WO2019153701A1 - 一种获得设备标识的方法及装置 - Google Patents

一种获得设备标识的方法及装置 Download PDF

Info

Publication number
WO2019153701A1
WO2019153701A1 PCT/CN2018/100618 CN2018100618W WO2019153701A1 WO 2019153701 A1 WO2019153701 A1 WO 2019153701A1 CN 2018100618 W CN2018100618 W CN 2018100618W WO 2019153701 A1 WO2019153701 A1 WO 2019153701A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
public key
network device
message
key
Prior art date
Application number
PCT/CN2018/100618
Other languages
English (en)
French (fr)
Inventor
周冲
付天福
张大成
魏建雄
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18905152.7A priority Critical patent/EP3745639A4/en
Publication of WO2019153701A1 publication Critical patent/WO2019153701A1/zh
Priority to US16/990,528 priority patent/US11350286B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/71—Hardware identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5038—Address allocation for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3278—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response using physically unclonable functions [PUF]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to the field of communications technologies, and to a method and an apparatus for obtaining a device identifier, and more particularly to a method and apparatus for obtaining a device identifier of a terminal in an Internet of Things.
  • Internet of Things (English: Internet of Things, IoT) is based on the use of radio frequency identification (English: Radio Frequency Identification, RFID), sensors, infrared sensors, global positioning systems, laser scanners and other information gathering equipment, according to the agreed agreement Any item that is connected to the Internet for information interaction and communication to enable intelligent identification, location, tracking, monitoring, and management.
  • the Internet of Things connects various terminals with information sensing functions through mobile communication networks and IoT platforms.
  • a terminal with information sensing function can also be called a terminal device or an Internet of Things terminal or an Internet of Things device.
  • IP Internet Protocol
  • a device identifier of a terminal is usually configured in a pre-configured manner. For example, for the mobile terminal, the user identification information provided by the operator to the terminal and the identification information written to the terminal at the factory are calculated to generate an identity identification of the terminal for authentication of the mobile terminal. For the wired terminal, the network access key provided by the operator and the identification information written to the terminal at the factory generate an identification identifier. Because different manufacturers adopt different configuration modes, the types of identifiers configured by different manufacturers for the terminal may be different. In addition, there are cases where different manufacturers configure the same identifier for different terminals. The above situation brings certain complexity to the device management in the Internet of Things.
  • an international mobile device identifier for the mobile terminal, for example, an international mobile device identifier (IMEI) is used to uniquely identify the terminal, but the registration mechanism needs to be registered in advance, and the configuration process is required. It is relatively complicated, and the registration cost is high, and the logo recycling is inefficient.
  • IMEI international mobile device identifier
  • the device identifier generated by the foregoing method has the problem of being too simple and being stolen.
  • the device identification is too simple, and it is easy to be counterfeited successfully.
  • the embodiment of the present application provides a method for obtaining a device ID, which is used to provide an overall solution with higher security and available device ID.
  • the embodiment of the present application provides a method for acquiring a device ID, where the method includes: a terminal sending, to a network device, a first message for requesting the device ID for the terminal, where the device ID is used for global unique Identify the terminal.
  • the terminal receives an encrypted key pair sent by the network device, the key pair including a first public key and a first private key.
  • the terminal receives the information sent by the network device, where the information is used to identify that the first public key is a device ID of the terminal.
  • the terminal determines that the first public key is the device ID based on the received key pair and the information.
  • the terminal receives the key pair sent by the network device and the information sent by the network device received by the terminal may be carried in the same message, or may be carried in different messages.
  • the terminal receives an operation of the encrypted key pair sent by the network device (for convenience of description, referred to as operation 1) and the terminal receives the network.
  • operation 1 an operation of the encrypted key pair sent by the network device
  • operation 2 an operation of the information sent by the device
  • operation 1 may be performed before, after or simultaneously with operation 2.
  • the terminal generates a request for acquiring the device ID, and the network device sends a key pair to the terminal based on the received request, and sends the information to the terminal to indicate that the public key included in the key pair is the device ID. Therefore, the network device dynamically allocates the device ID to the terminal based on the request of the terminal, does not need to perform ID allocation on the terminal in a pre-configured manner, and does not need to register with the registration institution in advance, which simplifies the configuration process and saves registration cost, and Since there is no need to pre-configure the device ID, the recycling efficiency of the device ID is improved.
  • the public key in the key pair ensures the uniqueness of the device ID, avoids duplication of the device ID, and the device ID based on the public key is relatively complex relative to the existing device ID, which reduces the device identifier is too simple. And the possibility of being counterfeited.
  • the method further includes: the terminal transmitting, to the network device, a second message that is signed by the first private key, where the second message carries a device ID that is the terminal The first public key.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on a physical unclonable function.
  • the terminal receives the encrypted key pair sent by the network device, including: the terminal receiving the key pair sent by the network device and encrypted by the second public key .
  • the terminal can only use the second private key corresponding to the second public key for decryption. Since the second public key and the second private key are keys generated by the terminal based on the PUF, and only the terminal itself stores the second private key, the second private key is difficult to counterfeit, and the transmission of the key pair can be effectively improved. .
  • the method further includes: the terminal saving the first private key, using the second public key pair
  • the saved first private key is encrypted. Encrypting the stored first private key by using the second public key can only be decrypted by the second private key corresponding to the second public key, because the second public key and the second private key are generated based on the PUF. Moreover, only the terminal itself owns the second private key, so the second private key cannot be easily counterfeited, and the storage of the first private key can be effectively guaranteed.
  • the first message carries a public key certificate issued by a certificate authority CA
  • the public key certificate carries the second public key.
  • the present application provides a method for acquiring a device ID, the method comprising: receiving, by a first network device, a first message sent by a terminal for requesting the device ID for the terminal, where the device ID is used by Globally uniquely identifying the terminal; the first network device sends an encrypted key pair to the terminal, the key pair including a first public key and a first private key; the first network device The terminal sends the first information, where the first information is used to identify that the first public key is a device ID of the terminal.
  • the key pair sent by the network device to the terminal and the information sent by the network device to the terminal may be carried in the same message, or may be carried in different messages.
  • the first network device sends an encrypted key pair operation to the terminal (refer to operation 1 for convenience of expression) and The sending, by the first network device, the first information to the terminal (Operation 2) can also be understood to be performed by the same operation.
  • operation 1 may be performed before, after or simultaneously with operation 2.
  • a device management system is deployed in the first network device, and the first network device receives a second message that is sent by the terminal and is signed by the first private key, where the second message is received.
  • Carrying the first public key as a device ID of the terminal.
  • the second message may be used to report the device ID, that is, the first public key, the device status information, the device location information, and/or the device type, to the device management system deployed in the first network device.
  • the operation to be performed by the second message may be identified by the message type in the second message or by the corresponding bit in the second message.
  • the second message may carry the first public key as the device ID.
  • the first network device may verify the signature by using the first public key, and then verify the identity of the terminal.
  • the network device returns a key pair to the terminal based on the request of the terminal to acquire the device ID.
  • the terminal uses the public key in the key pair as the device ID, and uses the private key in the key pair to sign the packet to authenticate the terminal. No need to reconfigure new authentication credentials, which effectively simplifies the configuration process and reduces system overhead in the scenario of massive IoT terminals.
  • a device management system is deployed in the first network device, and an ID management system is deployed in the second network device.
  • the method further includes: the first network device to the second network The device sends a third message, where the third message is used to request the device ID for the terminal; the first network device receives the key pair and the second information returned by the second network device, The second information is used to indicate that the first public key included in the key pair is the device ID.
  • an ID management system is deployed in the first network device, and after receiving the first message carrying the second public key, the first network device saves based on the second public key and itself The second public key authenticates the terminal.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on a physical unclonable function PUF.
  • the third message carries the second public key
  • the second network device performs identity verification on the terminal based on the second public key carried in the third message. Specifically, after the first network device receives the first message carrying the second public key, acquiring the second public key based on the first message, generating and reporting to the second network The device sends the third message carrying the second public key. The second network device performs identity verification on the terminal based on the second public key carried in the third message and the second public key saved in the third message. The second network device determines that the terminal passes the identity verification, and generates and sends the key pair and the second information to the first network device. The second network device determines that the second public key carried in the third message is the same as the second public key that is saved by itself, and determines that the terminal passes the identity verification.
  • the ID management system By authenticating the terminal, the ID management system only assigns the device ID to the authenticated terminal, thereby effectively avoiding resource consumption caused by the non-trusted terminal to apply for the ID management system.
  • S302 does not necessarily operate.
  • the first network device sends the encrypted key pair to the terminal, including: the first network device sends the secret encrypted by the second public key to the terminal Key pair.
  • the terminal After receiving the key pair encrypted by the second public key and sent by the network device, the terminal can only use the second private key corresponding to the second public key for decryption. Since the second public key and the second private key are keys generated by the terminal based on the PUF, and only the terminal itself stores the second private key, the second private key is difficult to counterfeit, and the transmission of the key pair can be effectively improved. .
  • the first message carries a public key certificate issued by a certificate authority CA
  • the public key certificate carries the second public key.
  • an embodiment of the present application provides a terminal for performing the method in any of the possible aspects of the first aspect or the first aspect.
  • the terminal comprises means for performing the method of the first aspect or any of the possible embodiments of the first aspect.
  • the embodiment of the present application provides a network device for performing the method in any possible design of the second aspect or the second aspect.
  • the terminal comprises means for performing the method of any of the possible aspects of the second aspect or the second aspect.
  • an embodiment of the present application provides a terminal, including: a transceiver, a processor, and a memory.
  • the transceiver, the processor and the memory can be connected by a bus system.
  • the memory is for storing a program, an instruction or a code
  • the processor is configured to execute a program, an instruction or a code in the memory, to complete the information executed by the terminal in the method in any of the first aspect or the first aspect of the first aspect. Operations other than sending and receiving.
  • an embodiment of the present application provides a network device, including: a transceiver, a processor, and a memory.
  • the transceiver, the processor and the memory can be connected by a bus system.
  • the memory is for storing a program, an instruction or a code
  • the processor is configured to execute a program, an instruction or a code in the memory, to perform the method performed by the network device in the method in any of the possible aspects of the second aspect or the second aspect Operations other than messaging.
  • the embodiment of the present application provides a communication system, including the terminal provided by the third aspect or the fifth aspect, and the network device provided by the fourth aspect or the sixth aspect.
  • the embodiment of the present application provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the first aspect, the second aspect, The instructions of the method of any of the possible implementations of the first aspect or any of the possible implementations of the second aspect.
  • the method, the terminal, the network device, and the system provided by the embodiment of the present application can effectively ensure the uniqueness of the device ID by generating a key pair and using the public key as the device ID, especially in the scenario of the Internet of Things mass device. It can effectively avoid the management difficulties caused by the duplication of device IDs. Further, the private key of the public key pair is used to sign the information sent by the terminal, so that the communication credential does not need to be configured in advance, and there is no need to negotiate an additional key, which greatly saves configuration in a massive terminal scenario. Authentication credentials and the overhead required to negotiate keys greatly simplify the configuration process and improve processing efficiency.
  • FIG. 1 is a schematic structural diagram of an Internet of Things system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for acquiring a device ID according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method for acquiring a device ID according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a terminal registration method according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a method for registering a terminal according to an embodiment of the present application
  • FIG. 6 is a schematic flowchart of a method for acquiring a device ID according to an embodiment of the present application
  • FIG. 7 is a schematic flowchart of a method for acquiring a device ID according to an embodiment of the present disclosure
  • FIG. 8 is a schematic flowchart of a method for acquiring a device ID according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of a network device according to an embodiment of the present application.
  • the application scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application, and are not limited to the application scenarios.
  • the technical solutions provided by the embodiments of the present application are applicable to similar technical problems, as the network architecture evolves and the new service scenario occurs.
  • a and/or B as referred to in this application shall be understood to include the case where only A is included, only B is included, or both A and B are included.
  • the "PUF” described in the present application refers to a physical unclonable function (PUF), which is a "biometric" recognition technology in the field of chips.
  • PUF physical unclonable function
  • In the chip manufacturing process even if two chips have the same design or even the manufacturing process, their physical properties are still different. At the molecular scale, there are always inevitable and uncontrollable variables that make each chip unique. These variables are completely random and cannot be eliminated. Even on the most advanced production lines, there are internal structural differences in the chips on the same wafer. Variables in the chip manufacturing process are extracted based on the PUF to generate a completely random key. These keys are unpredictable and arranging and permanent, even if the chip manufacturer cannot copy them.
  • the PUF algorithm for generating a key may use an existing algorithm, such as a universal key cryptography (Rivest-Shamir-Adelman, RSA) algorithm or a digital signature algorithm (DSA), which is not described herein.
  • terminal may refer to both a device owned, managed, or used by an operator or a content service provider, and may also include a common user terminal device.
  • a "terminal” may also be referred to as a terminal device, a network device, a node or a node device.
  • IoT network node When applied to the Internet of Things, it can also be called an IoT network node, an Internet of Things terminal, a terminal device, an Internet of Things device, an Internet of Things node device, or an Internet of Things terminal device.
  • any device with information sensing capabilities can be called a terminal.
  • the terminal can be a mobile phone (or "cellular" phone), a personal communication service (PCS) phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop) , WLL) station, personal digital assistant (PDA) and other equipment.
  • the terminal may also be a network device, which may also be referred to as an access network device, and may be a gNB (gNode B), which may be a common base station (for example, a base station (NodeB, NB) in a WCDMA system, in an LTE system.
  • gNode B gNode B
  • the evolved base station (eNB or eNodeB), the base station (Base Transceiver Station (BTS) in GSM or CDMA), may be a new radio controller (NR controller), and may be a centralized network element (Centralized network element).
  • the unit may be a new radio base station, which may be a radio remote module, may be a mobile management entity (MME), may be a micro base station, may be a distributed network unit, or may be a receiving point ( Transmission Reception Point (TRP) or Transmission Point (TP), which can also be a wireless controller in a Cloud Radio Access Network (CRAN) scenario, or the network device can be a relay station or an access point.
  • MME mobile management entity
  • TRP Transmission Reception Point
  • TP Transmission Point
  • CRAN Cloud Radio Access Network
  • the in-vehicle device and the network device in the future network or any other access device can also be a home gateway, a smart wearable device (for example, a smart watch, a smart bracelet, smart glasses, smart headphones, a smart helmet, a smart ring, a smart shoe, a smart necklace, etc.), various household appliances (for example, a refrigerator) , washing machines, televisions, water heaters, rice cookers, microwave ovens, ovens, bread machines, foot tubs, air purifiers, humidifiers, speakers, etc.), various transportation and transportation vehicles (for example, cars, airplanes, trains, boats, bicycles, Motorcycles, etc.), various instrumentation, network equipment (such as routers, switches, servers, firewalls, controllers, etc.), etc., this application is not limited to this, and cannot be exhaustive, and therefore will not be described again.
  • a smart wearable device for example, a smart watch, a smart bracelet, smart glasses, smart headphones, a smart helmet, a smart ring, a smart shoe,
  • the "Internet of Things Platform” described in this application is a relatively broad concept. It can integrate, sort, analyze and feedback data information collected by IoT terminals, mainly providing management, data management and operation management of massive terminals. And secure management.
  • the IoT platform incorporates many advanced technologies, including cloud computing, big data, artificial intelligence, etc., to meet the needs of information transportation and interaction of the Internet of Things.
  • the Internet of Things platform can be composed of multiple processing platforms with different functions. It is responsible for extracting data for control and decision-making from the perceptual data according to application requirements, and converting it into different formats, which is convenient for sharing by multiple application systems. In practical applications, the Internet of Things platform can be composed of one or more devices.
  • the IoT platform can be divided into four platform types from the bottom to the top: terminal management platform, connection management platform, application development platform and business analysis platform.
  • the terminal management platform is mainly responsible for registration management, identity identification, access control, configuration, monitoring, query, system upgrade, troubleshooting, and lifecycle management of the Internet of Things terminals.
  • the connection management platform is mainly responsible for IoT connection configuration and fault management, network resource usage management, connection resource management, package change, number/IP address/MAC resource management, and the like.
  • the application development platform can provide application development and unified data storage platform-as-a-service (Paas) platform, providing application development tools, middleware, data storage, business logic engine, and interface to third-party application platforms. :application platform interface, API), etc.
  • the business analysis platform is mainly used to classify and process business data, analyze and provide visual data analysis results, monitor the status of equipment and provide early warning through real-time dynamic analysis, or analyze and predict the business through machine learning.
  • network device refers to hardware used to indicate any information that can be transmitted and received and can be processed during information exchange.
  • it can be a personal computer, a server, a router, a switch, and the like.
  • the network device When the network device is used in the Internet of Things platform, it may be used to perform some or all of the functions of the foregoing terminal management platform, the connection management platform, the application development platform, and/or the service analysis platform, and the device management system and/or the device management system may be deployed in the network device.
  • Identification (English: identifier, ID) management system.
  • the device management system described in the present application is deployed in the Internet of Things platform, for example, may be deployed in the terminal management platform described above.
  • the Device Management System is a centralized device management system. It is mainly used to centrally manage (including configuration, query, monitoring, etc.) devices (such as terminals) and related service information of devices.
  • the device management system can be deployed on one or more network devices.
  • the "ID management system" described in the present application is deployed in the Internet of Things platform, for example, may be deployed in the terminal management platform described above.
  • the ID management system may be, for example, an Identity as a service (IDaas) system for managing device ID information of a device (for example, a terminal), including creating, configuring, verifying, activating, and querying a device ID. operating.
  • IDaas Identity as a service
  • the ID management system can be deployed on one or more network devices.
  • the ID management system and the device management system may be deployed on the same network device, or may be deployed on different network devices, which is not specifically limited in this embodiment.
  • the "IDaas” described in this application can be called identity authentication service, and can also be called identity and access management as a service, using a cloud computing infrastructure to securely manage user identity and access. .
  • the "globally unique public key" as used in the present application means that in a network or system having multiple terminals, the public key generated by any one terminal is different from the public key generated by another terminal, that is, no repetition occurs. .
  • the terminal 1 generates the public key 1, and other terminals, such as the terminal 2, cannot generate the same public key as the public key 1 based on the same or different algorithms.
  • the "globally unique identifier" as used in the present application means that in a network or system having multiple terminals, the device ID of any one terminal is different from the device ID of another terminal, that is, no repetition occurs.
  • the "public key” may also be referred to as a "public key”
  • the "private key” may also be referred to as a "private key.”
  • the public key and the private key are a key pair obtained by an algorithm, that is, the key pair is composed of a public key and a private key.
  • the public key is the part of the key pair that is exposed, and the private key is the non-public part.
  • Reference in the present application to "a public key and a private key corresponding to the public key” means that the private key and the public key form a key pair, a similar "private key and the private key”
