WO2023236720A1 - 设备认证和校验的方法、装置、设备和存储介质 - Google Patents
设备认证和校验的方法、装置、设备和存储介质 Download PDFInfo
- Publication number
- WO2023236720A1 WO2023236720A1 PCT/CN2023/093556 CN2023093556W WO2023236720A1 WO 2023236720 A1 WO2023236720 A1 WO 2023236720A1 CN 2023093556 W CN2023093556 W CN 2023093556W WO 2023236720 A1 WO2023236720 A1 WO 2023236720A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- certificate
- activation
- request
- verification
- trusted environment
- Prior art date
Links
- 238000012795 verification Methods 0.000 title claims abstract description 94
- 238000000034 method Methods 0.000 title claims abstract description 90
- 238000003860 storage Methods 0.000 title claims abstract description 21
- 230000004913 activation Effects 0.000 claims abstract description 208
- 230000004044 response Effects 0.000 claims abstract description 38
- 230000008569 process Effects 0.000 claims description 48
- 238000012545 processing Methods 0.000 claims description 20
- 238000012790 confirmation Methods 0.000 claims description 11
- 238000004590 computer program Methods 0.000 claims description 5
- 230000005540 biological transmission Effects 0.000 claims description 4
- 238000005242 forging Methods 0.000 abstract description 3
- 238000001994 activation Methods 0.000 description 160
- 238000010586 diagram Methods 0.000 description 35
- 230000006854 communication Effects 0.000 description 14
- 238000004891 communication Methods 0.000 description 13
- 230000006870 function Effects 0.000 description 7
- 238000004364 calculation method Methods 0.000 description 4
- 230000003993 interaction Effects 0.000 description 4
- 230000002452 interceptive effect Effects 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 238000013475 authorization Methods 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000012549 training Methods 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
- H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
Definitions
- Example embodiments of the present disclosure relate generally to the computer field, and in particular to methods, apparatus, devices and computer-readable storage media for device authentication and verification.
- a method of device authentication includes: at the first device, sending a device activation request to the second device, the device activation request including identity authentication information of the first device; and in response to receiving the activation certificate from the second device, storing the activation certificate in The first device is associated with a trusted environment.
- the method also includes sending a certificate signing request to the second device, the certificate signing request being generated in a trusted environment based at least in part on the activation certificate and storing a device certificate received from the second device in the trusted environment, the device certificate Generated based on the certificate signing request.
- a method for device verification includes locating an activation certificate in a trusted environment associated with the first device, the activation certificate being Generated by the second device authenticating the first device. In response to determining that the activation certificate exists in a trusted environment, the activation certificate is locally verified. The method further includes, in response to the activation certificate passing local verification, generating an activated verification identification for identity verification of the first device against the local service.
- a method of device authentication includes, in response to receiving a device activation request from the first device, verifying, at the second device, identity authentication information of the first device indicated in the device activation request. In response to successful verification of the identity authentication information, an activation certificate is sent to the first device. The method also includes, in response to receiving the certificate signing request from the first device, sending a device certificate to the first device, the device certificate being generated based on the certificate signing request.
- an apparatus for device authentication includes an activation request sending module configured to send a device activation request to a second device, where the device activation request includes identity authentication information of the first device; an activation certificate storage module configured to respond to the request from the first device.
- the second device receives the activation certificate and stores the activation certificate in a trusted environment associated with the first device; a certificate signature request sending module is configured to send a certificate signing request to the second device, the a certificate signing request generated in the trusted environment based at least in part on the activation certificate; and a device certificate storage module configured to store a device certificate received from the second device in the trusted environment, The device certificate is generated based on the certificate signing request.
- an apparatus for equipment verification includes: an activation certificate lookup module configured to look up an activation certificate in a trusted environment associated with a first device, the activation certificate being generated by a second device for authenticating the first device; a local verification module , configured to locally verify the activation certificate in response to determining that the activation certificate exists in the trusted environment; and an activated verification identification generation module configured to locally verify the activation certificate in response to the activation certificate , generating an activated verification identification for use in identity verification of the first device for local services.
- an apparatus for device authentication includes an authentication information verification module configured to, in response to receiving a device activation request from a first device, verify the identity authentication of the first device indicated in the device activation request. information; an activation certificate sending module configured to send an activation certificate to the first device in response to the successful verification of the identity authentication information; and a device certificate sending module configured to respond to receiving a message from the first device.
- a certificate signing request of the device sends a device certificate to the first device, where the device certificate is generated based on the certificate signing request.
- an electronic device in a seventh aspect of the present disclosure, includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit.
- the instructions when executed by at least one processing unit, cause the device to perform the method described in the first, second or third aspect.
- a computer-readable storage medium is provided.
- the computer program is stored on the medium.
- the program is executed by the processor, the method described in the first aspect, the second aspect or the third aspect is implemented.
- FIG. 1 illustrates a schematic diagram of an example environment in which embodiments of the present disclosure can be implemented
- Figure 2 shows a schematic diagram of an interactive process for device authentication according to some embodiments of the present disclosure
- Figure 3 shows a schematic diagram of an interactive process for device authentication according to some embodiments of the present disclosure
- Figure 4 shows a schematic diagram of an interactive process for device verification according to some embodiments of the present disclosure
- Figure 5 illustrates a flow diagram of a process for device authentication in accordance with some embodiments of the present disclosure
- FIG. 6 illustrates a flowchart of a process for device verification in accordance with some embodiments of the present disclosure
- FIG. 7 illustrates a flow diagram of a process for device authentication in accordance with some embodiments of the present disclosure
- FIG. 8 illustrates a flow diagram of a process for device verification in accordance with some embodiments of the present disclosure
- Figure 9 shows a block diagram of an apparatus for device authentication according to some embodiments of the present disclosure.
- Figure 10 shows a block diagram of an apparatus for device verification according to some embodiments of the present disclosure
- Figure 11 shows a block diagram of an apparatus for device authentication according to some embodiments of the present disclosure
- Figure 12 shows a block diagram of an apparatus for device verification according to some embodiments of the present disclosure.
- Figure 13 illustrates a block diagram of a device capable of implementing various embodiments of the present disclosure.
- the term “device authentication” may relate to the identity information registration and status activation process of a terminal device at a remote device.
- the term “device verification” may refer to a process performed on the terminal device based on the identity information of the terminal device that has been authenticated in the device authentication process during the request for local or remote services. Authentication.
- the service provider can provide the device with an activation certificate for the terminal device based on the identity authentication information of the terminal device.
- the terminal device After storing the activation certificate in the trusted environment (TEE) of the terminal device, the terminal device sends a certificate signing request to the service provider.
- the service provider generates a device certificate by signing the public key generated by the terminal device in the certificate signing request and sends the device certificate to the terminal device.
- the terminal device stores the device certificate in the TEE to complete the authentication process of the terminal device.
- the terminal device When the terminal device requests local or remote related services, if the terminal device finds the activation certificate for the terminal device in its trusted environment, the activation certificate will be verified for legality and validity. On the one hand, if the activation certificate is successfully verified, an activated identity is generated for signature verification against locally accessible authorized services and resources. On the other hand, if the activation certificate is successfully verified, the terminal device can use the private key of the terminal device to send a remote service request to the service provider, and the service provider can use the public key in the device certificate to verify the service request to send The response to this service request.
- the implementation of the present disclosure by utilizing activation certificates and device certificates in conjunction with digital signatures to mutually confirm identity and authorization services between the device side and the server side in a trusted environment (TEE), more trustworthy Device identity authentication and schooling inspection process. In this way, counterfeiting and fraudulent use of the device can be eliminated and illegal acquisition of service resources local to the device or on the server side can be prevented.
- TEE trusted environment
- FIG. 1 a diagram schematically illustrates an example environment 100 in which example implementations in accordance with the present disclosure may be implemented.
