of the present application.
  • FIG. 8b is a schematic structural diagram of an exemplary electronic device according to still another exemplary embodiment of the present application.
  • FIG. 9a is a schematic structural diagram of an exemplary network access authentication apparatus according to still another exemplary embodiment of the present application.
  • FIG. 9b is a schematic structural diagram of an exemplary terminal device according to still another exemplary embodiment of the present application.
  • FIG. 10a is a schematic structural diagram of an exemplary network access authentication apparatus according to still another exemplary embodiment of the present application.
  • FIG. 10b is a schematic structural diagram of an exemplary authentication server according to still another exemplary embodiment of the present application.
  • the embodiment of the present application provides a solution.
  • the main principle is that the authentication server allocates a device ID that uniquely identifies the terminal device to the terminal device, and combines the network management client with the network management client as the terminal.
  • the device provides the user name and the dynamic password encrypted by the device ID of the terminal device, and the terminal device performs network authentication with the user name and the dynamic password.
  • the identity of the terminal device can be identified according to the device ID in the user name, and on the other hand, the network authentication is performed based on the dynamic password combined with the device ID, which has higher security and meets security requirements.
  • FIG. 1 is a schematic structural diagram of an exemplary network access authentication system according to an exemplary embodiment of the present application.
  • the system includes: a terminal device 10, an authentication server 20, and an access management client 30.
  • the terminal device 10 can be connected to the authentication server 20 in a wired or wireless manner.
  • the authentication server 20 belongs to a network 21 and is mainly responsible for the network access management and control of the network 21 to which it belongs, and ensures the security of the network 21.
  • the authentication server 20 can be any device that can provide computing services, can respond to service requests, and process, for example, a conventional server, a cloud server, a cloud host, a virtual center, and the like.
  • the composition of the server mainly includes a processor, a hard disk, a memory, a system bus, etc., and is similar to a general computer architecture.
  • the terminal device 10 may be a smartphone, a tablet, a personal computer, a wearable device, or the like.
  • the terminal device 10 typically includes at least one processing unit 11 and at least one memory 12.
  • the number of processing units 11 and memories 12 depends on the configuration and type of the terminal device 10.
  • the memory 12 may include volatile, such as RAM, and may also include non-volatile, such as Read-Only Memory (ROM), flash memory, etc., or both.
  • An operating system (OS), one or more applications, and program data are stored in the memory 12.
  • the terminal device also includes some basic configurations 13, such as a network card chip, an IO bus, an audio and video component, and the like.
  • the terminal device 10 may also include some peripheral devices 14, such as a keyboard, a mouse, a stylus, a printer, and the like. These peripheral devices are well known in the art and will not be described herein.
  • the terminal device 10 can access the network 21 to which the authentication server 20 belongs, but needs to pass the network access authentication.
  • the terminal device 10 is mainly used to initiate a network access authentication request to the authentication server 20 according to the user name and the dynamic password.
  • the network access management client 30 is mainly used to provide the terminal device 10 with the user name and dynamic password required for network authentication; the authentication server 20 is mainly used.
  • the terminal device 10 is authenticated to the network according to the network access authentication request. It is worth mentioning that the network access operation of the terminal device 10 belongs to the system level operation and can be handled by the OS of the terminal device.
  • the network management client 30 can be implemented independently of the terminal device 10 or can be installed on the terminal device 10.
  • the implementation of the network management client 30 installed on the terminal device 10 is taken as an example.
  • the network management client 30 when the network management client 30 is installed on the terminal device 10, the network management client 30 is stored in the memory 12.
  • the terminal device 10 cooperates with the network access management client 30 to implement network authentication by using the device identity and the dynamic password.
  • the terminal device 10 can initiate an incoming network triggering operation.
  • the user can initiate an incoming network triggering operation through a setting option on the terminal device 10.
  • the terminal device 10 provides a setting option to the user, and the user clicks the setting option to enter a setting page, and the setting page includes various function setting items supported by the OS, such as sound, wallpaper, battery, and local area network. / Wi-Fi, carrier and other settings. The user continues to click on the LAN/Wi-Fi setting to enter the LAN/Wi-Fi settings page.
  • the terminal device 10 automatically searches for nearby network information whose signal strength meets the setting requirement and displays the network information on the local area network/Wi-Fi setting page.
  • the network information searched by the terminal device 10 includes the network 21 to which the authentication server 20 belongs.
  • the user triggers the operation of accessing the network 21 by clicking on the information of the network 21 on the local area network/Wi-Fi setting page.
  • the terminal device 10 can start the network access processing in response to the network access triggering operation.
  • the terminal device 10 sends an incoming network command to the network access management client 30 to instruct the network management client 30 to provide the terminal device 10 with the user name and dynamic password required for accessing the network.
  • the network access management terminal 30 receives the network access command, and starts to acquire the user name and the dynamic password according to the network access command.
  • the network management client 30 obtains the device ID that can be uniquely identified by the authentication server 20 for the terminal device 10 and obtains the user ID encrypted by the device ID.
  • the network management client 30 utilizes The seed key agreed with the authentication server 20 encrypts the device ID and the time value within the current time step to obtain a dynamic password. Because the password generation process is combined with the time factor, it belongs to the dynamic password, and the dynamic password is a one-time password, which needs to be regenerated every time it enters the network.
  • the network management client 30 provides the user name and the dynamic password to the terminal device 10.
  • the terminal device 10 obtains the user name and the dynamic password provided by the network management client 30, generates an incoming network authentication request according to the user name and the dynamic password, and sends the network access authentication request to the authentication server 20, so that the authentication server 20 performs the terminal device 10 on the terminal device 10. Network access certification.
  • the network management client 30 can provide the user name and the dynamic password to the terminal device 10 in multiple implementation manners.
  • the following examples illustrate:
  • the terminal device 10 when the user triggers the network access operation, the terminal device 10 presents an incoming network information page to the user as a way to obtain the user name and the dynamic password.
  • the user information input box and the password input box are set on the network information page, the user name input box is used to populate the user name, and the password input box is used to fill the dynamic password.
  • the user name and the dynamic password may be filled into the network information page, so that the terminal device 10 extracts the information from the network information page.
  • Username and dynamic password For example, the network management client 30 can automatically fill the user name into the username input box on the network information page, and fill the dynamic password into the password input box on the network information page. Such an embodiment in which the network management client 30 automatically populates the user name and dynamic password into the network information page is highly efficient.
  • the user name and the dynamic password may also be output to a page of the network management client 30, so that the user can obtain the user name and the page through the page. password.
  • the network information page provided by the terminal device 10 can be seen, and then the user name and the dynamic password are required to be input, so that the page provided by the network management client 30 including the user name and the dynamic password is accessed.
  • a page including a user name and a dynamic password may be displayed to the user according to the user's access request, so that the user can copy the user name and the dynamic password from the page to the network information page.
  • the terminal device 10 can obtain the user name and the dynamic password from the network information page, and then generate an network access authentication request and send it to the authentication server 20 for the authentication server 20 to the terminal.
  • the device 10 performs network access authentication.
  • the authentication server 20 receives the network access authentication request sent by the terminal device 10, and the network access authentication request includes a username and a dynamic password.
  • the username is obtained by encrypting the device ID of the terminal device 10.
  • the dynamic password is obtained by encrypting the device ID of the terminal device 10 and the time value within the specified time step of the terminal device 10 using the agreed seed key.
  • the authentication server 20 decrypts the user name; if the user name is not successfully decrypted, the authentication fails, and the terminal device 10 is denied access to the network 21; if the device ID of the terminal device 10 is successfully decrypted from the user name, the decryption is performed according to the decryption.
  • the device ID performs authenticity verification on the terminal device 10. Since the ID of the terminal device 10 is uniquely generated by the authentication server 20, the purpose of identifying the terminal device 10 can be achieved based on the device ID of the terminal device 10. If the terminal device 10 fails the authentication of the credibility, the authentication fails, and the terminal device 10 is denied access to the network 21; if the terminal device 10 passes the credibility verification, the terminal can be authenticated according to the device ID and the dynamic password in the network access request.
  • the device 10 performs legality verification. If the terminal device 10 passes the legality verification, the terminal device 10 is allowed to access the network 21; if the terminal device 10 fails the legality verification, the terminal device 10 is denied access to the network 21.
  • the network management client 30 provides the terminal device 10 with the device ID encrypted by the terminal device to obtain the user name and the dynamic password, and the terminal device 10 accesses the network with the user name and the dynamic password.
  • Authentication is actually networked authentication with device ID and dynamic password.
  • the identity of the terminal device can be identified according to the device ID in the user name, and on the other hand, the network authentication is performed based on the dynamic password combined with the device ID, which has higher security and meets security requirements. .
  • the network access management client 30 can register with the authentication server 20 in advance, and obtain data such as a user name, a device ID, and a seed key in advance through the registration process.
  • a process for the network management client 30 to register with the authentication server 20 includes the following steps:
  • the network access management client 30 sends a registration request to the authentication server 20, where the registration request carries hardware information of the terminal device 10.
  • the hardware information is not limited here.
  • the hardware information related to the terminal device 10 is applicable to the embodiment.
  • the information may be related to a central processing unit (CPU), a video card, a hard disk, or the like of the terminal device 10. .
  • the registration request may further include user information and/or enterprise information corresponding to the terminal device 10.
  • the authentication server 20 receives the registration request, parses out the hardware information of the terminal device 10, and generates a device ID that can uniquely identify the terminal device 10 according to the hardware information, and records it as a UMID.
  • the authentication server 20 may store the user information and/or the enterprise information corresponding to the terminal device 10, and may also be the terminal according to the user information and/or the enterprise information.
  • the device generates a User ID (UID) and/or a Customer ID (CID).
  • UID User ID
  • CID Customer ID
  • the UID is used to uniquely identify the user to which the terminal device 10 belongs; the CID user uniquely identifies the enterprise to which the terminal device 10 belongs.
  • the user information may include, but is not limited to, an account registered by the user, a password, a user's email address, a mobile phone number, a nickname, and the like.
  • Enterprise information may include, but is not limited to, user registered account number, password, company registration place, company name, enterprise nature, company size and other information.
  • the authentication server 20 generates two dynamic tokens, namely a token key (TokenKey, TK) and a process token (ProcessToken, PT), by using a set encryption algorithm.
  • a token key TokenKey, TK
  • a process token ProcessToken, PT
  • the TK can be used as the user name required for the terminal device 10 to enter the network for authentication, and is obtained by UMID encryption.
  • the PT can be used as an encrypted seed key and can be encrypted by UMID, TK and seed key.
  • the UMID may be encrypted using a Blowfish encryption algorithm to generate a TK.
  • the UMID, TK, and seed key may be encrypted using an AES-128 encryption algorithm to generate a PT.
  • the TK and the PT can be generated by combining the CID, the UID, and the UMID at the same time.
  • the encryption formulas for generating TK and PT in combination with CID, UID and UMID are as follows:
  • TK Blowfish(CID+UID+UMID+RANDOM+TIME,(app_secret))
  • PT TK+AES128(CID+UID+UMID,(app_secret))
  • app_secret represents the seed key agreed by the network management client 30 and the authentication server 20.
  • the seed key may be an API interface key of the network management client 30, and corresponds to the network management client 30 one-to-one.
  • the authentication server sends the TK, PT, and UMID to the network access management client 30.
  • the network management client 30 receives the TK, the PT, and the UMID, and saves the UMID and the TK in the local space.
  • the network management client 30 sends a PT to an independent encryption tool, and the encryption tool decrypts the PT to obtain a seed key and stores the seed key.
  • the encryption tool is a black box for the network management client 30 and the authentication server 20.
  • the encryption algorithm and the method for storing the seed key are not visible to the outside, and the encryption tool has a tamper-proof function, and in an unsafe situation. It is forbidden to be accessed or used. This can reduce the risk of the seed key being cracked, ensure the security of the seed key, and thus improve the security of the network access authentication.
  • the network management client 30 can save the device ID and user name of the terminal device 10 to the local space in advance. Therefore, when receiving the network access command, the network management client 30 can directly read the device ID and the user name of the terminal device 10 from the local space.
  • the network management client 30 can also request the device ID and the user name of the terminal device 10 from the authentication server 20 in real time upon receiving the network access command. For example, if the authentication server 20 does not deliver the device ID and the user name of the terminal device 10 to the network management client 30 in the above-mentioned registration process, the network management client 30 needs to send the authentication server 20 in real time when receiving the network access command. The device ID and user name of the terminal device 10 are requested.
  • the device ID and the user name of the terminal device 10 are sent by the authentication server 20 to the network management client 30.
  • the encryption algorithm only needs to be stored at the end of the authentication server 20, which is beneficial to reducing the probability of the encryption algorithm being cracked, thereby improving the device ID and User name security.
  • the authentication server 20 may store the device ID of the registered device through the registered device list, and store the status of the registered device through the device status list, such as registered, deleted, frozen, and Disabled, etc.
  • the registered device list and the device status list may be the same list, or may be two lists that are independent of each other.
  • the authentication server 20 can perform authenticity verification on the terminal device 10 in conjunction with the registered device list and the device status list.
  • An optional implementation manner includes: when the device ID of the terminal device 10 is successfully decrypted from the user name, the authentication server 20 searches the registered device list according to the decrypted device ID to determine whether the terminal device 10 has been registered; The device ID is queried in the device list, and the device status list is further queried to determine whether the status of the terminal device 10 is normal. If the device status list is queried to determine that the terminal device 10 is in a normal state, it is determined that the terminal device 10 is available. Reliability verification. If the decrypted device ID is not queried from the registered device list, or if the terminal device 10 is in an abnormal state, for example, deleted, disabled, or frozen, it is determined that the terminal device 10 fails. Reliability verification.
  • the process by which the authentication server 20 generates the username may simultaneously incorporate the CID and/or UID. Based on this, the authentication server 20 can decrypt the UID and/or CID from the user name in addition to decrypting the UMID from the user name.
  • multi-factor authentication can be performed from a device perspective, a user perspective, and a corporate perspective.
  • the authentication server 20 can authenticate the user and/or the enterprise to which the terminal device 10 belongs according to the UID and the pre-registered user information and/or enterprise information before performing the credibility verification on the terminal device 10; for example, It can be determined whether the UID and/or CID decrypted from the username matches the pre-registered user information and/or enterprise information, and if they match, it is determined that the user and/or the enterprise to which the terminal device 10 belongs is authenticated; Matching, determining that the user and/or enterprise to which the terminal device 10 belongs does not pass the authentication. When the user and/or the enterprise to which the terminal device 10 belongs is authenticated, the terminal device 10 is authenticated again.
