WO2022052665A1 - 无线终端及无线终端在Uboot模式下的接口访问鉴权方法 - Google Patents

无线终端及无线终端在Uboot模式下的接口访问鉴权方法 Download PDF

Info

Publication number
WO2022052665A1
WO2022052665A1 PCT/CN2021/110126 CN2021110126W WO2022052665A1 WO 2022052665 A1 WO2022052665 A1 WO 2022052665A1 CN 2021110126 W CN2021110126 W CN 2021110126W WO 2022052665 A1 WO2022052665 A1 WO 2022052665A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
information
wireless terminal
encryption algorithm
authentication request
Prior art date
Application number
PCT/CN2021/110126
Other languages
English (en)
French (fr)
Inventor
温海龙
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to JP2023516195A priority Critical patent/JP2023542099A/ja
Priority to EP21865721.1A priority patent/EP4213520A4/en
Priority to US18/026,240 priority patent/US20230370262A1/en
Publication of WO2022052665A1 publication Critical patent/WO2022052665A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
    • H04L9/302—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the embodiments of the present disclosure relate to, but are not limited to, the field of wireless terminals, and specifically relate to, but are not limited to, wireless terminals and an interface access authentication method for wireless terminals in Uboot mode.
  • the serial port of the wireless terminal is in the product development stage. It is an important communication interface for software debugging and fault diagnosis, through which you can understand the operating mechanism of the wireless terminal, obtain sensitive data and reverse firmware information.
  • the wireless terminal In order to prevent malicious attacks, reading or tampering, the wireless terminal only closes part of the serial port functions, while Most of the serial port functions are reserved to meet the needs of after-sales service fault diagnosis, which increases the security risks of wireless terminals. Therefore, it is necessary to add security measures for the interface access of wireless terminals to prevent malicious access to wireless terminal interfaces.
  • the interface access authentication method of the wireless terminal in the Uboot mode mainly solves the technical problem that the interface access of the wireless terminal has a security risk.
  • an embodiment of the present disclosure provides an interface access authentication method for a wireless terminal in Uboot mode, which is used to obtain the interface access authority of the wireless terminal, and the interface access authentication method includes:
  • the key query information and the key verification information are obtained according to the same plaintext key, including:
  • the first encryption algorithm is used to generate the key verification information from the plaintext key
  • the second encryption algorithm is used to generate the key query information from the plaintext key
  • the password strength policy includes a minimum password character length and a minimum number of character types included.
  • the first encryption algorithm and the second encryption algorithm are different; the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm; the second encryption algorithm includes an asymmetric encryption algorithm.
  • the first encryption algorithm includes AES, MD5 or SHA encryption algorithm.
  • the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithm.
  • Embodiments of the present disclosure also provide a wireless terminal, including a processor and a memory;
  • the processor is configured to execute one or more programs stored in the memory to implement the steps of the interface access authentication method as described above; wherein the memory is coupled to the processor.
  • Embodiments of the present disclosure also provide a wireless terminal, including:
  • an interface opening module configured to open the access authority of the serial port interface of the wireless terminal
  • a storage module configured to store a key verification information and a key query information preset by the wireless terminal; the key query information and the key verification information are obtained according to the same plaintext key;
  • the authentication module is configured to respond to the authentication request of the interface access, obtain the authentication request key information carried by the authentication request, and verify the authentication request key information according to the key verification information; when the verification is successful , obtain the interface access authority of the wireless terminal; when the verification fails, output the key query information.
  • an encryption module is further included, configured to encrypt the authentication request key information according to a first preset encryption algorithm, so that the authentication module can verify the encrypted data according to the key verification information.
  • the authentication requests key information.
  • the encryption module is further configured to randomly generate the plaintext encryption key according to a preset password strength policy, use a first encryption algorithm to generate the encryption key verification information from the plaintext encryption key, and use a second encryption algorithm to generate the encryption key verification information. generating the key query information from the plaintext key.
  • Embodiments of the present disclosure further provide a computer storage medium, where the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned implementation The steps of the interface access authentication method in the example.
  • the authentication request key information carried in the authentication request is obtained by responding to the authentication request of the interface access , verify the authentication request key information according to a preset key verification information, obtain the interface access authority of the wireless terminal when the verification is successful, and output a key query information when the verification fails.
  • the key query information and the key verification information are obtained according to the same plaintext key.
  • FIG. 1 is a schematic flowchart of an interface access authentication method in Uboot mode according to Embodiment 1 of the present disclosure
  • FIG. 2 is a schematic structural diagram of a wireless terminal according to Embodiment 2 of the present disclosure.
  • FIG. 3 is a schematic flowchart of an access authentication method for a serial port interface of a wireless terminal according to Embodiment 3 of the present disclosure
  • FIG. 4 is a schematic flowchart of a method for obtaining key verification information and key query information according to Embodiment 3 of the present disclosure
  • FIG. 5 is a schematic structural diagram of a wireless terminal in another embodiment.
  • the serial port of the wireless terminal is an important means of software debugging and fault diagnosis in the product development stage. For attackers, the serial port also has extremely high utilization value. Through it, you can understand the operating mechanism of the device, obtain sensitive data and reverse firmware. Only some projects of the wireless terminal have the device serial port function disabled, but most projects need to retain the device serial port debugging function for after-sales fault diagnosis. Therefore, security measures are required to prevent illegal users from accessing the device serial port. In order to protect the interface access of the wireless terminal in Uboot mode, any commands other than authentication requests are not allowed to be input in Uboot mode by default, and the interface console of the wireless device will not be opened even after the kernel of the wireless terminal is started. For example, to enable the serial port command input function of a wireless terminal, you need to enter a password and pass the authentication before opening.
  • FIG. 1 is a schematic flowchart of an interface access authentication method in Uboot mode according to Embodiment 1 of the present disclosure.
  • the method is used to obtain an interface access authority of a wireless terminal, including:
  • Step 1 Obtain the authentication request key information.
