WO2019113838A1 - 一种智能终端认证管理的方法 - Google Patents

一种智能终端认证管理的方法 Download PDF

Info

Publication number
WO2019113838A1
WO2019113838A1 PCT/CN2017/115936 CN2017115936W WO2019113838A1 WO 2019113838 A1 WO2019113838 A1 WO 2019113838A1 CN 2017115936 W CN2017115936 W CN 2017115936W WO 2019113838 A1 WO2019113838 A1 WO 2019113838A1
Authority
WO
WIPO (PCT)
Prior art keywords
manufacturer
authentication
signature
smart terminal
information
Prior art date
Application number
PCT/CN2017/115936
Other languages
English (en)
French (fr)
Inventor
裘炅
马哲雄
Original Assignee
杭州全视软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州全视软件有限公司 filed Critical 杭州全视软件有限公司
Priority to PCT/CN2017/115936 priority Critical patent/WO2019113838A1/zh
Publication of WO2019113838A1 publication Critical patent/WO2019113838A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the invention relates to the field of anti-counterfeiting technology for product anti-counterfeiting and product application process, and particularly relates to an authentication anti-counterfeiting method based on blockchain technology.
  • equipment certification mainly passes: labels (including RFID and other electronic labels), online authentication, and encrypted database authentication.
  • Non-standard use It is impossible to identify counterfeit or counterfeit goods, and the identification of different models (including software versions) from different manufacturers or manufacturers.
  • Limited storage of smart devices For example, video face recognition, the current basic storage is about one month.
  • the blockchain technology can realize the storage of notarization level, which can avoid the storage period of one month, which makes it difficult to trace the problem of forensics.
  • Intelligent devices can be used for a variety of purposes, and can be used for identification learning of different features.
  • the learning effects after deep learning training also require authentication, and the relevant IQ or learning ability can be evaluated to confirm that it can be used in different scenarios.
  • the object of the present invention is to provide a method for intelligent terminal authentication management in view of the deficiencies of the prior art.
  • a method for intelligent terminal authentication management comprising:
  • the content of the device label is as follows: the manufacturer generates the manufacturer summary for the relevant authentication information, and the manufacturer abstracts the manufacturer signature with the manufacturer key MKpri, and then the relevant authentication information + manufacturer summary + manufacturer signature generation device.
  • the device summary is encrypted with the device key EKpri to generate the device signature, and the related authentication information + manufacturer summary + manufacturer signature + device summary + device signature constitutes the device tag.
  • the relevant authentication information is the identifier information of the smart terminal.
  • the authentication method is as follows:
  • the smart terminal summarizes the process data generation process, and the process summary is encrypted by the device key EKpri to generate a process signature, and the process data + process summary + process signature constitutes a process tag.
  • the process data public key is obtained, and the process data of the intelligent terminal is obtained by the decryption process signature.
  • the device tag further includes using update authentication information.
  • the device tag further includes a technical intelligence item of the smart terminal.
  • the device label further includes a transaction condition of the smart terminal, and before obtaining the process data or the technical intelligence item of the smart terminal, obtaining the transaction condition and agreeing to the transaction condition to obtain the process data or the technical intelligence item of the intelligent terminal. Wait.
  • the authentication is implemented based on a blockchain, where the plaintext device summary and the plaintext manufacturer summary are stored, and the node of the blockchain first accesses the intelligent terminal to obtain the device public key, and obtains the original device by decryption. Abstract, and the existing plaintext device summary is verified. If the error is correct, the manufacturer's public key is obtained from the manufacturer's remote interface. The original manufacturer's abstract is obtained through decryption, and the existing plaintext manufacturer's abstract is verified, and the authentication is verified.
  • the device is authenticated once, that is, an authentication information including an authentication time is generated and stored in the blockchain.
  • the authentication node acquires the process data or the technical intelligence item of the smart terminal, and is packaged and stored in the blockchain.
  • the device label further includes a transaction condition of the smart terminal, and before obtaining the process data or the technical intelligence item of the smart terminal, obtaining the transaction condition and agreeing to the transaction condition to obtain the process data or the technical intelligence item of the intelligent terminal. Wait. When the user agrees or rejects the transaction condition, the transaction information is generated and saved in the blockchain.
  • the invention has the beneficial effects of fully authenticating the source, process, application result, intelligent model, etc. of the smart terminal, or adopting blockchain authentication, thereby realizing the intelligent terminal and other external parties (including devices, software, users, etc.)
  • the credibility of the transaction also enhances the reliability of automated trading.
  • Figure 1 is a schematic diagram of generating a manufacturer summary using the SHA 256 method
  • Figure 2 is a schematic diagram of generating a device digest in SHA 256 mode.
  • the related authentication information of the present invention is the identifier information of the smart terminal, and includes verification information such as a product model number, a serial number, an authentication information, a date of manufacture, and the like, and may also include a photo of the smart terminal.
  • the process data of the present invention is data generated during the working process of the intelligent terminal, such as collected data (image information collected by the camera, sound information collected by the recording device), data processing process, processing result, etc., and corresponding time information ,location information.
  • the use update update information according to the present invention includes built-in software version upgrade, maintenance, maintenance, detection information, and the like.