  • the corresponding public key (or similar expression) also means that the private key and the public key form a key pair.
  • the Internet of Things system includes a plurality of terminals 101 and an Internet of Things platform 102 communicatively coupled to the plurality of terminals 101.
  • the Internet of Things platform 102 includes a terminal management platform 103, a connection management platform 104, an application development platform 105, and a service analysis platform 106.
  • the terminal management platform 103 is deployed in at least one network device.
  • the two network devices (the network device 107 and the network device 108) are exemplified in FIG. 1 and should not be construed as limiting the application.
  • the device management system and the ID management system may be deployed in the network device deploying the terminal management platform 103.
  • the device management system is used to manage the terminal in a unified manner, configure the terminal, view and monitor the terminal status and service status.
  • the ID management system is used to generate, update, delete and/or verify the device ID of the terminal.
  • the device management system and the ID management system may be deployed in the same network device, for example, the network device 107, and may perform corresponding functions by different chips, or may be two processes on the same chip.
  • the device management system and the ID management system may also be deployed in different network devices. For example, the device management system is deployed in the network device 107, and the ID management system is deployed in the network device 108, which is not specifically limited in this application.
  • the IoT system may also include a certificate authority (CA) 109, which is the authority responsible for issuing certificates, certificates, and managing issued certificates.
  • CA certificate authority
  • the CA issues a digital certificate for each end that uses a public key, which is used to prove that the user listed in the certificate legally owns the public key listed in the certificate.
  • FIG. 1 is only a schematic diagram, and only the interaction between the Internet of Things platform and multiple terminals is taken as an example, and the application scenario of the present application should not be limited. Other terminals may be included in the IoT system.
  • the functions of the terminal management platform 103, the connection management platform 104, the application development platform 105, and the service analysis platform 106 may be respectively performed by different network devices, or all the functions of the above four platforms may be performed by one network device, or may be performed by A network device performs some functions of the above four platforms, and another one or more network devices perform other functions, which is not specifically limited in this application.
  • the number of terminals and network devices in the embodiment of the present application is not limited. For example, if there are multiple network devices, each network device may separately manage one or more terminals, or multiple network devices may jointly manage one or more terminals.
  • FIG. 2 is a schematic flowchart of a method 200 for acquiring a device ID according to an embodiment of the present application.
  • the network architecture of the application method 200 includes at least a terminal, a network device 1 and a network device 2.
  • the terminal may be the terminal 101 in the network architecture shown in FIG. 1, and the network device 1 may be in the network architecture shown in FIG.
  • the network device 108 of the device management system is deployed.
  • the network device 2 may be the network device 107 deployed with the ID management system in the network architecture shown in FIG. 1, wherein the ID management system may be, for example, an IDaas system.
  • the network architecture can be the network architecture shown in FIG. Method 200 includes the following operations.
  • the terminal sends a message 1 to the network device 1.
  • the message 1 is used to send a registration request to the network device 1, and is also used to indicate to the network device 1 that the device ID is requested by the terminal.
  • the terminal needs to access the Internet of Things, it needs to register in the device management system.
  • the terminal successfully registered in the device management system can access the Internet of Things and perform related operations.
  • the network device 1 sends a message 2 to the network device 2.
  • Message 2 is used to request the device ID for the terminal.
  • the network device 1 After receiving the message 1, the network device 1 generates and sends a message 2 to the network device 2 based on the indication of the message 1, requesting the device ID for the terminal.
  • the message 1 and the message 2 may be a Transmission Control Protocol (TCP) message or a User Datagram Protocol (UDP) message.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • Message 1 and Message 2 may be identified by message type for requesting the device ID, or may be identified by the corresponding bit for requesting the device ID.
  • the method 200 may further include: S203, the network device 2 authenticating the terminal.
  • the network device 2 can, but is not limited to, verify the identity of the terminal in the following ways.
  • the network device 2 authenticates the terminal based on the authentication credentials negotiated with the terminal. Specifically, the network device 2 and the terminal pre-negotiate the authentication credentials and save the negotiated authentication credentials locally.
  • the authentication credential is carried in the message 1.
  • the authentication credential is also carried in the message 2 sent by the network device 1 to the network device 2.
  • the identity of the terminal is verified according to the authentication credentials carried in the message 2 and the locally stored authentication credentials. If the authentication credential carried in message 2 matches the locally stored authentication credential, the terminal is considered to be authenticated.
  • the network device 2 authenticates the terminal according to a globally unique key. Specifically, the terminal generates a globally unique key pair in advance. For example, in the terminal of the terminal, the terminal generates a key pair 1 including the public key 1 and the private key 1 based on the PUF, and the network administrator or the network management system Key 1 is configured in advance to network device 2.
  • the public key 1 is carried in the message 1.
  • the public key 1 is also carried in the message 2 sent by the network device 1 to the network device 2.
  • the network device 2 authenticates the terminal according to the public key 1 carried in the message 2 and the locally stored public key 1. If the public key 1 carried in the message 2 is the same as the public key 1 stored in the network device 2, the terminal is considered to be authenticated.
  • the network device 2 authenticates the terminal according to the key certificate. Specifically, the terminal generates a globally unique key pair in advance. For example, at the factory stage, the key pair 1 including the public key 1 and the private key 1 is generated based on the PUF.
  • the terminal sends the public key 1 to the CA, and the public key certificate is sent by the CA, and the public key certificate is returned to the terminal, where the public key certificate carries the public key 1.
  • the public key certificate is issued by the CA, so that it is not necessary to configure the public key 1 in the network device 2 in advance, which simplifies the configuration process.
  • the terminal requests to acquire the device ID, the terminal carries the public key certificate in the message 1.
  • the public key certificate is also carried in the message 2 sent by the network device 1 to the network device 2.
  • the network device 1 verifies the public key certificate, and if the verification passes, it confirms that the terminal passes the identity verification.
  • the ID management system in the network device 2 only assigns the device ID to the authenticated terminal, thereby effectively avoiding the non-trusted terminal. Apply for resource consumption caused by the ID management system.
  • S203 is not an essential operation. When S203 is not executed, after S202, S204 may be executed.
  • the network device 2 generates a key pair 2 based on the message 2.
  • the key pair includes a public key 2 and a private key 2.
  • the network device 2 sends the key pair 2 and the information 1 to the network device 1.
  • the network device 2 After receiving the message 2, the network device 2 generates a key pair 2 in response to the request of the message 2, wherein the key pair 2 can be generated by the ID management system in the network device 2, and the information 1 is used to identify the public key described above. 2 is the device ID. Information 1 can be either a message type or a corresponding bit in the message. The key pair 2 and the information 1 may be carried in the same message or may be carried in different messages.
  • the network device 1 sends the information 2 to the terminal and the encrypted key pair 2.
  • the information 2 is used to identify the public key 2 described above as the device ID.
  • Information 2 can be a message type or a corresponding bit in the message.
  • the key pair 2 and the information 2 may be carried in the same message or may be carried in different messages.
  • the network device 1 can, but is not limited to, encrypt the key pair 2 in the following manner.
  • the terminal Before S201, for example, at the terminal of the terminal, the terminal generates a key pair 1 based on the PUF, wherein the key pair 1 includes the public key 1 and the private key 1.
  • the network device 1 can obtain the public key 1 in the following manner: mode a.
  • the message 1 carries the public key 1, and the network device 1 extracts the public key 1 from the message 1 and saves it; Or, in mode 2, the public key 1 is configured into the network device 1 by a network administrator or a network management system.
  • the network device 1 transmits the key pair 2 to the terminal, the key pair 2 is encrypted and protected by the public key 1.
  • the terminal decrypts the key pair 2 by using the private key 1.
  • the network device 1 encrypts the key pair 1 by using the public key 2, and decrypts it by the terminal through the private key 2 stored in the terminal. Since the public key 2 and the private key 2 are generated based on the PUF, and only the terminal itself stores the private key 2, the private key 2 cannot be easily counterfeited, and the security of the key pair 1 in transmission can be effectively improved.
  • the network device 1 and the terminal pre-negotiate the key, and the key pair 2 is encrypted by using the negotiated key.
  • the terminal receives and saves the key pair 2.
  • the terminal After the terminal receives the key pair 2, the key pair 2 is saved.
  • the terminal encrypts the stored key pair 2 by using the public key 1 generated by the PUF or encrypts only the stored private key 2 by using the public key 1, and the private key corresponding to the public key 1. 1 is used for decryption. Since the public key 1 and the private key 1 are generated based on the PUF, it is not easy to counterfeit, and therefore, the storage security of the private key 2 can be improved.
  • the terminal may also use other keys or other methods to encrypt the key pair 2 and at least the private key 2 to improve the storage security of the private key 2.
  • the terminal determines that the public key 1 is the device ID.
  • the terminal acquires the key pair 1, and determines that the public key 1 is the device ID according to the indication of the information 2, so that the terminal determines to obtain its own device ID.
  • the operation of storing the key pair 2 by the terminal and the operation of the operation of S208 are performed in sequence, that is, the terminal may save the key pair 2 before S208, or may save the key pair 2 after S208.
  • the key pair 2 can be saved while the S208 operation is completed.
  • the method 200 may further include:
  • the terminal sends the message 2 signed by the private key 1 to the network device 1.
  • the message 2 can be used to confirm that the terminal registration is successful to the device management system deployed in the network device 1.
  • the message 2 can also be used to report the device ID, that is, the public key 1, the device status information, the device location information, and/or the device type, to the network device 1.
  • the operation to be performed by the message 2 can be identified by the message type in the message 2 or by the corresponding bit in the message 2.
  • Message 2 can carry the public key 1 as the device ID.
  • the network device 1 After receiving the message 2, the network device 1 can verify the signature of the message 2 by using the public key 1, and then verify the identity of the terminal.
  • S209 and S208 are in no particular order, that is, S209 can be executed before S208, S209 can also be executed after S208, and S209 can also be executed simultaneously with S208.
  • the method 200 may further include: the terminal sending the message 3 signed by the private key 1 to the network device 3.
  • the network device 3 is a terminal other than the above terminal.
  • the information is exchanged between the terminal and the network device 3.
  • the terminal uses the private key 1 to sign the information carried in the message 3.
  • the message 3 carries the public key 1 as the device ID.
  • the network device 3 can directly extract the public key 1 from the message 3, so that the signature of the message 3 can be verified without pre-acquiring the public key 1, and then the identity of the terminal is verified.
  • FIG. 3 is a schematic flowchart of a method 300 for acquiring a device ID according to an embodiment of the present application.
  • the network architecture of the application method 300 includes at least the terminal and the network device 1.
  • the terminal may be, for example, the terminal 101 in the network architecture shown in FIG. 1.
  • the network device 1 may be, for example, the ID management system deployed in FIG. Network device 107 or network device 108 deployed with an ID management system.
  • the ID management system may be, for example, an IDaas system.
  • the network architecture can be the network architecture shown in FIG. Method 300 includes the following operations.
  • the terminal sends a message 1 to the network device 1.
  • Message 1 is used to request the device ID for the terminal.
  • the message may be used to identify the message for requesting the device ID, or the corresponding bit may be used to identify the message 1 for requesting the device ID.
  • the method 300 may further include: S302, the network device 1 authenticates the terminal.
  • the network device 1 can, but is not limited to, verify the identity of the terminal in the following ways.
  • Method 1 The network device 1 authenticates the terminal according to the authentication credential negotiated with the terminal. Specifically, the network device 1 and the terminal negotiate the authentication credentials and save the authentication credentials. When the terminal requests to obtain the device ID, it carries the negotiated authentication credential in message 1. After receiving the message 1, the network device 1 verifies the identity of the terminal according to the authentication credential carried in the message 1 and the authentication credential saved by itself. The network device 1 determines that the authentication credential carried in the message 1 matches the locally saved authentication credential, and considers that the terminal passes the identity authentication.
  • the network device 1 authenticates the terminal according to a globally unique key. Specifically, the terminal generates a globally unique key pair in advance, for example, at the factory stage, generating a key pair 1 including the public key 1 and the private key 1 based on the PUF, and the public key 1 is adopted by the network administrator or the network management system. Configure to network device 1 in advance.
  • the terminal requests to acquire the device ID, the terminal carries the public key 1 in the message 1.
  • the network device 1 After receiving the message 1, the network device 1 authenticates the terminal according to the public key 1 and the stored public key 1 carried in the message 1. If the public key 2 carried in the message 1 is the same as the public key 1 stored in the network device 1, the terminal is considered to be authenticated.
  • the network device 1 authenticates the terminal according to the key certificate. Specifically, the terminal generates a globally unique key pair in advance, for example, at the factory stage, generating a key pair 1 including the public key 1 and the private key 1 based on the PUF.
  • the terminal sends the public key 1 to the CA for certificate issuance, and the public key certificate is issued by the CA, and is returned to the terminal, where the public key certificate carries the public key 1.
  • the public key certificate is issued by the CA, so that it is not necessary to configure the public key 1 in the network device 1 in advance, which simplifies the configuration process.
  • the terminal requests to acquire the device ID, the terminal carries the public key certificate in the message 1. After receiving the message 1, the network device 1 verifies the public key certificate carried in the message 1, and if the verification succeeds, it confirms that the terminal passes the identity verification.
  • the ID management system in the network device 2 only allocates the device ID to the authenticated terminal, thereby effectively avoiding resource consumption caused by the non-trusted terminal to apply for the ID management system.
  • S302 does not necessarily operate. When S302 is not executed, after S301, S303 is executed.
  • the network device 1 generates a key pair 2, and the key pair 2 includes a public key 2 and a private key 2.
  • the network device 1 sends the encrypted key pair 2 and the information 1 to the terminal.
  • the network device 1 After receiving the message 1, the network device 1 generates the key pair 2 in response to the request of the terminal.
  • the key pair 2 can be generated by the ID management system in the network device 2, and the information 1 is used to identify the public key 2 as the device ID.
  • Information 1 can be either a message type or a corresponding bit in the message.
  • the key pair 2 and the information 1 may be carried in the same message or may be carried in different messages.
  • the method for encrypting the key pair 2 by the network device 1 is similar to the method for encrypting the key pair 2 by the network device 1 in the method 200. For details, refer to the related description in S206 of the method 200, and details are not described herein again.
  • the terminal receives and saves the key pair 2.
  • the terminal After the terminal receives the key pair 2, the key pair 2 is saved.
  • the terminal encrypts the stored key pair 2 by using the public key 1 generated by the PUF or encrypts only the stored private key 2 by using the public key 1, and the private key corresponding to the public key 1. 1 is used for decoding. Since the public key 1 and the private key 1 are generated based on the PUF, it is not easy to counterfeit, and therefore, the storage security of the private key 2 can be improved.
  • the terminal may also encrypt the key pair 2 or at least the private key 2 by using other keys or other manners to improve the storage security of the private key 2.
  • the terminal determines that the public key 2 is the device ID.
  • the terminal acquires the key pair 1, and according to the indication of the information 1, determines that the public key 2 is the device ID, so that the terminal obtains its own device ID.
  • the operation of storing the key pair 2 by the terminal and the operation of S306 are not sequential, that is, the terminal may save the key pair 2 before S306, or may save the key pair 2 after S306, or may complete The key pair 2 is saved while the S306 is operating.
  • FIG. 4 is a schematic flowchart of a terminal registration method 400 according to an embodiment of the present application.
  • method 400 can be performed after S305 in method 300.
  • Method 400 is described below in conjunction with FIG. Method 400 includes the following operations.
  • the terminal sends a registration request to the network device 2.
  • the registration request carries the public key 2 as the device ID.
  • the network device 2 and the network device 1 are deployed in the same network architecture, and the device management system is deployed in the network device 2.
  • the network device 1 may be the network device 108 in the network architecture shown in FIG. 1
  • the network device 2 may be the network device 107 in the network architecture shown in FIG. 1.
  • the network device 2 After receiving the registration request, the network device 2 sends a transmission confirmation request to the network device 1, and the confirmation request carries the public key 2, and the confirmation request is used to confirm whether the terminal has completed registration authentication in the network device 1.
  • the network device 1 receives the confirmation request, and verifies whether the terminal is registered according to the public key 2 stored locally and the public key 2 carried in the confirmation request. Specifically, the network device 1 can query whether the public key 1 of the terminal is saved in the ID management system. If the ID management system saves the public key 2, it indicates that the network device 1 has configured the device ID for the terminal, that is, the terminal is in the ID. Registration is completed in the management system.
  • the network device 1 confirms that the terminal is successfully registered, and sends an acknowledgement response to the network device 2, for indicating to the network device 2 that the terminal registration is successful.
  • the network device 2 may send a registration response to the terminal to notify the terminal that the registration is successful in the network device 2.
  • FIG. 5 is a schematic flowchart diagram of another terminal registration method 500 according to an embodiment of the present application.
  • method 500 can be performed after S303 in method 300.
  • Method 500 will now be described in conjunction with FIG. Method 500 includes the following operations.
  • the network device 1 sends the public key 2 and the information 2 to the network device 2.
  • Information 2 is used to indicate that the public key 1 is a device ID.
  • the information 1 can be, for example, a message type or a corresponding bit in the message.
  • Public key 1 and information 2 can be carried in the same message or in different messages.
  • the network device 2 and the network device 1 are deployed in the same network architecture, and the device management system is deployed in the network device 2.
  • the network device 1 may be the network device 108 in the network architecture shown in FIG. 1
  • the network device 2 may be the network device 107 in the network architecture shown in FIG. 1.
  • the network device 2 After receiving the public key 2, the network device 2 confirms that the public key 2 is the device ID based on the indication of the information 2.
  • the network device 2 holds the public key 2, for example, the public key 2 is stored in a database of the device management system.
  • the network device 2 receives the registration request sent by the terminal, where the registration request carries the public key 2 as the device ID.
  • the network device 2 verifies the terminal according to the saved public key 2 and the public key 2 in the registration request.
  • the network device confirms that the saved public key 2 is the same as the public key 2 in the registration request, and the terminal verification is considered to pass.
  • the network device sends a registration response to the terminal, where the terminal is successfully registered.
  • method 500 can also include S505: the terminal transmits message 2 signed by private key 2 to network device 2.
  • Message 2 can be used to confirm to the network device 2 that the terminal registration is successful.
  • the message 2 can also be used to report the device ID, that is, the public key 2, the device status information, the device location information, and/or the device type, to the device management system deployed in the network device 2.
  • the operation to be performed by the message 2 can be identified by the message type in the message 2 or by the corresponding bit in the message 2.
  • Message 2 can carry the public key 2 as the device ID.
  • the network device 2 After receiving the message 2, the network device 2 can verify the signature of the message 2 by using the public key 2, and then verify the identity of the terminal.
  • S501 may be completed before S304, or may be completed after S304, or may be completed simultaneously with S304; S501 This may be completed before S305, or may be completed after S305, or may be completed simultaneously with S305; S501 may be completed before S306, may be completed after S306, or may be completed simultaneously with S306.
  • S502 is executed after S306.
  • the method 500 may further include: the S505 terminal sends the message 3 signed by the private key 2 to the network device 3.
  • the network device 3 may be other terminals than the terminal.
  • the information is exchanged between the terminal and the network device 3.
  • the terminal uses the private key 2 to sign the information carried in the message 3.
  • the message 3 carries the public key 2 as the device ID.
  • the network device 3 can directly extract the public key 2 from the message 3, so that the signature of the message 3 can be verified without pre-acquiring the public key 2, and then the identity of the terminal is verified.
  • FIG. 6 is a schematic flowchart of a method 600 for acquiring a device ID according to an embodiment of the present application.
  • the network architecture of the application method 600 includes at least a terminal and a network device 1.
  • the terminal may be the terminal 101 shown in FIG. 1.
  • the network device 1 may be the network device 107 or the network device in the network architecture shown in FIG. 108.
  • a device management system and an ID management system are deployed in the network device 1, wherein the ID management system can be, for example, an IDaas system.
  • the network architecture can be the network architecture shown in FIG. Method 600 includes the following operations.
  • the terminal sends a message 1 to the network device 1.
  • the message 1 is used to request the device ID of the terminal from the ID management system, and simultaneously makes a registration request to the device management system.
  • the message 1 can be identified by the message type.
  • the message 1 is used to request the device ID for the terminal and to register with the device management system.
  • the message 1 can also be identified by the corresponding bit for requesting the device ID for the terminal and the device management system. Sign up.
  • the method 600 may further include: S602, the network device 1 authenticates the terminal.
  • the manner in which the network device 1 authenticates the terminal is the same as the method in which the network device 1 authenticates the terminal in the method 300.