- the environment 100 may include a terminal device 110 (which may also be referred to as a first device in this disclosure) and a remote device 120 (which may also be referred to as a second device in this disclosure).
- the remote device 120 may communicate with the end device 110 to effectuate the provision of services requested by the end device 110.
- the services requested by the terminal device 110 may include, for example, services directly obtained from the remote device 120 , or may include services provided by the remote device 120 to applications installed on the terminal device 110 .
- the remote device 120 can authenticate the identity of the terminal device 110 to determine the service permissions that the terminal device 110 can request, thereby The terminal device 110 is provided with services within the scope allowed by the service authority.
- the terminal device 110 may be any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, Personal communications system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio/video players, digital cameras/camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or the foregoing Any combination of items, including accessories and peripherals of these devices or any combination thereof.
- the terminal device 110 is also capable of supporting any type of user-directed interface (such as "wearable" circuitry, etc.).
- the remote device 120 may be, for example, various types of computing systems/servers capable of providing computing capabilities, including but not limited to mainframes, edge computing nodes, computing devices in cloud environments, and the like.
- FIG. 2 shows a schematic diagram of a process 200 for device authentication in accordance with some embodiments of the present disclosure.
- Process 200 may be implemented at terminal device 110 and remote device 120.
- process 200 will be described with reference to environment 100 of FIG. 1 .
- terminal device 110 sends (204) an authentication activation request for the terminal device 110 to remote device 120.
- the authentication activation request may include identity authentication information of the terminal device 110 .
- the identity authentication information may include a device identification (Device ID) of the terminal device 110.
- the device identification is the unique identity identification of the terminal device 110 , which can usually be the chip identification of the terminal device 110 or the production serial number of the terminal device 110 .
- the device identification can be written into the trusted environment associated with the terminal device 110 when the terminal device 110 is produced, to ensure the authenticity and non-tamperability of each read.
- the identity authentication information may also include password information such as the activation code of the terminal device 110 itself or the account password of the application or service requested by the terminal device 110 . It should be understood that in different request activation scenarios for the terminal device 110, the identity authentication information may include other information corresponding to the current request activation scenario.
- the remote device 120 verifies the identity authentication information received from the terminal device 110 .
- the remote device 120 can determine the service scope authorized by the terminal device 110 based on the identity authentication information, such as the services that the terminal device 110 can use. Alternatively or additionally, the remote device 120 may also determine the time within which the terminal device 110 can use these services. The remote device 120 may generate authorized content for the terminal device 110 based on the above determined content.
- remote device 120 may generate an asymmetric key pair (also referred to in this disclosure as a first asymmetric key pair).
- the first asymmetric key pair may be generated by a public key system (RSA), for example.
- RSA public key system
- the asymmetric key pair can also be generated by other digital signature methods such as Digital Signature Algorithm (DSA), Elliptic Curve Digital Signature Algorithm (ECDSA), etc.
- DSA Digital Signature Algorithm
- EDSA Elliptic Curve Digital Signature Algorithm
- the remote device 120 may perform a hash calculation on the determined authorized content for the terminal device 110 to generate a digest value. By encrypting the authorization content and the digest value with the first private key of the first asymmetric key pair, the remote device 120 can generate (206) an activation certificate (activate.crt) for the terminal device 110.
- the activation certificate may include, in addition to the encrypted content information, the first public key of the first asymmetric key pair. In addition, the activation certificate may also include the device identity of the terminal device 110 . It should be understood that an activation certificate is uniquely issued by the remote device 120 for a terminal device.
- the remote device 120 sends (208) the generated activation certificate to the terminal device 110.
- the terminal device 110 may perform signature verification on the activation certificate. For example, the terminal device 110 may use the first public key in the activation certificate to decrypt the signature of the activation certificate to obtain field information in the activation certificate, such as authorized content and a digest value associated with the authorized content.
- the terminal device 110 may also perform hash calculation on the authorized content to generate another digest value, and compare the other digest value with the digest value decrypted from the activation certificate. If the two digest values are the same, it means that the activation certificate was successfully verified.
- the successfully verified activation certificate may be stored (210) by the terminal device 110 in a trusted environment associated with the terminal device 110.
- the trusted environment of the terminal device 110 depends on the type of operating system running on the terminal device 110 .
- the system running on the terminal device 110 is an Android system
- the trusted environment may be a trusted environment based on the Android system.
- the trusted environment of the terminal device 110 may also depend on other hardware and/or software environments associated with the terminal device 110 . By introducing a trusted environment, sensitive information such as certificates and keys carried by trust can be protected from being leaked.
- An asymmetric key pair (also referred to as a second asymmetric key pair in this disclosure) may also be generated at the terminal device 110 .
- the terminal device 110 may encrypt field information, such as authorized content, obtained from the activation certificate through the second private key in the second asymmetric key pair, and based on the encrypted field information and the second asymmetric key
- the second public key in the key pair is used to generate (212) a certificate signing request.
- the certificate signing request may be, for example, a signature request file (Certificate Signing Request, CSR).
- the terminal device 110 sends (214) the certificate signing request to the remote device 120.
- Remote device 120 may generate (216) a device certificate based on the certificate signing request.
- the remote device 120 may use the third private key in the third asymmetric key pair to encrypt the second public key and field information included in the certificate signing request to generate a device certificate (device.crt).
- the device certificate may also include a third public key in a third asymmetric key pair.
- the device certificate may also include the device identity of the terminal device 110 . It should be understood that a device certificate is uniquely issued by the remote device 120 for a terminal device.
- Remote device 120 sends (218) the device certificate to end device 110.
- the terminal device 110 may obtain the second public key and field information by decrypting the device certificate using the third public key. If the terminal device 110 determines that the second public key has not been tampered with, the device certificate is stored (220) in a trusted environment.
- the terminal device 110 may also send an activation confirmation request for the terminal device 110 to the remote device 120 . Once the remote device 120 receives the activation confirmation request, the current status of the terminal device 110 is set to activated.
- the terminal device 110 may perform a device restart after sending an activation confirmation request to the remote device 120 .
- a secure connection may be established ( 202 ) between the terminal device 110 and the remote device 120 .
- the secure connection may be an mTLS connection.
- the mTLS connection is a connection based on the link layer security protocol, which can establish a two-way encrypted channel between the terminal device 110 and the remote device 120 to ensure the security of communication between the terminal device 110 and the remote device 120 .
- the link layer security protocol can establish a two-way encrypted channel between the terminal device 110 and the remote device 120 to ensure the security of communication between the terminal device 110 and the remote device 120 .
- a secure channel for trust transfer can be constructed in the initial stage of information interaction between the terminal device 110 and the remote device 120, thereby providing a preliminary security guarantee for the communication process between the terminal device 110 and the remote device 120.
- the mTLS connection can be established by preconfiguring the certificate (pre.crt) catch.
- the preset certificate may be included in the factory settings of the terminal device 110 .
- the preset certificate includes the private key (pre.key).
- the private key may be stored in the terminal device 110 .
- the preset certificate may also include the batch certificate of the terminal device 110 and the public key of the preset certificate.
- the preset certificate can be set to a long-term valid certificate.
- the same preset certificate can be configured for different terminal devices.
- different terminal devices may be different terminal devices produced in the same batch. In this way, the cost of configuring different preset certificates for different terminal devices can be reduced.
- the mTLS connection established between the terminal device 110 and the remote device 120 is only one implementation of the present disclosure. Alternatively or additionally, communication between the terminal device 110 and the remote device 120 may also be performed based on other security protocols.
- the terminal device 110 and the remote device 120 each hold a digital certificate containing authentication content, thereby realizing complete identity authentication of the device by the server through the mutual nesting of the activation certificate and the device certificate.
- the terminal device 110 ensures the reliability of the device authentication process by obtaining the security certificate issued by the remote device 120 in a trusted environment.
- the interaction between the terminal device 110 and the remote device 120 may also include interactions between various components involved in the terminal device 110 and the remote device 120 .