  • the technical intelligence item according to the present invention is a technical feature included in the smart terminal itself.
  • the deep learning mechanism information of the intelligent terminal includes training mechanism information and test mechanism information, and the training mechanism information includes training data, learning level, corresponding training parameters, feature value sets, results, and related data changes before and after learning;
  • Test mechanism information includes relevant test samples, results, and accurate values.
  • a patented camera the patent is a technical intelligence project.
  • the trading conditions described herein can be a price.
  • fire-fighting facilities mainly use anti-counterfeit labels or various certifications (such as China's CCCF certification, US UL certification, etc.).
  • the blockchain interface module is added to the device, and the interface module is integrated with the original circuit system, and is used for collecting required data (such as water pressure and water flow speed of the fire water system) from the original device, and realizing the Internet of Things interface.
  • required data such as water pressure and water flow speed of the fire water system
  • EKpub, EKpri an asymmetric key pair EK
  • MKpub MKpri
  • the manufacturer's own MK will be related to the authentication information (including the product model, serial number, authentication information, date of manufacture, etc., and may include photos, etc.).
  • the manufacturer abstracts the manufacturer's signature with the manufacturer key MKpri encryption, and then the relevant certification information + manufacturer summary + manufacturer signature + use update certification information (including the built-in software version upgrade, maintenance) , maintenance, detection information, etc.) Generate device summary by SHA 256, then encrypt the device summary with device key EKpri to generate device signature, and then save relevant authentication information in the device + manufacturer summary + manufacturer signature + use update authentication information + device Summary + device signature, direct access.
  • the smart terminal can access the smart terminal to obtain the device public key, obtain the original device digest by decryption, and verify with the existing plaintext device digest. If the error is correct, the manufacturer's public key is obtained from the manufacturer's remote interface. After the second verification, You can recognize the relevant certification information.
  • the authentication handheld terminal is registered with the device (blockchain interface module) into the authentication blockchain (which can be a separate channel), queries the current state to obtain the authentication block, and then combines the device to store the relevant authentication information.
  • the device key is decoded, and the secondary signature information of the previous step is sent to the handheld terminal, and the related authentication information is obtained.
  • the authentication method and the previous authentication method do not require access to the manufacturer's remote interface, but require device networking operations.
  • the above two authentication methods when there are major updates, such as built-in software version upgrade, system maintenance, and large maintenance, can generate new related certification information, which can be stored separately.
  • the time can be recorded, and the block can be generated and related broadcasted; when the alarm is completed, the time can also be recorded, and the block can be generated. Or the entire process is unified to generate a block at the end, broadcast.
  • the entire process is released via a blockchain and can be recorded in responsibility management.
  • the entire process record is valid.
  • Embodiment 2 Smart camera
  • a blockchain interface module (which may be a software mode) is placed in the original circuit to obtain data generated by the smart camera (such as face recognition results, behavior recognition results, etc.).
  • data generated by the smart camera such as face recognition results, behavior recognition results, etc.
  • an asymmetric key pair EK (EKpub, EKpri) is generated, in which the key EKpri is only saved locally for authentication of the system, and the public key EKpub can be directly accessed.
  • MKpub MKpri
  • the manufacturer's own MK will be related to the authentication information (including the product model, serial number, authentication information, date of manufacture, etc., and may include photos, etc.).
  • the manufacturer abstracts the manufacturer's signature with the manufacturer key MKpri encryption, and then the relevant certification information + manufacturer summary + manufacturer signature + use update certification information (including the built-in software version upgrade, maintenance) , maintenance, detection information, etc.) Generate device summary by SHA 256, then encrypt the device summary with device key EKpri to generate device signature, and then save relevant authentication information in the device + manufacturer summary + manufacturer signature + use update authentication information + device Summary + device signature, direct access.
  • the smart terminal can access the smart terminal to obtain the device public key, obtain the original device digest by decryption, and verify with the existing plaintext device digest. If the error is correct, the manufacturer's public key is obtained from the manufacturer's remote interface. After the second verification, You can recognize the relevant certification information.
  • the authentication handheld terminal is registered with the device (blockchain interface module) into the authentication blockchain (which can be a separate channel), queries the current state to obtain the authentication block, and then combines the device to store the relevant authentication information.
  • the device key is decoded, and the secondary signature information of the previous step is sent to the handheld terminal, and the related authentication information is obtained.
  • the authentication method and the previous authentication method do not require access to the manufacturer's remote interface, but require device networking operations.
  • the above two authentication methods when there are major updates, such as built-in software version upgrade, system maintenance, and large maintenance, can generate new related certification information, which can be stored separately.
  • the relevant authentication information + manufacturer summary + manufacturer signature + intelligent identification result (including time, recognition result, identification process, etc.) is generated by SHA 256 method, and the device summary is encrypted by device key EKpri.