  • the ID management system in the network device 2 only allocates the device ID to the authenticated terminal, thereby effectively avoiding resource consumption caused by the non-trusted terminal to apply for the ID management system.
  • S602 does not necessarily operate. When S602 is not executed, after S601, S603 is executed.
  • the network device 1 generates a key pair 2, and the key pair includes a public key 2 and a private key 2.
  • the network device 1 sends the encrypted key pair 2 and the information 1 to the terminal.
  • the network device 1 After receiving the information 1, the network device 1 generates a key pair 2 in response to the request of the terminal, wherein the key pair 2 can be generated by the ID management system in the network device 1.
  • Information 1 is used to identify the above public key 2 as the device ID.
  • Information 1 can be either a message type or a corresponding bit in the message.
  • the key pair 2 and the information 1 may be carried in the same message or may be carried in different messages.
  • the method for encrypting the key pair 2 by the network device 1 is similar to the method for encrypting the key pair 2 by the network device 1 in the method 200. For details, refer to the related description in S206 of the method 200, and details are not described herein again.
  • the terminal receives and saves the key pair 2.
  • the terminal After the terminal receives the key pair 2, the key pair 2 is saved.
  • the terminal encrypts the stored key pair 2 by using the public key 1 generated by the PUF or encrypts only the stored private key 2 by using the public key 1, and the private key corresponding to the public key 1. 1 is used for decryption. Since the public key 1 and the private key 1 are generated based on the PUF, it is not easy to counterfeit. Therefore, the storage security of the private key 2 can be improved.
  • the terminal may also use other keys or other methods to encrypt the key pair 2 and at least the private key 2 to improve the storage security of the private key 2.
  • the terminal determines that the public key 1 is the device ID.
  • the terminal acquires the key pair 1, and according to the indication of the information 1, determines that the public key 1 is the device ID.
  • the terminal may save the key pair 2 before S606, or may save the key pair 2 after S606, or may complete The key pair 2 is saved while the S606 is operating.
  • the method 600 may further include: S607: The terminal sends the message 2 signed by the private key 2 to the network device 1.
  • the message 2 can be used to confirm that the terminal registration is successful to the device management system deployed in the network device 1.
  • the message 2 can also be used to report the device ID, that is, the public key 2, the device status information, the device location information, and/or the device type, to the network device 1.
  • the operation to be performed by the message 2 can be identified by the message type in the message 2 or by the corresponding bit in the message 2.
  • Message 2 can carry the public key 2 as the device ID.
  • the network device 1 After receiving the message 2, the network device 1 can verify the signature of the message 2 by using the public key 2, and then verify the identity of the terminal.
  • the method 600 may further include: the terminal transmitting the message 3 signed by the private key 2 to the network device 3.
  • the network device 3 may be other terminals than the terminal.
  • the information is exchanged between the terminal and the network device 3.
  • the terminal uses the private key 2 to sign the information carried in the message 3.
  • the message 3 carries the public key 2 as the device ID.
  • the network device 3 can directly extract the public key 2 from the message 3, so that the signature of the message 3 can be verified without pre-acquiring the public key 2, and then the identity of the terminal is verified.
  • FIG. 7 is a schematic flowchart diagram of still another method 700 for acquiring a device ID according to an embodiment of the present application.
  • the network architecture of the application method 700 includes at least a terminal and a first network device.
  • the terminal may be the terminal 101 in the network architecture shown in FIG. 1
  • the first network device may be the network device 108 in the network architecture shown in FIG. 1.
  • a device management system and/or an ID management system are deployed in the first network device.
  • the network architecture can be the network architecture shown in FIG. Method 700 includes the following operations.
  • the terminal sends, to the first network device, a first message for requesting, by the terminal, the device ID, where the device ID is used to globally uniquely identify the terminal.
  • the first message may be a TCP message or a UDP message.
  • the first message may identify the first message by using the message type for requesting the device ID, or may identify the first message by using the corresponding bit for requesting the device ID.
  • the terminal receives an encrypted key pair sent by the first network device, where the key pair includes a first public key and a first private key.
  • the terminal receives the information sent by the first network device, where the information is used to identify that the first public key is a device ID of the terminal.
  • This information can be either the message type or the corresponding bit in the message.
  • the information sent in S703 and the key pair sent in S702 may be carried in one message or may be carried in different messages.
  • the key pair received by the terminal at S702 and the information received in S703 may be carried in the same message, or may be carried in different messages.
  • S702 and S703 can be understood to be completed by the same operation, or can be understood to be performed by two operations.
  • S703 may be performed before, after, or simultaneously with S702.
  • the terminal determines that the first public key is the device ID.
  • the terminal acquires the key pair and the information, and determines, according to the indication of the information, that the first public key is the device ID, so that the terminal determines to obtain its own device ID.
  • the device management system is deployed in the first network device, and the method 700 may further include: S705, the terminal sending the first private key signature to the first network device a second message, the second message carrying the first public key as a device ID of the terminal.
  • the second message can be used to confirm that the terminal registration is successful to the device management system deployed in the first network device.
  • the second message may also be used to report the device ID, that is, the first public key, the device status information, the device location information, and/or the device type, to the first network device.
  • the operation to be performed by the second message may be identified by the message type in the second message or by the corresponding bit in the second message.
  • the second message may carry the first public key as the device ID.
  • the first network device may verify the signature of the second message by using the first public key, and then verify the identity of the terminal.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on the PUF.
  • the terminal may precede the S701, for example, at the terminal of the terminal, the terminal generates a second public key and a second private key based on the PUF.
  • the network administrator or the network management system may configure the second public key in advance to the network device deployed with the ID management system; or the terminal sends the second public key to the CA, and the certificate is issued by the CA, and the public key issued by the CA The certificate is returned to the terminal.
  • Carrying the second public key in the first message including: directly carrying the second public key in the first message; or the first message carrying the public key certificate issued by the CA, the public key certificate Carrying the second public key.
  • the terminal When the terminal requests to acquire the device ID, the terminal carries the second public key in the first message. If the ID management system is deployed in the first network device, the first network device authenticates the terminal according to the second public key carried in the first message and the second public key saved in the first message. If the ID management system is not deployed in the first network device, and only the device management system is deployed, the first network device, after receiving the first message sent by the terminal, generates and sends the second public device to the second network device. The second message of the key. The ID management system is deployed in the second network device and the second public key is saved. After receiving the second message, the second network device performs identity verification on the terminal according to the second public key carried in the second message and the second public key saved by the second message.
  • the receiving, by the terminal, the encrypted key pair sent by the first network device includes:
  • the terminal After receiving the key pair encrypted by the second public key and sent by the first network device, the terminal can only use the second private key corresponding to the second public key for decryption. Since the second public key and the second private key are keys generated by the terminal based on the PUF, and only the terminal itself stores the second private key, the second private key is difficult to counterfeit, and the transmission of the key pair can be effectively improved. .
  • the method further includes:
  • the terminal saves the first private key, and encrypts the saved first private key by using the second public key.
  • the first private key is used to sign the packet to be sent by the subsequent terminal, and the first private key is encrypted by the second public key, which can effectively ensure the storage security of the first private key.
  • FIG. 8 is a schematic flowchart diagram of still another method 800 for acquiring a device ID according to an embodiment of the present application.
  • the network architecture of the application method 800 includes at least a terminal and a first network device.
  • the terminal may be the terminal 101 in the network architecture shown in FIG. 1
  • the first network device may be the network device 108 in the network architecture shown in FIG. 1.
  • a device management system and/or an ID management system are deployed in the first network device.
  • the network architecture can be the network architecture shown in FIG. Method 800 includes the following operations.
  • the first network device receives a first message that is sent by the terminal to request the device ID for the terminal, where the device ID is used to globally uniquely identify the terminal.
  • the first message may be a TCP message or a UDP message.
  • the first message may identify the first message by using the message type for requesting the device ID, or may identify the first message by using the corresponding bit for requesting the device ID.
  • the first network device sends an encrypted key pair to the terminal, where the key pair includes a first public key and a first private key.
  • the first network device sends first information to the terminal, where the first information is used to identify that the first public key is a device ID of the terminal.
  • the first information may be a message type or a corresponding bit in the message.
  • the key pair sent in S802 and the first information sent in S803 may be carried in the same message, or may be carried in different messages.
  • S802 and S803 can also be understood to be completed by the same operation.
  • S803 may be performed before, after, or simultaneously with S802.
  • the first private key is used to sign a second message sent by the terminal to the first network device, and the second message carries the first public key that is the device ID of the terminal.
  • a device management system is deployed in the first network device.
  • the second message can be used to confirm that the terminal registration is successful to the device management system deployed in the first network device.
  • the second message may also be used to report the device ID, that is, the first public key, the device status information, the device location information, and/or the device type, to the first network device.
  • the operation to be performed by the second message may be identified by the message type in the second message or by the corresponding bit in the second message.
  • the second message may carry the first public key as the device ID.
  • the first network device may verify the signature of the second message by using the first public key, and then verify the identity of the terminal.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on a physical unclonable function PUF.
  • the terminal generates a second public key and a second private key based on the PUF before transmitting the first information to the first network device, for example, at a terminal stage of the terminal.
  • the network administrator or the network management system may configure the second public key in advance to the network device deployed with the ID management system; or the terminal sends the second public key to the CA, and the certificate is issued by the CA, and the public key issued by the CA The certificate is returned to the terminal.
  • Carrying the second public key in the first message including: directly carrying the second public key in the first message; or the first message carrying the public key certificate issued by the CA, the public key certificate Carrying the second public key.
  • the terminal requests to acquire the device ID, the terminal carries the second public key in the first message.
  • the first network device is configured with an ID management system. After the terminal generates the second public key, the terminal may configure the first network device by using a network administrator or a network management system. Two public keys. When the terminal device requests to obtain the device ID, the second public key is carried in the first message. After receiving the first message, the first network device performs identity verification on the terminal according to the second public key carried in the first message and the second public key saved by the first message. The first network device determines that the second public key carried by the first message is the same as the second public key that is saved by itself, and determines that the terminal passes the identity verification.
  • the device management system is deployed in the first network device, and the ID management system is not deployed. After the first network device receives the first message, the first network device sends the Before the terminal sends the encrypted key pair, the method further includes:
  • the first network device generates a third message, where the third message carries the second public key, and the second public key is used to perform identity verification on the terminal by the second network device;
  • the second network device is configured with the ID management system. After the terminal generates the second public key, the second public key may be configured in the second network device by using a network administrator or a network management system. When the terminal device requests to obtain the device ID, the second public key is carried in the first message. After receiving the first message, the first network device generates and sends the third message to the second network device. The second network device receives the third message, and performs identity verification on the terminal based on the second public key carried in the third message and the second public key saved by itself. The second network device determines that the second public key carried by the third message is the same as the second public key saved by itself, and determines that the terminal passes the identity verification.
  • the first network device sends the encrypted key pair to the terminal, including: the first network device sends the key encrypted by the second public key to the terminal Correct.
  • the uniqueness of the device ID can be effectively ensured, especially in the scenario of the Internet of Things mass device, the device ID can be effectively avoided.
  • the private key of the public key pair is used to sign the information sent by the terminal, so that the communication credential does not need to be configured in advance, and there is no need to negotiate an additional key, which greatly saves configuration in a massive terminal scenario.
  • Authentication credentials and the overhead required to negotiate keys greatly simplify the configuration process and improve processing efficiency.
  • the method for acquiring a device ID according to an embodiment of the present application is described above with reference to FIG. 2 to FIG. 8 .
  • the terminal and the network device corresponding to the foregoing method embodiments will be described with reference to FIG. 9 and FIG. 10.
  • FIG. 9 is a schematic diagram of a terminal 900 according to an embodiment of the present application.
  • the terminal 900 can be applied to the network architecture shown in FIG. 1, for example, the terminal 101 in the network architecture shown in FIG. 1.
  • the terminal 900 can include a processor 910, a memory 920 coupled to the processor 910, and a transceiver 930.
  • the processor 910 may be a central processing unit (English: central processing unit, abbreviated: CPU), a network processor (English: network processor, abbreviation: NP) or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (abbreviated as PLD), or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field-programmable gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array Logic, abbreviation: GAL) or any combination thereof.
  • Processor 910 may refer to one processor or multiple processors.
  • the memory 920 may include a volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) For example, read-only memory (English: read-only memory, abbreviation: ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid state drive (English: solid-state drive , abbreviation: SSD); the memory may also include a combination of the above types of memory.
  • the memory 920 can include a plurality of software modules, such as a transmitting module 921, a processing module 922, and a receiving module 923.
  • the processor 910 can be used to perform a plurality of operations by executing the instructions in the software modules described above.
  • the memory 920 may refer to one memory or may include a plurality of memories.
  • processor 910 when a module is configured to perform an operation, it may actually represent that processor 910 is configured to execute instructions in the module to perform the operations described above.
  • processor 910 By executing the instructions in memory 920, processor 910 can perform some or all of the operations performed by the terminals described in methods 200, 300, 400, 500, 600, 700, or 800.
  • the processor 910 may send the message 1 requesting the device ID to the network device 1 through the transceiver 930, and receive the key pair including the public key 1 and the key 1 and the identification public key sent by the network device 1 through the transceiver 930.
  • 1 is information of a device ID, and it is determined that the public key 1 is a device ID of the terminal according to the received key pair and information.
  • the sending module 921 is configured to send, to the network device, a first message for requesting the device ID for the terminal, where the device ID is used to globally uniquely identify the terminal.
  • the receiving module 923 is configured to receive an encrypted key pair sent by the network device, where the key pair includes a first public key and a first private key, and is further configured to receive information sent by the network device, where the information The device ID used to identify the first public key is the terminal.
  • the processing module 922 is configured to determine that the first public key is the device ID.
  • the sending module 921 is further configured to send, to the network device, a second message that is signed by the first private key, where the second message carries the first public key that is a device ID of the terminal.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on a physical unclonable function.
  • the receiving module 923 is further configured to receive, by the network device, the key pair that is encrypted by the second public key.
  • FIG. 10 is a schematic diagram of a network device 1000 according to an embodiment of the present application.
  • the network device 1000 can be applied to the network architecture shown in FIG. 1, for example, the network device 107 or the network device 108 in the network architecture shown in FIG. 1.
  • the network device 1000 can include a processor 1010, a memory 1020 coupled to the processor 1001, and a transceiver 1030.
  • the processor 1010 can be a CPU, NP or a combination of a CPU and an NP.
  • the processor may further include a hardware chip.
  • the above hardware chip may be an ASIC, a PLD, or a combination thereof.
  • the above PLD may be a CPLD, an FPGA, a GAL, or any combination thereof.
  • the processor 1010 may refer to one processor or multiple processors.
  • the memory 1020 may include a volatile memory (English: volatile memory), such as a RAM; the memory may also include a non-volatile memory, such as a ROM, a flash memory, or an HDD. Or SSD; the memory may also comprise a combination of the above types of memory.
  • the memory 1020 can include a plurality of software modules, such as a transmitting module 1021, a processing module 1022, and a receiving module 1023.
  • the processor 1010 can be used to perform a plurality of operations by executing instructions in the software modules described above.
  • the memory 1020 may refer to one memory or may include a plurality of memories.
  • processor 1010 when a module is configured to perform an operation, it can represent that processor 1010 is configured to execute instructions in the module to perform the operations described above.
  • processor 1010 by executing instructions in memory 1020, processor 1010 can execute network device 1 in method 200, 300, 400, 500, or 600, and portions of method 700 or method 800 performed by a first network device or All operations.
  • the processor 1010 may receive, by the transceiver 1030, a message 1 for the terminal to send the requesting device ID, and send, by the transceiver 1030, a key pair including the public key 1 and the key 1 and the public key 1 as the device ID. information.
  • the receiving module 1023 is configured to receive a first message sent by the terminal for requesting the device ID for the terminal, where the device ID is used to globally uniquely identify the terminal.
  • the sending module 1021 is configured to send an encrypted key pair to the terminal, where the key pair includes a first public key and a first private key.
  • the sending module 1021 is further configured to send the first information to the terminal, where the first information is used to identify that the first public key is a device ID of the terminal.
  • the receiving module 1023 is further configured to receive a second message that is sent by the terminal and that is signed by the first private key, where the second message carries the first public that is the device ID of the terminal. key.
  • the first message carries a second public key
  • the second public key is a public key generated by the terminal based on a physical unclonable function PUF.
  • the processing module 1022 is further configured to: generate a third message, where The third message carries the second public key, the second public key is used to authenticate the terminal by the second network device; the third message is sent to the second network device; and the receiving station The key pair and the second information that are sent by the second network device, where the second information is used to indicate that the first public key included in the key pair is the device ID.
  • the processing module 1022 is further configured to send, to the terminal, the key pair encrypted by the second public key.
  • the first message carries a public key certificate issued by a certificate authority CA
  • the public key certificate carries the second public key
  • the processor 1010 may also perform, in whole or in part, the network device 2, the method 400, and the network device 2 in the method 500, the network device 1 in the method 600, by executing the instructions in the memory 1020. Or all operations performed by the second network device in method 800.
  • the transceiver may be a wired transceiver, a wireless transceiver, or a combination thereof.
  • the wired transceiver can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless transceiver can be, for example, a wireless local area network transceiver, a cellular network transceiver, a machine, or a combination thereof.
  • a bus interface which may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by the processor and various circuits of memory represented by the memory.
  • the bus interface can also link various other circuits, such as peripherals, voltage regulators, and power management circuits, as is known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • the transceiver provides means for communicating with various other devices on a transmission medium.
  • the processor is responsible for managing the bus architecture and the usual processing, and the memory can store the data that the processor uses when performing operations.
  • the present application also provides a communication system, including a terminal and a network device, and the terminal may be the terminal provided by the corresponding embodiment of FIG.
  • the network device may be the network device provided in the corresponding embodiment of FIG.
  • the communication system is for performing the method of any of the embodiments of Figures 2-8.
  • the steps of the method or algorithm described in the embodiments of the present application may be directly embedded in hardware, a software unit executed by a processor, or a combination of the two.
  • the software unit can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art.
  • the storage medium can be coupled to the processor such that the processor can read information from the storage medium and can store information to the storage medium, which can also be integrated into the processor.
  • the size of the sequence number of each process does not mean the order of execution sequence, and the order of execution of each process should be determined by its function and internal logic, and should not be taken by the embodiment of the present application.
  • the implementation process constitutes any qualification.
  • modules and method operations of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. The skilled person can use different methods for each particular application to implement the described functionality.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本申请提供了一种获取设备标识ID的方法，终端和网络设备。该方法包括：终端向网络设备发送用于获取设备ID的第一消息，所述设备ID用于全局唯一的标识所述终端；所述终端接收所述网络设备发送的经过加密的密钥对，所述密钥对包括第一公钥和第一私钥；所述终端接收所述网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID；所述终端确定所述第一公钥为所述设备ID。该方法能够有效避免设备ID重复，简化配置流程，节省***开销，提高获取设备ID的整体方案的安全性和可用性。