  • the command input function of the interface is disabled. If the command input function of interface access is pre-enabled, an authentication request command carrying the authentication request key information needs to be input. After inputting the authentication request in Uboot mode, respond to the authentication request of interface access, and obtain the authentication request key information carried in the authentication request.
  • Step 2 verify the authentication request key information.
  • the authentication request key information is verified according to a preset key verification information.
  • the preset key verification information is obtained according to a plaintext key.
  • the preset key verification information is obtained by encrypting the plaintext key using the first encryption algorithm. First, encrypt the obtained key verification information according to the first encryption algorithm, and then compare whether the encrypted key verification information is the same as the preset key verification information.
  • the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm.
  • Step 3 Obtain the interface access permission.
  • the interface access authority of the wireless terminal is obtained, that is, the command input function of interface access is enabled.
  • Step 4 output the key query information.
  • the key query information and the key verification information are obtained according to the same plaintext key, and the methods for obtaining the key query information and the key verification information include:
  • the plaintext key is randomly generated according to the preset password strength policy.
  • the preset password strength policy includes that the plaintext encryption key must contain uppercase letters, lowercase letters, special characters and/or numbers.
  • the preset password strength policy also includes the minimum character length of the plaintext encryption key. and the minimum number of character types contained.
  • the first encryption algorithm is used to generate the key verification information from the plaintext key
  • the second encryption algorithm is used to generate the key query information from the plaintext key.
  • the first encryption algorithm and the second encryption algorithm are different, wherein the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm, and the second encryption algorithm includes an asymmetric encryption algorithm.
  • the first encryption algorithm includes AES, MD5 or SHA encryption algorithm; in one embodiment, the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithm.
  • the plaintext key can be obtained according to the output key query information according to the second encryption algorithm, and the plaintext key is used as the authentication request key information, that is, The access authentication succeeds, and the interface access authority of the wireless terminal is obtained.
  • the embodiment of the present disclosure provides an interface access authentication method for a wireless terminal in the Uboot mode.
  • the authentication request key information carried in the authentication request is obtained, and according to a preset key
  • the verification information verifies the authentication request key information.
  • the interface access authority of the wireless terminal is obtained, and when the verification fails, a key query information is output.
  • the key query information and the key verification information are obtained according to the same plaintext key.
  • security measures for the wireless terminal interface access are added, thereby preventing malicious access to the wireless terminal interface.
  • the R&D or tester when the verification fails, will use the private key tool or IT system containing the second encryption algorithm to decrypt the key query information to obtain the plaintext key, and then use the authentication request on the interface to carry the decrypted key. Enter the plaintext key of the wireless terminal into the wireless terminal to enable the interface debugging function of the wireless terminal.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the wireless terminal 100 includes an interface opening module 110 , a storage module 120 and an authentication module 130 .
  • the interface enabling module 110 is configured to enable the access authority of the serial port interface of the wireless terminal.
  • the storage module 120 is configured to store a key verification information and a key query information preset by the wireless terminal 100, and the key query information and the key verification information are obtained according to the same plaintext key.
  • the authentication module 130 is configured to respond to the authentication request of the interface access, obtain the authentication request key information carried in the authentication request, and verify the authentication request key information according to the key verification information, and when the verification is successful, obtain the information of the wireless terminal.
  • the wireless terminal 100 further includes an encryption module 140 configured to encrypt the authentication request key information according to the first preset encryption algorithm, so that the authentication module 130 can verify the encrypted authentication information according to the key verification information. right to request key information.
  • the encryption module 140 is further configured to randomly generate the plaintext encryption key according to a preset password strength policy, use the first encryption algorithm to generate the encryption key verification information from the plaintext encryption key, and use the second encryption algorithm to generate the plaintext encryption key.
  • the key query information is generated.
  • the wireless terminal includes an interface opening module, a storage module, and an authentication module
  • the interface opening module is set to open the access authority of the serial port interface of the wireless terminal
  • the storage module is set to store key verification information and key query information
  • the authentication module is set to obtain the authentication request key information in response to the authentication request of the interface access, and verify the authentication request key information according to the key verification information, when the verification succeeds, obtain the interface access authority of the wireless terminal, and the verification fails , output the key query information.
  • the key query information and the key verification information are obtained according to the same plaintext key.
  • FIG. 3 is a schematic flowchart of an access authentication method for a serial port interface of a wireless terminal according to Embodiment 3 of the present disclosure.
  • the method is used to obtain the access authority of the serial port interface of a wireless terminal.
  • the wireless terminal includes a serial port module 200 and an authentication module. 300. After the wireless terminal is powered on, the command input function of the serial port module 200 is disabled in the uboot mode. If you want to enable the access authority of the uboot serial port interface, you need to enter the uboot startup mode when the wireless terminal is turned on and enter the countdown stage.
  • An authentication request for authentication request information, and the access authentication method includes:
  • Step S101 the serial port module 200 receives the authentication request carrying the authentication request information from the serial port of the wireless terminal;
  • Step S102 the serial port module 200 obtains the authentication request information from the authentication request, and sends the authentication request information to the authentication module 300;
  • Step S103 the authentication module 300 encrypts the authentication request information, and the encryption method is the same as the encryption method of the pre-compared key verification information.
  • the first encryption algorithm is used for encryption, and the first encryption algorithm includes AES, MD5 or SHA encryption algorithm;