  • the smart terminal can access the smart terminal to obtain the device public key, obtain the original device digest by decryption, and verify with the existing plaintext device digest, and the smart recognition result can be recognized without any error. If the manufacturer's certification is required further, the manufacturer's public key can be obtained from the manufacturer's remote interface. After the second verification, the relevant authentication information can be approved.
  • the blockchain can pass the authentication of the device and the manufacturer to generate blocks and broadcast the intelligent recognition result, time and authentication content. Smartly recognized videos can be saved. Or after authentication, access the camera memory and save or share the camera's memory (collected images, video information) in the blockchain.
  • the authentication method and the previous authentication method do not require access to the manufacturer's remote interface, but require device networking operations.
  • the blockchain registration of the learning mechanism can be performed.
  • the face recognition intelligent camera can obtain the recognized face through statistical analysis of multiple invisible features through various training data.
  • the eigenvalues, and the test results of the test samples, can be used to recognize the normal application of the smart camera.
  • device signature related authentication information + manufacturer summary + manufacturer signature + deep learning mechanism information (including training mechanism information and test mechanism information, training mechanism information including training data, learning level, corresponding training parameters, and feature value set) , results, related data changes before and after learning; test mechanism information including relevant test samples, results and accurate values, etc.)
  • device signature Generate device abstracts by SHA 256, then encrypt the device summary with device key EKpri to generate device signatures, and then on the device Save relevant authentication information + manufacturer summary + manufacturer signature + deep learning mechanism information + device summary + device signature, which can be directly accessed or sent to the relevant system (for evaluation and authentication of learning ability).
  • the smart terminal can access the smart terminal to obtain the device public key, obtain the original device digest by decryption, and verify with the existing plaintext device digest, and the learning mechanism information can be recognized without any error. If the manufacturer's certification is required further, the manufacturer's public key can be obtained from the manufacturer's remote interface. After the second verification, the relevant authentication information can be approved.
  • the blockchain can authenticate the device and the manufacturer to generate the block and broadcast the deep learning mechanism information, time, and authentication content. Used for evaluation and certification of learning mechanisms.
  • the authentication method and the previous authentication method do not require access to the manufacturer's remote interface, but require device networking operations.
  • the smart camera can have various learning mechanisms, such as face recognition, handwriting recognition, and other special image feature recognition, there can be a variety of deep learning mechanism information storage, recognition, and the like.
  • the contents of the transaction may include data collected by the camera (process data), and technical information items of the camera itself (image compression technology, auto focus technology, light intensity adaptive technology, etc.), and after the certification is completed, the transaction conditions, such as the price, are obtained. Agree to the terms of the transaction in order to obtain the process data of the intelligent terminal, or the technical intelligence project.
  • the relevant authentication information + manufacturer summary + manufacturer signature + price information (including the price of the intelligent recognition result, the price of the deep learning model and the test price) are generated by the SHA 256 method, and then the device summary is The device key EKpri encrypts and generates the device signature, and then saves the relevant authentication information + manufacturer summary + manufacturer signature + price information + device summary + device signature in the device, which can be directly accessed or sent to the relevant system (for the transaction of intelligent results) .
  • the smart terminal can access the smart terminal to obtain the device public key, obtain the original device digest by decryption, and verify with the existing plaintext device digest, and the price information can be recognized without any error. If further certification by the manufacturer is required, the manufacturer's public key can be obtained from the remote interface of the manufacturer. After the second verification, the relevant certification information can be approved and the transaction conditions can be obtained. If the transaction is agreed, the transaction can be obtained after payment. Projects such as process data, technical intelligence projects, etc.
  • the device can find a better deep learning model through comparison of test data, and can also select other more in-depth deep learning models or test process data, and conduct electronic transactions.
  • the user When the user agrees or rejects the transaction conditions, it generates transaction information, including price information, time and certification content, constitutes a contract, and generates a block and broadcasts.
  • the device can find a better deep learning model through comparison of test data.
  • the device can also select other more in-depth deep learning models or test process data, and perform blockchain electronic transactions.
  • the authentication method and the previous authentication method do not require access to the manufacturer's remote interface, but require device networking operations.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Business, Economics & Management (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Marketing (AREA)
  • Theoretical Computer Science (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Accounting & Taxation (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种智能终端认证管理的方法，实现智能产品防伪、产品应用过程防伪和产品智能接口过程防伪，采用多重签名方式和基于区块链方式来实现：设备厂家认证信息、设备自身认证信息、设备过程数据、类似于深度学习机制等的技术情报项目、交易条件等的防伪认证和相关过程的执行认证及记录。从而实现了智能终端和其他外界(包括设备、软件、用户等)的可信度和自动交易的可靠性。