Description

一种获得设备标识的方法及装置
本申请要求于2018年02月12日提交中国专利局、申请号为201810147255.9、申请名称为“一种获得设备标识的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，涉及一种获得设备标识的方法以及装置，尤其是涉及一种物联网中获得终端的设备标识的方法及装置。
背景技术
物联网(英文：Internet of things，IoT)是通过使用射频识别(英文：Radio Frequency Identification，RFID)、传感器、红外感应器、全球定位***、激光扫描器等信息采集设备，按约定的协议，把任何物品与互联网连接起来，进行信息交互和通信，以实现智能化识别、定位、跟踪、监控和管理的一种网络。物联网将各种具备信息传感功能的终端，通过移动通信网络和物联网平台连接。
具备信息传感功能的终端也可以称之为终端设备或物联网终端或物联网设备。随着物联网产业蓬勃发展，海量不同类型的终端通过固定或者移动互联网的互联网协议(英文：Internet Protocol，IP)数据通道与网络和应用进行信息交互，为此，需要为终端分配设备标识，以便于对终端进行管理。
在传统网络中，通常采用预配置的方式来配置终端的设备标识。例如，对于移动终端，运营商提供给终端的用户标识信息和出厂时写入终端的识别信息计算生成终端的身份识别标识，用于移动终端的认证。对于有线终端，运营商提供的入网密钥和出厂时写入终端的识别信息生成身份识别标识。由于不同的厂家采用不同的配置方式，不同厂家为终端配置的标识的类型，规格可能都不相同。另外，也存在不同厂家为不同的终端配置了相同标识的情形。上述情况给物联网中的设备管理带来一定的复杂性。
为了配置全局唯一的设备标识，对于移动终端，现有技术中采用例如国际移动设备标识(英文：international mobile equipment identify，IMEI)来对终端进行唯一标识，但是需要预先到注册机构进行注册，配置流程相对复杂，并且注册成本高，标识循环使用效率低。
进一步地，采用上述方式生成的设备标识存在过于简单而被盗用身份的问题，在被盗窃或者非法入侵时，限于设备标识过于简单，很容易被仿冒成功。
作为安全管理的重要一环，如何对设备进行可信认证，如何生成唯一的的设备标识，以便于管理，简化配置流程，以及提高获得设备标识的整体方案的安全性和可用性，成为目前亟待解决的问题。
发明内容
有鉴于此，本申请实施例提供了一种获取设备ID的方法，用于提供一种具有更高的安全性和可用的获得设备ID的整体方案。
第一方面，本申请实施例提供了一种获取设备ID的方法，该方法包括：终端向网络设备发送用于为该终端请求所述设备ID的第一消息，所述设备ID用于全局唯一的标识所述终端。该终端接收该网络设备发送的经过加密的密钥对，该密钥对包括第一公钥和第一私钥。该终端接收该网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID。该终端基于接收到的所述密钥对和所述信息，确定所述第一公钥为所述设备ID。
该终端接收所述网络设备发送的密钥对和该终端接收到的该网络设备发送的信息可以是携带在同一消息中，也可以是携带在不同的消息中的。当所述密钥对和所述信息携带在同一个消息中时，该终端接收该网络设备发送的经过加密的密钥对的操作(为了便于表述，简称为操作1)以及该终端接收该网络设备发送的信息的操作(操作2)可以被理解成是由同一个操作完成的。当所述密钥对和所述信息携带在不同的消息中时，操作1可以在操作2之前，之后或者与操作2同时执行。
在上述方案中，由终端生成获取设备ID的请求，网络设备基于接收到的请求，向终端发送密钥对，并向终端发送信息指示密钥对中包括的公钥为所述设备ID。由此，网络设备基于终端的请求，动态的向终端分配设备ID，无需采用预配置的方式对终端进行ID分配，也无需预先到注册机构进行注册，简化了配置流程，节省了注册成本，并且由于无需预配置设备ID，提高了设备ID的循环使用效率。另外，采用密钥对中的公钥作为设备ID，保证了设备ID的唯一性，避免设备ID发生重复，并且基于公钥的设备ID相对现有的设备ID相对复杂，降低了设备标识过于简单而被仿冒的可能性。
在一个可能的设计中，所述方法还包括：所述终端向所述网络设备发送经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的的设备ID的所述第一公钥。
在一个可能的设计中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能生成的公钥。
在一个可能的设计中，所述终端接收所述网络设备发送的经过加密的密钥对，包括：所述终端接收所述网络设备发送的经过所述第二公钥加密的所述密钥对。终端接收到网络设备发送的经过第二公钥加密的所述密钥对以后，只能采用与所述第二公钥对应的第二私钥进行解密。由于第二公钥和第二私钥是终端基于PUF生成的密钥，并且只有终端自身保存有所述第二私钥，因此，第二私钥难以仿冒，能够有效提高密钥对的传输安全。
在一个可能的设计中，所述终端接收所述网络设备发送的经过加密的密钥对之后，所述方法还包括：所述终端保存所述第一私钥，采用所述第二公钥对保存的所述第一私钥进行加密。通过第二公钥对存储的第一私钥进行加密，只能通过与所述第二公钥对应的第二私钥才能解密，因为第二公钥和第二私钥是基于PUF生成的，并且，只有终端自身拥有所述第二私钥，因此第二私钥无法轻易被仿冒，能够有效保证第一私钥的存储安全。
在一个可能的设计中，所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。通过CA签发证书，使得不必提前将第二公钥部署到网络设备中，简化了配置流程。
第二方面，本申请提供了一种获取设备ID的方法，该方法包括：第一网络设备接收终端发送的用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一地标识所述终端；所述第一网络设备向所述终端发送经过加密的密钥对，所述密钥对包括第一公钥和第一私钥；所述第一网络设备向所述终端发送第一信息，所述第一信息用于标识所述第一公钥为所述终端的设备ID。第二方面所提供的方法的技术效果参见第一方面的说明，此处不再赘述。
所述网络设备向所述终端发送的所述密钥对和所述网络设备向所述终端发送的所述信息可以是携带在同一个消息中的，也可以是携带在不同的消息中的。当所述密钥对和所述信息是携带在同一个消息中时，所述第一网络设备向所述终端发送经过加密的密钥对的操作(为了便于表述，称之为操作1)和所述第一网络设备向所述终端发送第一信息(操作2)也可以被理解成是由同一个操作完成的。当所述密钥对和所述信息是携带在不同的消息中时，操作1可以在操作2之前，之后或者与操作2同时执行。
在一个可能的设计中，所述第一网络设备中部署有设备管理***，所述第一网络设备接收所述终端发送的经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的设备ID的所述第一公钥。该第二消息可以用于向第一网络设备中部署的设备管理***上报设备ID，即第一公钥、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过第二消息中的消息类型，也可以通过第二消息中相应的比特位来标识第二消息所要执行的操作。第二消息中可以携带作为设备ID的第一公钥。第一网络设备接收到第二消息后，可以采用第一公钥验证签名，进而对终端的身份进行验证。由此，由于在上述方案中，网络设备基于终端发送的获取设备ID的请求，向终端返回一个密钥对。终端采用密钥对中的公钥作为设备ID，采用密钥对中的私钥对待发送的报文进行签名，以对终端进行身份验证。无需重新配置新的认证凭据，在海量物联网终端的场景下，有效的简化了配置流程，降低了***开销。
在一个可能的设计中，所述第一网络设备中部署有设备管理***，所述第二网络设备中部署有ID管理***。在所述第一网络设备接收所述第一消息之后，所述第一网络设备向所述终端发送经过加密的密钥对之前，所述方法还包括：所述第一网络设备向第二网络设备发送第三消息，所述第三消息用于为所述终端请求所述设备ID；所述第一网络设备接收所述第二网络设备返回的所述密钥对以及第二信息，所述第二信息用于指示所述密钥对中包括的所述第一公钥为所述设备ID。
在一个可能的设计中，第一网络设备中部署有ID管理***，所述第一网络设备接收到携带有所述第二公钥的第一消息后，基于所述第二公钥和自身保存的第二公钥，对所述终端进行身份验证。
在一个可能的设计中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能PUF生成的公钥。
在一个可选的设计中，所述第三消息中携带所述第二公钥，所述第二网络设备基于第三消息中携带的所述第二公钥，对所述终端进行身份验证。具体来说，所述第一网络设备接收携带有所述第二公钥的所述第一消息后，基于所述第一消息，获取所述第二公钥，生成并向所述第二网络设备发送携带所述第二公钥的所述第三消息。第二 网络设备基于所述第三消息中携带的所述第二公钥和自身保存的第二公钥，对所述终端进行身份验证。该第二网络设备确定所述终端通过身份验证，则生成并向所述第一网络设备发送所述密钥对和所述第二信息。该第二网络设备确定第三消息中携带的所述第二公钥和自身保存的第二公钥相同，则确定所述终端通过身份验证，
通过对终端进行身份验证，使得ID管理***只对通过身份验证的终端分配设备ID，有效避免非可信的终端申请对ID管理***带来的资源消耗。S302不是必须地操作。
在一个可能的设计中，所述第一网络设备向所述终端发送经过加密的密钥对，包括：所述第一网络设备向所述终端发送经过所述第二公钥加密的所述密钥对。终端接收到网络设备发送的经过第二公钥加密的所述密钥对以后，只能采用与所述第二公钥对应的第二私钥进行解密。由于第二公钥和第二私钥是终端基于PUF生成的密钥，并且只有终端自身保存有所述第二私钥，因此，第二私钥难以仿冒，能够有效提高密钥对的传输安全。
在一个可能的设计中，所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。通过CA签发证书，使得不必提前将第二公钥部署到网络设备中，简化了配置流程。
第三方面，本申请实施例提供了一种终端，用于执行第一方面或第一方面任意可能的设计中的方法。具体地，该终端包括用于执行第一方面或第一方面任意可能的实施方式中的方法的模块。
第四方面，本申请实施例提供了一种网络设备，用于执行第二方面或第二方面任意可能的设计中的方法。具体地，该终端包括用于执行第二方面或第二方面任意可能的实施方式中的方法的模块。
第五方面，本申请实施例提供了一种终端，包括：收发机、处理器和存储器。其中，收发机、处理器和存储器之间可以通过总线***相连。该存储器用于存储程序、指令或代码，所述处理器用于执行所述存储器中的程序、指令或代码，完成第一方面或第一方面任意可能的设计中的方法中所述终端执行的信息收发以外的操作。
第六方面，本申请实施例提供了一种网络设备，包括：收发机、处理器和存储器。其中，收发机、处理器和存储器之间可以通过总线***相连。该存储器用于存储程序、指令或代码，所述处理器用于执行所述存储器中的程序、指令或代码，完成第二方面或第二方面任意可能的设计中的方法中所述网络设备执行的信息收发以外的操作。
第七方面，本申请实施例提供了一种通信***，包括第三方面或第五方面提供的终端以及第四方面或第六方面提供的网络设备。
第八方面，本申请提实施例供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行第一方面、第二方面、第一方面任意可能的实现方式或第二方面任意可能的实现方式中的方法的指令。
根据本申请实施例提供的方法、终端、网络设备和***，通过生成一个密钥对，将其中的公钥作为设备ID，能够有效保证设备ID的唯一性，尤其在物联网海量设备的场景中，可以有效避免设备ID重复所带来的管理困难的问题。进一步地，采用公钥对中的私钥对终端发送的信息进行签名，使得通信时，无需预先配置认证凭据，也无 需协商额外的密钥，在海量终端的场景下，极大的节省了配置认证凭据，协商密钥所需的开销，极大的简化了配置流程，提高了处理效率。
附图说明
附图1为本申请实施例提供的一种物联网***架构示意图；
附图2为本申请实施例提供的一种获取设备ID的方法流程示意图；
附图3为本申请实施例提供的一种获取设备ID的方法流程示意图；
附图4为本申请实施例提供的一种终端注册方法流程示意图；
附图5为本申请实施例提供的一种终端注册方法流程示意图；
附图6为本申请实施例提供的一种获取设备ID的方法流程示意图；
附图7为本申请实施例提供的一种获取设备ID的方法流程示意图；
附图8为本申请实施例提供的一种获取设备ID的方法流程示意图；
附图9为本申请实施例提供的一种终端的结构示意图；
附图10为本申请实施例提供的一种网络设备的结构示意图。
具体实施方式
本申请实施例描述的应用场景是为了更加清楚的说明本申请实施例的技术方案，并不表示对于本申请实施例提供的技术方案只能限定于其应用场景。本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
除非有相反的说明，本申请中提及“1”、“2”、“3”、“第一”、“第二”以及“第三”等序数词用于对多个对象进行区分，不用于限定多个对象的顺序。
本申请中提及的“A和/或B”，应该理解为包括以下情形：仅包括A，仅包括B，或者同时包括A和B。
以下，对本申请中的部分用语进行简单介绍，以方便本领域技术人员理解。
本申请所述的“PUF”，是指物理不可克隆功能(英文：physical unclonable function，PUF)，是一种芯片领域的“生物特征”识别技术。在芯片制造过程中，即便两个芯片拥有相同的设计、甚至制造过程，其物理属性仍有一些不同。从分子尺度来讲，总是存在不可避免和不可控制的变量，这些变量使得每个芯片都是独一无二的。这些变量是完全随机的，而且不能消除，即使在最先进的生产线上，同一片晶圆上的芯片也会存在内部的结构差异。基于PUF提取芯片制造过程中的变量，来产生完全随机的密钥。这些密钥不可预测和安排，永久存在，即使芯片的制造商也无法仿制。PUF生成密钥的算法可以使用已有的算法，例如通用关键字密码(英文：Rivest-Shamir-Adelman，RSA)算法或数字签名算法(英文：digital signature algorithm，DSA)，本申请不再赘述。
本申请的“终端”既可以指运营商或者内容服务提供商拥有、管理或者使用的设备，也可以包括常见的用户终端设备。“终端”也可以被称为终端设备，网络设备，节点或节点设备。当应用于物联网时，也可以被称为物联网网络节点，物联网终端，终端设备，物联网设备，物联网节点设备或物联网终端设备。总之，任何具备信息传感功能的设备都可以称之为终端。终端可以是移动电话(或称为“蜂窝”电话)，个人通信业务(Personal Communication Service，PCS)电话、无绳电话、会话发起协 议(Session Initiation Protocol，SIP)话机、无线本地环路(Wireless Local Loop，WLL)站、个人数字助理(Personal Digital Assistant，PDA)等设备。终端例如还可以是各种网络设备，也可以称之为接入网设备，可以是gNB(gNode B)，可以是普通的基站(例如WCDMA***中的基站(NodeB，NB)，LTE***中的演进型基站(Evolutional NodeB，eNB或eNodeB)，GSM或CDMA中的基站(Base Transceiver Station，BTS))，可以是新无线控制器(New Radio controller，NR controller)，可以是集中式网元(Centralized Unit)，可以是新无线基站，可以是射频拉远模块，可以是移动管理实体(mobile management entity，MME)，可以是微基站，可以是分布式网元(Distributed Unit)，可以是接收点(Transmission Reception Point，TRP)或传输点(Transmission Point，TP)，还可以是云无线接入网络(Cloud Radio Access Network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备以及未来网络中的网络设备或者任何其它接入设备，但本申请实施例不限于此。终端还可以是家庭网关，智能可穿戴设备(例如，智能手表，智能手环，智能眼镜，智能耳机，智能头盔，智能戒指，智能鞋，智能项链等等)，各种家用电器(例如，冰箱，洗衣机，电视，热水器，电饭煲，微波炉，烤箱，面包机，足浴盆，空气净化器，加湿器，音箱等等)，各种交通以及运输工具(例如，汽车，飞机，火车，船，自行车，摩托车等等)，各种仪器仪表，网络设备(例如路由器，交换机，服务器，防火墙，控制器等等)等等，本申请不限于此，无法一一穷举，因此不再赘述。
本申请所述的“物联网平台”是一个比较广泛的概念，能够对物联网终端所收集的数据信息进行综合、整理、分析和反馈等操作，主要提供海量终端的管理、数据管理、运营管理和安全的管理。物联网平台融合了很多先进的技术，包括云计算、大数据、人工智能等，以满足对物联网进行信息运输和交互的需求。物联网平台可以由多个具有不同功能的处理平台组成，负责根据应用需求从感知数据中提取用于控制和决策的数据，并转化成不同的格式，便于多个应用***共享。在实际应用中，物联网平台可以是由一个或多少设备构成。从类型上，物联网平台从底层到高层可分为四个平台类型：终端管理平台、连接管理平台、应用开发平台和业务分析平台。其中，终端管理平台主要负责对物联网终端进行注册管理，身份识别，访问控制，配置，监控，查询，***升级，故障排查、生命周期管理等。连接管理平台主要负责对物联网连接配置和故障管理、网络资源用量管理、连接资源管理、套餐变更、号码/IP地址/MAC资源管理等。应用开发平台可以提供应用开发和统一数据存储的平台即服务(英文：platform as a service，Paas)平台，提供应用开发工具、中间件、数据存储、业务逻辑引擎、对接第三方应用平台接口(英文：application platform interface，API)等。业务分析平台主要用于对业务数据进行分类处理、分析并提供视觉化数据分析结果，通过实时动态分析，监控设备状态并予以预警，或通过机器学习，对业务进行分析预测。
本申请所述的“网络设备”，是指在信息交换时，用来表示任何可收发信息以及可对信息进行处理的硬件。例如可以是个人电脑，服务器，路由器，交换机等。当网络设备用于物联网平台时，可以用于执行上述终端管理平台、连接管理平台、应用开 发平台和/或业务分析平台的部分或者全部功能，网络设备中可以部署有设备管理***和/或标识(英文：identifier,ID)管理***。
本申请所述的“设备管理***”，部署在所述物联网平台中，例如，可以部署在上述的终端管理平台中。“设备管理***”是一个设备集中管理***，主要用于集中管理(包含配置、查讯，监控等)设备(例如终端)以及设备的相关业务信息。设备管理***可以部署在一台或者多台网络设备上。
本申请所述的“ID管理***”，部署在所述物联网平台中，例如，可以部署在上述的终端管理平台中。“ID管理***”例如可以是身份认证即服务(英文：Identity as a service,IDaas)***，用于管理设备(例如终端)的设备ID信息，包括创建、配置、验证、激活、查询设备ID等操作。该ID管理***可以部署在一台或者多台网络设备上。
所述ID管理***和所述设备管理***可以集成部署在同一台网络设备上，也可以分别部署在不同的网络设备上，本申请实施例对此不作具体限定。
本申请所述的“IDaas”，可称之为身份即认证服务，也可称之为身份和访问管理作为一种服务，使用的是一种云计算的基础设施来安全的管理用户身份和访问。
本申请所述的“全局唯一的公钥”，是指在拥有多个终端的网络或***中，任意一个终端生成的公钥与另一个终端生成的公钥是不同的，即不会发生重复。例如，终端1生成公钥1，其它终端，例如终端2，基于相同或者不同的算法，均无法生成和公钥1相同的公钥。
本申请所述的“全局唯一的标识”，是指在拥有多个终端的网络或***中，任意一个终端的设备ID与另一个终端的设备ID是不同的，即不会发生重复。
在本申请中，“公钥”也可以称之为“公开密钥”，“私钥”也可以称之为“私有密钥”。公钥和私钥是通过某种算法得到的一个密钥对，即密钥对由一个公钥和一个私钥组成。公钥是密钥对中公开的部分，私钥则是非公开的部分。在本申请中提及“公钥以及与该公钥对应的私钥”(或相类似的表述)则表示该私钥与公钥组成一个密钥对，类似的“私钥以及与该私钥对应的公钥”(或相类似的表述)也是表示该私钥和该公钥组成一个密钥对。