  • Step S104 verifying the key verification information and the encrypted authentication request information
  • Step S105 if the verification fails, send the key query information to the serial port module 200;
  • step S106 the serial port module 200 outputs the received key query information, does not enable the access authority of the serial port interface, and closes the serial port console.
  • the access authentication method may further include:
  • Step S107 obtaining key verification information according to the key query information.
  • the key query information and the key verification information are obtained according to the same plaintext encryption key, the first encryption algorithm is used to generate the plaintext encryption key to generate the encryption key verification information, and the second encryption algorithm is used to generate the encryption key query information from the plaintext encryption key.
  • the first encryption algorithm and the second encryption algorithm are different, wherein the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm, and the second encryption algorithm includes an asymmetric encryption algorithm.
  • the first encryption algorithm includes AES, MD5 or SHA encryption algorithm, and the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithm;
  • Step S108 carrying the plaintext encryption key to the serial port module 200 through the authentication request, and the serial port module 200 sends the plaintext encryption key to the authentication module 300 for access authentication of the serial port interface of the wireless terminal;
  • Step S109 encrypt the plaintext key, and verify the key verification information and the encrypted plaintext key
  • Step S110 sending verification success information to the serial port module 200;
  • Step S111 the serial port module 200 enables the access authority of the serial port interface of the wireless terminal.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • FIG. 4 is a schematic flowchart of a method for obtaining key verification information and key query information according to Embodiment 3 of the present disclosure, which is used to generate and obtain key verification information and a password for securely opening a serial port interface of a wireless terminal by a key generation device.
  • Key query information first query whether the key verification information already exists, if so, stop the generation of the key verification information and the key query information, if not, the method includes:
  • Step S201 generating a plaintext key.
  • the password strength policy includes the minimum length of password characters and the minimum number of character types (such as uppercase, lowercase, numbers, special characters, etc.).
  • Step S202 adopt the second encryption algorithm to encrypt the plaintext key, generate and store the key query information, because the acquisition of the key query information does not need to be generated in the uboot mode, so the second encryption algorithm can use complex asymmetric encryption. algorithm to generate key query information in a preset dedicated key generation device.
  • Step S203 using the first encryption algorithm to encrypt the plaintext key to generate and store the key verification information, because in the authentication process, it is necessary to use the first encryption algorithm to encrypt the pre-verification authentication request information in the uboot mode , so the first encryption algorithm needs to use a symmetric encryption algorithm or a hash algorithm, and uboot does not need to integrate a complex encryption algorithm library, so that the encryption process is simple and easy to implement.
  • the first encryption algorithm includes encryption algorithms such as AES, MD5, or SHA.
  • This embodiment also provides a wireless terminal, including a processor and a memory, the processor is configured to execute one or more programs stored in the memory, so as to implement the steps of the interface access authentication method described in Embodiment 1, wherein , the memory is coupled to the processor.
  • the present embodiments also provide a computer-readable storage medium embodied in any method or technology arranged to store information, such as computer-readable instructions, data structures, computer program modules, or other data volatile or nonvolatile, removable or non-removable media.
  • Computer-readable storage media include but are not limited to RAM (Random Access Memory, random access memory), ROM (Read-Only Memory, read-only memory), EEPROM (Electrically Erasable Programmable read only memory, electrified Erasable Programmable Read-Only Memory) ), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, Or any other medium that can be used to store the desired information and that can be accessed by a computer.
  • This embodiment also provides a computer program (or computer software), the computer program can be distributed on a computer-readable medium and executed by a computable device, so as to realize the above-mentioned first embodiment, third embodiment and fourth embodiment At least one step of the interface access authentication method under the Uboot mode, the access authentication method of the serial port interface of the wireless terminal and the acquisition method of the key verification information and the key query information; and in some cases, can be different from At least one of the steps shown or described is performed in the order described in the above embodiments.
  • FIG. 5 is a schematic structural diagram of a wireless terminal in another embodiment, which includes a processor 51, a memory 53, and a communication bus 52, wherein:
  • the communication bus 52 is configured to realize the connection communication between the processor 51 and the memory 52;
  • the processor 51 is configured to execute one or more computer programs stored in the memory 53 to implement at least one step of the data transmission method in the first embodiment above.
  • This embodiment also provides a computer program product, including a computer-readable device, where the computer program as shown above is stored on the computer-readable device.
  • the computer-readable device may include the computer-readable storage medium as described above.
  • each wireless terminal uses the interface authentication key verification information and key query information to be randomly generated and unique, and the interface access authority of the wireless terminal is checked during the startup phase of the uboot mode Therefore, it has higher security.
  • the interface authentication password supports the password query function. If the R&D or tester does not know the authentication password, they can enter the authentication password to query, and then use tools or IT systems to decrypt them into plaintext keys, so as to improve the user experience. experience.
  • the key verification information and the key query information are generated by a preset key generation device, and the preset key generation device can run in a non-uboot mode, thereby reducing the difficulty of implementing the interface access authentication method disclosed in this application .
  • the functional modules/units in the system, and the device can be implemented as software (which can be implemented by computer program codes executable by a computing device). ), firmware, hardware, and their appropriate combination.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively.
  • Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • communication media typically embodies computer readable instructions, data structures, computer program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery, as is well known to those of ordinary skill in the art medium. Therefore, the present disclosure is not limited to any particular combination of hardware and software.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本公开提供了一种无线终端及无线终端在Uboot模式下的接口访问鉴权方法，通过响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息，依据预设的一密匙验证信息验证鉴权请求密匙信息，当验证成功时，获取无线终端的接口访问权限，当验证失败时，输出一密匙查询信息。其中，密匙查询信息与密匙验证信息依据相同的明文密匙获取。由于获取无线终端的接口访问权限需有鉴权步骤，增加了无线终端接口访问的安全措施，进而阻止对无线终端接口的恶意访问。