- Figure 3 shows a schematic diagram of an interactive process for device authentication according to some embodiments of the present disclosure.
- the remote device 120 may include a gateway 121, a server 122, a database 123 and a certificate center 124.
- the device authentication process 300 is described in further detail below with reference to FIG. 3 . Detailed descriptions of the same or similar steps in process 300 as in process 200 will not be repeated here.
- a secure connection may be established (302) between the terminal device 110 and the gateway 121.
- the terminal device 110 sends (304) an authentication activation request for the terminal device 110 to the gateway 120.
- the authentication activation request may include identity authentication information of the terminal device 110 .
- the gateway 121 forwards (306) the authentication activation request to the server 122.
- the server 122 can query (308) the identity authentication information associated with the terminal device 110 from the database 123. If the database 123 determines that the received identity authentication information of the terminal device 110 and the identity authentication information queried in the database 123 match each other, the query will be successful. Send (310) to server 122.
- the server 122 generates an activation certificate issuance request and sends (312) the activation certificate issuance request to the certificate center 124.
- the issuance request may include, for example, the service scope authorized by the terminal device 110 determined by the server 122, such as the services that the terminal device 110 can use.
- the certificate authority 124 may generate a digest value for the service scope authorized by the terminal device 110 (also referred to as authorized content in this disclosure) through hash calculation and utilize the key in the first asymmetric key pair.
- the first private key encrypts the authorization content and the digest value to generate an activation certificate.
- the activation certificate is sent (314) from the certificate center 124 to the terminal device 110 via the server 123 and the gateway 122.
- the activation certificate may include the first public key of the first asymmetric key pair.
- the terminal device 110 After the activation certificate is successfully verified by the terminal device 110 based on the first public key, the terminal device 110 stores (316) the activation certificate in a trusted environment.
- the terminal device 110 may encrypt the field information obtained from the activation certificate, such as the authorized content, through the second private key in the second asymmetric key pair generated by it, and based on the encrypted field information and the second The second public key in the asymmetric key pair is used to generate (318) the certificate signing request.
- the terminal device 110 sends (320) the certificate signing request to the server 122 via the gateway 121.
- the server 122 calls (322) the certificate issuance interface of the certificate center 124 based on the certificate signing request.
- the device certificate may be generated by encrypting the second public key and field information included in the certificate signing request using the third private key in the third asymmetric key pair.
- the device certificate may also include a third public key in a third asymmetric key pair.
- the certificate center 124 sends (324) the issued device certificate to the server 122, and the server 122 sends (326) the device certificate to the terminal device 110 via the gateway 121.
- the terminal device 110 stores (328) the device certificate into the trusted environment and sends (330) an activation confirmation request to the server 122 via the gateway 121. After receiving the activation confirmation request, the server 122 requests (332) the database 123 to change the status of the terminal device 110 in the database 123 to activation success.
- FIG. 3 only illustrates components included in the remote device 120 .
- the components included in the remote device 120 shown in Figure 3 may be modified or replaced.
- Process 400 may be implemented at terminal device 110 and remote device 120. For ease of discussion, process 400 will be described with reference to environment 100 of FIG. 1 .
- the terminal device 110 searches (402) whether there is an activation certificate stored in its trusted environment. If it is determined that the activation certificate already exists, the terminal device 110 may determine whether the activation certificate is still valid according to the legality and/or expiry of the activation certificate indicated in the activation certificate.
- an activation status identification is generated to trigger a device authentication process, such as that described in connection with FIGS. 2 and 3 .
- an activation status identification is generated (404).
- the activation status identification may be generated, for example, by a device certificate stored in a trusted environment associated with the terminal device 110 .
- a digest value is generated based on field information (such as authorized content) in the device certificate through hash calculation, and then the digest value is encrypted by the private key in the second asymmetric key pair generated by the terminal device 110 to generate the activation state. logo.
- a shutdown of the terminal device 110 is triggered and/or a warning is sent to the remote device 120 .
- the terminal device 110 can request local services or remote services.
- Local services may be regarded as services that have been provided by the remote device 120 locally to the terminal device 110 , which may include offline services that have been installed at the terminal device 110 or have been authorized to the terminal device 110 , for example, provided by the remote device 110 Offline services, offline games or offline books provided by applications on.
- remote services can be Online services provided by the remote device 120 are deemed necessary.
- the terminal device 110 may perform signature verification on the generated activation status identification (406). During the verification process, the activation status identifier is decrypted by the public key in the second asymmetric key pair generated by the terminal device 110 to obtain the digest value. The terminal device 110 may compare the decrypted digest value with the digest value calculated through hashing, and if the two match each other, it is determined that the signature verification of the generated activation status identification is successful. The terminal device 110 can access or obtain the requested local service. If the two do not match, provision of the requested service to the terminal device 110 is denied.
- the generated activation status identification also needs to be signed and verified. If the activation status identifier is successfully verified, the service request is generated by encrypting the requested remote service content using the private key in the second asymmetric key pair generated by the terminal device 110 .
- the terminal device 110 sends (408) the service request to the remote device 120.
- the remote device 120 decrypts the service request by the public key in the second asymmetric key pair generated by the terminal device 110 to authenticate (410) the service request.
- the remote device 120 obtains the requested service content through public key decryption and the digest value obtained by the terminal device 110 by hashing the service content.
- the remote device 120 may hash the requested service content to obtain a digest value and compare the digest value with the decrypted digest value. If the two match each other, it is determined that the service request was successfully authenticated. In this case, the remote device 120 may provide (412) its requested service content to the terminal device 110.
- the identity of the device is verified based on the security certificate obtained during the device authentication phase, thereby effectively eliminating forgery and fraudulent use of the device, thereby preventing the service provider and service recipient from Interests have been unlawfully infringed upon.
- FIG. 5 illustrates a flow diagram of a process 500 for device authentication in accordance with some embodiments of the present disclosure.
- Process 500 may be implemented at first device 110 .
- the first device sends a device activation request to the second device.
- the device activation request includes identity authentication information of the first device.
- the first device determines whether an activation certificate was received. If the first device determines that the activation certificate was received, then at block 530, the activation certificate is stored in a trusted environment associated with the first device.
- the first device may perform signature verification on the activation certificate based on the first public key in the first asymmetric key pair, the first private key in the first asymmetric key pair being used by the second device Used to sign the activation certificate. If it is determined that the signature verification is passed, the first device may store the activation certificate in the trusted environment.
- the first device may generate a second asymmetric key pair.
- the first device may sign the certificate signing request using the second private key of the second asymmetric key pair and send the second public key of the second asymmetric key pair to the second device.
- the first device sends a certificate signing request to the second device.
- the certificate signing request is generated based at least in part on the activation certificate in a trusted environment.
- the first device stores the device certificate received from the second device in the trusted environment.
- the device certificate is generated based on the certificate signing request.
- the first device may establish a secure connection between the first device and the device for transmission of at least one of a device activation request, an activation certificate, a certificate signing request, and a device certificate.
- the first device may send an activation confirmation to the second device.
- Figure 6 illustrates a flow diagram of a process 600 for device verification in accordance with some embodiments of the present disclosure.
- Process 600 may be implemented at first device 110 .
- the first device looks for an activation certificate generated by the second device used to authenticate the first device in a trusted environment associated with the first device.
- the first device determines whether an activation certificate exists through the lookup results. If it is determined that an activation certificate exists, then at block 630, the activation certificate is locally verified. If it is determined that no activation certificate exists, then at block 660, execution of the activation authentication process is triggered.
- the first device determines whether the activation certificate passes local verification. If the activation certificate passes local verification, then at block 650, the first device generates an activated verification identification. If the activation certificate fails local verification, at block 670, the first device is turned off and/or a warning is sent to the second device.
- locally verifying the activation certificate includes verifying at least one of the legitimacy of the activation certificate and the validity period of the activation certificate.