图1是本申请实施例提供的一种物联网***的***架构示意图，物联网***包括多个终端101以及与该多个终端101通信连接的物联网平台102。其中物联网平台102中包括终端管理平台103，连接管理平台104，应用开发平台105以及业务分析平台106。终端管理平台103中部署在至少一个网络设备中，图1中仅以两个网络设备(网络设备107和网络设备108)为例进行举例说明，不应构成对本申请的限制。部署终端管理平台103的网络设备中可以部署设备管理***和ID管理***。设备管理***用于对终端进行统一管理，对终端进行配置，查看以及监控终端状态和业务状态。ID管理***用于生成，更新，删除和/或验证终端的设备ID。其中，设备管理***和ID管理***可以部署在同一个网络设备中，例如网络设备107，可以由不同的芯片完成相应的功能，也可以是同一个芯片上的两个进程。设备管理***和ID管理***也可以部署在不同的网络设备中，例如设备管理***部署在网络设备107中，ID管理***部署在网络设备108中，本申请对此不作具体限定。该物联网***也可以包括证书颁 发中心(英文：certification authority，CA)109，CA是负责签发证书、认证证书、管理已颁发证书的机关。例如，CA为每个使用公开密钥的终发放一个数字证书，数字证书用于证明证书中列出的用户合法拥有证书中列出的公开密钥。需要说明的是，图1仅是示意图，仅以物联网平台和多个终端之间的交互为例来进行介绍，不应对本申请的应用场景造成限定。该物联网***中可以包括其它的终端。终端管理平台103，连接管理平台104，应用开发平台105以及业务分析平台106的功能可以分别由不同的网络设备来执行，也可以由一个网络设备来执行上述4个平台的所有功能，也可以由一个网络设备来执行上述4个平台中部分功能，另外的一个或多个网络设备来执行其他的功能，本申请对此不作具体限定。本申请实施例中对于终端以及网络设备的数量不做限定。例如，网络设备是多个的情况下，可以每个网络设备分别对一个或多个终端进行管理，也可以是多个网络设备共同对一个或多个终端进行管理。
虽然本申请中以物联网为例对本申请的应用场景进行介绍，但是本领域技术人员可以理解，本申请的技术方案适用于各种不同的网络场景，本申请对此不作具体限定。
图2是根据本申请实施例提供的一种获取设备ID的方法200的流程示意图。应用方法200的网络架构至少包括终端，网络设备1和网络设备2，举例来说，终端可以是图1所示的网络架构中的终端101，网络设备1可以是图1所示的网络架构中部署有设备管理***的的网络设备108，网络设备2可以是图1所示的网络架构中的部署有ID管理***的网络设备107，其中ID管理***例如可以是IDaas***。该网络架构可以是图1所示的网络架构。方法200包括以下操作。
S201、终端向网络设备1发送消息1。
消息1用于向网络设备1发送注册请求，同时也用于向网络设备1指示为终端请求设备ID。具体来说，终端要接入物联网时，需要在设备管理***中进行注册，在设备管理***中成功注册的终端可以接入所述物联网，进行相关的操作。
S202、网络设备1向网络设备2发送消息2。
消息2用于为终端请求设备ID。网络设备1接收到所述消息1后，基于消息1的指示，生成并向所述网络设备2发送消息2，为所述终端请求设备ID。
消息1和消息2可以是传输控制协议(英文：Transmission Control Protocol，TCP)消息，也可以是用户数据包协议(英文：User datagram protocol，UDP)消息。消息1和消息2可以通过消息类型来标识该消息2用于请求设备ID，也可以通过相应的比特位来标识该消息2用于请求设备ID。
在一个具体的实施方式中，在S202之后，方法200还可以包括：S203、网络设备2对终端进行身份验证。
网络设备2可以但不限于采用以下几种方式对终端的身份进行验证。
方式一
网络设备2根据与终端协商的认证凭据对终端进行身份验证。具体来说，网络设备2和终端预先协商认证凭据，并将协商好的认证凭据保存在本地。终端请求获取设备ID时，在消息1中携带该认证凭据。网络设备1向网络设备2发送的消息2中也携带所述认证凭据。网络设备2到消息2后，根据消息2中携带的认证凭据与本地保存的认证凭据，对终端的身份进行验证。如果消息2中携带的认证凭据与本地保存的认 证凭据匹配，则认为终端通过身份认证。
方式二
网络设备2根据全局唯一的密钥对终端进行身份验证。具体来说，终端预先生成全局唯一的密钥对，例如，在终端出厂阶段，终端基于PUF生成包括公钥1和私钥1的密钥对1，并且由网络管理员或者网络管理***将公钥1提前配置到网络设备2中。终端请求获取设备ID时，在消息1中携带公钥1。网络设备1向网络设备2发送的消息2中也携带该公钥1。网络设备2收到消息2后，根据消息2中携带的公钥1与本地保存的公钥1，对终端进行身份验证。如果消息2中携带的公钥1与网络设备2中保存的公钥1相同，则认为终端通过身份验证。
方式三：
网络设备2根据密钥证书对终端进行身份认证。具体来说，终端预先生成全局唯一的密钥对，例如，在终端出厂阶段，基于PUF生成包括公钥1和私钥1的密钥对1。终端将公钥1发送给CA，由CA签发公钥证书，并将公钥证书返回给终端，其中，该公钥证书中携带所述公钥1。采用CA签发公钥证书的方式，使得不必提前在网络设备2中配置公钥1，简化了配置流程。终端在请求获取设备ID时，在消息1中携带公钥证书。网络设备1向网络设备2发送的消息2中也携带所述公钥证书。网络设备1收到消息2后，对所述公钥证书进行验证，验证通过，则确认终端通过身份验证。
通过对终端进行身份验证，尤其是采用方式二或方式三的方法对终端进行身份验证，使得网络设备2中的ID管理***只对通过身份验证的终端分配设备ID，有效避免非可信的终端申请对ID管理***带来的资源消耗。S203不是必须的操作，当不执行S203时，在S202后，可以执行S204。
S204、网络设备2基于消息2生成密钥对2，密钥对包括公钥2和私钥2。
S205、网络设备2向网络设备1发送所述密钥对2和信息1。
网络设备2收到消息2后，响应于消息2的请求，生成密钥对2，其中密钥对2可以是由网络设备2中的ID管理***生成的，信息1用于标识上述的公钥2为设备ID。信息1可以是消息类型，也可以是消息中相应的比特位。所述密钥对2和所述信息1可以承载在同一个消息中，也可以承载在不同的消息中。
S206、网络设备1向终端发送信息2以及经过加密的所述密钥对2。
信息2用于标识上述的公钥2为设备ID。信息2可以是消息类型，也可以是消息中相应的比特位。所述密钥对2和所述信息2可以承载在同一个消息中，也可以承载在不同的消息中。
网络设备1可以但不限于采用以下方式对密钥对2进行加密。
方式一
在S201前，例如在终端出厂阶段，终端基于PUF生成密钥对1，其中密钥对1包括公钥1和私钥1。在终端生成密钥对2后，网络设备1可以采用如下方式获取公钥1：方式a.消息1中携带所述公钥1，网络设备1从消息1中提取所述公钥1并保存；或者，方式2，由网络管理员或者网络管理***将公钥1配置到网络设备1中。网络设备1向终端发送密钥对2时，采用公钥1对密钥对2进行加密保护，终端接收到经过公钥1加密的密钥对2后，采用私钥1进行解密。
在方式一中，网络设备1采用公钥2对所述密钥对1进行加密，并由终端通过终端中保存的私钥2进行解密。由于公钥2和私钥2是基于PUF生成的，并且只有终端自身保存有私钥2，因此，私钥2无法轻易被仿冒，能够有效的提高密钥对1在传输中的安全性。
方式二、网络设备1和终端之间预先协商密钥，采用协商好的密钥对密钥对2进行加密。
S207、终端接收并保存密钥对2。
终端接收密钥对2后，保存密钥对2。在一个具体的实施方式中，终端采用基于PUF生成的公钥1对存储的密钥对2进行加密或者采用公钥1仅对存储的私钥2进行加密，与公钥1相对应的私钥1用于解密。由于公钥1和私钥1是基于PUF生成，不易仿冒，因此，能够提高私钥2的存储安全。当然，终端也可以采用其它的密钥或其它的方式对密钥对2，至少对私钥2进行加密保护，以提高私钥2的存储安全。
S208、终端确定公钥1为所述设备ID。
终端获取密钥对1，并根据信息2的指示确定所述公钥1为所述设备ID，这样终端就确定获得了自己的设备ID。
需要说明的是，S207中终端保存密钥对2的操作与S208的操作的执行顺序不分先后，即终端可以在S208之前保存密钥对2，也可以在S208之后保存密钥对2，也可以在完成S208操作的同时保存密钥对2。
在一个具体的实施方式中，在S207后，方法200还可以包括：
S209、终端向网络设备1发送经过私钥1签名的消息2。
具体来说，消息2可用于向网络设备1中部署的设备管理***确认终端注册成功。消息2也可以用于向网络设备1上报设备ID，即公钥1、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过消息2中的消息类型，也可以通过消息2中相应的比特位来标识消息2所要执行的操作。消息2中可以携带作为设备ID的公钥1。网络设备1接收到消息2后，可以采用公钥1验证消息2的签名，进而对终端的身份进行验证。
其中，S209和S208的执行顺序不分先后，即S209可以在S208之前执行，S209也可以在S208之后执行，S209也可以与S208同时执行。
在一个具体的实施方式中，在S208后，方法200还可以包括：终端向网络设备3发送经过私钥1签名的消息3。
网络设备3是上述终端以外的其它终端。终端和网络设备3之间进行信息交互，终端使用私钥1对消息3携带的信息进行签名，消息3中携带作为设备ID的公钥1。网络设备3接收到消息3后，可以直接从消息3中提取公钥1，从而无需预先获取公钥1，即可验证消息3的签名，进而对终端的身份进行验证。
图3是根据本申请实施例提供的一种获取设备ID的方法300的流程示意图。应用方法300的网络架构至少包括终端和网络设备1，举例来说，终端例如可以是图1所示的网络架构中的终端101，网络设备1例如可以是图1所示的部署有ID管理***的网络设备107或部署有ID管理***的网络设备108。其中，ID管理***例如可以是IDaas***。该网络架构可以是图1所示的网络架构。方法300包括以下操作。
S301、终端向网络设备1发送消息1。
消息1用于为终端请求设备ID。消息1中可以通过消息类型来标识该消息用于请求设备ID，也可以通过相应的比特位来标识该消息1用于请求设备ID。
在一个具体的实施方式中，在S301之后，方法300还可以包括：S302、网络设备1对终端进行身份验证。
网络设备1可以但不限于采用以下几种方式对终端的身份进行验证。
方式一、网络设备1根据和终端协商的认证凭据对终端进行身份验证。具体来说，网络设备1和终端协商认证凭据，并保存认证凭据。终端请求获取设备ID时，在消息1中携带协商好的认证凭据。网络设备1收到消息1后，根据消息1中携带的认证凭据与自身保存的认证凭据，对终端的身份进行验证。网络设备1确定消息1中携带的认证凭据与本地保存的认证凭据匹配，则认为终端通过身份认证。
方式二、网络设备1根据全局唯一的密钥对终端进行身份验证。具体来说，终端预先生成全局唯一的密钥对，例如在终端出厂阶段，基于PUF生成包括公钥1和私钥1的密钥对1，并且由网络管理员或者网络管理***将公钥1提前配置到网络设备1中。终端在请求获取设备ID时，在消息1中携带公钥1。网络设备1收到消息1后，根据消息1中携带的公钥1与保存的公钥1，对终端进行身份验证。如果消息1中携带的公钥2与网络设备1中保存的公钥1相同，则认为终端通过身份验证。
方式三、网络设备1根据密钥证书对终端进行身份验证。具体来说，终端预先生成全局唯一的密钥对，例如在终端出厂阶段，基于PUF生成包括公钥1和私钥1的密钥对1。终端将公钥1发送给CA进行证书签发，由CA签发公钥证书，并返回给终端，其中，该公钥证书中携带所述公钥1。采用CA签发公钥证书的方式，使得不必提前在网络设备1中配置公钥1，简化了配置流程。终端在请求获取设备ID时，在消息1中携带公钥证书。网络设备1收到消息1后，对消息1中携带的所述公钥证书进行验证，验证通过，则确认终端通过身份验证。
通过对终端进行身份验证，使得网络设备2中的ID管理***只对通过身份验证的终端分配设备ID，有效避免非可信的终端申请对ID管理***带来的资源消耗。S302不是必须地操作。当不执行S302时，在S301后，执行S303。
S303、网络设备1生成密钥对2，密钥对2包括公钥2和私钥2。
S304、网络设备1向终端发送经过加密的密钥对2和信息1。
网络设备1收到消息1后，响应于终端的请求，生成密钥对2。其中，密钥对2可以是由网络设备2中的ID管理***生成的，信息1用于标识上述的公钥2为设备ID。信息1可以是消息类型，也可以是消息中相应的比特位。所述密钥对2和所述信息1可以承载在同一个消息中，也可以承载在不同的消息中。
网络设备1对密钥对2进行加密的方法，与方法200中，网络设备1对密钥对2进行加密的方法类似，具体参见方法200中S206中相关说明，此处不再赘述。
S305、终端接收并保存密钥对2。
终端接收密钥对2后，保存密钥对2。在一个具体的实施方式中，终端采用基于PUF生成的公钥1对存储的密钥对2进行加密或者采用公钥1仅对存储的私钥2进行加密，与公钥1相对应的私钥1用于解码。由于公钥1和私钥1是基于PUF生成，不 易仿冒，因此，能够提高私钥2的存储安全。当然，终端也可以采用其它的密钥或其它的方式对密钥对2，或者至少对私钥2进行加密保护，以提高私钥2的存储安全。
S306、终端确定公钥2为所述设备ID。
终端获取密钥对1，根据信息1的指示，确定公钥2为所述设备ID，这样终端就获得了自己的设备ID。
需要说明的是，S305中终端保存密钥对2的操作与S306的操作无先后顺序，即终端可以在S306之前保存密钥对2，也可以在S306之后保存密钥对2，也可以在完成S306操作的同时保存密钥对2。
图4是根据本申请实施例提供的一种终端注册方法400的流程示意图。
在一个具体的实施方式中，方法400可以在方法300中的S305之后执行。下面结合图4对方法400进行说明。方法400包括以下操作。
S401、终端向网络设备2发送注册请求。该注册请求中携带作为设备ID的公钥2。网络设备2和网络设备1部署于同一个网络架构中，网络设备2中部署有设备管理***。举例来说，网络设备1可以是图1所示的网络架构中网络设备108，网络设备2可以是图1所示的网络架构中的网络设备107。
S402、网络设备2接收到所述注册请求后，向网络设备1发送发送确认请求，确认请求中携带公钥2，该确认请求用于确认终端是否已经在网络设备1中完成注册认证。
S403、网络设备1收到所述确认请求，根据本地保存的的公钥2与确认请求中携带的公钥2对终端是否注册进行验证。具体地，网络设备1可以在ID管理***中查询是否保存有终端的公钥1，如果ID管理***保存有公钥2，则表示网络设备1为终端配置过设备ID，也就表明终端在ID管理***中完成注册。
S404、网络设备1确认终端注册成功，向网络设备2发送确认响应，用于向网络设备2指示终端注册成功。
S405、网络设备2接收到所述确认响应后，可以向终端发送注册响应，以通告所述终端在网络设备2中注册成功。
图5是根据本申请实施例提供的另一种终端注册方法500的流程示意图。
在一个具体的实施方式中，方法500可以在方法300中的S303之后执行。下面结合图5对方法500进行说明。方法500包括以下操作。
S501、网络设备1向网络设备2发送公钥2和信息2。
信息2用于指示公钥1为设备ID。信息1例如可以是消息类型，也可以是消息中相应的比特位。公钥1和信息2可以承载在同一个消息中，也可以承载在不同的消息中。网络设备2和网络设备1部署于同一个网络架构中，网络设备2中部署有设备管理***。举例来说，网络设备1可以是图1所示的网络架构中网络设备108，网络设备2可以是图1所示的网络架构中的网络设备107。网络设备2接收到公钥2后，基于信息2的指示，确认公钥2为设备ID。网络设备2保存公钥2，例如，将公钥2保存在设备管理***的数据库中。
S502、网络设备2接收终端发送的注册请求，注册请求中携带作为设备ID的公钥2。
S503、网络设备2根据保存的公钥2与注册请求中的公钥2，对终端进行验证。
网络设备确认保存的公钥2与注册请求中的公钥2相同，则认为终端验证通过。
S504、网络设备向终端发送注册响应，用于指示终端注册成功。
在S504之后，方法500还可以包括S505：终端向网络设备2发送经过私钥2签名的消息2。
消息2可用于向网络设备2确认终端注册成功。消息2也可以用于向网络设备2中部署的设备管理***上报设备ID，即公钥2、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过消息2中的消息类型，也可以通过消息2中相应的比特位来标识消息2所要执行的操作。消息2中可以携带作为设备ID的公钥2。网络设备2接收到消息2后，可以采用公钥2验证消息2的签名，进而对终端的身份进行验证。
需要说明的是，本申请实施例对S501与S304-S306之间的操作顺序不作具体限定，举例来说，S501可以在S304之前完成，也可以在S304之后完成，也可以与S304同时完成；S501可以在S305之前完成，也可以在S305之后完成，也可以与S305同时完成；S501可以在S306之前完成，也可以在S306之后完成，也可以与S306同时完成。S502在S306之后执行。
在一个具体的实施方式中，在S504后，方法500还可以包括：S505终端向网络设备3发送经过私钥2签名的消息3。
网络设备3可以是终端以外的其它终端。终端和网络设备3之间进行信息交互，终端使用私钥2对消息3携带的信息进行签名，消息3中携带作为设备ID的公钥2。网络设备3接收到消息3后，可以直接从消息3中提取公钥2，从而无需预先获取公钥2，即可验证消息3的签名，进而对终端的身份进行验证。
图6是根据本申请实施例提供的一种获取设备ID的方法600的流程示意图。应用方法600的网络架构至少包括终端和网络设备1，举例来说，终端,可以是图1所示的终端101，网络设备1可以是图1所示的网络架构中的网络设备107或网络设备108。网络设备1中部署有设备管理***和ID管理***，其中ID管理***例如可以是IDaas***。该网络架构可以是图1所示的网络架构。方法600包括以下操作。
S601、终端向网络设备1发送消息1。
消息1用于向ID管理***请求终端的设备ID，同时向设备管理***进行注册请求。消息1可以通过消息类型来标识该消息1用于为终端请求设备ID以及向设备管理***进行注册，也可以通过相应的比特位来标识该消息1用于为终端请求设备ID以及向设备管理***进行注册。
在一个具体的实施方式中，在S601之后，方法600还可以包括：S602、网络设备1对终端进行身份验证。
网络设备1对终端进行身份验证的方式，与方法300中网络设备1对终端进行身份验证的方式相同，具体参见方法300中S302的相关说明，此处不再赘述。
通过对终端进行身份验证，使得网络设备2中的ID管理***只对通过身份验证的终端分配设备ID，有效避免非可信的终端申请对ID管理***带来的资源消耗。S602不是必须地操作。当不执行S602时，在S601后，执行S603。
S603、网络设备1生成密钥对2，密钥对包括公钥2和私钥2。
S604、网络设备1向终端发送经过加密的密钥对2和信息1。
网络设备1收到信息1后，响应于终端的请求，生成密钥对2，其中，密钥对2可以是由网络设备1中的ID管理***生成的。信息1用于标识上述的公钥2为设备ID。信息1可以是消息类型，也可以是消息中相应的比特位。所述密钥对2和所述信息1可以承载在同一个消息中，也可以承载在不同的消息中。
网络设备1对密钥对2进行加密的方法，与方法200中，网络设备1对密钥对2进行加密的方法类似，具体参见方法200中S206中相关说明，此处不再赘述。
S605、终端接收并保存密钥对2。
终端接收密钥对2后，保存密钥对2。在一个具体的实施方式中，终端采用基于PUF生成的公钥1对存储的密钥对2进行加密或者采用公钥1仅对存储的私钥2进行加密，与公钥1相对应的私钥1用于解密。由于公钥1和私钥1是基于PUF生成，不易仿冒，因此，采用能够提高私钥2的存储安全。当然，终端也可以采用其它的密钥或其它的方式对密钥对2，至少对私钥2进行加密保护，以提高私钥2的存储安全。
S606、终端确定公钥1为所述设备ID。
终端获取密钥对1，根据信息1的指示，确定公钥1为所述设备ID。
需要说明的是，S605中终端保存密钥对2的操作与S606的操作无先后顺序，即终端可以在S606之前保存密钥对2，也可以在S606之后保存密钥对2，也可以在完成S606操作的同时保存密钥对2。