  • the authentication server 20 needs to perform the validity verification on the terminal device 10 according to the device ID and the dynamic password in the network access authentication request.
  • An implementation manner for authenticating the terminal device 10 includes: the authentication server 20 can determine at least two time steps, wherein the at least two time steps include a current time step and is closest to the current time step At least one historical time step; for each of the at least two time steps, the decrypted device ID and the time within each time step using the seed key pair agreed with the incoming management client 30 The value is encrypted to generate at least two dynamic passwords; the terminal device is verified for validity according to at least two dynamic passwords and a dynamic password in the network authentication request. For example, the at least two dynamic passwords can be compared with the dynamic passwords carried in the network authentication request. If at least two dynamic passwords have the same dynamic password as the dynamic password carried in the network authentication request, the terminal device 10 is determined to be legal. If the dynamic password that is the same as the dynamic password carried in the network authentication request does not exist in the at least two dynamic passwords, it is determined that the terminal device 10 fails the legality verification.
  • the authentication server 20 may store mapping data of the authenticated device.
  • the certified devices here include the currently authenticated devices that are online, as well as the historically authenticated devices that have been offline.
  • the mapping data of the authenticated device includes, but is not limited to, the device ID of the authenticated device, the Media Access Control (MAC) address, the UID, the CID, and the dynamic password used when the authentication is passed. Based on this, the authentication server 20 can perform legality verification on the terminal device in combination with the mapping data of the authenticated device.
  • MAC Media Access Control
  • Another implementation manner for authenticating the terminal device 10 includes: the authentication server 20 determines, according to the device ID decrypted from the user name, whether there is a dynamic password used by the terminal device to pass the last authentication through the mapping data of the authenticated device. . If there is a dynamic password used by the terminal device to pass the last authentication, the terminal device 10 is legally configured according to the dynamic password used in the last authentication of the terminal device and the dynamic password carried in the network access request. Sexual verification. For example, the last password of the terminal device can be compared with the dynamic password carried in the network access request by using the dynamic password used; if the two are the same, it is determined that the terminal device 10 passes the legality verification; if the two are not the same, it is determined. The terminal device 10 does not pass the legality verification.
  • the authentication server 20 determines at least two time steps, and uses the seed key agreed with the network management client 30 to respectively identify the device ID. And encrypting the time value in each time step to obtain at least two dynamic passwords; comparing at least two dynamic passwords with dynamic passwords carried in the network authentication request; if at least two dynamic passwords exist in the network authentication If the dynamic password with the same dynamic password is carried in the request, it is determined that the terminal device 10 passes the legality verification; if at least two dynamic passwords do not have the same dynamic password as the dynamic password carried in the network authentication request, it is determined that the terminal device 10 is not Pass legality verification.
  • the authentication server 20 may also send the device ID and the time value within the current time step or the historical time step to the encryption tool, so that the encryption tool uses the pre-agreed seed key to the device.
  • the ID and the time value within the current time step or historical time step are encrypted to obtain a dynamic key.
  • the dynamic password has a certain timeliness. When the validity is over, the dynamic password will be invalidated and will be deleted.
  • the result of dynamic password generation is the same within the same time step.
  • the authentication server 20 it is not known in which time step the dynamic password carried in the network authentication request is generated, and the time and authentication of the dynamic password generating end (ie, the network access management client 30) is due to the network.
  • the time when the server 20 receives the dynamic password may be very different, and it is possible that the two times are not within the same time step. For example, there may be a case where the network management client 30 generates a dynamic password at the end of a time step, and the authentication server 20 receives the dynamic password at the start of the next time step, which is a reasonable case.
  • the historical time step may be one or more.
  • the authentication server 20 may also return the authentication result to the terminal device 10.
  • the authentication result includes: the terminal device 10 passes the authentication, or the terminal device 10 fails the authentication.
  • the network authentication system shown in Figure 1 can be deployed and implemented under the 802.1X protocol framework.
  • the network access authentication system shown in FIG. 1 may be combined with the EAP-PEAP authentication mode in the 802.1X protocol, and the EAP-PEAP is used as a carrier to form a new authentication mode, but is not limited to the EAP-PEAP authentication.
  • Another exemplary network access authentication system mainly includes: a terminal device 10, an authentication server 20, an incoming network management client 30, a Radius server 40, and a network attached storage (NAS) device. 50.
  • the terminal device 10 is connected to the Radius server 40 via the NAS device 50, and the Radius server 40 is connected to the authentication server 20.
  • the NAS device 50 in addition to the terminal device 10, the NAS device 50, the Radius server 30, and the authentication server 20, other network devices such as a gateway may be included, and details are not described herein. Depending on the deployment of the visual network.
  • the functions of the terminal device 10, the authentication server 20, and the network management client 30 are substantially unchanged.
  • the terminal device 10 is still mainly used to initiate the network access authentication request to the authentication server 20 according to the user name and the dynamic password.
  • the initiation process is described in the foregoing description;
  • the network management client 30 is still mainly used to provide the terminal device 10 with the user name and dynamics required for network authentication.
  • the authentication server 20 is still mainly used for performing network access authentication on the terminal device 10.
  • the interaction data between the terminal device 10 and the authentication server 20 needs to be encapsulated into a remote authentication dial in user service (Radius) protocol packet and forwarded through the Radius server 40.
  • Radius remote authentication dial in user service
  • Radius is a client/server (C/S) architecture protocol.
  • Radius server 40 and NAS device 50 are servers and clients under the Radius protocol, respectively.
  • the NAS device 50 can be any device running Radius client software, and provides services for accessing and interacting with the Radius server 40 to the remote access user (ie, the terminal device 10).
  • the Radius server 40 is mainly used as a proxy of the authentication server 20, and is responsible for encapsulation/decapsulation and forwarding of Radius protocol packets, which is different from the Radius server in the traditional sense.
  • the Radius server 40 can be any device that runs Radius server software.
  • an authentication process that can be implemented in the network authentication system shown in FIG. 3 includes the following steps:
  • the terminal device 10 sends an incoming network command to the network access management client 30 in response to the user-initiated network access operation, and at the same time, displays the network information page on the interface of the terminal device.
  • the network management client 30 can read the UMID and the TK from the local space, and use the TK as the username.
  • the network management client 30 invokes an encryption tool, and the encryption tool encrypts the UMID and the time value in the current time step by using the seed key to obtain a dynamic password.
  • the time step may be 5 minutes, 3 minutes, 2 minutes, etc., depending on the application requirements.
  • the network management client 30 automatically fills the TK and the dynamic password to the network information page.
  • the terminal device 10 obtains a TK and a dynamic password from the network access information page.
  • Transport Layer Security (TLS) channel establishment phase TLS
  • the terminal device 10 sends an EAPoL-Start message to the NAS device 50 to start the start of the 802.1X access.
  • the NAS device 50 sends an EAP-Request/Identity message to the terminal device 10, and requests the terminal device 10 to report the network identifier of the user.
  • the terminal device 10 responds to the NAS device 50 with an EAP-Response/Identity message.
  • the NAS device 50 sends the EAP-Response/Identity to the Radius server 40 in the EAPoR (EAP over Radius) message format.
  • EAPoR EAP over Radius
  • the Radius server 40 receives the EAP-Response/Identity packet, determines to use the EAP-PEAP authentication according to the configuration, and sends a RADIUS-Access-Challenge message to the NAS device 50, where the packet includes the Radius server 40 and sends the packet to the terminal device.
  • the EAP-Request/Peap/Start packet of 10 indicates that it is desired to start EAP-PEAP authentication.
  • the NAS device 50 sends the EAP-Request/Peap/Start message to the terminal device 10.
  • the terminal device 10 After receiving the EAP-Request/Peap/Start message, the terminal device 10 processes the dynamic password according to the MSCHPAV2 algorithm, obtains a hash value, denotes ntSendResponse, and encapsulates the user name and the hash value ntSendResponse in the EAP-Response.
  • the /Client Hello message is sent to the NAS device 50.
  • the NAS device 50 sends the EAP-Response/Client Hello message to the Radius server 40 in the EAPoR packet format.
  • the Radius server 40 After receiving the EAP-Response/Client Hello message sent by the terminal device 10, the Radius server 40 parses the TK and the hash value ntSendResponse.
  • the Radius server 40 sends a TK and a hash value ntSendResponse to the authentication server 20.
  • the authentication server 20 decrypts the user name according to the set decryption algorithm; if the decryption is successful, the process proceeds to step 417; if the decryption is not successful, the process proceeds to step 421.
  • the decryption algorithm corresponds to an encryption algorithm used by the authentication server 20 to generate a username in the registration process.
  • the authentication server 20 performs credibility verification on the terminal device 10 according to the device ID decrypted from the user name. If the terminal device 10 passes the credibility verification, the process proceeds to step 418. If the credibility verification fails, the process proceeds to step 421. .
  • the authentication server 20 performs legality verification on the terminal device 10 according to the device ID and the hash value ntSendResponse. If the legality verification is passed, the process proceeds to step 419. If the legality verification is not passed, the process proceeds to step 421.
  • the authentication server 20 records the mapping data of the authenticated device.
  • the mapped data of the authenticated device includes information such as the device ID, MAC address, user name, hash value of the authenticated device, and the hash password required during the authentication process. Based on this, the authentication server 20 can determine, according to the device ID, whether there is a hash password used by the terminal device 10 to pass the authentication in the mapping data of the authenticated device.
  • the terminal device 10 If the result of the determination is that the hash code of the last used by the terminal device 10 is hashed, a hash value is obtained; the hash value is compared with the hash value ntSendResponse; the two hash values are the same. It is determined that the terminal device 10 passes the legality verification; if the two hash values are not the same, it is determined that the terminal device 10 does not pass the legality verification.
  • the time value within the time step is encrypted to obtain at least two dynamic passwords; at least two dynamic passwords are processed according to the MSCHPAV2 algorithm to obtain at least two hash passwords; and further, at least two hash passwords are hashed Process to get at least two hash values.
  • the hash password corresponding to the hash value identical to the hash value ntSendResponse is stored in the mapping data of the terminal device 10.
  • the authentication server 20 generates an authentication pass identifier msch_response by the MSCHPAV2 algorithm, and sends an authentication pass identifier msch_response to the Radius server 40.
  • the Radius server 40 encapsulates the authentication in the RADIUS-Access-Accept packet by using the identifier msch_response, and sends a RADIUS-Access-Accept packet to the terminal device 10 through the NAS device 50, and ends the authentication process.
  • the authentication server 20 transmits the failed authentication result to the Radius server 40, and proceeds to step 422.
  • the Radius server 40 encapsulates the unauthenticated result in the RADIUS-Access-Reject message, and sends the RADIUS-Access-Reject message to the terminal device 10 through the NAS device 50, and ends the authentication process.
  • the following embodiments of the present application respectively provide a flow of several network access authentication methods from the perspective of the network management client, the terminal device, and the authentication server.
  • 501 Obtain a device ID of the terminal device and a user name encrypted by the device ID according to the network access instruction of the terminal device, where the device ID is generated by the authentication server for the terminal device.
  • the user name and the dynamic password are provided to the terminal device, so that the terminal device generates an incoming network authentication request and sends the authentication request to the authentication server for network access authentication.
  • the foregoing provides the user name and the dynamic password to the terminal device, including:
  • the user name and the dynamic password are output to the local page, and the local page is displayed to the user according to the user's access request, so that the user can copy the user name and the dynamic password from the local page to the network information page provided by the terminal device.
  • the seed key is maintained and managed by an encryption tool independent of the local end. Based on this, the foregoing uses the seed key agreed with the authentication server to encrypt the device ID and the time value within the current time step to obtain a dynamic password, including: sending the device ID and the time value within the current time step to the encryption. A tool that causes the encryption tool to encrypt the device ID and the time value within the current time step using the seed key and output the dynamic password.
  • the authentication server may also be registered.
  • the network management client mainly performs the following operations: sending a registration request to the authentication server, where the registration request includes hardware information of the terminal device, where the hardware information is used by the authentication server to generate a device ID for the terminal device; Receiving the user name, the device ID, and the seed key encrypted by the user name and the device ID; storing the device ID and the user name in the local space, and sending the seed key encrypted by the user name and the device ID to the seed key An encryption tool for the encryption tool to decrypt the seed key.
  • the foregoing registration request further includes: user information corresponding to the terminal device; the user information is used by the authentication server to generate a user ID for the terminal device. Based on this, the network management client also receives the user ID delivered by the authentication server.
  • FIG. 6 From the perspective of the terminal device, a flow of the network authentication method is shown in FIG. 6, and includes the following steps:
  • the network management client Obtains a user name and a dynamic password provided by the network management client; the user name is encrypted by the device ID of the terminal device, and the dynamic password is obtained by encrypting the device ID and the time value in the current time step, and the device ID is the authentication server as the terminal device. Generated.
  • the user when the operation is triggered in response to the network access, the user may also display an incoming information page to obtain the username and the dynamic password.
  • obtaining the user name and the dynamic password provided by the network management client includes: obtaining the user name and the dynamic password from the network information page.
  • the user name and the dynamic password are filled in the network information page by the network management client, or copied from the page of the network management client to the network information page.
  • the foregoing device performs credibility verification on the terminal device according to the device ID of the terminal device that is decrypted from the user name, including: when the device ID of the terminal device is successfully decrypted from the user name, according to the device ID searches for a list of registered devices.
  • the registered device list stores the device ID of the registered device.
  • the device ID is queried from the list of registered devices, and the device status list is queried.
  • the device status list stores the status of the registered device. It is found that the terminal device is in a normal state, and it is determined that the terminal device passes the credibility verification.
  • the user name further includes: a user ID corresponding to the terminal device. Based on this, before the authenticity verification of the terminal device is performed according to the device ID, the user identity of the user to which the terminal device belongs may be verified according to the user ID and the user information corresponding to the pre-registered terminal device; When the validity is verified, the operation of authenticating the terminal device according to the device ID is performed.
  • the foregoing device performs validity verification on the terminal device according to the credibility verification result, the device ID, and the dynamic password in the network access authentication request, including: when the terminal device passes the credibility verification, using and accessing the network
  • the seed key of the management client agreement encrypts the device ID and the time value in each time step of at least two time steps respectively to generate at least two dynamic passwords; according to at least two dynamic passwords and network access authentication requests