Description

无线终端及无线终端在Uboot模式下的接口访问鉴权方法
相关申请的交叉引用
本公开基于2020年9月14日提交的中国专利申请CN202010960485.4，并且要求该专利申请的优先权，通过引用将其所公开的内容全部并入本申请。
技术领域
本公开实施例涉及但不限于无线终端领域，具体而言，涉及但不限于无线终端及无线终端在Uboot模式下的接口访问鉴权方法。
背景技术
随着通信技术的不断发展，各种不同的无线终端得到了广泛的推广和应用，现有的无线终端一般都需要通过各种接口来调用和获取数据，例如，无线终端的串口是产品研发阶段的软件调试和故障诊断的重要通讯接口，通过它可以了解无线终端的运行机制、获取敏感数据和逆向固件信息，为了防止恶意攻击、读取或篡改，无线终端只对部分串口功能进行关闭，而绝大部分串口功能为了满足售后服务故障诊断的需要而保留，就增加了无线终端的安全隐患，因此需要为无线终端的接口访问增加安全措施，以能够阻止对无线终端接口的恶意访问。
发明内容
本公开实施例提供的无线终端在Uboot模式下的接口访问鉴权方法，主要解决的技术问题是无线终端的接口访问存在安全隐患。
为解决上述技术问题，本公开实施例提供一种无线终端在Uboot模式下的接口访问鉴权方法，用于获取无线终端的接口访问权限，所述接口访问鉴权方法包括：
响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息；
依据预设的一密匙验证信息验证所述鉴权请求密匙信息；
在验证成功的情况下，获取所述无线终端的接口访问权限；
再验证失败的情况下，输出一密匙查询信息；所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取。
在一实施例中，所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取，包括：
按预设密码强度策略随机生成所述明文密匙；
采用第一加密算法将所述明文密匙生成所述密匙验证信息，采用第二加密算法将所述明文密匙生成所述密匙查询信息。
在一实施例中，所述密码强度策略包括密码字符最小长度和包含的最少字符类型数。
在一实施例中，所述第一加密算法和所述第二加密算法不同；所述第一加密算法包括对称加密算法或散列算法；所述第二加密算法包括非对称加密算法。
在一实施例中，所述第一加密算法包括AES、MD5或SHA加密算法。
在一实施例中，所述第二加密算法包括RSA或椭圆曲线非对称加密算法。
本公开实施例还提供一种无线终端，包括处理器和存储器；
所述处理器设置为执行所述存储器中存储的一个或者多个程序，以实现如上所述的接口访问鉴权方法的步骤；其中，所述存储器与所述处理器耦接。
本公开实施例还提供一种无线终端，包括：
接口开启模块，设置为开启所述无线终端的串口接口的访问权限；
存储模块，设置为存储所述无线终端预设的一密匙验证信息和一密匙查询信息；所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取；
鉴权模块，设置为响应接口访问的鉴权请求，获取所述鉴权请求携带的鉴权请求密匙信息，并依据所述密匙验证信息验证所述鉴权请求密匙信息；验证成功时，获取所述无线终端的接口访问权限；验证失败时，输出所述密匙查询信息。
一实施例中，还包括加密模块，设置为按第一预设加密算法对所述鉴权请求密匙信息进行加密，以用于所述鉴权模块依据所述密匙验证信息验证加密后的所述鉴权请求密匙信息。
一实施例中，所述加密模块还设置为按预设密码强度策略随机生成所述明文密匙，采用第一加密算法将所述明文密匙生成所述密匙验证信息，采用第二加密算法将所述明文密匙生成所述密匙查询信息。
本公开实施例还提供一种计算机存储介质，所述计算机可读存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如上所述实施例中的接口访问鉴权方法的步骤。
根据本公开实施例提供的一种无线终端在Uboot模式下的接口访问鉴权方法、无线终端以及计算机存储介质，通过响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息，依据预设的一密匙验证信息验证鉴权请求密匙信息，当验证成功时，获取无线终端的接口访问权限，当验证失败时，输出一密匙查询信息。其中，密匙查询信息与密匙验证信息依据相同的明文密匙获取。在某些实施过程中由于获取无线终端的接口访问权限需有鉴权步骤，增加了无线终端接口访问的安全措施，进而阻止对无线终端接口的恶意访问。
本公开其他特征和相应的有益效果在说明书的后面部分进行阐述说明，且应当理解，至少部分有益效果从本公开说明书中的记载变的显而易见。
附图说明
图1为本公开实施例一的Uboot模式下的接口访问鉴权方法的流程示意图；
图2为本公开实施例二的一种无线终端的结构示意图；
图3为本公开实施例三的一种无线终端串口接口的访问鉴权方法的流程示意图；
图4为本公开实施例三的密匙验证信息和密匙查询信息的获取方法的流程示意图；
图5为另一种实施例中无线终端的结构示意图。
具体实施方式
为了使本公开的目的、技术方案及优点更加清楚明白，下面通过具体实施方式结合附图对本公开实施例作进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本公 开，并不设置为限定本公开。
实施例一：
无线终端的串口是产品研发阶段的软件调试和故障诊断的重要手段，对于攻击者来说串口也具有极高的利用价值，通过它可以了解设备运行机制、获取敏感数据和逆向固件。无线终端只有部分项目的设备串口功能是关闭的，但大部分项目为了售后故障诊断需要保留设备串口调试功能，因此需要有安全措施能够阻止非法用户对设备串口的访问。为了对无线终端在Uboot模式下的接口访问进行保护，在Uboot模式下默认不允许输入除鉴权请求之外的任何命令，即使无线终端的内核启动后也不打开无线设备的接口控制台。例如，要打开无线终端的串口命令输入功能，则需要输入密码并且鉴权通过后才能开启，该密码对每个无线终端唯一，是无线终端自行生成并保存到Flash存储中。