在一个具体的是谁方式中，在S606以后，方法600还可以包括：S607、终端向网络设备1发送经过私钥2签名的消息2。
具体来说，消息2可用于向网络设备1中部署的设备管理***确认终端注册成功。消息2也可以用于向网络设备1上报设备ID，即公钥2、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过消息2中的消息类型，也可以通过消息2中相应的比特位来标识消息2所要执行的操作。消息2中可以携带作为设备ID的公钥2。网络设备1接收到消息2后，可以采用公钥2验证消息2的签名，进而对终端的身份进行验证。
在一个具体的实施方式中，在S606后，方法600还可以包括：终端向网络设备3发送经过私钥2签名的消息3。
网络设备3可以是终端以外的其它终端。终端和网络设备3之间进行信息交互，终端使用私钥2对消息3携带的信息进行签名，消息3中携带作为设备ID的公钥2。网络设备3接收到消息3后，可以直接从消息3中提取公钥2，从而无需预先获取公钥2，即可验证消息3的签名，进而对终端的身份进行验证。
图7是根据本申请实施例提供的又一种获取设备ID的方法700的流程示意图。应用方法700的网络架构至少包括终端和第一网络设备。举例来说，终端可以是图1所示的网络架构中的终端101，第一网络设备可以是图1所示的网络架构中的网络设备108。第一网络设备中部署有设备管理***和/或ID管理***。该网络架构可以是图1所示的网络架构。方法700包括以下操作。
S701、终端向第一网络设备发送用于为所述终端请求所述设备ID的第一消息，所 述设备ID用于全局唯一的标识所述终端。
第一消息可以是TCP消息，也可以是UDP消息。第一消息可以通过消息类型来标识该第一消息用于请求设备ID，也可以通过相应的比特位来标识该第一消息用于请求设备ID。
S702、所述终端接收所述第一网络设备发送的经过加密的密钥对，所述密钥对包括第一公钥和第一私钥。
第一网络设备对密钥对进行加密的方法，可参见方法200中S206中网络设备1对密钥对2进行加密的相关说明，此处不再赘述。
S703、所述终端接收所述第一网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID。
该信息可以是消息类型，也可以是消息中相应的比特位。S703中发送的信息和S702中发送的密钥对可以承载在一个消息中，也可以承载在不同的消息中。
所述终端在S702接收到的密钥对和在S703中接收到的信息可以是携带在同一个消息中的，也可以是携带在不同的消息中的。当所述密钥对和所述信息是携带在同一个消息中时，S702和S703既可以被理解成是由同一个操作完成的，也可以被理解成是由两个操作完成的。当所述密钥对和所述信息是携带在不同的消息中时，S703可以在S702之前，之后或者与S702同时执行。
S704、所述终端确定所述第一公钥为所述设备ID。
终端获取所述密钥对和所述信息，并根据该信息的指示，确定所述第一公钥为所述设备ID，这样终端就确定获得了自己的设备ID。
在一个具体的实施方式中，所述第一网络设备中部署有设备管理***，所述方法700还可以包括：S705、所述终端向所述第一网络设备发送经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的的设备ID的所述第一公钥。
该第二消息可用于向第一网络设备中部署的设备管理***确认终端注册成功。第二消息也可以用于向该第一网络设备上报设备ID，即第一公钥、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过第二消息中的消息类型，也可以通过第二消息中相应的比特位来标识第二消息所要执行的操作。第二消息中可以携带作为设备ID的第一公钥。第一网络设备接收到第二消息后，可以采用第一公钥验证第二消息的签名，进而对终端的身份进行验证。
在一种实施方式中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于PUF生成的公钥。
终端可以在S701之前，例如，在终端出厂阶段，终端基于PUF生成第二公钥和第二私钥。网络管理员或者网络管理***可以将第二公钥提前配置到部署有ID管理***的网络设备中；或者，终端将第二公钥发送给CA，由CA进行证书签发，CA将签发的公钥证书返回给终端。通过CA签发证书，使得不必提前将第二公钥部署到网络设备中，简化了配置流程。所述第一消息中携带第二公钥，包括：第一消息中直接携带所述第二公钥；或者，所述第一消息中携带所述CA签发的公钥证书，所述公钥证书中携带所述第二公钥。终端在请求获取设备ID时，在第一消息中携带所述第二公钥。如果第一网络设备中部署有ID管理***，则第一网络设备根据第一消息中携带的第二公钥与自 身保存的第二公钥，对终端进行身份验证。如果第一网络设备中没有部署ID管理***，仅部署有设备管理***，则第一网络设备接收到终端发送的第一消息后，会生成并向第二网络设备发送携带有所述第二公钥的第二消息。其中，第二网络设备中部署有ID管理***并保存有第二公钥。第二网络设备接收到第二消息后，根据第二消息中携带的第二公钥与自身保存的第二公钥，对终端进行身份验证。
在一种实施方式中，所述终端接收所述第一网络设备发送的经过加密的密钥对，包括：
所述终端接收所述第一网络设备发送的经过所述第二公钥加密的所述密钥对。
终端接收到第一网络设备发送的经过第二公钥加密的所述密钥对以后，只能采用与所述第二公钥对应的第二私钥进行解密。由于第二公钥和第二私钥是终端基于PUF生成的密钥，并且只有终端自身保存有所述第二私钥，因此，第二私钥难以仿冒，能够有效提高密钥对的传输安全。
在一种实施方式中，所述终端接收所述第一网络设备发送的经过加密的密钥对之后，所述方法还包括：
所述终端保存所述第一私钥，采用所述第二公钥对保存的所述第一私钥进行加密。
第一私钥用于对后续终端待发送的报文进行签名，通过第二公钥对存储的第一私钥进行加密，能有有效保证第一私钥的存储安全。
图8是根据本申请实施例提供的又一种获取设备ID的方法800的流程示意图。应用方法800的网络架构至少包括终端和第一网络设备。举例来说，终端可以是图1所示的网络架构中的终端101，第一网络设备可以是图1所示的网络架构中的网络设备108。第一网络设备中部署有设备管理***和/或ID管理***。该网络架构可以是图1所示的网络架构。方法800包括以下操作。
S801、第一网络设备接收终端发送的用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一地标识所述终端。
第一消息可以是TCP消息，也可以是UDP消息。第一消息可以通过消息类型来标识该第一消息用于请求设备ID，也可以通过相应的比特位来标识该第一消息用于请求设备ID。
S802、所述第一网络设备向所述终端发送经过加密的密钥对，所述密钥对包括第一公钥和第一私钥。
第一网络设备对密钥对进行加密的方法，可参见方法200中S206中网络设备1对密钥对2进行加密的相关说明，此处不再赘述。
S803、所述第一网络设备向所述终端发送第一信息，所述第一信息用于标识所述第一公钥为所述终端的设备ID。
该第一信息可以是消息类型，也可以是消息中相应的比特位。
S802中发送的的密钥对和在S803中发送的第一信息可以是携带在同一个消息中的，也可以是携带在不同的消息中的。当所述密钥对和所述信息是携带在同一个消息中时，S802和S803也可以被理解成是由同一个操作完成的。当所述密钥对和所述信息是携带在不同的消息中时，S803可以在S802之前，之后或者与S802同时执行。
其中，所述第一私钥用于所述终端向第一网络设备发送的第二消息进行签名，所 述第二消息携带作为所述终端的设备ID的所述第一公钥。
在一个具体的实施方式中，所述第一网络设备中部署有设备管理***。该第二消息可用于向第一网络设备中部署的设备管理***确认终端注册成功。第二消息也可以用于向该第一网络设备上报设备ID，即第一公钥、设备状态信息、设备位置信息和/或设备类型等信息。具体地，可以通过第二消息中的消息类型，也可以通过第二消息中相应的比特位来标识第二消息所要执行的操作。第二消息中可以携带作为设备ID的第一公钥。第一网络设备接收到第二消息后，可以采用第一公钥验证第二消息的签名，进而对终端的身份进行验证。
在一个实施方式中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能PUF生成的公钥。
终端在向所述第一网络设备发送所述第一信息之前，例如，在终端出厂阶段，基于PUF生成第二公钥和第二私钥。网络管理员或者网络管理***可以将第二公钥提前配置到部署有ID管理***的网络设备中；或者，终端将第二公钥发送给CA，由CA进行证书签发，CA将签发的公钥证书返回给终端。通过CA签发证书，使得不必提前将第二公钥部署到网络设备中，简化了配置流程。所述第一消息中携带第二公钥，包括：第一消息中直接携带所述第二公钥；或者，所述第一消息中携带所述CA签发的公钥证书，所述公钥证书中携带所述第二公钥。终端在请求获取设备ID时，在第一消息中携带所述第二公钥。
在一个具体的实施方式中，所述第一网络设备中部署有ID管理***，终端生成所述第二公钥后，可以通过网络管理员或者网络管理***在第一网络设备中配置所述第二公钥。终端设备请求获取设备ID时，在第一消息中携带所述第二公钥。第一网络设备接收到该第一消息后，根据第一消息携带的第二公钥与自身保存的第二公钥，对该终端进行身份验证。第一网络设备确定第一消息携带的第二公钥与自身保存的第二公钥相同，则确定终端通过身份验证。
在另一个具体实施方式中，所述第一网络设备中部署设备管理***，没有部署ID管理***，在所述第一网络设备接收所述第一消息之后，所述第一网络设备向所述终端发送经过加密的密钥对之前，所述方法还包括：
所述第一网络设备生成第三消息，所述第三消息携带所述第二公钥，所述第二公钥用于被所述第二网络设备对所述终端进行身份验证；
所述第一网络设备向第二网络设备发送第三消息，所述第三消息携带所述第二公钥，所述第二公钥用于被所述第二网络设备对所述终端进行身份验证；
所述第一网络设备接收所述第二网络设备发送的所述密钥对以及第二信息，所述第二信息用于指示所述密钥对中包括的所述第一公钥为所述设备ID。
其中，所述第二网络设备部署有所述ID管理***，终端生成所述第二公钥后，可以通过网络管理员或者网络管理***在该第二网络设备中配置所述第二公钥。终端设备请求获取设备ID时，在第一消息中携带所述第二公钥。第一网络设备接收到该第一消息后，生成并向所述第二网络设备发送所述第三消息。所述第二网络设备接收所述第三消息，基于所述第三消息中携带的所述第二公钥与自身保存的所述第二公钥，对所述终端进行身份验证。第二网络设备确定第三消息携带的第二公钥与自身保存的第 二公钥相同，则确定终端通过身份验证。
在一个实施方式中，所述第一网络设备向所述终端发送经过加密的密钥对，包括：所述第一网络设备向所述终端发送经过所述第二公钥加密的所述密钥对。
根据本申请实施例提供的方法，通过生成一个密钥对，将其中的公钥作为设备ID，能够有效保证设备ID的唯一性，尤其在物联网海量设备的场景中，可以有效避免设备ID重复所带来的管理困难的问题。进一步地，采用公钥对中的私钥对终端发送的信息进行签名，使得通信时，无需预先配置认证凭据，也无需协商额外的密钥，在海量终端的场景下，极大的节省了配置认证凭据，协商密钥所需的开销，极大的简化了配置流程，提高了处理效率。
以上，结合图2-图8说明了说明书根据本申请实施例提供的获取设备ID的方法。以下，结合图9和图10对与上述各方法实施例对应的终端和网络设备进行描述。
图9是本申请实施例提供的一种终端900的示意图。该终端900可以应用于图1所示的网络架构中，例如可以是图1所示的网络架构中的终端101。如图9所示，终端900可以包括处理器910，与所述处理器910耦合连接的存储器920，收发器930。处理器910可以是中央处理器(英文：central processing unit，缩写：CPU)，网络处理器(英文：network processor，缩写：NP)或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器件(英文：programmable logic device，缩写：PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。处理器910可以是指一个处理器，也可以包括多个处理器。存储器920可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)；存储器还可以包括上述种类的存储器的组合。在一个实施方式中，存储器920可以包括多个软件模块，例如发送模块921，处理模块922和接收模块923。通过执行上述软件模块中的指令，处理器910可用于执行多个操作。存储器920可以是指一个存储器，也可以包括多个存储器。在一些实施方式中，当一个模块被配置用于执行一个操作，它可能实际表示处理器910被配置于执行模块中的指令以完成上述操作。通过执行存储器920中的指令，处理器910可以执行方法200、300、400、500、600、700或800中所述的终端所执行的部分或全部操作。例如，处理器910可以通过收发器930向网络设备1发送所述请求设备ID的消息1，通过收发器930接收网络设备1发送的包括公钥1和密钥1的密钥对和标识公钥1为设备ID的信息，并且根据所述收到的密钥对和信息确定所述公钥1为终端的设备ID。
发送模块921用于向网络设备发送用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一的标识所述终端。接收模块923用于接收所述网络设备发送 的经过加密的密钥对，所述密钥对包括第一公钥和第一私钥，还用于接收所述网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID。处理模块922用于确定所述第一公钥为所述设备ID。
发送模块921还用于向所述网络设备发送经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的的设备ID的所述第一公钥。
在一个具体的实施方式中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能生成的公钥。接收模块923还用于接收接收所述网络设备发送的经过所述第二公钥加密的所述密钥对。
图10是本申请实施例提供的一种网络设备1000的示意图。该网络设备1000可以应用于图1所示的网络架构中，例如可以是图1所示的网络架构中的网络设备107或者网络设备108。如图10所示，网络设备1000可以包括处理器1010，与所述处理器1001耦合连接的存储器1020，收发器1030。处理器1010可以是CPU，NP或者CPU和NP的组合。处理器还可以进一步包括硬件芯片。上述硬件芯片可以是ASIC，PLD或其组合。上述PLD可以是CPLD，FPGA，GAL或其任意组合。处理器1010可以是指一个处理器，也可以包括多个处理器。存储器1020可以包括易失性存储器(英文：volatile memory)，例如RAM；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如ROM，快闪存储器(英文：flash memory)，HDD或SSD；存储器还可以包括上述种类的存储器的组合。在一个实施方式中，存储器1020可以包括多个软件模块，例如发送模块1021，处理模块1022和接收模块1023。通过执行上述软件模块中的指令，处理器1010可用于执行多个操作。存储器1020可以是指一个存储器，也可以包括多个存储器。在一些实施方式中，当一个模块被配置用于执行一个操作，它可以表示处理器1010被配置于执行模块中的指令以完成上述操作。在一个实施方式中，通过执行存储器1020中的指令，处理器1010可以执行方法200、300、400、500或600中网络设备1，以及方法700或方法800中第一网络设备所执行的部分或全部操作。例如，处理器1010可以通过收发器1030接收终端发送所述请求设备ID的消息1，通过收发器1030向终端发送包括公钥1和密钥1的密钥对和标识公钥1为设备ID的信息。
接收模块1023用于接收终端发送的用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一地标识所述终端。发送模块1021用于向所述终端发送经过加密的密钥对,所述密钥对包括第一公钥和第一私钥。发送模块1021还用于向所述终端发送第一信息，所述第一信息用于标识所述第一公钥为所述终端的设备ID。
在一个实施方式中，接收模块1023还用于接收所述终端发送的经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的设备ID的所述第一公钥。
在一个实施方式中，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能PUF生成的公钥。
在一个实施方式中，在接收摸1023接收所述第一消息之后，以及发送模块1021向所述终端发送经过加密的密钥对之前，所述处理模块1022还用于：生成第三消息，所述第三消息携带所述第二公钥，所述第二公钥用于被第二网络设备对所述终端进行身份验证；向所述第二网络设备发送所述第三消息；以及接收所述第二网络设备发送 的所述密钥对以及第二信息，所述第二信息用于指示所述密钥对中包括的所述第一公钥为所述设备ID。
在一个实施方式中，处理模块1022还用于向所述终端发送经过所述第二公钥加密的所述密钥对。
在一个实施方式中，所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。
在一个实施方式中，通过执行存储器1020中的指令，处理器1010也可以全部或者部分的执行方法200中的网络设备2，方法400以及方法500中的网络设备2，方法600中的网络设备1或者方法800中第二网络设备所执行的全部操作。
本申请实施例中，收发器可以是有线收发器，无线收发器或其组合。有线收发器例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线收发器例如可以为无线局域网收发器，蜂窝网络收发、器机或其组合。图9以及图10中还可以包括总线接口，总线接口可以包括任意数量的互联的总线和桥，具体由处理器代表的一个或多个处理器和存储器代表的存储器的各种电路链接在一起。总线接口还可以将诸如***设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机提供用于在传输介质上与各种其他设备通信的单元。处理器负责管理总线架构和通常的处理，存储器可以存储处理器在执行操作时所使用的数据。
本申请还提供了一种通信***，包括终端和网络设备，所述终端可以是图9对应实施例所提供的终端。所述网络设备可以是图10对应实施例提供的网络设备。所述通信***用于执行图2-图8任一实施例的方法。
本领域技术任何还可以了解到本申请实施例列出的各种步骤(step)可以通过电子硬件、电脑软件，或两者的结合进行实现。这样的功能是通过硬件还是软件来实现取决于特定的应用和整个***的设计要求。本领域技术人员可以对于每种特定的应用，可以使用各种方法实现所述的功能，但这种实现不应被理解为超出本申请实施例保护的范围。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息，存储媒介还可以集成到处理器中。
应理解，在本申请的各种实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的模块及方法操作，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的***、装置和模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
本说明书的各个部分均采用递进的方式进行描述，各个实施方式之间相同相似的部分互相参见即可，每个实施方式重点介绍的都是与其他实施方式不同之处。尤其，对于装置和***实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例部分的说明即可。
本申请说明书的上述描述可以使得本领域技术任何可以利用或实现本申请的内容，任何基于所公开内容的修改都应该被认为是本领域显而易见的，本申请所描述的基本原则可以应用到其它变形中而不偏离本申请的发明本质和范围。因此，本申请所公开的内容不仅仅局限于所描述的实施例和设计，还可以扩展到与本申请原则和所公开的新特征一致的最大范围。以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (24)