  • the dynamic password in the terminal performs legality verification on the terminal device; wherein, at least two time steps include a current time step and at least one historical time step that is closest to the current time step.
  • the time value in each time step of the device ID and the at least two time steps is separately encrypted by using the seed key agreed with the network management client to obtain at least two Before the dynamic password, the device may also determine whether there is a dynamic password used by the terminal device in the mapping data of the authenticated device according to the device ID; if the judgment result is that the dynamic password is used according to the last authentication of the terminal device, The dynamic password in the network authentication request is used to verify the validity of the terminal device. If the judgment result is non-existent, the seed key agreed with the network management client is used to perform the device ID and each time in at least two time steps respectively. The time value within the step size is encrypted to generate at least two dynamic password operations.
  • the method before the receiving the network access authentication request sent by the terminal device, the method further includes a registration process.
  • the authentication server mainly performs the following operations: receiving a registration request sent by the network management client, the registration request carrying hardware information of the terminal device; generating a device for the terminal device according to the hardware information in the registration request ID; encrypting the device ID to generate a username; encrypting the seed key by using the username and the device ID to obtain an encrypted seed key; sending the username, the device ID, and the encrypted seed key Give the network management client.
  • the execution bodies of the steps of the method provided by the foregoing embodiments may all be the same device, or the method may also be performed by different devices.
  • the execution body of step 501 to step 503 may be device A; for example, the execution body of steps 501 and 502 may be device A, the execution body of step 503 may be device B, and the like.
  • FIG. 8 is a schematic structural diagram of a network access management apparatus according to another embodiment of the present disclosure.
  • the network access management device can be implemented as the aforementioned network management client.
  • the network management device includes an obtaining module 81, an encryption module 82, and a providing module 83.
  • the obtaining module 81 is configured to obtain, according to a network access instruction of the terminal device, a device ID of the terminal device and a user name encrypted by the device ID, where the device ID is generated by the authentication server for the terminal device.
  • the encryption module 82 is configured to encrypt the device ID and the time value within the current time step by using a seed key agreed with the authentication server to obtain a dynamic password.
  • the providing module 83 is configured to provide the user name and the dynamic password to the terminal device, so that the terminal device generates an network access authentication request and sends the network authentication request to the authentication server for network access authentication.
  • the providing module 83 is specifically configured to: fill the user name and the dynamic password into a network information page provided by the terminal device; or output the user name and the dynamic password to On the local page, the local page is displayed to the user according to the user's access request, so that the user copies the user name and the dynamic password from the local page to the terminal device. Provided in the access information page.
  • the seed key is maintained and managed by an encryption tool that is independent of the local end.
  • the encryption module 82 is specifically configured to: send the device ID and a time value within the current time step to the encryption tool, so that the encryption tool uses the seed key to pair the device ID with the current The time value within the time step is encrypted and the dynamic password is output.
  • the network management device further includes: a sending module, a receiving module, and a storage module.
  • the sending module sends a registration request to the authentication server, where the registration request includes hardware information of the terminal device, where the hardware information is used by the authentication server to generate the device ID for the terminal device.
  • the receiving module is configured to receive the user name, the device ID, and the seed key encrypted by the user name and the device ID delivered by the authentication server.
  • a storage module configured to store the device ID and the user name in a local space, and send a seed key encrypted by the user name and the device ID to the encryption tool, for the encryption tool
  • the seed key is decrypted.
  • the registration request further includes: user information corresponding to the terminal device; the user information is used by the authentication server to generate a user ID for the terminal device.
  • the network management device can be implemented as an electronic device, including: a memory 84 and a processor 85.
  • the memory 84 can be configured to store other various data to support operation on the electronic device. Examples of such data include instructions for any application or method operating on an electronic device, contact data, phone book data, messages, pictures, videos, and the like.
  • Memory 84 can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Disk or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM erasable Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Disk Disk or Optical Disk.
  • Processor 85 is coupled to memory 84 for executing a program in memory 84 for:
  • the user name and the dynamic password are provided to the terminal device, so that the terminal device generates an network access authentication request and sends the network authentication request to the authentication server for network access authentication.
  • the processor 85 can implement other functions in addition to the above functions when performing the program in the memory 84. For details, refer to the descriptions related to the network management client in the foregoing embodiments.
  • the electronic device further includes: a communication component 86, a display 87, a power component 88, an audio component 89, and the like. Only some of the components are schematically illustrated in Figure 8b, and it is not meant that the electronic device only includes the components shown in Figure 8b.
  • the embodiment of the present application further provides a computer readable storage medium storing a computer program, which when executed by a computer, can implement the method steps or functions related to the network access management client in the foregoing embodiments.
  • FIG. 9 is a schematic structural diagram of a network access authentication apparatus according to another embodiment of the present disclosure.
  • the network authentication device can be implemented inside the terminal device that requires network access authentication.
  • the network authentication device includes: a sending module 91, an obtaining module 92, and a generating module 93.
  • the sending module 91 is configured to send a network access command to the network management client in response to the network access triggering operation, to indicate that the network management client provides the user name and dynamic password required for the network access to the terminal device.
  • the obtaining module 92 is configured to obtain the user name and the dynamic password provided by the network management client; the user name is encrypted by the device ID of the terminal device, and the dynamic password is determined by the device ID and the current The time value within the time step is encrypted, and the device ID is generated by the authentication server for the terminal device.
  • the generating module 93 is configured to generate an access authentication request according to the username and the dynamic password.
  • the sending module 91 is further configured to send the network access authentication request to the authentication server, so that the authentication server performs network access authentication on the terminal device.
  • the network access authentication device further includes: a display module, configured to display the network information page when the operation is triggered in response to the network access, to obtain the user name and the dynamic password required for the network access authentication.
  • the obtaining module 92 is specifically configured to: obtain the user name and the dynamic password from the network access information page; wherein the user name and the dynamic password are filled by the network management client to the network access In the information page, or copied by the user from the page of the network management client to the network information page.
  • the network authentication device can be implemented as a terminal device, including: a memory 95, a processor 96, and a communication component 97.
  • the memory 95 can be configured to store other various data to support operations on the terminal device. Examples of such data include instructions for any application or method operating on the terminal device, contact data, phone book data, messages, pictures, videos, and the like.
  • the memory 95 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM Programmable Read Only Memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Disk Disk or Optical Disk.
  • the processor 96 is coupled to the memory 95 for executing a program in the memory 95 for:
  • control communication component 97 sends an incoming network command to the network management client to instruct the network management client to provide the terminal device with a user name and a dynamic password required for accessing the network;
  • the user name and the dynamic password provided by the network management client are encrypted by a device ID of the terminal device, and the dynamic password is determined by the device ID and a current time step The value is obtained by encrypting, and the device ID is generated by the authentication server for the terminal device;
  • the network access authentication request is generated according to the user name and the dynamic password, and the control communication component 97 sends the network access authentication request to the authentication server, so that the authentication server performs network access authentication on the terminal device.
  • a communication component configured to send the network access instruction to the network management client, and send the network access authentication request to the authentication server.
  • the processor 96 can implement other functions in addition to the above functions when performing the program in the memory 95. For details, refer to the descriptions related to the terminal device in the foregoing embodiments.
  • the terminal device further includes: a display 98, a power supply component 99, an audio component 90, and the like. Only some of the components are schematically illustrated in Figure 9b, and it is not meant that the terminal device only includes the components shown in Figure 9b.
  • the embodiment of the present application further provides a computer readable storage medium storing a computer program, which when executed by a computer, can implement the method steps or functions related to the terminal device in the foregoing embodiments.
  • FIG. 10 is a schematic structural diagram of a network access authentication apparatus according to another embodiment of the present disclosure.
  • the network authentication device can be implemented inside the authentication server.
  • the network authentication device includes: a receiving module 1001, a decrypting module 1002, and a verification module 1003.
  • the receiving module 1001 is configured to receive a network access authentication request sent by the terminal device, where the network access authentication request includes a username and a dynamic password.
  • the decryption module 1002 is configured to decrypt the username according to a set decryption algorithm.
  • the verification module 1003 is configured to perform credibility verification on the terminal device according to the device ID of the terminal device decrypted by the decryption module 1002 from the user name.
  • the verification module 1003 is further configured to perform legality verification on the terminal device according to the credibility verification result, the device ID, and the dynamic password in the network access authentication request.
  • the verification module 1003 when the verification module 1003 performs the credibility verification on the terminal device, specifically, when the device ID of the terminal device is successfully decrypted from the user name, the registration device is searched according to the device ID. a list, the registered device list stores a device ID of the registered device; if the device ID is queried from the registered device list, the device status list is queried, and the device status list stores the status of the registered device; Querying from the device status list that the terminal device is in a normal state, determining that the terminal device passes the credibility verification.
  • the verification module 1003 is further configured to: perform identity verification on a user to which the terminal device belongs according to the user ID and user information corresponding to the terminal device that is pre-registered; When the user is authenticated, the operation of authenticating the terminal device according to the device ID is performed.
  • the method is specifically configured to: when the terminal device passes the credibility verification, use the seed key agreed with the network management client to separately Encrypting the device ID and the time value in each of the at least two time steps to generate at least two dynamic passwords; according to the at least two dynamic passwords and the dynamic password in the network authentication request, Performing legality verification on the terminal device; wherein the at least two time steps include a current time step and at least one historical time step that is closest to the current time step.
  • the verification module 1003 is further configured to: determine, according to the device ID, whether there is a dynamic password used by the terminal device to pass the last authentication pass in the mapping data of the authenticated device; if the determination result is Performing validity verification on the terminal device according to the dynamic password used by the terminal device last authentication and the dynamic password in the network access authentication request; if the determination result is not exist, performing the utilization and the network management client agreement
  • the seed key encrypts the device ID and the time value within each of the at least two time steps to generate at least two dynamic passwords, respectively.
  • the network authentication device further includes: a generating module, an encryption module, and a sending module.
  • the receiving module 1001 is further configured to receive a registration request sent by the network management client, where the registration request carries hardware information of the terminal device.
  • a generating module configured to generate the device ID for the terminal device according to the hardware information.
  • an encryption module configured to encrypt the device ID, generate the username, and encrypt the seed key by using the username and the device ID to obtain an encrypted seed key.
  • a sending module configured to send the username, the device ID, and the encrypted seed key to the network management client.
  • the network authentication device can be implemented as an authentication server, including: a memory 1004, a processor 1005, and a communication component 1006.
  • the memory 1004 can be configured to store other various data to support operations on the authentication server. Examples of such data include instructions for any application or method operating on an authentication server, contact data, phone book data, messages, pictures, videos, and the like.
  • the memory 1004 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable. Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Magnetic Memory, Flash Memory, Disk or Optical Disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read only memory
  • EPROM Electrically erasable programmable read only memory
  • PROM Programmable Read Only Memory
  • ROM Read Only Memory
  • Magnetic Memory Flash Memory
  • Disk Disk or Optical Disk.
  • the communication component 1006 is configured to receive a network access authentication request sent by the terminal device, where the network access authentication request includes a username and a dynamic password.
  • the processor 1005 is coupled to the memory 1004 for executing a program in the memory 1004 for:
  • the processor 1005 can implement other functions in addition to the above functions when executing the program in the memory 1004. For details, refer to the description related to the authentication server in the foregoing embodiments.
  • the authentication server further includes: a display 1007, a power component 1008, an audio component 1009, and the like. Only some of the components are schematically illustrated in Figure 10b, and it does not mean that the authentication server only includes the components shown in Figure 10b.
  • the embodiment of the present application further provides a computer readable storage medium storing a computer program, which when executed by a computer, can implement the method steps or functions related to the authentication server in the foregoing embodiments.
  • the communication components in Figures 8b, 9b, and 10b can be configured to facilitate wired or wireless communication between the device to which the communication component belongs and other devices.
  • the device to which the communication component belongs can access a wireless network based on a communication standard such as WiFi, 2G or 3G, or a combination thereof.
  • the communication component receives a broadcast signal or broadcast associated information from an external broadcast management system via a broadcast channel.
  • the communication component further includes a near field communication (NFC) module to facilitate short range communication.
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • the display in Figures 8b, 9b, and 10b may include a screen whose screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from the user.
  • the touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor may sense not only the boundary of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.
  • the power components in Figures 8b, 9b, and 10b provide power to the various components of the device to which the power components belong.
  • the power components can include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the devices to which the power components belong.
  • the audio components in Figures 8b, 9b, and 10b are configured to output and/or input audio signals.
  • the audio component includes a microphone (MIC) that is configured to receive an external audio signal when the device to which the audio component belongs is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode.
  • the received audio signal can be further stored in a memory or transmitted via a communication component.
  • the audio component further includes a speaker for outputting an audio signal.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请实施例提供一种入网认证方法、装置及***。入网认证方法主要包括：由入网管理客户端利用终端设备的设备ID加密得到用户名，并利用设备ID和时间步长内的时间值加密得到动态密码，使得终端设备以所述用户名和动态密码进行入网认证。设备ID由认证服务器为终端设备唯一分配，所以对终端设备具有身份标识作用，这使得入网认证可不依赖于数字证书，在满足入网安全性需求的同时，解决了终端设备因不支持或无法使用数字证书导致无法完成入网认证的问题。