- the first device may generate a verification request. Signing the verification request with a second private key from a second asymmetric key pair that can be generated in a trusted environment, where the second public key was used during a previous device authentication process has been sent from the first device to the second device. The first device may also send a signed verification request to the second device for identity verification of the first device in the remote service.
- FIG. 7 illustrates a flow diagram of a process 700 for device authentication in accordance with some embodiments of the present disclosure.
- Process 700 may be implemented at second device 120 .
- the second device determines whether a device activation request is received from the first device. If it is determined that the device activation request is received, then at block 720, the second device verifies the identity authentication information of the first device indicated in the device activation request.
- the second device determines whether the identity authentication information is successfully verified. If it is determined that the identity authentication information is successfully verified, in block 740, the second device sends the activation certificate to the first device. At block 750, if the second device determines to have received a certificate signing request from the first device, then at block 750, the second device sends a device certificate generated based on the certificate signing request to the first device.
- At least one of the device activation request, activation certificate, certificate signing request, and device certificate is transmitted over a secure connection between the first device and the second device.
- the second device may also use the first private key in the first asymmetric key pair to sign the activation certificate and send the first public key in the first asymmetric key pair to the second device.
- One device may also use the first private key in the first asymmetric key pair to sign the activation certificate and send the first public key in the first asymmetric key pair to the second device.
- the second device may also obtain the second public key in the second asymmetric key pair from the certificate signing request.
- the second asymmetric key pair is generated in a trusted environment associated with the first device.
- the second device generates a device certificate by signing the second public key.
- the second device may also receive a request for the first device from the first device. activation confirmation.
- Figure 8 illustrates a flow diagram of a process 800 for device verification in accordance with some embodiments of the present disclosure.
- Process 800 may be implemented at second device 120 .
- the second device performs signature verification on the verification request using the second public key in the second asymmetric key pair.
- the second asymmetric key pair is generated in a trusted environment associated with the first device.
- the second device sends a corresponding verification response to the first device based on the result of the signature verification.
- FIG. 9 shows a schematic structural block diagram of an apparatus 900 for device authentication according to some embodiments of the present disclosure.
- the apparatus 900 may include an activation request sending module 910 configured to send a device activation request to the second device.
- the device activation request includes identity authentication information of the first device.
- Apparatus 900 may include an activation certificate storage module 920 configured to store the activation certificate in a trusted environment associated with the first device in response to receiving the activation certificate from the second device.
- Apparatus 900 may further include a certificate signing request sending module 930 configured to send a certificate signing request to a second device, the certificate signing request generated based at least in part on the activation certificate in a trusted environment and a device certificate storage module 940 configured to The device certificate received from the second device is stored in a trusted environment. The device certificate is generated based on a certificate signing request.
- the apparatus 900 may be further configured to establish a secure connection between the first device and the device for transmission of at least one of a device activation request, an activation certificate, a certificate signing request, and a device certificate.
- the activation certificate storage module 920 may be further configured to perform signature verification on the activation certificate based on the first public key in the first asymmetric key pair, the first asymmetric key pair in the first asymmetric key pair.
- the private key is used by the second device to sign the activation certificate. If it is determined that the signature verification passes, the activation certificate is stored in a trusted environment.
- the apparatus 900 may be further configured to generate a second asymmetric key pair and use the second private key in the second asymmetric key pair to sign the certificate signing request and transfer the second asymmetric key pair to the certificate signing request.
- the second public key in the pair is sent to the second device.
- the apparatus 900 may also be configured to send an activation confirmation to the second device.
- Figure 10 shows a schematic structural block diagram of an apparatus 1000 for device verification according to some embodiments of the present disclosure.
- the apparatus 1000 may include an activation certificate lookup module 1010 configured to look for the activation certificate in a trusted environment associated with the first device.
- the activation certificate is generated by the second device used to authenticate the first device.
- Apparatus 1000 may include a local verification module 1020 configured to locally verify the activation certificate in response to determining that the activation certificate exists in a trusted environment.
- the apparatus 1000 may further include an activated verification identification generation module 1030 configured to generate an activated verification identification for identity verification of the first device against the local service in response to the activation certificate passing local verification.
- locally verifying the activation certificate includes verifying at least one of the legitimacy of the activation certificate and the validity period of the activation certificate.
- the apparatus 1000 may further include generating a verification request in response to the activation certificate passing local verification; signing the verification request using the second private key in the second asymmetric key pair, the second asymmetric key The key pair is generated in a trusted environment, wherein the second public key of the second asymmetric key pair has been sent by the first device to the second device during a previous device authentication process; and sending the signed key pair to the second device A verification request is used to verify the identity of the first device in the remote service.
- Figure 11 shows a schematic structural block diagram of an apparatus 1100 for device authentication according to some embodiments of the present disclosure.
- the apparatus 1100 may include an authentication information verification module 1110 configured to, in response to receiving a device activation request from the first device, verify the identity authentication information of the first device indicated in the device activation request.
- the apparatus 1100 may include an activation certificate sending module 1120 configured to send the activation certificate to the first device in response to successful verification of the identity authentication information.
- the apparatus 1100 may also include a device certificate sending module 1130, which is Configured to send a device certificate to the first device in response to receiving a certificate signing request from the first device. The device certificate is generated based on a certificate signing request.
- At least one of the activation request, activation certificate, certificate signing request, and device certificate is transmitted over a secure connection between the first device and the second device.
- the apparatus 1100 may be further configured to sign the activation certificate using the first private key in the first asymmetric key pair; and send the first public key in the first asymmetric key pair to First device.
- the apparatus 1100 may be further configured to obtain, from the certificate signing request, a second public key in a second asymmetric key pair, the second asymmetric key pair being in a trusted domain associated with the first device. environment; and generate a device certificate by signing the second public key.
- the apparatus 1100 may be further configured to receive an activation confirmation for the first device from the first device.
- Figure 12 shows a schematic structural block diagram of an apparatus 1200 for device verification according to some embodiments of the present disclosure.
- the apparatus 1200 may include a signature verification module 1210 configured to, in response to receiving a verification request from the first device, perform the verification request using a second public key in the second asymmetric key pair.
- Signature verification the second asymmetric key pair is generated in a trusted environment associated with the first device; and the verification response sending module 1220 is configured to send a corresponding verification response to the first device according to the result of the signature verification. .
- the units included in the apparatus 900, the apparatus 1000, the apparatus 1100 and/or the apparatus 1200 may be implemented in various ways, including software, hardware, firmware or any combination thereof. In some embodiments, one or more units may be implemented using software and/or firmware, such as machine-executable instructions stored on a storage medium. In addition to or as an alternative to machine-executable instructions, some or all of the elements in apparatus 900, apparatus 1000, apparatus 1100, and/or apparatus 1200 may be implemented, at least in part, by one or more hardware logic components.
- exemplary types of hardware logic components include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLD), etc.
- FPGAs field programmable gate arrays
- ASICs application specific integrated circuits
- ASSPs application specific standard products
- SOCs systems on a chip
- CPLD complex programmable logic devices
- Figure 13 illustrates a block diagram of a computing device/server 1300 in which one or more embodiments of the present disclosure may be implemented. It should be understood that the computing device/server 1300 shown in Figure 13 is exemplary only and should not constitute any limitation on the functionality and scope of the embodiments described herein.
- computing device/server 1300 is in the form of a general purpose computing device.
- Components of computing device/server 1300 may include, but are not limited to, one or more processors or processing units 1310, memory 1320, storage devices 1330, one or more communication units 1340, one or more input devices 1360, and one or more Output device 1360.
- the processing unit 1310 may be a real or virtual processor and can perform various processes according to a program stored in the memory 1320 . In a multi-processor system, multiple processing units execute computer-executable instructions in parallel to increase the parallel processing capabilities of the computing device/server 1300.