  1. 一种获取设备标识ID的方法，其特征在于，包括:
    终端向网络设备发送用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一的标识所述终端；
    所述终端接收所述网络设备发送的经过加密的密钥对，所述密钥对包括第一公钥和第一私钥；
    所述终端接收所述网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID；
    所述终端确定所述第一公钥为所述设备ID。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述终端向所述网络设备发送经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的设备ID的所述第一公钥。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能生成的公钥。
  4. 根据权利要求3所述的方法，其特征在于，
    所述终端接收所述网络设备发送的经过加密的密钥对，包括：
    所述终端接收所述网络设备发送的经过所述第二公钥加密的所述密钥对。
  5. 根据权利要求3或4所述的方法，其特征在于，所述终端接收所述网络设备发送的经过加密的密钥对之后，所述方法还包括：
    所述终端保存所述第一私钥，并采用所述第二公钥对保存的所述第一私钥进行加密。
  6. 根据权利要求3-5任一项所述的方法，其特征在于，
    所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。
  7. 一种获取设备标识ID的方法，其特征在于，包括:
    第一网络设备接收终端发送的用于为所述终端请求所述设备ID的第一消息，所述设备ID用于全局唯一地标识所述终端；
    所述第一网络设备向所述终端发送经过加密的密钥对，所述密钥对包括第一公钥和第一私钥；
    所述第一网络设备向所述终端发送第一信息，所述第一信息用于标识所述第一公钥为所述终端的设备ID。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述第一网络设备接收所述终端发送的经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的设备ID的所述第一公钥。
  9. 根据权利要求7或8所述的方法，其特征在于，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能PUF生成的公钥。
  10. 根据权利要求9所述的方法，其特征在于，在所述第一网络设备接收所述第一消息之后，所述第一网络设备向所述终端发送经过加密的密钥对之前，所述方法还 包括：
    所述第一网络设备生成第三消息，所述第三消息携带所述第二公钥，所述第二公钥用于被第二网络设备对所述终端进行身份验证；
    所述第一网络设备向所述第二网络设备发送所述第三消息；
    所述第一网络设备接收所述第二网络设备发送的所述密钥对以及第二信息，所述第二信息用于指示所述密钥对中包括的所述第一公钥为所述设备ID。
  11. 根据权利要求9或10所述的方法，其特征在于，所述第一网络设备向所述终端发送经过加密的密钥对，包括：
    所述第一网络设备向所述终端发送经过所述第二公钥加密的所述密钥对。
  12. 根据权利要9-11任一项所述的方法，其特征在于，
    所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。
  13. 一种终端，其特征在于，包括：
    存储器，该存储器包括指令；
    与所述存储器通信的处理器，所述处理器用于执行所述指令，从而：
    向网络设备发送用于为所述终端请求设备ID的第一消息，所述设备ID用于全局唯一的标识所述终端；
    接收所述网络设备发送的经过加密的密钥对，所述密钥对包括第一公钥和第一私钥；
    接收所述网络设备发送的信息，所述信息用于标识所述第一公钥为所述终端的设备ID；
    确定所述第一公钥为所述设备ID。
  14. 根据权利要求13所述的终端，其特征在于，所述处理器还用于执行所述指令，从而：
    向所述网络设备发送经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的的设备ID的所述第一公钥。
  15. 根据权利要求13或14所述的终端，其特征在于，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能生成的公钥。
  16. 根据权利要求15所述的终端，其特征在于，所述处理器还用于执行所述指令，从而：
    接收所述网络设备发送的经过所述第二公钥加密的所述密钥对。
  17. 根据权利要求15或16所述的终端，其特征在于，所述处理器还用于执行所述指令，从而：
    保存所述第一私钥，并采用所述第二公钥对保存的所述第一私钥进行加密。
  18. 根据权利要求15-17任一项所述的终端，其特征在于，所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。
  19. 一种网络设备，用作第一网络设备，其特征在于，包括：
    存储器，该存储器包括指令；
    与所述存储器通信的处理器，所述处理器用于执行所述指令，从而：
    接收终端发送的用于为所述终端请求设备ID的第一消息，所述设备ID用于全局唯一地标识所述终端；
    向所述终端发送经过加密的密钥对,所述密钥对包括第一公钥和第一私钥；
    向所述终端发送第一信息，所述第一信息用于标识所述第一公钥为所述终端的设备ID。
  20. 根据权利要求19所述的网络设备，其特征在于，所述处理器还用于执行所述指令，从而：
    接收所述终端发送的经过所述第一私钥签名的第二消息，所述第二消息携带作为所述终端的设备ID的所述第一公钥。
  21. 根据权利要求19或20所述的网络设备，其特征在于，所述第一消息中携带第二公钥，所述第二公钥为所述终端基于物理不可克隆功能PUF生成的公钥。
  22. 根据权利要求21所述的网络设备，其特征在于，在所述处理器接收所述第一消息之后，以及向所述终端发送经过加密的密钥对之前，所述处理器还用于执行所述指令，从而：
    生成第三消息，所述第三消息携带所述第二公钥，所述第二公钥用于被第二网络设备对所述终端进行身份验证；
    向所述第二网络设备发送所述第三消息；
    接收所述第二网络设备发送的所述密钥对以及第二信息，所述第二信息用于指示所述密钥对中包括的所述第一公钥为所述设备ID。
  23. 根据权利要求21或22所述的网络设备，其特征在于，所述处理器还用于执行所述指令，从而：
    向所述终端发送经过所述第二公钥加密的所述密钥对。
  24. 根据权利要求21-23任一项所述的网络设备，其特征在于，
    所述第一消息中携带由证书颁发中心CA签发的公钥证书，所述公钥证书中携带所述第二公钥。
PCT/CN2018/100618 2018-02-12 2018-08-15 一种获得设备标识的方法及装置 WO2019153701A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18905152.7A EP3745639A4 (en) 2018-02-12 2018-08-15 DEVICE IDENTIFICATION PROCESS AND APPARATUS
US16/990,528 US11350286B2 (en) 2018-02-12 2020-08-11 Device identifier obtaining method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810147255.9A CN108429740B (zh) 2018-02-12 2018-02-12 一种获得设备标识的方法及装置
CN201810147255.9 2018-02-12