请参考图1，为本公开实施例一的Uboot模式下的接口访问鉴权方法的流程示意图，该方法用于获取无线终端的接口访问权限，包括：
步骤一，获取鉴权请求密匙信息。
无线终端开机启动进入Uboot模式后，接口的命令输入功能是关闭的，如果预开启接口访问的命令输入功能，需输入携带鉴权请求密匙信息的鉴权请求命令。在Uboot模式下输入鉴权请求后，响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息。
步骤二，验证鉴权请求密匙信息。
依据预设的一密匙验证信息验证鉴权请求密匙信息。其中，预设的密匙验证信息是依据一明文密匙获取的。一实施例中，预设的密匙验证信息是将明文密匙使用第一加密算法加密后获取的。先将获取的密匙验证信息按第一加密算法进行加密，然后比对加密后的密匙验证信息和预设的密匙验证信息是否相同，相同则验证成功，不相同则验证失败。一实施例中，第一加密算法包括对称加密算法或散列算法。
步骤三，获取接口访问权限。
验证成功，获取无线终端的接口访问权限，即开启接口访问的命令输入功能。
步骤四，输出密匙查询信息。
如果验证失败，则输出一密匙查询信息。其中，密匙查询信息与密匙验证信息依据相同的明文密匙获取，密匙查询信息和密匙验证信息获取方法包括：
按预设密码强度策略随机生成明文密匙，预设密码强度策略包括明文密匙必须包括大写字母、小写字母、特殊字符和/或数字，预设密码强度策略还包括明文密匙的字符最小长度和包含的最少字符类型数。采用第一加密算法将明文密匙生成密匙验证信息，采用第二加密算法将明文密匙生成密匙查询信息。一实施例中，第一加密算法和第二加密算法不同，其中，第一加密算法包括对称加密算法或散列算法，第二加密算法包括非对称加密算法。一实施例中，第一加密算法包括AES、MD5或SHA加密算法；一实施例中，第二加密算法包括RSA或椭圆曲线非对称加密算法。
因密匙查询信息与密匙验证信息依据相同的明文密匙获取，所以依据输出的密匙查询信息按第二加密算法可获取明文密匙，将明文密匙作为鉴权请求密匙信息，即访问鉴权成功，进而获取无线终端的接口访问权限。
本公开实施例提供的一种无线终端在Uboot模式下的接口访问鉴权方法，通过响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息，依据预设的一密匙验证信息验证鉴权请求密匙信息，当验证成功时，获取无线终端的接口访问权限，当验证失败时，输出一密匙查询信息。其中，密匙查询信息与密匙验证信息依据相同的明文密匙获取。在某些实施过程中由于获取无线终端的接口访问权限需有鉴权步骤，增加了无线终端接口访问的安全措施，进而阻止对无线终端接口的恶意访问。在一实施例中，当验证失败时，研发或测试人员将使用包含第二加密算法私钥工具或IT***将密匙查询信息解密出明文密匙，然后再在接口使用鉴权请求携带解密后的明文密匙输入无线终端来开启无线终端的接口调试功能。
实施例二：
请参考图2，为本公开实施例二的一种无线终端的结构示意图，无线终端100包括接口开启模块110、存储模块120和鉴权模块130。接口开启模块110，设置为开启无线终端的串口接口的访问权限。存储模块120设置为存储无线终端100预设的一密匙验证信息和一密匙查询信息，密匙查询信息与密匙验证信息依据相同的明文密匙获取。鉴权模块130设置为响应接口访问的鉴权请求，获取鉴权请求携带的鉴权请求密匙信息，并依据密匙验证信息验证鉴权请求密匙信息,当验证成功时，获取无线终端的接口访问权限，验证失败时，输出所述密匙查询信息。一实施例中，无线终端100还包括加密模块140，设置为按照第一预设加密算法对鉴权请求密匙信息进行加密，以用于鉴权模块130依据密匙验证信息验证加密后的鉴权请求密匙信息。加密模块140还设置为按预设密码强度策略随机生成所述明文密匙，采用第一加密算法将所述明文密匙生成所述密匙验证信息，采用第二加密算法将所述明文密匙生成所述密匙查询信息。
在本申请实施例中，无线终端包括接口开启模块、存储模块和鉴权模块，接口开启模块设置为开启无线终端的串口接口的访问权限，存储模块设置为存储密匙验证信息和密匙查询信息，鉴权模块设置为响应接口访问的鉴权请求获取鉴权请求密匙信息，并依据密匙验证信息验证鉴权请求密匙信息,当验证成功时，获取无线终端的接口访问权限，验证失败时，输出所述密匙查询信息。其中，密匙查询信息与密匙验证信息依据相同的明文密匙获取。
实施例三：
请参考图3，为本公开实施例三的一种无线终端串口接口的访问鉴权方法的流程示意图，该方法用于获取无线终端串口接口的访问权限，无线终端包括串口模块200和鉴权模块300，无线终端开机启动后，在uboot模式下串口模块200的命令输入功能是关闭的，如果要开启uboot的串口接口的访问权限，则需要在无线终端开机进入uboot启动模式的倒计时阶段， 输入带鉴权请求信息的鉴权请求，该访问鉴权方法包括：
步骤S101，串口模块200从无线终端的串口接收携带鉴权请求信息的鉴权请求；
步骤S102，串口模块200从鉴权请求中获取鉴权请求信息，并发送鉴权请求信息给鉴权模块300；
步骤S103，鉴权模块300对鉴权请求信息进行加密，加密方式使用与预进行比较的密匙验证信息的加密方式相同。一实施例中，采用第一加密算法加密，该第一加密算法包括AES、MD5或SHA加密算法；
步骤S104，验证密匙验证信息和加密后的鉴权请求信息；
步骤S105，验证失败发送密匙查询信息给串口模块200；
步骤S106，串口模块200输出接收的密匙查询信息，并不开启串口接口的访问权限，关闭串口控制台。