Description

一种智能终端认证管理的方法 技术领域
本发明涉及产品防伪和产品应用过程防伪技术领域，具体涉及到基于区块链技术的认证防伪方法。
背景技术
目前设备认证主要是通过：标签(包括RFID等电子标签)、在线认证、加密数据库认证等。这些方式存在缺点：很容易被物理复制，无法实现精准式追溯，无法实现动态信息(可以有效防止物理复制)的认证管理。
另外随着人脸识别、行为识别、智能机器人、自动驾驶等智能型设备的越来越普及，对这些设备的厂家、内嵌软件的认证管理，及其智能处理成果的认证管理，都是智慧物联网急需解决的问题。
如果没有针对设备厂家的认证、没有对其内嵌软件的有效认证、没有对智能处理成果的有效认证，会有几方面的问题：
1.使用不规范：无法识别仿冒或假货，以及不同厂家或同厂家不同型号(包括软件版本)的识别。
2.智能设备成果认证无法自动化：一旦成果是文本形式，易被窜改，还需人工查阅整个过程数据进行确认，无法体现智能成果的优势。
3.智能设备存储有限：比如视频人脸识别，目前基本的存储是一个月左右，通过区块链技术可以实现公证级的存储，可以避免一个月的存储期限，导致很难追查取证的问题。
4.不同智能设备成果无法相互使用：以上点如述，结构化成果数据无法得到认证，则不同智能设备之间的数据无法相互认可或集成，会造成智能化设备的应用效果不佳。
5.智能设备能有多种用途，可以用于不同特征的识别学习，其深度学习训练后的学习效果也需要认证，通过相关智商或学习能力的评估，以确认可用于不同的场景。
6.智能成果无法实现与设备、人员之间的自动交易，这样智能过程的所有权、使用权很难进行鉴价和交易。
发明内容
本发明的目的是针对先有技术的不足，提供一种智能终端认证管理的方法。
本发明的目的是通过以下技术方案实现的：一种智能终端认证管理的方法，该方法包括：
给智能终端设置一个设备标签，该设备标签的内容如下：厂家将相关认证信息生成厂家摘要，厂家摘要以厂家密钥MKpri加密生成厂家签名，同时再将相关认证信息+厂家摘要+厂家签名生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，相关认证信息+厂家摘要+厂家签名+设备摘要+设备签名组成设备标签。其中，相关认证信息为智能终端的标志信息。
认证方法如下：
访问智能终端获取设备公钥，通过解密设备签名得到设备摘要，与已有的明文设备摘要进行比对，一致则从厂家的远程接口中获取厂家公钥，通过解密厂家签名得到厂家摘要，进行第二道比对，一致则验证通过认证。
进一步地，智能终端将过程数据生成过程摘要，过程摘要以设备密钥EKpri加密生成过程签名，过程数据+过程摘要+过程签名组成过程标签。
经两道认证后，获得过程数据公钥，通过解密过程签名获得智能终端的过程数据。
进一步地，所述设备标签还包括使用更新认证信息。
进一步地，所述设备标签还包括智能终端的技术情报项目。
进一步地，所述设备标签还包括智能终端的交易条件，在获取该智能终端的过程数据、或技术情报项目前，先获得交易条件，同意交易条件才能获得智能终端的过程数据、或技术情报项目等。
进一步地，所述认证是基于区块链实现，所述区块链中保存有明文设备摘要和明文厂家摘要，所述区块链的节点先访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则再从厂家的远程接口中获取厂家公钥，通过解密得到原厂家摘要，与已有的明文厂家摘要进行验证，一致则验证通过认证。
进一步地，对设备进行一次认证，即生成一条包含认证时间的认证信息，保存于区块链中。
进一步地，认证通过后，认证节点获取智能终端的过程数据或技术情报项目，打包后存储在区块链中。
进一步地，所述设备标签还包括智能终端的交易条件，在获取该智能终端的过程数据、或技术情报项目前，先获得交易条件，同意交易条件才能获得智能 终端的过程数据、或技术情报项目等。用户在同意或拒绝交易条件时，即生成交易信息，保存在区块链中。
本发明的有益效果在于：对智能终端的来源、过程、应用结果、智能模型等进行充分认证，或者采用区块链式的认证，从而实现了智能终端和其他外界(包括设备、软件、用户等)的可信度，也增强了自动交易的可靠性。
附图说明
图1为用SHA 256方式生成厂家摘要的示意图；
图2为用SHA 256方式生成设备摘要的示意图。
具体实施方式
本发明所述的相关认证信息为智能终端的标志信息，包括产品型号、序列号、认证信息、出厂日期等验证信息，还可以包括智能终端的照片等。
本发明所述的过程数据为智能终端工作过程中产生的数据，例如采集的数据(摄像头采集的图像信息，录音设备采集的声音信息)，数据处理结过程、处理结果等，包含相应的时间信息、位置信息。
本发明所述的使用更新认证信息包括内置软件版本升级、保养、维护、检测信息等。
本发明所述的技术情报项目为智能终端本身包含的技术特征。智能终端的深度学习机制信息，深度学习机制信息包括训练机制信息和测试机制信息等，训练机制信息包括训练数据、学习层次、相应训练参数、特征值集、结果、学习前后的相关数据变化等；测试机制信息包括相关测试样本、结果和准确值等。例如，一个具有专利技术的摄像头，该项专利就是一个技术情报项目。