Description

入网认证方法、装置及***
本申请要求2017年07月20日递交的申请号为201710595977.6、发明名称为“入网认证方法、装置及***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，尤其涉及一种入网认证方法、装置及***。
背景技术
随着无线局域网(Wireless Local Area Networks，WLAN)的广泛应用，为了解决WLAN的用户接入认证问题，出现了网络准入控制(Network Admission Control，NAC)体系。NAC体系能够对接入WLAN的终端进行严格、高细粒度的管控，保证合法以及安全的终端入网，降低WLAN的安全风险。
802.1X是NAC体系常用的入网认证技术。802.1X采用的可扩展身份验证协议(Extensible Authentication Protocol，EAP)认证方式包括：EAP-MD5、EAP-PEAP、EAP-TLS、EAP-TTLS以及EAP-LEAP。其中，EAP-TLS认证方式是一种基于证书的双向认证方式，其在安全性、实用性等方面都占据优势，因此成为众多企业首选的入网认证方式。
EAP-TLS认证方式需要使用数字证书，来验证设备身份。但在实际场景中，特别是在终端设备一侧，经常出现不支持或无法使用数字证书等问题，造成无法完成入网认证。因此，需要一种既能兼容各种设备，又能满足设备识别、安全性等需求的入网认证方案。
发明内容
本申请的多个方面提供一种入网认证方法、装置及***，用以对终端设备进行入网认证，满足设备识别、安全性等需求，同时解决设备兼容问题。
本申请实施例提供一种入网认证方法，包括：
根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的；
利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码；
将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
本申请实施例还提供一种入网认证方法，包括：
响应于入网触发操作，向入网管理客户端发送入网指令，以指示所述入网管理客户端为本端的终端设备提供入网所需的用户名和动态密码；
获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的；
根据所述用户名和所述动态密码，生成入网认证请求，并将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证。
本申请实施例还提供一种入网认证方法，包括：
接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码；
按照设定的解密算法，对所述用户名进行解密；
根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证；
根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
本申请实施例还提供一种电子设备，包括：存储器以及处理器；
所述存储器，用于存储程序；
所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的；
利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码；
将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
本申请实施例还提供一种终端设备，包括：存储器、处理器以及通信组件；
所述存储器，用于存储程序；
所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
响应于入网触发操作，控制所述通信组件向入网管理客户端发送入网指令，以指示 所述入网管理客户端为所述终端设备提供入网所需的用户名和动态密码；
获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的；
根据所述用户名和所述动态密码，生成入网认证请求，并控制所述通信组件将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证；
所述通信组件，用于向所述入网管理客户端发送所述入网指令，并将所述入网认证请求发送给所述认证服务器。
本申请实施例还提供一种认证服务器，包括：存储器、通信组件以及处理器；
所述存储器，用于存储程序；
所述通信组件，用于接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码；
所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
按照设定的解密算法，对所述用户名进行解密；
根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证；
根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
本申请实施例还提供一种认证***，包括：终端设备、入网管理客户端以及认证服务器；
所述终端设备，用于响应于入网触发操作，向所述入网管理客户端发送入网指令；获取所述入网管理客户端提供的用户名和动态密码；以及根据所述用户名和所述动态密码，生成入网认证请求，并将所述入网认证请求发送给所述认证服务器；
所述入网管理客户端，用于根据所述入网指令，获取所述设备ID以及所述用户名；利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得所述动态密码；以及将所述用户名和所述动态密码提供给所述终端设备；所述用户名由所述设备ID加密得到的；
所述认证服务器，用于接收所述入网认证请求，所述入网认证请求包括所述用户名和所述动态密码；根据从所述用户名中解密出的所述设备ID，对所述终端设备进行可信 性验证；以及根据可信性验证结果、所述设备ID和所述动态密码，对所述终端设备进行合法性验证。
在本申请实施例中，由入网管理客户端利用终端设备的设备ID加密得到用户名，并利用设备ID和时间步长内的时间值加密得到动态密码，使得终端设备以所述用户名和动态密码进行入网认证。由于设备ID由认证服务器为终端设备唯一分配，所以对终端设备具有身份标识作用。因此，对认证服务器来说，一方面可根据用户名中的设备ID识别设备身份，而无需数字证书，解决了终端设备因不支持或无法使用数字证书导致无法完成入网认证的问题，适用于各种类型的设备进行入网认证；另一方面相比于静态域密码，基于与设备ID相结合的动态密码进行入网认证，安全性更高，满足安全性需求。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请一示例性实施例提供的示例性入网认证***的结构示意图；
图2为本申请另一示例性实施例提供的入网管理客户端向认证服务器进行注册的流程示意图；
图3为本申请又一示例性实施例提供的示例性入网认证***的结构示意图；
图4为本申请又一示例性实施例提供的示例性入网认证方法的流程示意图；
图5为本申请又一示例性实施例提供的从入网管理客户端的角度描述的入网认证方法的流程示意图；
图6为本申请又一示例性实施例提供的从终端设备的角度描述的入网认证方法的流程示意图；
图7为本申请又一示例性实施例提供的从认证服务器的角度描述的入网认证方法的流程示意图；
图8a为本申请又一示例性实施例提供的示例性入网管理装置的结构示意图；
图8b为本申请又一示例性实施例提供的示例性电子设备的结构示意图；
图9a为本申请又一示例性实施例提供的示例性入网认证装置的结构示意图；
图9b为本申请又一示例性实施例提供的示例性终端设备的结构示意图；
图10a为本申请又一示例性实施例提供的示例性入网认证装置的结构示意图；
图10b为本申请又一示例性实施例提供的示例性认证服务器的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
在现有技术中，因为EAP-TLS认证方式在安全性、实用性等方面的优势，成为众多企业首选的入网认证方式。但是，因为EAP-TLS认证方式需要使用数字证书来验证入网设备的身份，而对一些终端设备来说，经常出现不支持或无法使用数字证书等问题，造成无法完成入网认证。
针对上述技术问题，本申请实施例提供一种解决方案，主要原理是：由认证服务器为终端设备分配可唯一标识所述终端设备的设备ID，结合入网管理客户端，由入网管理客户端为终端设备提供由终端设备的设备ID加密得到用户名和动态密码，终端设备以所述用户名和动态密码进行入网认证。对认证服务器来说，一方面可根据用户名中的设备ID识别终端设备的身份，另一方面基于与设备ID相结合的动态密码进行入网认证，安全性更高，满足安全性需求。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1为本申请一示例性实施例提供的示例性入网认证***的结构示意图。如图1所示，该***包括：终端设备10、认证服务器20以及入网管理客户端30。终端设备10可与认证服务器20以有线方式或无线方式连接。
认证服务器20隶属于一网络21，主要负责其所属网络21的入网认证管控，确保网络21的安全。认证服务器20可以是任何可提供计算服务，能够响应服务请求，并进行处理的设备，例如可以是常规服务器、云服务器、云主机、虚拟中心等。服务器的构成主要包括处理器、硬盘、内存、***总线等，和通用的计算机架构类似。
终端设备10可以是智能手机、平板电脑、个人电脑、穿戴设备等。终端设备10通常包括至少一个处理单元11和至少一个存储器12。处理单元11和存储器12的数量取决于终端设备10的配置和类型。存储器12可以包括易失性的，例如RAM，也可以包括非易失性的，例如只读存储器(Read-Only Memory，ROM)、闪存等，或者也可以同时包括两种类型的。存储器12内通常存储有操作***(Operating System，OS)、一个或多个应用程序，也可以存储有程序数据等。除了处理单元11和存储器12之外，终端设 备还包括一些基本配置13，例如网卡芯片、IO总线、音视频组件等。可选地，终端设备10还可以包括一些***设备14，例如键盘、鼠标、输入笔、打印机等。这些***设备在本领域中是总所周知的，在此不做赘述。
在本示例性的入网认证***中，终端设备10可以接入认证服务器20所属的网络21，但需要通过入网认证。其中，终端设备10主要用于根据用户名和动态密码向认证服务器20发起入网认证请求；入网管理客户端30主要用于向终端设备10提供入网认证所需的用户名和动态密码；认证服务器20主要用于根据入网认证请求对终端设备10进行入网认证。值得一提的是，终端设备10的入网操作属于***级操作，可由终端设备的OS负责处理。
另外，入网管理客户端30可以独立于终端设备10实现，或者也可以安装于终端设备10上实现。在图1所示入网认证***中，以入网管理客户端30安装于终端设备10上实现为例。如图1所示，当入网管理客户端30安装于终端设备10上实现时，该入网管理客户端30存储于存储器12中。终端设备10与入网管理客户端30相配合，可以实现以设备身份和动态密码进行入网认证。
当用户需要通过终端设备10接入认证服务器20所属网络21时，可通过终端设备10发出入网触发操作。例如，用户可以通过终端设备10上的设置选项发出入网触发操作。在一示例性的设备实现中，终端设备10向用户提供了设置选项，用户点击该设置选项可进入设置页面，设置页面上包括OS支持的各种功能设置项，例如声音、墙纸、电池、局域网/Wi-Fi、运营商等设置项。用户继续点击局域网/Wi-Fi设置项，以进入局域网/Wi-Fi设置页面。此时，终端设备10会自动搜索附近的信号强度符合设定要求的网络信息并将网络信息显示于局域网/Wi-Fi设置页面上。在本实施例中，假设终端设备10搜索到的网络信息包括认证服务器20所属网络21。用户通过点击局域网/Wi-Fi设置页面上网络21的信息，即触发接入网络21的操作。
终端设备10可响应于入网触发操作，开始进行入网处理。终端设备10向入网管理客户端30发送入网指令，以指示入网管理客户端30为终端设备10提供入网所需的用户名和动态密码。入网管理客户端30接收入网指令，根据该入网指令，开始获取用户名和动态密码的操作。一方面，入网管理客户端30获取由认证服务器20为终端设备10生成的可唯一标识终端设备10的设备ID，并获取由设备ID加密得到的用户名；另一方面，入网管理客户端30利用与认证服务器20约定的种子密钥对设备ID和当前时间步长内的时间值进行加密，以获得动态密码。因为密码生成过程与时间因子结合，所以属于动态 密码，并且该动态密码是一次性密码，每次入网都需要重新生成。
之后，入网管理客户端30将用户名和动态密码提供给终端设备10。终端设备10获取入网管理客户端30提供的用户名和动态密码，根据所述用户名和动态密码，生成入网认证请求，并将入网认证请求发送给认证服务器20，以供认证服务器20对终端设备10进行入网认证。
其中，入网管理客户端30可以采用多种实现方式将用户名和动态密码提供给终端设备10。下面举例说明：
在一示例性实现方式中，在用户触发入网操作时，终端设备10向用户展示一入网信息页面，作为获取用户名和动态密码的途径。可选地，该入网信息页面上设置有用户名输入框和密码输入框，用户名输入框用于填充用户名，密码输入框用于填充动态密码。
可选地，对入网管理客户端30来说，在获取到用户名和动态密码之后，可以将用户名和动态密码填充至所述入网信息页面中，以供终端设备10从入网信息页面中提取所述用户名和动态密码。例如，入网管理客户端30可以自动将用户名填充至入网信息页面上的用户名输入框内，并将动态密码填充至入网信息页面上的密码输入框内。这种由入网管理客户端30自动将用户名和动态密码填充至所述入网信息页面中的实施方式，效率较高。
可选地，对入网管理客户端30来说，在获取到用户名和动态密码之后，也可以将用户名和动态密码输出至入网管理客户端30的一页面上，以供用户通过该页面获知用户名和密码。对用户来说，在触发入网操作之后，可以看到终端设备10提供的入网信息页面，进而获知需要输入用户名和动态密码，于是去访问入网管理客户端30提供的包括有用户名和动态密码的页面。对入网管理客户端30来说，可根据用户的访问请求，向用户展示包括有用户名和动态密码的页面，以供用户从所述页面中将用户名和动态密码复制到入网信息页面中。
当上述入网信息页面上填充用户名和动态密码后，终端设备10可以从该入网信息页面中获取所述用户名和动态密码，进而生成入网认证请求并发送给认证服务器20，以供认证服务器20对终端设备10进行入网认证。
认证服务器20接收终端设备10发送的入网认证请求，该入网认证请求包括用户名和动态密码。用户名是由终端设备10的设备ID加密得到的，动态密码是利用约定的种子密钥对终端设备10的设备ID以及终端设备10当时指定时间步长内的时间值进行加密得到的。
之后，认证服务器20对用户名进行解密；若未成功解密用户名，则认证失败，拒绝终端设备10接入网络21；若从用户名中成功解密出终端设备10的设备ID，则根据解密出的设备ID对终端设备10进行可信性验证，因为终端设备10的ID是认证服务器20唯一生成的，所以基于终端设备10的设备ID可以达到识别终端设备10的目的。若终端设备10未通过可信性验证，则认证失败，拒绝终端设备10接入网络21；若终端设备10通过可信性验证，则可以根据设备ID和入网认证请求中的动态密码，对终端设备10进行合法性验证。若终端设备10通过合法性验证，允许终端设备10接入网络21；若终端设备10未通过合法性验证，拒绝终端设备10接入网络21。
由上述可见，在本示例性的入网认证***中，由入网管理客户端30为终端设备10提供由终端设备的设备ID加密得到用户名和动态密码，终端设备10以所述用户名和动态密码进行入网认证，实际上是以设备ID和动态密码进行入网认证。从认证服务器20的角度来看，一方面可根据用户名中的设备ID识别终端设备的身份，另一方面基于与设备ID相结合的动态密码进行入网认证，安全性更高，满足安全性需求。
在一示例性应用场景中，在终端设备10进行入网认证之前，入网管理客户端30可以预先向认证服务器20进行注册，通过该注册过程预先获得用户名、设备ID和种子密钥等数据。如图2所示，一种入网管理客户端30向认证服务器20进行注册的流程包括以下步骤：
201、入网管理客户端30向认证服务器20发送注册请求，所述注册请求携带有终端设备10的硬件信息。
此处不对硬件信息进行限定，凡是与终端设备10相关的硬件信息均适用于本实施例，例如可以是与终端设备10的中央处理单元(Central Processing Unit，CPU)、显卡、硬盘等相关的信息。
可选地，注册请求中还可以包括终端设备10对应的用户信息和/或企业信息。
202、认证服务器20接收注册请求，从中解析出终端设备10的硬件信息，并根据所述硬件信息生成可唯一标识终端设备10的设备ID，记为UMID。
可选地，当注册请求中包括用户信息和/或企业信息时，认证服务器20可以存储终端设备10对应的用户信息和/或企业信息，并且还可以根据该用户信息和/或企业信息为终端设备生成用户ID(User ID，UID)和/或企业ID(Customer Identity，CID)。其中，UID用于唯一标识终端设备10所属的用户；CID用户唯一标识终端设备10所属的企业。
例如，用户信息可以包括但不限于：用户注册的账号、密码、用户的邮箱、手机号码、昵称等信息。企业信息可以包括但不限于：用户注册的账号、密码、企业注册地、企业名称、企业性质、企业规模等信息。
203、认证服务器20采用设定的加密算法生成两个动态令牌(token)，即令牌密钥(TokenKey，TK)和进程令牌(ProcessToken，PT)。
其中，TK可作为终端设备10入网认证时所需的用户名，由UMID加密得到。PT可作为加密后的种子密钥，可由UMID、TK以及种子密钥加密得到。