- Computing device/server 1300 typically includes a plurality of computer storage media. Such media may be any available media that is accessible to computing device/server 1300, including, but not limited to, volatile and nonvolatile media, removable and non-removable media.
- Memory 1320 may be volatile memory (e.g., registers, cache, random access memory (RAM)), nonvolatile memory (e.g., read only memory (ROM), electrically erasable programmable read only memory (EEPROM) , flash memory) or some combination thereof.
- Storage device 1330 may be a removable or non-removable medium and may include machine-readable media such as a flash drive, a magnetic disk, or any other medium that may be capable of storing information and/or data (such as training data for training ) and can be accessed within computing device/server 1300.
- machine-readable media such as a flash drive, a magnetic disk, or any other medium that may be capable of storing information and/or data (such as training data for training ) and can be accessed within computing device/server 1300.
- Computing device/server 1300 may further include additional removable/non-removable, volatile/non-volatile storage media.
- a disk drive may be provided for reading from or writing to a removable, non-volatile disk (eg, a "floppy disk") and for reading from or writing to a removable, non-volatile optical disk. Read or write to optical disc drives.
- each drive may be connected to the bus (not shown) by one or more data media interfaces.
- Memory 1320 may include a computer program product 1325 having one or more program modules configured to perform various methods or actions of various embodiments of the disclosure.
- the communication unit 1340 implements communication with other computing devices through communication media. Additionally, the functionality of the components of computing device/server 1300 may be implemented as a single computing cluster or as multiple computing machines capable of communicating through communications connections. Accordingly, computing device/server 1300 may operate in a networked environment using logical connections to one or more other servers, a network personal computer (PC), or another network node.
- PC network personal computer
- Input device 1350 may be one or more input devices, such as a mouse, keyboard, trackball, etc.
- Output device 1360 may be one or more output devices, such as a display, speakers, printer, etc.
- Computing device/server 1300 may also communicate via communication unit 1340 with one or more external devices (not shown), such as storage devices, display devices, etc., as needed, and with one or more external devices that enable the user to communicate with the computing device/server. 1300 interacts with a device, or with any device (e.g., network card, modem, etc.) that enables computing device/server 1300 to communicate with one or more other computing devices. Such communication may be performed via an input/output (I/O) interface (not shown).
- I/O input/output
- a computer-readable storage medium is provided with one or more computer instructions stored thereon, wherein the one or more computer instructions are executed by a processor to implement the method described above.
- These computer-readable program instructions may be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, thereby producing a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, the computer-readable program instructions , resulting in an apparatus that implements the functions/actions specified in one or more blocks in the flowchart and/or block diagram.
- These computer-readable program instructions can also be stored in a computer-readable storage medium. These instructions cause the computer, programmable data processing device and/or other equipment to work in a specific manner. Therefore, the computer-readable medium storing the instructions includes a manufactured product, They include instructions that implement various aspects of the functions/acts specified in one or more blocks of the flowchart illustrations and/or block diagrams.
- Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other equipment, causing a series of operating steps to be performed on the computer, other programmable data processing apparatus, or other equipment to produce a computer-implemented process , thereby causing instructions executed on a computer, other programmable data processing apparatus, or other equipment to implement the functions/actions specified in one or more blocks in the flowcharts and/or block diagrams.
- each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions that contains one or more executable functions for implementing the specified logical functions instruction.
- the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved.
- each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration can be implemented by special purpose hardware-based systems that perform the specified functions or acts. , or can be implemented using a combination of specialized hardware and computer instructions.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
根据本公开的实施例,提供了设备认证和校验的方法、装置、设备和存储介质。设备认证的方法包括:在第一设备处,向第二设备发送设备激活请求,该设备激活请求包括第一设备的身份认证信息以及响应于从第二设备接收到激活证书,将激活证书存储在与第一设备相关联的可信任环境中。该方法还包括向第二设备发送证书签名请求,该证书签名请求在可信任环境中至少部分地基于激活证书而生成以及将从第二设备接收的设备证书存储在可信任环境中,该设备证书基于证书签名请求而生成。以此方式,在节约开销的基础上实现了更为可靠的身份认证与鉴权机制,从而可以杜绝对设备的伪造或仿冒带来的非法牟利的漏洞风险。
Description
本申请要求2022年06月07日递交的,标题为“设备认证和校验的方法、装置、设备和存储介质”、申请号为2022106420881的中国发明专利申请的优先权。
本公开的示例实施例总体涉及计算机领域,特别地涉及用于设备认证和校验的方法、装置、设备和计算机可读存储介质。
目前,随着通信技术的发展,越来越多的用户通过智能手机、平板、可穿戴设备等智能通信设备来从服务提供者处获取不同类型的服务。然而,不法分子往往利用此类设备利于伪造和冒用的特点进行大量的虚拟复制,以实施身份作弊及非法牟利等不法行为。因此需要有效手段来从源头上杜绝此类非法牟利的漏洞风险。
发明内容
在本公开的第一方面,提供了一种设备认证的方法。该方法包括在第一设备处,向第二设备发送设备激活请求,该设备激活请求包括所述第一设备的身份认证信息以及响应于从第二设备接收到激活证书,将激活证书存储在与第一设备相关联的可信任环境中。该方法还包括向第二设备发送证书签名请求,该证书签名请求在可信任环境中至少部分地基于激活证书而生成以及将从第二设备接收的设备证书存储在可信任环境中,该设备证书基于所述证书签名请求而生成。
在本公开的第二方面,提供了一种设备校验的方法。该方法包括在与第一设备相关联的可信任环境中查找激活证书,该激活证书由用
于认证第一设备的第二设备生成。响应于确定激活证书存在于可信任环境中,对该激活证书进行本地验证。该方法还包括响应于激活证书通过本地验证,生成已激活校验标识以用于第一设备针对本地服务的身份校验。
在本公开的第三方面,提供了一种设备认证的方法。该方法包括响应于接收到来自第一设备的设备激活请求,在第二设备处验证设备激活请求中指示的第一设备的身份认证信息。响应于对该身份认证信息的验证成功,向第一设备发送激活证书。该方法还包括响应于接收到来自第一设备的证书签名请求,向第一设备发送设备证书,该设备证书基于证书签名请求而生成。
在本公开的第四方面,提供了一种用于设备认证的装置。该装置包括激活请求发送模块,被配置为向第二设备发送设备激活请求,所述设备激活请求包括所述第一设备的身份认证信息;激活证书存储模块,被配置为响应于从所述第二设备接收到激活证书,将所述激活证书存储在与所述第一设备相关联的可信任环境中;证书签名请求发送模块,被配置为向所述第二设备发送证书签名请求,所述证书签名请求在所述可信任环境中至少部分地基于所述激活证书而生成;以及设备证书存储模块,被配置为将从所述第二设备接收的设备证书存储在所述可信任环境中,所述设备证书基于所述证书签名请求而生成。
在本公开的第五方面,提供了一种用于设备校验的装置。该装置包括:激活证书查找模块,被配置为在与第一设备相关联的可信任环境中查找激活证书,所述激活证书由用于认证所述第一设备的第二设备生成;本地验证模块,被配置为响应于确定所述激活证书存在于所述可信任环境中,对所述激活证书进行本地验证;以及已激活校验标识生成模块,被配置为响应于所述激活证书通过本地验证,生成已激活校验标识以用于所述第一设备针对本地服务的身份校验。
在本公开的第六方面,提供了一种用于设备认证的装置。该装置包括认证信息验证模块,被配置为响应于接收到来自第一设备的设备激活请求,验证所述设备激活请求中指示的所述第一设备的身份认证
信息;激活证书发送模块,被配置为响应于对所述身份认证信息的所述验证成功,向所述第一设备发送激活证书;以及设备证书发送模块,被配置为响应于接收到来自第一设备的证书签名请求,向所述第一设备发送设备证书,所述设备证书基于证书签名请求而生成。
在本公开的第七方面,提供了一种电子设备。该设备包括至少一个处理单元;以及至少一个存储器,至少一个存储器被耦合到至少一个处理单元并且存储用于由至少一个处理单元执行的指令。指令在由至少一个处理单元执行时使设备执行第一方面、第二方面或第三方面所述的方法。
在本公开的第八方面,提供了一种计算机可读存储介质。介质上存储有计算机程序,程序被处理器执行时实现第一方面、第二方面或第三方面所述的方法。
应当理解,本发明内容部分中所描述的内容并非旨在限定本公开的实施例的关键特征或重要特征,也不用于限制本公开的范围。本公开的其它特征将通过以下的描述而变得容易理解。
结合附图并参考以下详细说明,本公开各实施例的上述和其他特征、优点及方面将变得更加明显。在附图中,相同或相似的附图标记表示相同或相似的元素,其中:
图1示出了本公开的实施例能够在其中实现的示例环境的示意图;
图2示出了根据本公开的一些实施例的用于设备认证的交互过程的示意图;
图3示出了根据本公开的一些实施例的用于设备认证的交互过程的示意图;
图4示出了根据本公开的一些实施例的用于设备校验的交互过程的示意图;
图5示出了根据本公开的一些实施例的用于设备认证的过程的流程图;
图6示出了根据本公开的一些实施例的用于设备校验的过程的流程图;
图7示出了根据本公开的一些实施例的用于设备认证的过程的流程图;
图8示出了根据本公开的一些实施例的用于设备校验的过程的流程图;
图9示出了根据本公开的一些实施例的用于设备认证的装置的框图;
图10示出了根据本公开的一些实施例的用于设备校验的装置的框图;
图11示出了根据本公开的一些实施例的用于设备认证的装置的框图;
图12示出了根据本公开的一些实施例的用于设备校验的装置的框图;以及
图13示出了能够实施本公开的多个实施例的设备的框图。
下面将参照附图更详细地描述本公开的实施例。虽然附图中示出了本公开的某些实施例,然而应当理解的是,本公开可以通过各种形式来实现,而且不应该被解释为限于这里阐述的实施例,相反,提供这些实施例是为了更加透彻和完整地理解本公开。应当理解的是,本公开的附图及实施例仅用于示例性作用,并非用于限制本公开的保护范围。
在本公开的实施例的描述中,术语“包括”及其类似用语应当理解为开放性包含,即“包括但不限于”。术语“基于”应当理解为“至少部分地基于”。术语“一个实施例”或“该实施例”应当理解为“至少一个实施例”。术语“一些实施例”应当理解为“至少一些实施例”。下文还可能包括其他明确的和隐含的定义。
如上文所述,在用户使用智能手机、智能平板或可穿戴设备等智
能通信设备获取相应服务时,常常要面对设备被伪造和冒用的风险。不法分子通过伪造和冒用设备进行身份作弊并且进而获取非法牟利。
目前针对通过模拟器制造虚拟设备来进行刷量作弊、盗用或是伪造真实用户的设备信息来进行非法操作以及利用伪造的设备信息从服务器侧骗取未授权的服务资源等非法行为缺乏有效手段来识别,从而导致用户和服务器均存在利益受损的风险。
在本公开的实施例中,术语“设备认证”可以涉及终端设备在远程设备处的身份信息注册和状态激活过程。在本公开的实施例中,术语“设备校验”可以涉及终端设备的在请求本地或远程服务过程中,根据在设备认证过程中已经被认证的终端设备的身份信息而对终端设备所实施的身份验证。
根据本公开的各个实施例,提出一种用于设备认证和校验的方案。例如,在终端设备进行身份认证的过程中,服务提供者能够根据终端设备的身份认证信息向设备提供针对该终端设备的激活证书。在将该激活证书存储至该终端设备的可信任环境(TEE)中后,终端设备向服务提供者发送证书签名请求。服务提供者通过对证书签名请求中的、由终端设备生成的公钥进行签名来生成设备证书并且将该设备证书发送至终端设备。终端设备将该设备证书存储在TEE中,以完成该终端设备的认证过程。