本发明所述的交易条件可以为一个价格。
下面结合具体实施例对本发明作进一步说明。
实施例1:智能消防
目前消防设施主要采用防伪标签或各种认证证书(如中国的CCCF认证、美国的UL认证等)。
对设备加装区块链接口模块，将接口模块与原电路***集成，用于从原设备中采集所需的数据(如消防水***的水压、水流速度等数据)，实现物联网接口。同时生成一个非对称密钥对EK(EKpub,EKpri)，其中密钥EKpri只在本地保存，用于***的认证，公钥EKpub则可以直接被访问。
1)认证：有两种方式，一种是厂家认证；另一种是区块链认证。
i)厂家认证
是厂家签名+设备签名这两重签名方式来实现：厂家自身的MK(MKpub，MKpri)，将相关认证信息(包括产品型号、序列号、认证信息、出厂日期等验证信息，还可以包括照片等)用MD5 256等方式生成摘要(厂家摘要)，厂家摘要以厂家密钥MKpri加密生成厂家签名，同时再将相关认证信息+厂家摘要+厂家签名+使用更新认证信息(包括内置软件版本升级、保养、维护、检测信息等)用SHA 256方式生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，再在设备中保存相关认证信息+厂家摘要+厂家签名+使用更新认证信息+设备摘要+设备签名，可直接访问。
认证时可以访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则再从厂家的远程接口中获取厂家公钥，同样经第二道验证后，即可认可相关认证信息。
将相关认证信息、使用更新认证信息与设备进行对比即可。
ii)区块链认证
认证用的手持终端与设备(区块链接口模块)一起登记入认证区块链(可以是单独通道)，查询当前状态获取认证区块，再结合设备将保存有相关认证信息的区块，由设备密钥解码，并将上一步的二次签名信息发送到手持终端上，即可获得相关认证信息。
该认证方式与上一认证方式是不需要访问厂家的远程接口，但需要设备联网操作。
以上二个认证方式，当有重大更新，如内置软件版本升级、***大维护、大保养，可以再生成新的相关认证信息，可以分别存放。
2)应用过程认证
当设备(如火灾自动报警***)出现火情报警时，可记录时间，也可以生成区块，并进行相关的广播；当报警完成时，也可以记录时间，也可以生成区块。或者将整个过程在结束时统一生成一区块，进行广播。
通过区块链方式发布整个过程，可以记录在责任管理中。整个过程记录有效。
实施例2:智能摄像机
在原电路中置入区块链接口模块(可以是软件方式)，可以获取智能摄像头生成的数据(如人脸识别结果、行为识别结果等数据)。同时生成一个非对称密钥对EK(EKpub,EKpri)，其中密钥EKpri只在本地保存，用于***的认证，公钥EKpub则可以直接被访问。
1)认证：有两种方式，一种是厂家认证；另一种是区块链认证。
i)厂家认证
是厂家签名+设备签名这两重签名方式来实现：厂家自身的MK(MKpub，MKpri)，将相关认证信息(包括产品型号、序列号、认证信息、出厂日期等验证信息，还可以包括照片等)用MD5 256等方式生成摘要(厂家摘要)，厂家摘要以厂家密钥MKpri加密生成厂家签名，同时再将相关认证信息+厂家摘要+厂家签名+使用更新认证信息(包括内置软件版本升级、保养、维护、检测信息等)用SHA 256方式生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，再在设备中保存相关认证信息+厂家摘要+厂家签名+使用更新认证信息+设备摘要+设备签名，可直接访问。
表1 智能摄像头认证数据示例
Figure PCTCN2017115936-appb-000001
认证时可以访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则再从厂家的远程接口中获取厂家公钥，同样经第二道验证后，即可认可相关认证信息。
将相关认证信息、使用更新认证信息与设备进行对比即可。
ii)区块链认证
认证用的手持终端与设备(区块链接口模块)一起登记入认证区块链(可以 是单独通道)，查询当前状态获取认证区块，再结合设备将保存有相关认证信息的区块，由设备密钥解码，并将上一步的二次签名信息发送到手持终端上，即可获得相关认证信息。
该认证方式与上一认证方式是不需要访问厂家的远程接口，但需要设备联网操作。
以上二个认证方式，当有重大更新，如内置软件版本升级、***大维护、大保养，可以再生成新的相关认证信息，可以分别存放。
2)应用过程认证
有两种方式，一种是设备认证发送或存放；另一种是认证后存入区块链。
i)设备认证
是设备签名方式来实现：将相关认证信息+厂家摘要+厂家签名+智能识别结果(包括时间、识别结果、识别过程等)用SHA 256方式生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，再在设备中保存相关认证信息+厂家摘要+厂家签名+智能识别结果+设备摘要+设备签名，可直接访问或发送到相关***中(用于集成或互换)。