可选地，可以采用Blowfish加密算法对UMID进行加密以生成TK。
可选地，可以采用AES-128加密算法对UMID、TK以及种子密钥加密以生成PT。
进一步，当认证服务器20为终端设备生成CID、UID和UMID时，可以同时结合CID、UID和UMID来生成TK和PT。其中，结合CID、UID和UMID生成TK和PT的加密公式分别如下：
TK＝Blowfish(CID+UID+UMID+RANDOM+TIME，(app_secret))
PT＝TK+AES128(CID+UID+UMID，(app_secret))
在上述加密公式中，app_secret表示入网管理客户端30与认证服务器20约定的种子密钥。该种子密钥可以是入网管理客户端30的API接口密钥，与入网管理客户端30一一对应。
204、认证服务器向入网管理客户端30发送TK、PT以及UMID。
205、入网管理客户端30接收TK、PT以及UMID，并将UMID、TK保存在本地空间中。
206、入网管理客户端30向独立的加密工具发送PT，由加密工具对PT解密获得种子密钥并存储种子密钥。
其中，加密工具对入网管理客户端30以及认证服务器20来说是一个黑匣子，其采用的加密算法以及存储种子密钥的方式对外不可见，且加密工具具有防篡改功能，而且在不安全的情况下禁止被访问或使用，这样可以降低种子密钥被破解的风险，保证种子密钥的安全性，进而可提高入网认证的安全性。对入网管理客户端30和认证服务器来说，在需要时只需调用加密工具即可。
基于上述注册流程，入网管理客户端30可以预先将终端设备10的设备ID和用户名保存至本地空间中。因此，当接收到入网指令时，入网管理客户端30可直接从本地空间中读取终端设备10的设备ID和用户名。除该实施方式之外，入网管理客户端30也可以 在接收到入网指令时，实时地向认证服务器20请求终端设备10的设备ID和用户名。例如，如果认证服务器20未在上述注册流程中向入网管理客户端30下发终端设备10的设备ID和用户名，则入网管理客户端30在接收到入网指令时，需要实时地向认证服务器20请求终端设备10的设备ID和用户名。其中，由认证服务器20向入网管理客户端30下发终端设备10的设备ID和用户名，加密算法只需保存在认证服务器20一端，有利于降低加密算法被破解的概率，进而提高设备ID和用户名的安全性。
进一步可选地，在上述注册流程中，认证服务器20可以通过注册设备列表存储已注册设备的设备ID，并通过设备状态列表存储已注册设备的状态，例如已注册、已删除、被冻结、被禁用等。其中，注册设备列表和设备状态列表可以是同一列表，也可以是相互独立的两个列表。
基于上述注册设备列表和设备状态列表，认证服务器20可以结合注册设备列表和设备状态列表，对终端设备10进行可信性验证。一种可选实施方式包括：当从用户名中成功解密出终端设备10的设备ID时，认证服务器20根据解密出的设备ID查找注册设备列表，以判断终端设备10是否已经注册；如果从注册设备列表中查询到所述解密出的设备ID，进一步查询设备状态列表，以判断终端设备10的状态是否正常；如果从设备状态列表中查询到终端设备10处于正常状态，确定终端设备10通过可信性验证。如果未从注册设备列表中查询到所述解密出的设备ID，或者从设备状态列表中查询到终端设备10处于异常状态，例如被删除、被禁用、被冻结，则确定终端设备10未通过可信性验证。
在一可选实施方式中，认证服务器20在生成用户名(即TK)的过程可以同时结合CID和/或UID。基于此，认证服务器20除了可以从用户名中解密出UMID之外，还可以从用户名中解密出UID和/或CID。为了提高网络安全性，可以从设备角度、用户角度以及企业角度进行多因素认证。基于此，认证服务器20在对终端设备10进行可信性验证之前，可以根据UID和预先注册的用户信息和/或企业信息，对终端设备10所属的用户和/或企业进行身份验证；例如，可以判断从用户名中解密出的UID和/或CID是否与预先注册的用户信息和/或企业信息相匹配，如果相匹配，确定终端设备10所属的用户和/或企业通过身份验证；如果不匹配，确定终端设备10所属的用户和/或企业未通过身份验证。当终端设备10所属的用户和/或企业通过身份验证时，再对终端设备10进行可信性验证。
在上述实施例或下述实施例中，在终端设备10通过可信性验证之后，认证服务器20需要根据设备ID和入网认证请求中的动态密码对终端设备10进行合法性验证。
一种对终端设备10进行合法性验证的实施方式包括：认证服务器20可以确定至少两个时间步长，其中，所述至少两个时间步长包括当前时间步长以及与当前时间步长相距最近的至少一个历史时间步长；对至少两个时间步长中的每个时间步长，利用与入网管理客户端30约定的种子密钥对解密出的设备ID和每个时间步长内的时间值进行加密，以生成至少两个动态密码；根据至少两个动态密码和入网认证请求中的动态密码，对终端设备进行合法性验证。例如，可以将至少两个动态密码与入网认证请求中携带的动态密码进行比较；若至少两个动态密码中存在与入网认证请求中携带的动态密码相同的动态密码，则确定终端设备10通过合法性验证；若至少两个动态密码中不存在与入网认证请求中携带的动态密码相同的动态密码，则确定终端设备10未通过合法性验证。
进一步可选地，认证服务器20可以存储已认证设备的映射数据。这里已认证设备包括当前在线的已认证设备，也包括已下线的历史已认证设备。已认证设备的映射数据包括但不限于：已认证设备的设备ID、媒体访问控制(Media Access Control，MAC)地址、UID、CID、认证通过时所使用的动态密码等数据。基于此，认证服务器20可以结合已认证设备的映射数据对终端设备进行合法性验证。
另一种对终端设备10进行合法性验证的实施方式包括：认证服务器20根据从用户名中解密出的设备ID判断已认证设备的映射数据中是否存在终端设备上次认证通过所使用的动态密码。若已认证设备的映射数据中存在终端设备上次认证通过所使用的动态密码，则根据终端设备上次认证通过所使用的动态密码和入网认证请求中携带的动态密码，对终端设备10进行合法性验证。例如，可以将终端设备上次认证通过所使用的动态密码与入网认证请求中携带的动态密码进行比较；若两者相同，则确定终端设备10通过合法性验证；若两者不相同，则确定终端设备10未通过合法性验证。
若已认证设备的映射数据中不存在终端设备上次认证通过所使用的动态密码，则认证服务器20确定至少两个时间步长，利用与入网管理客户端30约定的种子密钥分别对设备ID和每个时间步长内的时间值进行加密，以获得至少两个动态密码；将至少两个动态密码与入网认证请求中携带的动态密码进行比较；若至少两个动态密码中存在与入网认证请求中携带的动态密码相同的动态密码，则确定终端设备10通过合法性验证；若至少两个动态密码中不存在与入网认证请求中携带的动态密码相同的动态密码，则确定终 端设备10未通过合法性验证。
可选地，在上述认证过程中，认证服务器20也可以将设备ID以及当前时间步长或历史时间步长内的时间值发送给加密工具，以使加密工具利用预先约定的种子密钥对设备ID以及当前时间步长或历史时间步长内的时间值进行加密，从而获得动态密钥。
值得说明的是，动态密码具有一定时效性，当时效性结束时，该动态密码就会失效，故会被删除。在同一个时间步长内，动态密码生成的结果是一样的。对认证服务器20来说，并不知道入网认证请求中携带的动态密码是在哪个时间步长内生成的，而且由于网络的原因，动态密码生成端(即入网管理客户端30)的时间和认证服务器20接收到动态密码的时间可能差距会很大，有可能使得这两个时间不在同一个时间步长内。例如，可能存在这种情况：入网管理客户端30在一个时间步长的结尾时刻生成动态密码，认证服务器20在下一个时间步长的开始时刻接收到该动态密码，这种情况属于合理情况。基于此，考虑到传输时延，在上述计算动态密码的过程中不仅考虑当前时间步长，而且考虑与当前时间步长相邻的历史时间步长，历史时间步长可以是一个或多个。历史时间步长的个数越多，被攻击的风险就越大，因此历史时间步长的个数可视网络的风险容忍程度而定。
进一步，认证服务器20在获得终端设备10的认证结果之后，还可以向终端设备10返回认证结果。所述认证结果包括：终端设备10通过认证，或终端设备10未通过认证。
图1所示入网认证***可在802.1X协议框架下部署实施。可选地，图1所示入网认证***还可与802.1X协议中的EAP-PEAP认证方式相结合，以EAP-PEAP作为载体形成一种新的认证方式，但并不限于与EAP-PEAP认证方式相结合。基于此，如图3所示，另一种示例性的入网认证***主要包括：终端设备10、认证服务器20、入网管理客户端30、Radius服务器40以及网络附属存储(Network Attached Storage，NAS)设备50。终端设备10通过NAS设备50与Radius服务器40连接，Radius服务器40与认证服务器20连接。
值得说明的是，图3所示入网认证***中，除了终端设备10、NAS设备50、Radius服务器30以及认证服务器20之外，还可以包括网关等其它一些网络设备，在此不做赘述，具体可视网络部署情况而定。
在图3所示示例性的入网认证***中，终端设备10、认证服务器20以及入网管理客户端30的功能基本不变。终端设备10仍旧主要用于根据用户名和动态密码向认证服 务器20发起入网认证请求，发起过程参见前面的描述；入网管理客户端30仍旧主要用于向终端设备10提供入网认证所需的用户名和动态密码；认证服务器20仍旧主要用于对终端设备10进行入网认证，认证过程参见前面的描述。区别在于：终端设备10与认证服务器20之间的交互数据需要封装为远程用户拨号认证***(Remote authentication dial in user service，Radius)协议报文，并通过Radius服务器40进行转发。
Radius是一种客户端/服务器(C/S)结构的协议，Radius服务器40和NAS设备50分别是Radius协议下的服务器和客户端。其中，NAS设备50可以是任何运行Radius客户端软件的设备，主要向远程接入用户(即终端设备10)提供接入及与Radius服务器40交互的服务。在本实施例中，Radius服务器40主要作为认证服务器20的代理，负责Radius协议报文的封装/解封装以及转发，这点不同于传统意义上的Radius服务器。其中，Radius服务器40可以是任何运行Radius服务端软件的设备。
在图3所示入网认证***中，终端设备10可以采用图2所示流程向认证服务器20进行注册，详细流程在此不再赘述。之后，当用户需要通过终端设备10接入认证服务器20所属的网络21时，可进入入网认证流程。可选地，如图4所示，可在图3所示入网认证***中实施的一种认证流程包括以下步骤：
认证初始化阶段：
401、终端设备10响应于用户触发的入网操作，向入网管理客户端30发送入网指令，与此同时，在终端设备的界面上展示入网信息页面。
402、入网管理客户端30可从本地空间中读取UMID以及TK，将TK作为用户名。
403、入网管理客户端30调用加密工具，由加密工具利用种子密钥对UMID和当前时间步长内的时间值进行加密，以获得动态密码。
可选地，时间步长可以是5分钟、3分钟、2分钟等，具体视应用需求而定。
404、入网管理客户端30自动将TK和动态密码填充至入网信息页面上。
405、终端设备10从入网信息页面中获取TK和动态密码。
传输层安全(Transport Layer Security，TLS)通道建立阶段：
406、终端设备10向NAS设备50发送一个EAPoL-Start报文，开始802.1X接入的开始。
407、NAS设备50向终端设备10发送EAP-Request/Identity报文，要求终端设备10上报用户的网络标识。
408、终端设备10向NAS设备50回应一个EAP-Response/Identity报文。
409、NAS设备50以EAPoR(EAP over Radius)的报文格式将EAP-Response/Identity发送给Radius服务器40。
410、Radius服务器40收到EAP-Response/Identity报文，根据配置确定使用EAP-PEAP认证，并向NAS设备50发送RADIUS-Access-Challenge报文，该报文里面含有Radius服务器40发送给终端设备10的EAP-Request/Peap/Start报文，表示希望开始进行EAP-PEAP的认证。
411、NAS设备50将EAP-Request/Peap/Start报文发送给终端设备10。
改进MSCHPAV2认证阶段：
412、终端设备10收到EAP-Request/Peap/Start报文后，按照MSCHPAV2算法对动态密码进行处理，获得一哈希值，记为ntSendResponse，将用户名和哈希值ntSendResponse，封装在EAP-Response/Client Hello报文中发送给NAS设备50。
413、NAS设备50以EAPoR的报文格式将EAP-Response/Client Hello报文发送给Radius服务器40。
414、Radius服务器40收到终端设备10发来的EAP-Response/Client Hello报文后，从中解析出TK和哈希值ntSendResponse。
415、Radius服务器40向认证服务器20发送TK和哈希值ntSendResponse。
416、认证服务器20按照设定的解密算法对用户名进行解密；若成功解密，进入步骤417；若未成功解密，进入步骤421。该解密算法与认证服务器20在注册流程中生成用户名时采用的加密算法相对应。
417、认证服务器20根据从用户名中解密出的设备ID对终端设备10进行可信性验证；若终端设备10通过可信性验证，进入步骤418；若未通过可信性验证，进入步骤421。
418、认证服务器20根据设备ID和哈希值ntSendResponse，对终端设备10进行合法性验证；若通过合法性验证，进入步骤419；若未通过合法性验证，进入步骤421。
在本实施例中，认证服务器20会记录已认证设备的映射数据。已认证设备的映射数据中包括已认证设备的设备ID、MAC地址、用户名、哈希值以及认证过程中所需的哈希密码等信息。基于此，认证服务器20可以根据设备ID判断已认证设备的映射数据中是否存在终端设备10上一次通过认证所使用的哈希密码。
若判断结果为存在，则对终端设备10上一次通过认证所使用的哈希密码做哈希处理得到一哈希值；将该哈希值与哈希值ntSendResponse进行比较；两个哈希值相同，确定终端设备10通过合法性验证；若两个哈希值不相同，确定终端设备10未通过合法性验 证。
若判断结果为不存在，根据当前时间，确定当前时间步长以及与当前时间步长相邻的历史时间步长；利用与入网管理客户端30约定的种子密钥对设备ID和所确定的每个时间步长内的时间值进行加密，获得至少两个动态密码；按照MSCHPAV2算法对至少两个动态密码进行处理，获得至少两个哈希密码；进而，对至少两个哈希密码进行哈希处理，获得至少两个哈希值。将至少两个哈希值与哈希值ntSendResponse进行比较；若至少两个哈希值中存在与哈希值ntSendResponse相同的哈希值，确定终端设备10通过合法性验证；若至少两个哈希值中不存在与哈希值ntSendResponse相同的哈希值，确定终端设备10未通过合法性验证。
当确定终端设备10通过合法性验证后，将与哈希值ntSendResponse相同的哈希值所对应的哈希密码存储到终端设备10的映射数据中。
419、认证服务器20通过MSCHPAV2算法生成一个认证通过标识msch_response，并向Radius服务器40发送认证通过标识msch_response。
420、Radius服务器40将认证通过标识msch_response封装在RADIUS-Access-Accept报文中，通过NAS设备50向终端设备10发送RADIUS-Access-Accept报文，结束认证流程。
421、认证服务器20向Radius服务器40发送未通过认证结果，并进入步骤422。
422、Radius服务器40将未通过认证结果封装在RADIUS-Access-Reject报文中，并通过NAS设备50向终端设备10发送RADIUS-Access-Reject报文，结束认证流程。
基于上述图1或图3所示的入网认证***，本申请以下实施例分别从入网管理客户端、终端设备以及认证服务器的角度给出了几种入网认证方法的流程。
从入网管理客户端的角度来看，一种入网认证方法的流程如图5所示，包括以下步骤：
501、根据终端设备的入网指令，获取终端设备的设备ID以及由设备ID加密得到的用户名，设备ID是认证服务器为终端设备生成的。
502、利用与认证服务器约定的种子密钥对设备ID和当前时间步长内的时间值进行加密，以获得动态密码。
503、将用户名和动态密码提供给终端设备，以供终端设备生成入网认证请求并发往认证服务器进行入网认证。
在一可选实施方式中，上述将用户名和动态密码提供给终端设备，包括：
将用户名和动态密码填充至终端设备提供的入网信息页面中；或者
将用户名和动态密码输出至本端页面上，并根据用户的访问请求，向用户展示本端页面，以供用户从本端页面中将用户名和动态密码复制到终端设备提供的入网信息页面中。
在一可选实施方式中，上述种子密钥由独立于本端的加密工具维护管理。基于此，上述利用与认证服务器约定的种子密钥对设备ID和当前时间步长内的时间值进行加密，以获得动态密码，包括：将设备ID和当前时间步长内的时间值发送给加密工具，以使加密工具利用种子密钥对设备ID和当前时间步长内的时间值进行加密并输出动态密码。
在一可选实施方式中，在根据终端设备的入网指令，获取终端设备的设备ID以及由设备ID加密得到的用户名之前，还可以向认证服务器进行注册。在所述注册流程中，入网管理客户端主要执行以下操作：向认证服务器发送注册请求，所述注册请求包括终端设备的硬件信息，所述硬件信息用于供认证服务器为终端设备生成设备ID；接收认证服务器下发的用户名、设备ID以及由用户名和设备ID加密后的种子密钥；将设备ID以及用户名存储在本地空间中，并将由用户名和设备ID加密后的种子密钥发送至加密工具，以供加密工具解密出种子密钥。