在终端设备请求本地或远程相关服务时,如果终端设备在其可信任环境中查找到针对该终端设备的激活证书,则对该激活证书进行合法性和有效性验证。一方面,如果该激活证书被成功验证,则生成已激活标识以用于针对本地可访问的授权服务和资源的签名校验。另一方面,如果该激活证书被成功验证,终端设备可以利用该终端设备的私钥向服务提供者发送远程服务请求,服务提供者可以采用设备证书中的公钥来验证该服务请求,以发送针对该服务请求的响应。
根据本公开的实现,通过在可信任环境(TEE)中,利用激活证书和设备证书以及结合数字签名来对设备侧和服务器侧之间的身份和授权服务进行相互确认,可以提供更加可信的设备身份认证以及校
验过程。以此方式,能够杜绝针对设备的伪造和冒用并且防止对设备本地或服务器侧的服务资源的不法获取。
示例环境
首先参见图1,其示意性示出了其中可以实施根据本公开的示例性实现方式的示例环境100的示意图。
如图1所示,环境100可以包括终端设备110(在本公开中也可以被称作第一设备)和远程设备120(在本公开中也可以被称作第二设备)。在示例环境100中,远程设备120可以与终端设备110进行通信,以实现针对终端设备110所请求的服务的供应。
在一些实施例中,终端设备110所请求的服务例如可以包括从远程设备120上直接获取到的服务,也可以包括由远程设备120供应到安装在终端设备110的应用的服务。
在一些实施例中,在终端设备110与远程设备120建立连接并请求所需服务的过程中,远程设备120可以对终端设备110的身份进行认证,以确定终端设备110能够请求的服务权限,从而为终端设备110提供在该服务权限所允许的范围内的服务。
在一些实施例中,终端设备110可以是任意类型的移动终端、固定终端或便携式终端,包括移动手机、台式计算机、膝上型计算机、笔记本计算机、上网本计算机、平板计算机、媒体计算机、多媒体平板、个人通信***(PCS)设备、个人导航设备、个人数字助理(PDA)、音频/视频播放器、数码相机/摄像机、定位设备、电视接收器、无线电广播接收器、电子书设备、游戏设备或者前述各项的任意组合,包括这些设备的配件和外设或者其任意组合。在一些实施例中,终端设备110也能够支持任意类型的针对用户的接口(诸如“可佩戴”电路等)。远程设备120例如可以是能够提供计算能力的各种类型的计算***/服务器,包括但不限于大型机、边缘计算节点、云环境中的计算设备,等等。
应当理解,仅出于示例性的目的描述环境100的结构和功能,而
不暗示对于本公开的范围的任何限制。
设备认证过程
图2示出了根据本公开的一些实施例的用于设备认证的过程200的示意图。过程200可以在终端设备110和远程设备120处实现。为便于讨论,将参考图1的环境100来描述过程200。
现在参考图2,终端设备110向远程设备120发送(204)针对该终端设备110认证激活请求。该认证激活请求可以包括终端设备110的身份认证信息。
在一些实施例中,该身份认证信息可以包括终端设备110的设备标识(Device ID)。该设备标识是终端设备110的唯一身份标识,通常可以是终端设备110的芯片标识或是终端设备110的生产序列号。该设备标识可以在终端设备110被生产时写入与该终端设备110相关联的可信任环境中,以保证每次读取的真实性和不可篡改性。
在一些实施例中,该身份认证信息还可以包括终端设备110自身的激活码或是终端设备110所请求的应用或服务的账号密码等口令信息。应当理解,在针对终端设备110的不同的请求激活场景下,该身份认证信息可以包括其他的、与当前请求激活场景相对应的信息。
远程设备120从终端设备110接收的身份认证信息进行验证。在一些实施中,远程设备120可以基于该身份认证信息确定终端设备110被授权的服务范围,例如终端设备110可以使用的服务。可选的或附加的,远程设备120还可以确定终端设备110可以使用这些服务的时效。远程设备120可以基于以上确定的内容来生成针对终端设备110的授权内容。
在一些实施例中,远程设备120可以生成一对非对称密钥对(在本公开中也被称作第一非对称密钥对)。该第一非对称密钥对例如可以通过公开密钥***(RSA)来生成。可选的或附加的,该非对称密钥对例如还可以通过数字签名算法(DSA),椭圆曲线数字签名算法(ECDSA)的等其他数字签名方法来生成。
远程设备120可以对所确定的针对终端设备110的授权内容进行哈希计算来生成摘要值。通过利用该第一非对称密钥对中的第一私钥对授权内容和摘要值进行加密,远程设备120可以生成(206)针对该终端设备110的激活证书(activate.crt)。在该激活证书中除经加密的内容自信之外还可以包括第一非对称密钥对中的第一公钥。此外,该激活证书还可以包括终端设备110的设备身份标识。应当理解,一本激活证书是远程设备120为一个终端设备所唯一签发的。
远程设备120将所生成的激活证书发送(208)至终端设备110。在收到激活证书之后,终端设备110可以对激活证书进行签名验证。例如终端设备110可以采用激活证书中的第一公钥对激活证书的签名进行解密以获取激活证书中的字段信息,例如授权内容以及与该授权内容相关联的摘要值。终端设备110可以对授权内容同样进行哈希计算来生成另一摘要值,并将该另一摘要值与从激活证书中解密得到的摘要值进行比较。如果两个摘要值相同,则表示该激活证书被成功地验证。
被成功验证的激活证书可以被终端设备110存储(210)至与该终端设备110相关联的可信任环境中。在一些实施例中,终端设备110的可信任环境取决于在终端设备110上运行的操作***的类型。例如运行在终端设备110上的***为安卓***,则可信任环境可以是基于安卓***的可信任环境。可选的或附加的,终端设备110的可信任环境还可以取决于与该终端设备110相关联的其他硬件和/或软件环境。通过引入可信任环境,可以保障信任承载的证书以及密钥等敏感信息不被泄露。
在终端设备110处也可以生成一对非对称密钥对(在本公开中也被称作第二非对称密钥对)。终端设备110可以通过该第二非对称密钥对中的第二私钥对从激活证书中获取到的字段信息,例如授权内容进行加密,并且基于经加密的字段信息和该第二非对称密钥对中的第二公钥来生成(212)证书签名请求。该证书签名请求例如可以是签名请求文件(Certificate Signing Request,CSR)。
终端设备110将该证书签名请求发送(214)至远程设备120。远程设备120可以基于该证书签名请求生成(216)设备证书。
可选的,远程设备120可以利用第三非对称密钥对中的第三私钥来对证书签名请求中所包括的第二公钥和字段信息进行加密来生成设备证书(device.crt)。在该设备证书中还可以包括第三非对称密钥对中的第三公钥。
此外,该设备证书还可以包括终端设备110的设备身份标识。应当理解,一本设备证书是远程设备120为一个终端设备所唯一签发的。
远程设备120将该设备证书发送(218)给终端设备110。终端设备110可以通过利用第三公钥对设备证书进行解密来获取第二公钥和字段信息。如果终端设备110确定该第二公钥没有被篡改,则将该设备证书存储(220)至可信任环境中。此外,终端设备110还可以向远程设备120发送针对终端设备110的激活确认请求。一旦远程设备120接收到激活确认请求,则将终端设备110的当前状态设置为激活。
可选地,终端设备110可以在向远程设备120发送激活确认请求之后进行设备重启。
在图2示出的示例过程200中,可选地或附加地,终端设备110可以与远程设备120之间建立(202)安全连接。在一些实施例中,该安全连接可以是mTLS连接。mTLS连接是一种基于链路层安全协议的连接,其能够在终端设备110和远程设备120之间建立双向加密通道,以保证终端设备110和远程设备120之间的通信安全。一旦该mTLS连接,终端设备110和远程设备120之间的通信均可以在链路层安全协议下进行。例如在上文中已经描述的由终端设备110发送至远程设备的认证激活请求和证书签名请求以及由远程设备120发送至终端设备的激活证书和设备证书均可以经由该mTLS连接来传输。
通过采用基于mTLS的安全连接,能够在终端设备110和远程设备120进行信息交互的初始阶段构建信任传递的安全通道,从而为终端设备110和远程设备120之间的通信过程提供初步安全保证。
在一些实施中,可以通过预置证书(pre.crt)来建立该mTLS连
接。该预置证书可以被包括在终端设备110的出厂设置中。预置证书包括私钥(pre.key)。该私钥可以被存储于终端设备110中。预置证书还可以包括终端设备110的批次证书以及预置证书的公钥。该预置证书可以被设置为长期有效类型的证书。
在一些实施例中,可以为不同的终端设备均配置同样的预置证书。例如不同的终端设备可以是同批次生产的不同终端设备。以此方式可以降低为不同终端设备均分别配置不同预置证书带来的成本。
应当理解,终端设备110与远程设备120之间建立的mTLS连接仅仅是本公开的一种实现。可选地或附加的,终端设备110和远程设备120之间也可以在其他安全协议的基础上来进行通信。
以此方式,终端设备110和远程设备120各持有一本包含认证内容的数字证书,由此通过激活证书与设备证书的互相嵌套实现了服务端对设备的完整身份认证。
在结合图2描述的设备认证过程中,终端设备110通过在可信任环境中获取远程设备120所签发的安全证书来保证设备认证过程的可靠性。在一些实施例中,终端设备110与远程设备120之间的交互还可以包括终端设备110远程设备120所涉及各个组件之间的交互。
图3示出了根据本公开的一些实施例的用于设备认证的交互过程的示意图。在图3中,远程设备120可以包括网关121,服务端122,数据库123和证书中心124。以下结合图3进一步详细描述设备认证的过程300。在过程300中与过程200相同或相似的步骤的详细描述在此不再重复。