认证时可以访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则可以认可智能识别结果。如果进一步需要厂家认证，则可以从厂家的远程接口中获取厂家公钥，同样经第二道验证后，即可认可相关认证信息。
表2 智能摄像头识别结果数据示例
Figure PCTCN2017115936-appb-000002
ii)认证后置入区块链
当设备有智能识别结果时，区块链通过对设备和厂家的认证，才能将智能识别结果、时间和认证内容生成区块，并进行广播。智能识别的视频可以不保存。或在认证后，访问摄像头内存，并将摄像头的内存(采集的图像、视频信息)在区块链中进行保存或共享。
该认证方式与上一认证方式是不需要访问厂家的远程接口，但需要设备联网操作。
3)学习机制的认证
由于学习机制不同，识别效果也会有区别，可以对学习机制进行区块链登记，人脸识别智能摄像机，通过各种训练数据，经过多层隐形特征的统计分析，可以得出所识别的人脸特征值，并通过测试样本的结果准确值测试，即可认可智能摄像机的正常应用。
表3 智能摄像头学习过程及训练数据示例
Figure PCTCN2017115936-appb-000003
为了认证此学习机制，并结合到智能摄像机的应用结果中，采用以下两种方式来进行：
有两种方式，一种是设备认证发送或存放；另一种是认证后存入区块链。
i)设备认证
是设备签名方式来实现：将相关认证信息+厂家摘要+厂家签名+深度学习机制信息(包括训练机制信息和测试机制信息等，训练机制信息包括训练数据、学习层次、相应训练参数、特征值集、结果、学习前后的相关数据变化等；测试机制信息包括相关测试样本、结果和准确值等)用SHA 256方式生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，再在设备中保存相关认证信息+厂家摘要+厂家签名+深度学习机制信息+设备摘要+设备签名，可直接访问或发送到相关***中(用于学习能力的评估和认证)。
认证时可以访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则可以认可学习机制信息。如果进一步需要厂家认证，则可以从厂家的远程接口中获取厂家公钥，同样经第二道验证后，即可认可相关认证信息。
ii)认证后置入区块链
当设备出厂、更新或实现新的学习机制时，区块链通过对设备和厂家的认证，才能将深度学习机制信息、时间和认证内容生成区块，并进行广播。用于学习 机制的评估和认证。
该认证方式与上一认证方式是不需要访问厂家的远程接口，但需要设备联网操作。
另外由于智能摄像机可以有多种学习机制，比如用于人脸识别、手写字识别、其他特殊图像特征识别，所以可以有多种深度学习机制信息的存储、认识等。
4)数据交易
通过对应用认证过程和学习机制认证实现所有权和使用权的商业化，可以评估或给出大致的估价，实现设备间、软件与设备间的商业交易过程。
交易的内容可以包括摄像头采集的数据(过程数据)，以及摄像头本身的技术情报项目(图像压缩技术、自动聚焦技术、光强自适应技术等)，在认证完成后，即获得交易条件，例如价格；同意交易条件才能获得智能终端的过程数据、或技术情报项目等。
也是有两种方式
i)交易过程的设备认证
是设备签名方式来实现：将相关认证信息+厂家摘要+厂家签名+价格信息(包括智能识别结果的价格、深度学习模型的价格和测试价格)用SHA 256方式生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，再在设备中保存相关认证信息+厂家摘要+厂家签名+价格信息+设备摘要+设备签名，可直接访问或发送到相关***中(用于智能成果的交易)。
认证时可以访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则可以认可价格信息。如果进一步需要厂家认证，则可以从厂家的远程接口中获取厂家公钥，同样经第二道验证后，即可认可相关认证信息，并获得交易条件，若同意交易，付费后即可获得相关交易项目，例如过程数据、技术情报项目等。
联网购买时，可以选择该设备以上信息的单次或多次购买，再实现电子支付。这样完成智能识别过程、深度学习模型和测试过程数据等各种数据的交易。
另外该设备通过测试数据的比较，可以发现更好的深度学习模型，也可以选择其他智能程度更高的深度学习模型或测试过程数据，并进行电子交易。
ii)交易过程的区块链
用户在同意或拒绝交易条件时，即生成交易信息，包含价格信息、时间和认证内容，构成合约，并生成区块，广播。
联网购买时，可以选择该设备以上信息的单次或多次购买，再实现区块链式的电子交易。这样通过区块链货币完成智能识别过程、深度学习模型和测试过 程数据等各种数据的交易。
另外该设备通过测试数据的比较，可以发现更好的深度学习模型，该设备也可以选择其他智能程度更高的深度学习模型或测试过程数据，并进行区块链式的电子交易。
该认证方式与上一认证方式是不需要访问厂家的远程接口，但需要设备联网操作。