在一可选实施方式中，上述注册请求还包括：终端设备对应的用户信息；所述用户信息用于供认证服务器为终端设备生成用户ID。基于此，入网管理客户端还会接收认证服务器下发的用户ID。
从终端设备的角度来看，一种入网认证方法的流程如图6所示，包括以下步骤：
601、响应于入网触发操作，向入网管理客户端发送入网指令，以指示入网管理客户端为本端的终端设备提供入网所需的用户名和动态密码。
602、获取入网管理客户端提供的用户名和动态密码；用户名由终端设备的设备ID加密得到，动态密码由设备ID和当前时间步长内的时间值加密得到，设备ID是认证服务器为终端设备生成的。
603、根据用户名和动态密码，生成入网认证请求，并将入网认证请求发送给认证服务器，以供认证服务器对终端设备进行入网认证。
在一可选实施方式中，在响应入网触发操作时，还可以向用户展示一入网信息页面，以获取用户名和动态密码。基于此，上述获取入网管理客户端提供的用户名和动态密码， 包括：从所述入网信息页面中获取用户名和动态密码。其中，用户名和动态密码是由入网管理客户端填充至入网信息页面中，或者由用户从入网管理客户端的页面中复制到入网信息页面中。
从认证服务器的角度来看，一种入网认证方法的流程如图7所示，包括以下步骤：
701、接收终端设备发送的入网认证请求，入网认证请求包括用户名和动态密码。
702、按照设定的加密算法，对所述用户名进行解密。
703、根据从用户名中解密出的终端设备的设备ID，对终端设备进行可信性验证。
704、根据可信性验证结果、设备ID和入网认证请求中的动态密码，对终端设备进行合法性验证。
在一可选实施方式中，上述根据从用户名中解密出的终端设备的设备ID，对终端设备进行可信性验证，包括：当从用户名成功解密出终端设备的设备ID时，根据设备ID查找注册设备列表，注册设备列表存储有已注册设备的设备ID；从注册设备列表中查询到设备ID，查询设备状态列表，设备状态列表存储有已注册设备的状态；若从设备状态列表中查询到终端设备处于正常状态，确定终端设备通过可信性验证。
在一可选实施方式中，上述用户名中还包括：终端设备对应的用户ID。基于此，在根据设备ID对终端设备进行可信性验证之前，还可以根据用户ID和预先注册的终端设备对应的用户信息，对终端设备所属的用户进行合法性验证；当终端设备所属的用户通过合法性验证时，执行根据设备ID对终端设备进行可信性验证的操作。
在一可选实施方式中，上述根据可信性验证结果、设备ID和入网认证请求中的动态密码，对终端设备进行合法性验证，包括：当终端设备通过可信性验证时，利用与入网管理客户端约定的种子密钥分别对设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码；根据至少两个动态密码和入网认证请求中的动态密码，对终端设备进行合法性验证；其中，至少两个时间步长包括当前时间步长以及与当前时间步长相距最近的至少一个历史时间步长。
在一可选实施方式中，上述在利用与入网管理客户端约定的种子密钥分别对设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以获得至少两个动态密码之前，还可以根据设备ID判断已认证设备的映射数据中是否存在终端设备上次认证通过所使用的动态密码；若判断结果为存在，根据终端设备上次认证通过所使用的动态密码和入网认证请求中的动态密码，对终端设备进行合法性验证；若判断结果为不存在，执行 利用与入网管理客户端约定的种子密钥分别对设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码的操作。
在一可选实施方式中，上述在接收终端设备发送的入网认证请求之前，还包括一注册流程。在所述注册流程中，认证服务器主要执行以下操作：接收入网管理客户端发送的注册请求，所述注册请求携带有终端设备的硬件信息；根据所述注册请求中的硬件信息为终端设备生成设备ID；对所述设备ID进行加密，以生成用户名；利用用户名和设备ID对种子密钥进行加密，以获得加密后的种子密钥；将用户名、设备ID以及加密后的种子密钥发送给入网管理客户端。
需要说明的是，上述实施例所提供方法的各步骤的执行主体均可以是同一设备，或者，该方法也由不同设备作为执行主体。比如，步骤501至步骤503的执行主体可以为设备A；又比如，步骤501和502的执行主体可以为设备A，步骤503的执行主体可以为设备B；等等。
图8a为本申请又一实施例提供的入网管理装置的结构示意图。该入网管理装置可作为前述的入网管理客户端实现。如图8a所示，所述入网管理装置包括：获取模块81、加密模块82和提供模块83。
获取模块81，用于根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的。
加密模块82，用于利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码。
提供模块83，用于将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
在一可选实施方式中，提供模块83具体用于：将所述用户名和所述动态密码填充至所述终端设备提供的入网信息页面中；或者，将所述用户名和所述动态密码输出至本端页面上，并根据用户的访问请求，向所述用户展示所述本端页面，以供所述用户从所述本端页面中将所述用户名和所述动态密码复制到所述终端设备提供的入网信息页面中。
在一可选实施方式中，种子密钥由独立于本端的加密工具维护管理。基于此，加密模块82具体用于：将所述设备ID和当前时间步长内的时间值发送给所述加密工具，以使所述加密工具利用所述种子密钥对所述设备ID和当前时间步长内的时间值进行加密并输出所述动态密码。
在一可选实施方式中，入网管理装置还包括：发送模块、接收模块和存储模块。
发送模块，向所述认证服务器发送注册请求，所述注册请求包括所述终端设备的硬件信息，所述硬件信息用于供所述认证服务器为所述终端设备生成所述设备ID。
接收模块，用于接收所述认证服务器下发的所述用户名、所述设备ID以及由所述用户名和所述设备ID加密后的种子密钥。
存储模块，用于将所述设备ID以及所述用户名存储在本地空间中，并将由所述用户名和所述设备ID加密后的种子密钥发送至所述加密工具，以供所述加密工具解密出所述种子密钥。
在一可选实施方式中，所述注册请求还包括：所述终端设备对应的用户信息；所述用户信息用于供所述认证服务器为所述终端设备生成用户ID。
以上描述了入网管理装置的内部功能和结构，如图8b所示，实际中，该入网管理装置可实现为电子设备，包括：存储器84以及处理器85。
存储器84，可被配置为存储其它各种数据以支持在电子设备上的操作。这些数据的示例包括用于在电子设备上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。
存储器84可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
处理器85与存储器84耦合，用于执行存储器84中的程序，以用于：
根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的；
利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码；
将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
其中，处理器85在执行存储器84中的程序时，除了上面的功能之外，还可实现其它功能，具体可参见前面各实施例中与入网管理客户端相关的描述。
进一步，如图8b所示，电子设备还包括：通信组件86、显示器87、电源组件88、音频组件89等其它组件。图8b中仅示意性给出部分组件，并不意味着电子设备只包括图8b所示组件。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，所述计算机程序被计算机执行时能够实现上述各实施例中与入网管理客户端相关的方法步骤或功能。
图9a为本申请又一实施例提供的入网认证装置的结构示意图。该入网认证装置可位于需要入网认证的终端设备的内部实现。如图9a所示，所述入网认证装置包括：发送模块91、获取模块92和生成模块93。
发送模块91，用于响应于入网触发操作，向入网管理客户端发送入网指令，以指示所述入网管理客户端为本端的终端设备提供入网所需的用户名和动态密码。
获取模块92，用于获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的。
生成模块93，用于根据所述用户名和所述动态密码，生成入网认证请求。
所述发送模块91，还用于将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证。
在一可选实施方式中，入网认证装置还包括：显示模块，用于在响应入网触发操作时，展示入网信息页面，以获取入网认证所需的用户名和动态密码。基于此，获取模块92具体用于：从所述入网信息页面中获取所述用户名和所述动态密码；其中，所述用户名和所述动态密码是由所述入网管理客户端填充至所述入网信息页面中，或者由所述用户从所述入网管理客户端的页面中复制到所述入网信息页面中。
以上描述了入网认证装置的内部功能和结构，如图9b所示，实际中，该入网认证装置可实现为终端设备，包括：存储器95、处理器96以及通信组件97。
存储器95，可被配置为存储其它各种数据以支持在终端设备上的操作。这些数据的示例包括用于在终端设备上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。
存储器95可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
处理器96与存储器95耦合，用于执行存储器95中的程序，以用于：
响应于入网触发操作，控制通信组件97向入网管理客户端发送入网指令，以指示所述入网管理客户端为所述终端设备提供入网所需的用户名和动态密码；
获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的；
根据所述用户名和所述动态密码，生成入网认证请求，并控制通信组件97将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证。
通信组件，用于向所述入网管理客户端发送所述入网指令，并将所述入网认证请求发送给所述认证服务器。
其中，处理器96在执行存储器95中的程序时，除了上面功能之外，还可实现其它功能，具体可参见前面各实施例中与终端设备相关的描述。
进一步，如图9b所示，终端设备还包括：显示器98、电源组件99、音频组件90等其它组件。图9b中仅示意性给出部分组件，并不意味着终端设备只包括图9b所示组件。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，所述计算机程序被计算机执行时能够实现上述各实施例中与终端设备相关的方法步骤或功能。
图10a为本申请又一实施例提供的入网认证装置的结构示意图。该入网认证装置可位于认证服务器内部实现。如图10a所示，所述入网认证装置包括：接收模块1001、解密模块1002和验证模块1003。
接收模块1001，用于接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码；
解密模块1002，用于按照设定的解密算法，对所述用户名进行解密。
验证模块1003，用于根据解密模块1002从用户名中解密出的所述终端设备的设备ID时，对所述终端设备进行可信性验证。
验证模块1003，还用于根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
在一可选实施方式中，验证模块1003对所述终端设备进行可信性验证时，具体用于：当从用户名中成功解密出终端设备的设备ID时，根据所述设备ID查找注册设备列表，所述注册设备列表存储有已注册设备的设备ID；若从所述注册设备列表中查询到所述设 备ID，查询设备状态列表，所述设备状态列表存储有已注册设备的状态；若从所述设备状态列表中查询到所述终端设备处于正常状态，确定所述终端设备通过可信性验证。
在一可选实施方式中，验证模块1003还用于：根据所述用户ID和预先注册的所述终端设备对应的用户信息，对所述终端设备所属的用户进行身份验证；当所述终端设备所属的用户通过身份验证时，执行根据所述设备ID对所述终端设备进行可信性验证的操作。
在一可选实施方式中，验证模块1003对所述终端设备进行合法性验证时，具体用于：当终端设备通过可信性验证时，利用与入网管理客户端约定的种子密钥分别对所述设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码；根据所述至少两个动态密码和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证；其中，所述至少两个时间步长包括当前时间步长以及与当前时间步长相距最近的至少一个历史时间步长。
在一可选实施方式中，验证模块1003还用于：根据所述设备ID判断已认证设备的映射数据中是否存在所述终端设备上次认证通过所使用的动态密码；若判断结果为存在，根据所述终端设备上次认证通过所使用的动态密码和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证；若判断结果为不存在，执行利用与入网管理客户端约定的种子密钥分别对所述设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码的操作。
在一可选实施方式中，入网认证装置还包括：生成模块、加密模块和发送模块。
接收模块1001，还用于接收入网管理客户端发送的注册请求，所述注册请求携带有所述终端设备的硬件信息。
生成模块，用于根据所述硬件信息为所述终端设备生成所述设备ID。
加密模块，用于对所述设备ID进行加密，生成所述用户名，并利用所述用户名和所述设备ID对种子密钥进行加密，以获得加密后的种子密钥。
发送模块，用于将所述用户名、所述设备ID以及所述加密后的种子密钥发送给所述入网管理客户端。
以上描述了入网认证装置的内部功能和结构，如图10b所示，实际中，该入网认证装置可实现为认证服务器，包括：存储器1004、处理器1005以及通信组件1006。
存储器1004，可被配置为存储其它各种数据以支持在认证服务器上的操作。这些数据的示例包括用于在认证服务器上操作的任何应用程序或方法的指令，联系人数据，电 话簿数据，消息，图片，视频等。
存储器1004可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
通信组件1006，用于接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码。
处理器1005与存储器1004耦合，用于执行存储器1004中的程序，以用于：
按照设定的解密算法，对所述用户名进行解密；
根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证；
根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
其中，处理器1005在执行存储器1004中的程序时，除了上面功能之外，还可实现其它功能，具体可参见前面各实施例中与认证服务器相关的描述。
进一步，如图10b所示，认证服务器还包括：显示器1007、电源组件1008、音频组件1009等其它组件。图10b中仅示意性给出部分组件，并不意味着认证服务器只包括图10b所示组件。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，所述计算机程序被计算机执行时能够实现上述各实施例中与认证服务器相关的方法步骤或功能。
在图8b、图9b和图10b中的通信组件，可被配置为便于通信组件所属设备和其他设备之间有线或无线方式的通信。通信组件所属设备可以接入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合。在一个示例性实施例中，通信组件经由广播信道接收来自外部广播管理***的广播信号或广播相关信息。在一个示例性实施例中，所述通信组件还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
在图8b、图9b和图10b中的显示器，可以包括屏幕，其屏幕可以包括液晶显示器 (LCD)和触摸面板(TP)。如果屏幕包括触摸面板，屏幕可以被实现为触摸屏，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。所述触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与所述触摸或滑动操作相关的持续时间和压力。
在图8b、图9b和图10b中的电源组件，为电源组件所属设备的各种组件提供电力。电源组件可以包括电源管理***，一个或多个电源，及其他与为电源组件所属设备生成、管理和分配电力相关联的组件。
在图8b、图9b和图10b中的音频组件，被配置为输出和/或输入音频信号。例如，音频组件包括一个麦克风(MIC)，当音频组件所属设备处于操作模式，如呼叫模式、记录模式和语音识别模式时，麦克风被配置为接收外部音频信号。所接收的音频信号可以被进一步存储在存储器或经由通信组件发送。在一些实施例中，音频组件还包括一个扬声器，用于输出音频信号。
本领域内的技术人员应明白，本发明的实施例可提供为方法、***、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或 其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (19)