在一实施例中，该访问鉴权方法还可包括：
步骤S107，依据密匙查询信息获取密匙验证信息。密匙查询信息和密匙验证信息是依据同一明文密匙获取，采用第一加密算法将明文密匙生成密匙验证信息，采用第二加密算法将明文密匙生成密匙查询信息。在一实施例中，第一加密算法和第二加密算法不同，其中，第一加密算法包括对称加密算法或散列算法，第二加密算法包括非对称加密算法。一实施例中，第一加密算法包括AES、MD5或SHA加密算法，第二加密算法包括RSA或椭圆曲线非对称加密算法；
步骤S108，通过鉴权请求携带明文密匙给串口模块200，串口模块200将明文密匙发送给鉴权模块300用于无线终端串口接口的访问鉴权；
步骤S109，对明文密匙进行加密，并验证密匙验证信息和加密后的明文密匙；
步骤S110，发送验证成功信息给串口模块200；
步骤S111：串口模块200开启无线终端的串口接口的访问权限。
实施例四：
请参考图4，为本公开实施例三的密匙验证信息和密匙查询信息的获取方法的流程示意图，用于通过密匙生成装置生成获取无线终端串口接口安全开启的密匙验证信息和密匙查询信息，首先查询密匙验证信息是否已存在，如果存在则停止密匙验证信息和密匙查询信息的生成，如果不存在则该方法包括：
步骤S201，生成明文密匙。按照预设密码强度策略生成一个随机密码作为明文密匙，密码强度策略包括密码字符最小长度、包含的最少字符类型数(例如大写、小写、数字、特殊字符等)。
步骤S202，采用第二加密算法对明文密匙进行加密，生成密匙查询信息并存储，因密匙查询信息的获取不需要在uboot模式下生成，所以第二加密算法可采用复杂的非对称加密算法，在预设的专用密匙生成装置中生成密匙查询信息。
步骤S203，采用第一加密算法对明文密匙进行加密，以生成密匙验证信息并存储，因在鉴权过程中，需要在uboot模式下对预验证鉴权请求信息采用第一加密算法进行加密，所以第一加密算法需采用对称加密算法或散列算法，不需要uboot集成复杂的加密算法库，从而 使得加密过程简单和易于实现。一实施例中，第一加密算法包括AES、MD5或SHA等加密算法。
本实施例还提供了一种无线终端，包括处理器和存储器，处理器设置为执行存储器中存储的一个或者多个程序，以实现实施例一中所述的接口访问鉴权方法的步骤，其中，存储器与处理器耦接。
本实施例还提供了一种计算机可读存储介质，该计算机可读存储介质包括在设置为存储信息(诸如计算机可读指令、数据结构、计算机程序模块或其他数据)的任何方法或技术中实施的易失性或非易失性、可移除或不可移除的介质。计算机可读存储介质包括但不限于RAM(Random Access Memory，随机存取存储器),ROM(Read-Only Memory，只读存储器),EEPROM(Electrically Erasable Programmable read only memory，带电可擦可编程只读存储器)、闪存或其他存储器技术、CD-ROM(Compact Disc Read-Only Memory，光盘只读存储器)，数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。
本实施例还提供了一种计算机程序(或称计算机软件)，该计算机程序可以分布在计算机可读介质上，由可计算装置来执行，以实现上述实施例一、实施例三和实施例四中的Uboot模式下的接口访问鉴权方法、无线终端串口接口的访问鉴权方法和密匙验证信息和密匙查询信息的获取方法的至少一个步骤；并且在某些情况下，可以采用不同于上述实施例所描述的顺序执行所示出或描述的至少一个步骤。
本实施例还提供了一种数据传输装置，请参考图5，为另一种实施例中无线终端的结构示意图，其包括处理器51、存储器53及通信总线52，其中：
通信总线52设置为实现处理器51和存储器52之间的连接通信；
处理器51设置为执行存储器53中存储的一个或者多个计算机程序，以实现上述实施例一中一种数据传输方法中的至少一个步骤。
应当理解的是，在某些情况下，可以采用不同于上述实施例所描述的顺序执行所示出或描述的至少一个步骤。
本实施例还提供了一种计算机程序产品，包括计算机可读装置，该计算机可读装置上存储有如上所示的计算机程序。本实施例中该计算机可读装置可包括如上所示的计算机可读存储介质。
在本申请的一实施例中，由于每个无线终端用于接口鉴权密匙验证信息和密匙查询信息是随机生成且唯一，而且在uboot模式的启动阶段就对无线终端的接口访问权限进行了控制因此具有较高的安全性。另本申请一实施例中，接口鉴权密码支持密码查询功能，研发或测试人员如果不知道认证密码则可以输入鉴权密令查询，然后使用工具或IT***解密成明文密匙，从而可以提升用户体验。密匙验证信息和密匙查询信息是由预设的密匙生成装置生成， 该预设的密匙生成装置可运行在非uboot模式，从而可以降低本申请公开的接口访问鉴权方法的实现难度。
可见，本领域的技术人员应该明白，上文中所公开方法中的全部或某些步骤、***、装置中的功能模块/单元可以被实施为软件(可以用计算装置可执行的计算机程序代码来实现)、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。
此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、计算机程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。所以，本公开不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本公开实施例所作的进一步详细说明，不能认定本公开的具体实施只局限于这些说明。对于本公开所属技术领域的普通技术人员来说，在不脱离本公开构思的前提下，还可以做出若干简单推演或替换，都应当视为属于本公开的保护范围。