Claims (9)

  1. 一种智能终端认证管理的方法，其特征在于，该方法包括：
    给智能终端设置一个设备标签，该设备标签的内容如下：厂家将相关认证信息生成厂家摘要，厂家摘要以厂家密钥MKpri加密生成厂家签名，同时再将相关认证信息+厂家摘要+厂家签名生成设备摘要，再将设备摘要以设备密钥EKpri加密生成设备签名，相关认证信息+厂家摘要+厂家签名+设备摘要+设备签名组成设备标签。其中，相关认证信息为智能终端的标志信息。
    认证方法如下：
    访问智能终端获取设备公钥，通过解密设备签名得到设备摘要，与已有的明文设备摘要进行比对，一致则从厂家的远程接口中获取厂家公钥，通过解密厂家签名得到厂家摘要，进行第二道比对，一致则验证通过认证。
  2. 根据权利要求1所述的方法，其特征在于，智能终端将过程数据生成过程摘要，过程摘要以设备密钥EKpri加密生成过程签名，过程数据+过程摘要+过程签名组成过程标签。
    经权利要求1所述的两道认证后，获得过程数据公钥，通过解密过程签名获得智能终端的过程数据。
  3. 根据权利要求1所述的方法，其特征在于，所述设备标签还包括使用更新认证信息。
  4. 根据权利要求1所述的方法，其特征在于，所述设备标签还包括智能终端的技术情报项目。
  5. 根据权利要求1述的方法，其特征在于，所述设备标签还包括智能终端的交易条件，在获取该智能终端的过程数据、或技术情报项目前，先获得交易条件，同意交易条件才能获得智能终端的过程数据、或技术情报项目等。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述认证是基于区块链实现，所述区块链中保存有明文设备摘要和明文厂家摘要，所述区块链的节点先访问智能终端获取设备公钥，通过解密得到原设备摘要，与已有的明文设备摘要进行验证，无误则再从厂家的远程接口中获取厂家公钥，通过解密得到原厂家摘要，与已有的明文厂家摘要进行验证，一致则验证通过认证。
  7. 根据权利要求6所述的方法，其特征在于，对设备进行一次认证，即生成一条包含认证时间的认证信息，保存于区块链中。
  8. 根据权利要求6所述的方法，其特征在于，认证通过后，认证节点获取智能终端的过程数据或技术情报项目，打包后存储在区块链中。
  9. 根据权利要求8所述的方法，其特征在于，所述设备标签还包括智能终端的交易条件，在获取该智能终端的过程数据、或技术情报项目前，先获得交易条件，同意交易条件才能获得智能终端的过程数据、或技术情报项目等。用户在同意或拒绝交易条件时，即生成交易信息，保存在区块链中。
PCT/CN2017/115936 2017-12-13 2017-12-13 一种智能终端认证管理的方法 WO2019113838A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/115936 WO2019113838A1 (zh) 2017-12-13 2017-12-13 一种智能终端认证管理的方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/115936 WO2019113838A1 (zh) 2017-12-13 2017-12-13 一种智能终端认证管理的方法