  1. 一种入网认证方法，其特征在于，包括：
    根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的；
    利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码；
    将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
  2. 根据权利要求1所述的方法，其特征在于，所述将所述用户名和所述动态密码提供给所述终端设备，包括：
    将所述用户名和所述动态密码填充至所述终端设备提供的入网信息页面中；或者
    将所述用户名和所述动态密码输出至本端页面上，并根据用户的访问请求，向所述用户展示所述本端页面，以供所述用户从所述本端页面中将所述用户名和所述动态密码复制到所述终端设备提供的入网信息页面中。
  3. 根据权利要求1或2所述的方法，其特征在于，所述种子密钥由独立的加密工具维护管理；
    所述利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码，包括：
    将所述设备ID和当前时间步长内的时间值发送给所述加密工具，以使所述加密工具利用所述种子密钥对所述设备ID和当前时间步长内的时间值进行加密并输出所述动态密码。
  4. 根据权利要求3所述的方法，其特征在于，在根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名之前，所述方法还包括：
    向所述认证服务器发送注册请求，所述注册请求包括所述终端设备的硬件信息，所述硬件信息用于供所述认证服务器为所述终端设备生成所述设备ID；
    接收所述认证服务器下发的所述用户名、所述设备ID以及由所述用户名和所述设备ID加密后的种子密钥；
    将所述设备ID以及所述用户名存储在本地空间中，并将由所述用户名和所述设备ID加密后的种子密钥发送至所述加密工具，以供所述加密工具解密出所述种子密钥。
  5. 根据权利要求4所述的方法，其特征在于，所述注册请求还包括：所述终端设备 对应的用户信息；所述用户信息用于供所述认证服务器为所述终端设备生成用户ID。
  6. 一种入网认证方法，其特征在于，包括：
    响应于入网触发操作，向入网管理客户端发送入网指令，以指示所述入网管理客户端为本端的终端设备提供入网所需的用户名和动态密码；
    获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的；
    根据所述用户名和所述动态密码，生成入网认证请求，并将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证。
  7. 根据权利要求6所述的方法，其特征在于，还包括：
    在响应于所述入网触发操作时，展示一入网信息页面，以获取所述用户名和所述动态密码；
    所述获取所述入网管理客户端提供的所述用户名和所述动态密码，包括：
    从所述入网信息页面中获取所述用户名和所述动态密码；
    其中，所述用户名和所述动态密码是由所述入网管理客户端填充至所述入网信息页面中，或者由所述用户从所述入网管理客户端的页面中复制到所述入网信息页面中。
  8. 一种入网认证方法，其特征在于，包括：
    接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码；
    按照设定的解密算法，对所述用户名进行解密；
    根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证；
    根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
  9. 根据权利要求8所述的方法，其特征在于，所述根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证，包括：
    当从所述用户名中成功解密出所述设备ID时，根据所述设备ID查找注册设备列表，所述注册设备列表存储有已注册设备的设备ID；
    若从所述注册设备列表中查询到所述设备ID，查询设备状态列表，所述设备状态列表存储有已注册设备的状态；
    若从所述设备状态列表中查询到所述终端设备处于正常状态，确定所述终端设备通 过可信性验证。
  10. 根据权利要求8所述的方法，其特征在于，所述用户名中还包括：所述终端设备对应的用户ID；
    在根据从所述用户名中解密出的所述终端设备的设备ID，对所述终端设备进行可信性验证之前，所述方法还包括：
    根据所述用户ID和预先注册的所述终端设备对应的用户信息，对所述终端设备所属的用户进行身份验证；
    当所述终端设备所属的用户通过身份验证时，执行根据所述设备ID对所述终端设备进行可信性验证的操作。
  11. 根据权利要求8所述的方法，其特征在于，所述根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证，包括：
    当所述终端设备通过可信性验证时，利用与入网管理客户端约定的种子密钥分别对所述设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码；
    根据所述至少两个动态密码和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证；
    其中，所述至少两个时间步长包括当前时间步长以及与当前时间步长相距最近的至少一个历史时间步长。
  12. 根据权利要求11所述的方法，其特征在于，在利用与入网管理客户端约定的种子密钥分别对所述设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以获得至少两个动态密码之前，所述方法还包括：
    根据所述设备ID判断已认证设备的映射数据中是否存在所述终端设备上次认证通过所使用的动态密码；
    若判断结果为存在，根据所述终端设备上次认证通过所使用的动态密码和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证；
    若判断结果为不存在，执行利用与入网管理客户端约定的种子密钥分别对所述设备ID和至少两个时间步长中每个时间步长内的时间值进行加密，以生成至少两个动态密码的操作。
  13. 根据权利要求8所述的方法，其特征在于，在接收终端设备发送的入网认证请求之前，所述方法还包括：
    接收入网管理客户端发送的注册请求，所述注册请求携带有所述终端设备的硬件信息；
    根据所述硬件信息为所述终端设备生成所述设备ID；
    对所述设备ID进行加密，生成所述用户名；
    利用所述用户名和所述设备ID对种子密钥进行加密，以获得加密后的种子密钥；
    将所述用户名、所述设备ID以及所述加密后的种子密钥发送给所述入网管理客户端。
  14. 一种电子设备，其特征在于，包括：存储器以及处理器；
    所述存储器，用于存储程序；
    所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
    根据终端设备的入网指令，获取所述终端设备的设备ID以及由所述设备ID加密得到的用户名，所述设备ID是认证服务器为所述终端设备生成的；
    利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得动态密码；
    将所述用户名和所述动态密码提供给所述终端设备，以供所述终端设备生成入网认证请求并发往所述认证服务器进行入网认证。
  15. 一种终端设备，其特征在于，包括：存储器、处理器以及通信组件；
    所述存储器，用于存储程序；
    所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
    响应于入网触发操作，控制所述通信组件向入网管理客户端发送入网指令，以指示所述入网管理客户端为所述终端设备提供入网所需的用户名和动态密码；
    获取所述入网管理客户端提供的所述用户名和所述动态密码；所述用户名由所述终端设备的设备ID加密得到，所述动态密码由所述设备ID和当前时间步长内的时间值加密得到，所述设备ID是认证服务器为所述终端设备生成的；
    根据所述用户名和所述动态密码，生成入网认证请求，并控制所述通信组件将所述入网认证请求发送给所述认证服务器，以供所述认证服务器对所述终端设备进行入网认证；
    所述通信组件，用于向所述入网管理客户端发送所述入网指令，并将所述入网认证请求发送给所述认证服务器。
  16. 一种认证服务器，其特征在于，存储器、通信组件以及处理器；
    所述存储器，用于存储程序；
    所述通信组件，用于接收终端设备发送的入网认证请求，所述入网认证请求包括用户名和动态密码；
    所述处理器，与所述存储器耦合，用于执行所述存储器中的所述程序，以用于：
    按照设定的解密算法，对所述用户名进行解密；
    根据从所述用户名中解密出所述终端设备的设备ID，对所述终端设备进行可信性验证；
    根据可信性验证结果、所述设备ID和所述入网认证请求中的动态密码，对所述终端设备进行合法性验证。
  17. 一种认证***，其特征在于，包括：终端设备、入网管理客户端以及认证服务器；
    所述终端设备，用于响应于入网触发操作，向所述入网管理客户端发送入网指令；获取所述入网管理客户端提供的用户名和动态密码；以及根据所述用户名和所述动态密码，生成入网认证请求，并将所述入网认证请求发送给所述认证服务器；
    所述入网管理客户端，用于根据所述入网指令，获取所述设备ID以及所述用户名；利用与所述认证服务器约定的种子密钥对所述设备ID和当前时间步长内的时间值进行加密，以获得所述动态密码；以及将所述用户名和所述动态密码提供给所述终端设备；所述用户名由所述设备ID加密得到的；
    所述认证服务器，用于接收所述入网认证请求，所述入网认证请求包括所述用户名和所述动态密码；根据从所述用户名中解密出的所述设备ID，对所述终端设备进行可信性验证；以及根据可信性验证结果、所述设备ID和所述动态密码，对所述终端设备进行合法性验证。
  18. 根据权利要求17所述的***，其特征在于，所述入网管理客户端安装于所述终端设备上。
  19. 根据权利要求17或18所述的***，其特征在于，还包括：NAS设备和Radius服务器；所述终端设备通过所述NAS设备与所述Radius服务器连接，所述Radius服务器与所述认证服务器连接。
PCT/CN2018/094933 2017-07-20 2018-07-09 入网认证方法、装置及*** WO2019015500A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/632,316 US11616775B2 (en) 2017-07-20 2018-07-09 Network access authentication method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710595977.6 2017-07-20
CN201710595977.6A CN109286932B (zh) 2017-07-20 2017-07-20 入网认证方法、装置及***