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/990,528 Continuation US11350286B2 (en) 2018-02-12 2020-08-11 Device identifier obtaining method and apparatus

Publications (1)

Publication Number Publication Date
WO2019153701A1 true WO2019153701A1 (zh) 2019-08-15

Family

ID=63156886

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/100618 WO2019153701A1 (zh) 2018-02-12 2018-08-15 一种获得设备标识的方法及装置

Country Status (4)

Country Link
US (1) US11350286B2 (zh)
EP (1) EP3745639A4 (zh)
CN (2) CN108429740B (zh)
WO (1) WO2019153701A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112291190A (zh) * 2020-07-28 2021-01-29 国网思极网安科技（北京）有限公司 一种身份认证方法、终端及服务器

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111641581B (zh) * 2019-03-01 2022-07-19 阿里巴巴集团控股有限公司 一种数据处理方法、装置、设备和存储介质
CN110198433B (zh) * 2019-04-23 2021-01-01 视联动力信息技术股份有限公司 一种监控视频录制设备的接入方法及***
CN110191089B (zh) * 2019-04-25 2021-06-25 西安邮电大学 用于物联网数据处理的非交互式认证方法和***
WO2020215280A1 (en) * 2019-04-25 2020-10-29 Nokia Technologies Oy Secure and private authentication and key agreement for device-to-device relay communication
CN110505312B (zh) * 2019-09-09 2022-05-10 合肥移瑞通信技术有限公司 一种可云端部署的物联网平台管理***
CN111131494B (zh) * 2019-12-31 2022-06-03 上海能塔智能科技有限公司 车数据的存储、验证处理方法、装置、电子设备与介质
CN111726782B (zh) * 2020-05-22 2023-12-29 浙江吉利汽车研究院有限公司 一种安全认证方法及***
US12034860B2 (en) * 2020-08-26 2024-07-09 Micron Technology, Inc. Memory write access control
CN112491559B (zh) * 2020-12-03 2022-11-22 中国联合网络通信集团有限公司 一种身份验证方法及装置
CN112449345B (zh) * 2020-12-09 2024-02-09 中国联合网络通信集团有限公司 一种安全通信方法和设备
CN112637249B (zh) * 2021-03-10 2021-12-14 浙江宇视科技有限公司 物联网节点标识认证方法、装置、电子设备及存储介质
CN113259096B (zh) * 2021-04-27 2021-11-12 江南信安（北京）科技有限公司 一种适于物联网通信环境的密钥在线协商方法及***
US20220385485A1 (en) * 2021-06-01 2022-12-01 Micron Technology, Inc. Identity theft protection with no password access
CN113923668B (zh) * 2021-10-11 2023-07-25 中国联合网络通信集团有限公司 识别网络攻击行为的方法、装置、芯片及可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255725A (zh) * 2011-07-16 2011-11-23 山东省数字证书认证管理有限公司 随机混合密钥加解密方法
CN104066078A (zh) * 2013-03-21 2014-09-24 中兴通讯股份有限公司 一种设备标识的分配方法及***
CN108390885A (zh) * 2018-03-01 2018-08-10 北京华为数字技术有限公司 一种获得设备标识的方法及装置

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI115257B (fi) * 2001-08-07 2005-03-31 Nokia Corp Menetelmä informaation käsittelemiseksi elektroniikkalaitteessa, järjestelmä, elektroniikkalaite ja suoritinlohko
US20040240669A1 (en) * 2002-02-19 2004-12-02 James Kempf Securing neighbor discovery using address based keys
US20050154889A1 (en) 2004-01-08 2005-07-14 International Business Machines Corporation Method and system for a flexible lightweight public-key-based mechanism for the GSS protocol
KR20060110420A (ko) * 2005-04-19 2006-10-25 삼성전자주식회사 단일 주파수 망을 가지는 디지털 방송 시스템에서 방송제공 장치 및 방법과 그 시스템
US8606231B2 (en) * 2005-11-16 2013-12-10 Sirius Xm Radio Inc. Proprietary radio control head with authentication
CN101052033B (zh) * 2006-04-05 2012-04-04 华为技术有限公司 基于ttp的认证与密钥协商方法及其装置
DE602006021712D1 (de) * 2006-05-16 2011-06-16 Sap Ag Kontext-sensitivitätsbasierte Kryptographie
JP4519935B2 (ja) 2008-12-26 2010-08-04 株式会社東芝 情報通信方法、通信端末装置および情報通信システム
CN101640590B (zh) 2009-05-26 2012-01-11 深圳市安捷信联科技有限公司 一种获取标识密码算法私钥的方法和密码中心
CN101710859B (zh) * 2009-11-17 2014-02-12 深圳国微技术有限公司 一种认证密钥协商方法
US9489504B2 (en) 2013-10-03 2016-11-08 Qualcomm Incorporated Physically unclonable function pattern matching for device identification
CN104955039B (zh) * 2014-03-27 2019-10-25 西安西电捷通无线网络通信股份有限公司 一种网络鉴权认证的方法及设备
DE102015220226A1 (de) * 2015-10-16 2017-04-20 Volkswagen Aktiengesellschaft Verfahren zur Zertifizierung durch ein Steuergerät eines Fahrzeugs
US10169626B2 (en) * 2015-12-14 2019-01-01 Afero, Inc. Internet of things (IOT) apparatus and method for electronic shelf tags
CN106230784B (zh) 2016-07-20 2020-09-18 新华三技术有限公司 一种设备验证方法及装置
CN106899410B (zh) 2016-09-13 2019-06-25 ***通信有限公司研究院 一种设备身份认证的方法及装置
CN106453330B (zh) 2016-10-18 2019-11-12 深圳市金立通信设备有限公司 一种身份认证的方法和***
CN106571913A (zh) * 2016-10-31 2017-04-19 全球能源互联网研究院 一种面向电力无线专网的两方认证密钥协商方法
CN106533669B (zh) * 2016-11-15 2018-07-13 百度在线网络技术（北京）有限公司 设备识别的方法、装置和***

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102255725A (zh) * 2011-07-16 2011-11-23 山东省数字证书认证管理有限公司 随机混合密钥加解密方法
CN104066078A (zh) * 2013-03-21 2014-09-24 中兴通讯股份有限公司 一种设备标识的分配方法及***
CN108390885A (zh) * 2018-03-01 2018-08-10 北京华为数字技术有限公司 一种获得设备标识的方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3745639A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112291190A (zh) * 2020-07-28 2021-01-29 国网思极网安科技（北京）有限公司 一种身份认证方法、终端及服务器
CN112291190B (zh) * 2020-07-28 2022-10-14 国网思极网安科技（北京）有限公司 一种身份认证方法、终端及服务器

Also Published As

Publication number Publication date
US11350286B2 (en) 2022-05-31
US20200374696A1 (en) 2020-11-26
CN112019647A (zh) 2020-12-01
EP3745639A1 (en) 2020-12-02
CN108429740B (zh) 2020-08-07
EP3745639A4 (en) 2021-03-03
CN108429740A (zh) 2018-08-21

Similar Documents

Publication Publication Date Title
WO2019153701A1 (zh) 一种获得设备标识的方法及装置
US11777926B2 (en) Internet of things (IoT) device management
US11616775B2 (en) Network access authentication method, apparatus, and system
CN112019503B (zh) 一种获得设备标识的方法、通信实体、通信***及存储介质
WO2017190616A1 (zh) 无线网络连接方法、无线接入点、服务器及***
CN105162772B (zh) 一种物联网设备认证与密钥协商方法和装置
CN107637039B (zh) 执行所有者转移的***和转移设备所有权的方法和***
US20160269176A1 (en) Key Configuration Method, System, and Apparatus
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
US10516654B2 (en) System, apparatus and method for key provisioning delegation
US12003629B2 (en) Secure server digital signature generation for post-quantum cryptography key encapsulations
EP4231680A1 (en) Identity authentication system, method and apparatus, device, and computer readable storage medium
US10924480B2 (en) Extended trust for onboarding
CN110198538B (zh) 一种获得设备标识的方法及装置
JP2017506454A (ja) 通信ネットワークにおけるネットワーク要素の認証
CN106537962B (zh) 无线网络配置、接入和访问方法、装置及设备
US20230107045A1 (en) Method and system for self-onboarding of iot devices
WO2022170583A1 (zh) 物联网中的权限配置方法、装置、设备及存储介质
JP6527115B2 (ja) 機器リスト作成システムおよび機器リスト作成方法
US20220360454A1 (en) Methods and devices for securing a multiple-access peripheral network
KR101785382B1 (ko) 클라이언트 인증 방법, 클라이언트의 동작 방법, 서버, 및 통신 소프트웨어
US12009979B2 (en) Secure and adaptive mechanism to provision zero- touch network devices
US20230308424A1 (en) Secure Session Resumption using Post-Quantum Cryptography
WO2022105739A1 (zh) 终端定位方法、终端定位***、存储介质和电子装置
JP2017111599A (ja) 認証装置、認証システム及び認証方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18905152

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018905152

Country of ref document: EP

Effective date: 20200824