Publications (1)

Publication Number Publication Date
WO2019113838A1 true WO2019113838A1 (zh) 2019-06-20

Family

ID=66819776

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/115936 WO2019113838A1 (zh) 2017-12-13 2017-12-13 一种智能终端认证管理的方法

Country Status (1)

Country Link
WO (1) WO2019113838A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050262353A1 (en) * 2004-05-20 2005-11-24 Docomo Communications Laboratories Usa, Inc. Digital signatures including identity-based aggregate signatures
CN101369306A (zh) * 2008-08-29 2009-02-18 广东南方信息安全产业基地有限公司 一种电子标签安全***
CN101520865A (zh) * 2009-03-31 2009-09-02 薛忠华 一种利用无线射频电子标签结合公钥基础设施进行药品防伪的方法
CN106209877A (zh) * 2016-07-19 2016-12-07 井创（北京）科技有限公司 一种以区块链后台为认证核心的防伪认证***
CN108055135A (zh) * 2017-12-13 2018-05-18 杭州全视软件有限公司 一种智能终端认证管理的方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050262353A1 (en) * 2004-05-20 2005-11-24 Docomo Communications Laboratories Usa, Inc. Digital signatures including identity-based aggregate signatures
CN101369306A (zh) * 2008-08-29 2009-02-18 广东南方信息安全产业基地有限公司 一种电子标签安全***
CN101520865A (zh) * 2009-03-31 2009-09-02 薛忠华 一种利用无线射频电子标签结合公钥基础设施进行药品防伪的方法
CN106209877A (zh) * 2016-07-19 2016-12-07 井创（北京）科技有限公司 一种以区块链后台为认证核心的防伪认证***
CN108055135A (zh) * 2017-12-13 2018-05-18 杭州全视软件有限公司 一种智能终端认证管理的方法

Similar Documents

Publication Publication Date Title
US11550935B2 (en) Method, apparatus, and electronic device for blockchain-based recordkeeping
US11113699B2 (en) Open registry for identity of things
CN108055135B (zh) 一种智能终端认证管理的方法
US11831710B2 (en) Tracking and certification of digital media via distributed ledger
US9681302B2 (en) Method, apparatus, and system for providing and using a trusted tag
US10142833B2 (en) Methods, systems and apparatus for recognizing genuine products
US20180019872A1 (en) Open registry for internet of things including sealed materials
EP3053146B1 (en) Systems and methods for sharing verified identity documents
US20180032759A1 (en) Open registry for human identification
US11736291B2 (en) Digital notarization using a biometric identification service
KR100785765B1 (ko) 제품인증 방법 및 그 장치
CN110958319B (zh) 一种基于区块链的侵权存证管理方法及装置
US20190197562A1 (en) System and method for product authentication
US9639839B2 (en) Fingerprint recognition control methods for payment and non-payment applications
US20200344046A1 (en) Product Tracking System and Method
WO2020056597A1 (zh) 物品身份管理方法、终端、微处理单元、标识设备和***
WO2018067974A1 (en) Open registry for human identification
US12047511B2 (en) Information processing system and information processing method
WO2018064329A1 (en) Open registry for internet of things including sealed materials
WO2019113838A1 (zh) 一种智能终端认证管理的方法
US9282107B1 (en) Secure verification of website claims
US20200204377A1 (en) Digital notarization station that uses a biometric identification service
WO2012124084A1 (ja) 商品認証システムおよび商品認証方法
US11954215B1 (en) System and method for security suite concatenating validation elements for blockchain binding operations
Winkler et al. User-based attestation for trustworthy visual sensor networks

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17934607

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17934607

Country of ref document: EP

Kind code of ref document: A1