Publications (1)

Publication Number Publication Date
WO2019015500A1 true WO2019015500A1 (zh) 2019-01-24

Family

ID=65016512

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/094933 WO2019015500A1 (zh) 2017-07-20 2018-07-09 入网认证方法、装置及***

Country Status (4)

Country Link
US (1) US11616775B2 (zh)
CN (1) CN109286932B (zh)
TW (1) TWI756439B (zh)
WO (1) WO2019015500A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113114623A (zh) * 2021-03-12 2021-07-13 深圳市广和通无线股份有限公司 数据连接方法、装置、终端设备和计算机可读存储介质
CN113285949A (zh) * 2021-05-21 2021-08-20 新华三大数据技术有限公司 一种外网访问控制方法、装置、设备及存储介质
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN114866265A (zh) * 2021-01-20 2022-08-05 晶晨半导体(上海)股份有限公司 网络连接方法、路由器、管理员终端设备以及通信设备
US11616775B2 (en) 2017-07-20 2023-03-28 Alibaba Group Holding Limited Network access authentication method, apparatus, and system

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7338386B2 (ja) * 2019-10-04 2023-09-05 富士フイルムビジネスイノベーション株式会社 情報処理装置、情報処理システム及びプログラム
CN110784317B (zh) 2019-10-30 2022-09-13 京东方科技集团股份有限公司 一种数据加密的交互方法、装置及***
CN111343289B (zh) * 2020-05-22 2020-09-25 苏宁智能终端有限公司 基于mqtt协议的消息推送方法及***
CN112492602B (zh) * 2020-11-19 2023-08-01 武汉武钢绿色城市技术发展有限公司 5g终端安全接入装置、***及设备
CN112512047B (zh) * 2020-11-19 2022-06-10 四川省肿瘤医院 一种无线网络安全认证的检测方法
CN112533203A (zh) * 2020-11-20 2021-03-19 深圳市元征科技股份有限公司 基于Zigbee的入网方法及相关装置
TWI747645B (zh) * 2020-12-07 2021-11-21 中華電信股份有限公司 用戶駐地裝置的服務供裝伺服器和服務供裝方法
EP4260545A1 (en) * 2020-12-09 2023-10-18 Sony Group Corporation Broker device, publisher device, subscriber device, publisher-subscriber system, publisher-subscriber method
CN112637157A (zh) * 2020-12-14 2021-04-09 国网电动汽车服务有限公司 一种可信的换电设备接入方法
CN113873511A (zh) * 2021-07-16 2021-12-31 天翼智慧家庭科技有限公司 一种基于远程验证的Zigbee安全入网方法和***
CN113727345A (zh) * 2021-08-30 2021-11-30 展讯半导体(成都)有限公司 无线网络连接访问控制方法、装置、存储介质及终端
CN113949535B (zh) * 2021-09-18 2024-03-29 陈德周 一种基于区块链的联网设备监管认证方法及***
CN114138365B (zh) * 2021-11-30 2024-02-23 深信服科技股份有限公司 一种认证方法、装置、电子设备及存储介质
US20230198990A1 (en) * 2021-12-16 2023-06-22 Cisco Technology, Inc. Group identity assignment and policy enforcement for devices within the same network
WO2023225824A1 (zh) * 2022-05-23 2023-11-30 北京小米移动软件有限公司 设备入网的方法、装置、存储介质及电子设备
CN115150143B (zh) * 2022-06-24 2024-03-12 国家石油天然气管网集团有限公司 工控设备入网认证方法、装置、设备和存储介质
CN116389032B (zh) * 2022-12-29 2023-12-08 国网甘肃省电力公司庆阳供电公司 一种基于sdn架构的电力信息传输链路身份验证方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1694555A (zh) * 2005-05-24 2005-11-09 北京易诚世纪科技有限公司 一种基于移动通信终端的动态密码***及方法
CN102378175A (zh) * 2011-10-08 2012-03-14 华为终端有限公司 一种无线局域网络认证方法及移动终端
CN104539785A (zh) * 2014-08-22 2015-04-22 南京速帕信息科技有限公司 一键放行的手机令牌的实现方法

Family Cites Families (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100452072C (zh) 1995-02-13 2009-01-14 英特特拉斯特技术公司 用于管理在第一装置和第二装置之间的数字文档的分布的方法
EP2278545A3 (en) * 2002-05-29 2011-04-13 Sony Corporation Information processing system
US7360096B2 (en) * 2002-11-20 2008-04-15 Microsoft Corporation Securely processing client credentials used for Web-based access to resources
US7454785B2 (en) 2002-12-19 2008-11-18 Avocent Huntsville Corporation Proxy method and system for secure wireless administration of managed entities
JP2004342088A (ja) 2003-04-21 2004-12-02 Sony Corp 端末機器認証システム、端末機器、第１の振り分けサーバ、振り分けシステム、サービスサーバ、第２の振り分けサーバ、端末機器方法、第１の振り分け方法、振り分け方法、サービス提供方法、サービスサーバ方法、第１の振り分け方法、第２の振り分け方法、端末機器プログラム、第１の振り分けプログラム、振り分けプログラム、サービスサーバプログラム、第２の振り分けプログラム、及び記憶媒体
JP4240297B2 (ja) 2003-04-21 2009-03-18 ソニー株式会社 端末機器、認証端末プログラム、機器認証サーバ、機器認証プログラム
US20070186115A1 (en) 2005-10-20 2007-08-09 Beijing Watch Data System Co., Ltd. Dynamic Password Authentication System and Method thereof
US20070220594A1 (en) 2006-03-04 2007-09-20 Tulsyan Surendra K Software based Dynamic Key Generator for Multifactor Authentication
US20090097459A1 (en) * 2007-10-15 2009-04-16 Sony Ericsson Mobile Communications Ab Method for wan access to home network using one time-password
US9112909B2 (en) 2008-02-13 2015-08-18 Futurewei Technologies, Inc. User and device authentication in broadband networks
US8484705B2 (en) 2008-04-25 2013-07-09 Hewlett-Packard Development Company, L.P. System and method for installing authentication credentials on a remote network device
US9218469B2 (en) 2008-04-25 2015-12-22 Hewlett Packard Enterprise Development Lp System and method for installing authentication credentials on a network device
CN101500232A (zh) * 2009-03-13 2009-08-05 北京华大智宝电子***有限公司 实现动态身份认证的方法及***
US9084071B2 (en) * 2009-09-10 2015-07-14 Michael-Anthony Lisboa Simple mobile registration mechanism enabling automatic registration via mobile devices
US8984588B2 (en) 2010-02-19 2015-03-17 Nokia Corporation Method and apparatus for identity federation gateway
US20110219427A1 (en) 2010-03-04 2011-09-08 RSSBus, Inc. Smart Device User Authentication
US8627424B1 (en) 2010-06-30 2014-01-07 Emc Corporation Device bound OTP generation
US20120323717A1 (en) 2011-06-16 2012-12-20 OneID, Inc. Method and system for determining authentication levels in transactions
US9292670B2 (en) * 2012-02-29 2016-03-22 Infosys Limited Systems and methods for generating and authenticating one time dynamic password based on context information
US20130262873A1 (en) 2012-03-30 2013-10-03 Cgi Federal Inc. Method and system for authenticating remote users
US9641521B2 (en) 2012-09-14 2017-05-02 Iovation Llc Systems and methods for network connected authentication
US9124433B2 (en) * 2012-12-28 2015-09-01 Vasco Data Security, Inc. Remote authentication and transaction signatures
US9143492B2 (en) * 2013-03-15 2015-09-22 Fortinet, Inc. Soft token system
WO2015061977A1 (en) 2013-10-30 2015-05-07 Hewlett-Packard Development Company, L.P. User authentication
WO2015130700A1 (en) 2014-02-26 2015-09-03 Secureauth Corporation Security object creation, validation, and assertion for single sign on authentication
US9378345B2 (en) 2014-04-29 2016-06-28 Bank Of America Corporation Authentication using device ID
CN105099690A (zh) * 2014-05-19 2015-11-25 江苏博智软件科技有限公司 一种移动云计算环境下基于otp和用户行为的认证授权方法
US9894520B2 (en) * 2014-09-24 2018-02-13 Fortinet, Inc. Cache-based wireless client authentication
US20160149894A1 (en) 2014-11-25 2016-05-26 Appright, Inc. System and method for providing multi factor authentication
TWI573083B (zh) * 2015-06-12 2017-03-01 蓋特資訊系統股份有限公司 有效期的個人交易碼產生方法、認證方法與其系統
US9594922B1 (en) * 2015-06-30 2017-03-14 EMC IP Holding Company LLC Non-persistent shared authentication tokens in a cluster of nodes
CN106341372A (zh) * 2015-07-08 2017-01-18 阿里巴巴集团控股有限公司 终端的认证处理、认证方法及装置、***
US10171439B2 (en) 2015-09-24 2019-01-01 International Business Machines Corporation Owner based device authentication and authorization for network access
US10785219B1 (en) * 2015-11-16 2020-09-22 EMC IP Holding Company LLC Methods, systems, and computer readable mediums for securely establishing credential data for a computing device
CN106888455B (zh) * 2016-08-15 2020-12-15 创新先进技术有限公司 一种无线局域网接入认证方法、装置及***
CN106789883A (zh) * 2016-11-21 2017-05-31 美的智慧家居科技有限公司 连接服务器的方法和装置
US10404628B2 (en) * 2017-03-02 2019-09-03 Verizon Patent And Licensing Inc. Systems and methods for providing requested user information to a validated user
US10341864B2 (en) * 2017-03-03 2019-07-02 Verizon Patent And Licensing Inc. Network-based device registration for content distribution platforms
US20180278607A1 (en) * 2017-03-22 2018-09-27 Amazon Technologies, Inc. Device Credentials Management
US10158982B2 (en) * 2017-04-25 2018-12-18 Vmware, Inc. Message-based management service enrollment
US20180330368A1 (en) * 2017-05-11 2018-11-15 Circle Media Labs Inc. Secure authenticated passwordless communications between networked devices
CN109286932B (zh) 2017-07-20 2021-10-19 阿里巴巴集团控股有限公司 入网认证方法、装置及***

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1694555A (zh) * 2005-05-24 2005-11-09 北京易诚世纪科技有限公司 一种基于移动通信终端的动态密码***及方法
CN102378175A (zh) * 2011-10-08 2012-03-14 华为终端有限公司 一种无线局域网络认证方法及移动终端
CN104539785A (zh) * 2014-08-22 2015-04-22 南京速帕信息科技有限公司 一键放行的手机令牌的实现方法

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11616775B2 (en) 2017-07-20 2023-03-28 Alibaba Group Holding Limited Network access authentication method, apparatus, and system
CN114866265A (zh) * 2021-01-20 2022-08-05 晶晨半导体(上海)股份有限公司 网络连接方法、路由器、管理员终端设备以及通信设备
CN114866265B (zh) * 2021-01-20 2024-04-19 晶晨半导体(上海)股份有限公司 网络连接方法、路由器、管理员终端设备以及通信设备
CN113114623A (zh) * 2021-03-12 2021-07-13 深圳市广和通无线股份有限公司 数据连接方法、装置、终端设备和计算机可读存储介质
CN113285949A (zh) * 2021-05-21 2021-08-20 新华三大数据技术有限公司 一种外网访问控制方法、装置、设备及存储介质
CN113285949B (zh) * 2021-05-21 2022-03-25 新华三大数据技术有限公司 一种外网访问控制方法、装置、设备及存储介质
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN113746864B (zh) * 2021-09-22 2023-06-23 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质

Also Published As

Publication number Publication date
TW201909614A (zh) 2019-03-01
US20200169548A1 (en) 2020-05-28
US11616775B2 (en) 2023-03-28
CN109286932B (zh) 2021-10-19
TWI756439B (zh) 2022-03-01
CN109286932A (zh) 2019-01-29

Similar Documents

Publication Publication Date Title
TWI756439B (zh) 入網認證方法、裝置及系統
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
US8532620B2 (en) Trusted mobile device based security
EP1577736B1 (en) Efficient and secure authentication of computing systems
US8327143B2 (en) Techniques to provide access point authentication for wireless network
EP3114794B1 (en) Wireless device authentication and service access
AU2015298224B2 (en) Apparatus and method for sharing a hardware security module interface in a collaborative network
US20160269176A1 (en) Key Configuration Method, System, and Apparatus
WO2016177052A1 (zh) 一种用户认证方法和装置
US20130332724A1 (en) User-Space Enabled Virtual Private Network
WO2019062666A1 (zh) 一种实现安全访问内部网络的***、方法和装置
US20120265996A1 (en) Permitting Access To A Network
WO2016106560A1 (zh) 一种实现远程接入的方法、装置及***
US20160014112A1 (en) Wireless communication of a user identifier and encrypted time-sensitive data
WO2022111187A1 (zh) 终端认证方法、装置、计算机设备及存储介质
WO2019056957A1 (zh) 数据处理、身份认证方法及***、终端
US8397281B2 (en) Service assisted secret provisioning
US20180375648A1 (en) Systems and methods for data encryption for cloud services
US20180357411A1 (en) Authentication Of A Device
KR102171377B1 (ko) 로그인 제어 방법
JP2024501326A (ja) アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード
US11611541B2 (en) Secure method to replicate on-premise secrets in a cloud environment
TW202215813A (zh) 用於加密通訊的電子裝置及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18834719

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18834719

Country of ref document: EP

Kind code of ref document: A1