Claims (10)

  1. 一种无线终端在Uboot模式下的接口访问鉴权方法，用于获取无线终端的接口访问权限，所述接口访问鉴权方法包括：
    响应接口访问的鉴权请求，获取所述鉴权请求携带的鉴权请求密匙信息；
    依据预设的一密匙验证信息验证所述鉴权请求密匙信息；
    在验证成功的情况下，获取所述无线终端的接口访问权限；
    在验证失败的情况下，输出一密匙查询信息；所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取。
  2. 如权利要求1所述的接口访问鉴权方法，其中，所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取，包括：
    按预设密码强度策略随机生成所述明文密匙；
    采用第一加密算法将所述明文密匙生成所述密匙验证信息，采用第二加密算法将所述明文密匙生成所述密匙查询信息。
  3. 如权利要求2所述的接口访问鉴权方法，其中，所述密码强度策略包括密码字符最小长度和包含的最少字符类型数。
  4. 如权利要求2所述的接口访问鉴权方法，其中，所述第一加密算法和所述第二加密算法不同；所述第一加密算法包括对称加密算法或散列算法,所述第二加密算法包括非对称加密算法。
  5. 如权利要求2所述的接口访问鉴权方法，其中，所述第一加密算法包括AES、MD5或SHA加密算法；所述第二加密算法包括RSA或椭圆曲线非对称加密算法。
  6. 一种无线终端，包括：
    接口开启模块，设置为开启所述无线终端的串口接口的访问权限；
    存储模块，设置为存储所述无线终端预设的一密匙验证信息和一密匙查询信息；所述密匙查询信息与所述密匙验证信息依据相同的明文密匙获取；
    鉴权模块，设置为响应接口访问的鉴权请求，获取所述鉴权请求携带的鉴权请求密匙信息，并依据所述密匙验证信息验证所述鉴权请求密匙信息；验证成功时，获取所述无线终端的接口访问权限；验证失败时，输出所述密匙查询信息。
  7. 如权利要求6所述的无线终端，其中，还包括加密模块，设置为按一第一预设加密算法对所述鉴权请求密匙信息进行加密，以用于所述鉴权模块依据所述密匙验证信息验证加密后的所述鉴权请求密匙信息。
  8. 如权利要求7所述的无线终端，其中，所述加密模块还设置为按预设密码强度策略随机生成所述明文密匙，采用第一加密算法将所述明文密匙生成所述密匙验证信息，采用第二加密算法将所述明文密匙生成所述密匙查询信息。
  9. 一种无线终端，包括处理器和存储器，所述存储器与所述处理器耦接；
    所述处理器设置为执行所述存储器中存储的一个或者多个程序，以实现如权利要求1至5中任一项所述的接口访问鉴权方法的步骤。
  10. 一种计算机可读存储介质，所述计算机可读存储介质存储有一个或者多个计算机程 序，所述一个或者多个计算机程序可被一个或者多个处理器执行，以实现如权利要求1至5中任一项所述的接口访问鉴权方法的步骤。
PCT/CN2021/110126 2020-09-14 2021-08-02 无线终端及无线终端在Uboot模式下的接口访问鉴权方法 WO2022052665A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2023516195A JP2023542099A (ja) 2020-09-14 2021-08-02 無線端末、及び無線端末のＵｂｏｏｔモードにおけるインタフェースアクセス認証方法
EP21865721.1A EP4213520A4 (en) 2020-09-14 2021-08-02 WIRELESS TERMINAL AND INTERFACE ACCESS AUTHENTICATION METHOD FOR WIRELESS TERMINAL IN UBOOT MODE
US18/026,240 US20230370262A1 (en) 2020-09-14 2021-08-02 Wireless Terminal and Method for Authenticating Interface Access of Wireless Terminal in Uboot Mode

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010960485.4A CN114189862A (zh) 2020-09-14 2020-09-14 无线终端及无线终端在Uboot模式下的接口访问鉴权方法
CN202010960485.4 2020-09-14

Publications (1)

Publication Number Publication Date
WO2022052665A1 true WO2022052665A1 (zh) 2022-03-17

Family

ID=80539637

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/110126 WO2022052665A1 (zh) 2020-09-14 2021-08-02 无线终端及无线终端在Uboot模式下的接口访问鉴权方法

Country Status (5)

Country Link
US (1) US20230370262A1 (zh)
EP (1) EP4213520A4 (zh)
JP (1) JP2023542099A (zh)
CN (1) CN114189862A (zh)
WO (1) WO2022052665A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114760063A (zh) * 2022-03-18 2022-07-15 百安居信息技术(上海)有限公司 家装留资数据处理方法、***、存储介质及设备

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112257074B (zh) * 2020-11-10 2024-02-23 深圳市绿联科技股份有限公司 一种usb接口芯片电路、扩展坞、固件鉴权方法和装置

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104322003A (zh) * 2012-01-31 2015-01-28 菲纳逻辑商业技术有限公司 借助实时加密进行的密码认证和识别方法
CN105488435A (zh) * 2015-11-30 2016-04-13 南京南瑞继保电气有限公司 一种嵌入式***串口终端防攻击方法
CN106992857A (zh) * 2017-03-30 2017-07-28 努比亚技术有限公司 一种刷机验证方法及装置
CN107395560A (zh) * 2017-06-05 2017-11-24 努比亚技术有限公司 安全校验及其发起、管理方法、设备、服务器和存储介质
CN108965943A (zh) * 2018-07-26 2018-12-07 四川长虹电器股份有限公司 Android智能电视对串口访问密码控制的方法
CN109981562A (zh) * 2019-01-17 2019-07-05 平安科技（深圳）有限公司 一种软件开发工具包授权方法及装置
CN110719166A (zh) * 2019-10-15 2020-01-21 深圳市元征科技股份有限公司 芯片烧录方法、芯片烧录装置、芯片烧录***及存储介质
CN112257074A (zh) * 2020-11-10 2021-01-22 深圳市绿联科技有限公司 一种usb接口芯片电路、扩展坞、固件鉴权方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE19835609C2 (de) * 1998-08-06 2000-06-08 Siemens Ag Programmgesteuerte Einheit
JP2009505304A (ja) * 2005-08-22 2009-02-05 エヌエックスピー ビー ヴィ 埋設式メモリのアクセス制御
US8214630B2 (en) * 2009-02-24 2012-07-03 General Instrument Corporation Method and apparatus for controlling enablement of JTAG interface

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104322003A (zh) * 2012-01-31 2015-01-28 菲纳逻辑商业技术有限公司 借助实时加密进行的密码认证和识别方法
CN105488435A (zh) * 2015-11-30 2016-04-13 南京南瑞继保电气有限公司 一种嵌入式***串口终端防攻击方法
CN106992857A (zh) * 2017-03-30 2017-07-28 努比亚技术有限公司 一种刷机验证方法及装置
CN107395560A (zh) * 2017-06-05 2017-11-24 努比亚技术有限公司 安全校验及其发起、管理方法、设备、服务器和存储介质
CN108965943A (zh) * 2018-07-26 2018-12-07 四川长虹电器股份有限公司 Android智能电视对串口访问密码控制的方法
CN109981562A (zh) * 2019-01-17 2019-07-05 平安科技（深圳）有限公司 一种软件开发工具包授权方法及装置
CN110719166A (zh) * 2019-10-15 2020-01-21 深圳市元征科技股份有限公司 芯片烧录方法、芯片烧录装置、芯片烧录***及存储介质
CN112257074A (zh) * 2020-11-10 2021-01-22 深圳市绿联科技有限公司 一种usb接口芯片电路、扩展坞、固件鉴权方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4213520A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114760063A (zh) * 2022-03-18 2022-07-15 百安居信息技术(上海)有限公司 家装留资数据处理方法、***、存储介质及设备

Also Published As

Publication number Publication date
CN114189862A (zh) 2022-03-15
JP2023542099A (ja) 2023-10-05
EP4213520A4 (en) 2024-03-13
US20230370262A1 (en) 2023-11-16
EP4213520A1 (en) 2023-07-19

Similar Documents

Publication Publication Date Title
EP3458999B1 (en) Self-contained cryptographic boot policy validation
CN112513857A (zh) 可信执行环境中的个性化密码安全访问控制
JP4912879B2 (ja) プロセッサの保護された資源へのアクセスに対するセキュリティ保護方法
WO2020192406A1 (zh) 数据存储、验证方法及装置
US7639819B2 (en) Method and apparatus for using an external security device to secure data in a database
US6539480B1 (en) Secure transfer of trust in a computing system
US8281115B2 (en) Security method using self-generated encryption key, and security apparatus using the same
US20160350549A1 (en) Implementing access control by system-on-chip
WO2019109968A1 (zh) 一种解锁sim卡的方法及移动终端
US9893882B1 (en) Apparatus, system, and method for detecting device tampering
WO2022052665A1 (zh) 无线终端及无线终端在Uboot模式下的接口访问鉴权方法
US20170201528A1 (en) Method for providing trusted service based on secure area and apparatus using the same
US20230237193A1 (en) Security processor configured to authenticate user and authorize user for user data and computing system including the same
CN106992978B (zh) 网络安全管理方法及服务器
CN114942729A (zh) 一种计算机***的数据安全存储与读取方法
US9076002B2 (en) Stored authorization status for cryptographic operations
US11216571B2 (en) Credentialed encryption
US20230198746A1 (en) Secure key exchange using key-associated attributes
CN116484379A (zh) ***启动方法、包含可信计算基软件的***、设备及介质
CN110740036A (zh) 基于云计算的防攻击数据保密方法
CN108228219B (zh) 一种带外刷新bios时验证bios合法性的方法及装置
EP3525391A1 (en) Device and method for key provisioning
CN117786667B (zh) 一种用于可控计算的进程权限管理方法、***及存储介质
CN114491481B (zh) 一种基于fpga的安全计算方法及装置
CN114091027B (zh) 信息配置方法、数据访问方法及相关装置、设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21865721

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023516195

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2021865721

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021865721

Country of ref document: EP

Effective date: 20230414