现在参考图3,终端设备110可以与网关121之间建立(302)安全连接。终端设备110向网关120发送(304)针对该终端设备110认证激活请求。该认证激活请求可以包括终端设备110的身份认证信息。网关121将该认证激活请求转发(306)至服务端122。该服务端122可以从数据库123查询(308)与终端设备110相关联的身份认证信息。如果数据库123确定所接收的终端设备110的身份认证信息与在数据库123中查询到的身份认证信息彼此匹配,则将查询成功的结果
发送(310)至服务端122。服务端122生成激活证书签发请求,并将该激活证书签发请求发送(312)至证书中心124。签发请求中例如可以包括服务端122所确定的终端设备110被授权的服务范围,例如终端设备110可以使用的服务。
在一些实施例中,证书中心124可以通过哈希计算生成针对终端设备110被授权的服务范围(在本公开中也被称作授权内容)的摘要值并利用第一非对称密钥对中的第一私钥对授权内容以及摘要值进行加密,以生成激活证书。该激活证书从证书中心124经由服务端123和网关122被发送(314)到终端设备110。该激活证书可以包括第一非对称密钥对中的第一公钥。
在该激活证书被终端设备110基于第一公钥验证成功之后,终端设备110将该激活证书存储(316)至可信任环境中。
终端设备110可以通过由其生成的第二非对称密钥对中的第二私钥对从激活证书中获取到的字段信息,例如授权内容进行加密,并且基于经加密的字段信息和该第二非对称密钥对中的第二公钥来生成(318)证书签名请求。
终端设备110经由网关121将证书签名请求发送(320)到服务端122。服务端122基于证书签名请求调用(322)证书中心124的证书签发接口。在证书中心124,可以利用第三非对称密钥对中的第三私钥来对证书签名请求中所包括的第二公钥和字段信息进行加密来生成设备证书。在该设备证书中还可以包括第三非对称密钥对中的第三公钥。
证书中心124将所签发的设备证书发送(324)至服务端122,服务端122经由网关121将设备证书发送(326)至终端设备110。
终端设备110将设备证书存储(328)至可信任环境中并且向经由网关121向服务器122发送(330)激活确认请求。服务器122在接收到激活确认请求之后向数据库123请求(332)将终端设备110在数据库123中的状态更改为激活成功。
通过图3进一步描述了终端设备110与远程设备120中的相应组
件之间的交互过程。应当理解,图3仅示例性地示出了远程设备120包括的组件。在图3中示出的远程设备120所包括的组件可以被修改或替换。
设备校验过程
在终端设备110请求本地或远程服务时,可以利用在结合图2和图3描述的设备认证过程中获取到的安全证书来同时保证服务提供方和服务接收方的数据安全。图4示出了根据本公开的一些实施例的设备校验的过程400的流程图。过程400可以在终端设备110和远程设备120处实现。为便于讨论,将参考图1的环境100来描述过程400。
现在参考图4,在终端设备110重启或开机后,终端设备110查找(402)在其可信任环境中是否存储有激活证书。如果确定该激活证书已经存在,则终端设备110可以根据在激活证书中指示的激活证书的合法性和/或时效来确定该激活证书是否仍然有效。
如果确定该激活证书不存在,则生成激活状态标识,以触发例如结合图2和图3所描述的设备认证过程。
在一些实施例中,如果终端设备110确定激活证书仍然有效,则生成(404)激活状态标识。该激活状态标识例如可以通过存储在与终端设备110相关联的可信任环境中的设备证书来生成。例如,通过哈希计算基于设备证书中的字段信息(例如授权内容)生成摘要值,然后通过由终端设备110生成的第二非对称密钥对中的私钥对摘要值进行加密来生成激活状态标识。
在一些实施例中,如果终端设备110确定激活证书失效或被篡改,则触发终端设备110的关机和/或向远程设备120发送警告。
如在上文中已经描述的,终端设备110可以请求本地服务或远程服务。本地服务可以被视作已经由远程设备120提供到终端设备110本地的服务,其可以包括已经被安装在终端设备110处或已经授权到终端设备110处的离线服务,例如由安装在终端设备110上的应用所提供的离线服务、离线游戏或离线书籍等。相反的,远程服务可以被
视作需要由远程设备120提供的在线服务。
在请求本地服务时,终端设备110可以对所生成的激活状态标识进行签名校验(406)。在校验过程中,通过由终端设备110生成的第二非对称密钥对中的公钥对激活状态标识进行解密获得摘要值。终端设备110可以将该解密得到的摘要值与通过哈希计算得到的摘要值进行比较,如果两者彼此匹配,则确定对所生成的激活状态标识进行的签名校验是成功的。终端设备110可以访问或获取所请求的本地服务。如果两者不匹配,则拒绝向终端设备110提供所请求的服务。
在请求远程服务时,同样需要对所生成的激活状态标识进行签名校验。如果激活状态标识被成功校验,则通过由终端设备110生成的第二非对称密钥对中的私钥对所请求的远程服务内容进行加密来生成服务请求。终端设备110将该服务请求发送(408)至远程设备120。远程设备120通过由终端设备110生成的第二非对称密钥对中的公钥对服务请求进行解密,以验证(410)该服务请求。类似地,远程设备120通过公钥解密得到所请求的服务内容和终端设备110通过对服务内容进行哈希计算得到的摘要值。远程设备120可以对所请求的服务内容进行哈希计算得到摘要值并将该摘要值与解密得到的摘要值进行比较。如果两者彼此匹配,则确定服务请求被成功验证。在这种情况下,远程设备120可以向终端设备110提供(412)其所请求的服务内容。
以此方式,在设备进行服务请求的过程中,基于在设备认证阶段获取的安全证书对设备身份进行验证,从而有效杜绝针对设备的伪造和冒用行为,进而防止服务提供方和服务接收方的利益受到不法侵害。
示例过程
图5示出了根据本公开的一些实施例的用于设备认证的过程500的流程图。过程500可以在第一设备110处实现。
在框510,第一设备向第二设备发送设备激活请求。该设备激活请求包括所述第一设备的身份认证信息。
在框520,第一设备确定是否接收到激活证书。如果第一设备确定接收到激活证书,则在框530,将激活证书存储于与该第一设备相关联的可信任环境中。
在一些实施例中,第一设备可以基于第一非对称密钥对中的第一公钥,对激活证书进行签名验证,该第一非对称密钥对中的第一私钥由第二设备用来对激活证书进行签名。如果确定签名验证通过,则第一设备可以将该激活证书存储在可信任环境中。
在一些实施例中,第一设备可以生成第二非对称密钥对。第一设备可以利用该第二非对称密钥对中的第二私钥对证书签名请求进行签名并且将第二非对称要对中的第二公钥发送给第二设备。
在框540,第一设备向第二设备发送证书签名请求。该证书签名请求在可信任环境中至少部分地基于激活证书而生成。
在框550,第一设备将从第二设备接收的设备证书存储在可信任环境中。该设备证书基于所述证书签名请求而生成。
在一些实施例中,第一设备可以建立所述第一设备与所述设备之间的安全连接,以用于设备激活请求、激活证书、证书签名请求和设备证书中至少一个的传输。
在一些实施例中,第一设备可以向第二设备发送激活确认。
图6示出了根据本公开的一些实施例的用于设备校验的过程600的流程图。过程600可以在第一设备110处实现。
在框610,第一设备在与第一设备相关联的可信任环境中查找激活证书,该激活证书由用于认证第一设备的第二设备生成。
在框610,第一设备通过查找结果确定是否存在激活证书。如果确定存在激活证书,则在框630,对该激活证书进行本地验证。如果确定不存在激活证书,则在框660,触发激活认证过程的执行。
在框640,第一设备确定激活证书是否通过本地验证。如果激活证书通过本地验证,则在框650,第一设备生成已激活校验标识。如果激活证书未通过本地验证,则在框670,关闭第一设备和/或向第二设备发送警告。
在一些实施例中,对激活证书进行本地验证包括验证激活证书的合法性以及激活证书的有效期中至少一项。
在一些实施例中,如果确定激活证书通过本地验证,第一设备可以生成校验请求。利用第二非对称密钥对中的第二私钥对校验请求进行签名,该第二非对称密钥对可以在可信任环境中被生成,其中该第二公钥在先前的设备认证过程中已由第一设备发送给第二设备。第一设备还可以向第二设备发送经过签名的校验请求,以用于第一设备在远程服务中的身份校验。
图7示出了根据本公开的一些实施例的用于设备认证的过程700的流程图。过程700可以在第二设备120处实现。
在框710,第二设备确定是否接收到来自第一设备的设备激活请求。如果确定接收到设备激活请求,则在框720,第二设备验证设备激活请求中指示的第一设备的身份认证信息。
在框730,第二设备确定该身份认证信息是否被验证成功。如果确定该身份认证信息被验证成功,则在框740,第二设备向第一设备发送激活证书。在框750,如果第二设备确定接收到来自第一设备的证书签名请求,则在框750,第二设备向第一设备发送设备证书该设备证书基于证书签名请求而生成。
在一些实施例中,设备激活请求、激活证书、证书签名请求和设备证书中至少一个是通过第一设备与第二设备之间的安全连接传输的。
在一些实施例中,第二设备还可以利用第一非对称密钥对中的第一私钥对所述激活证书进行签名并将第一非对称密钥对中的第一公钥发送给第一设备。
在一些实施例中,第二设备还可以从证书签名请求中获取第二非对称密钥对中的第二公钥。该第二非对称密钥对在与第一设备相关联的可信任环境中被生成。第二设备通过对所述第二公钥进行签名来生成设备证书。
在一些实施例中,第二设备还可以从第一设备接收针对第一设备
的激活确认。
图8示出了根据本公开的一些实施例的用于设备校验的过程800的流程图。过程800可以在第二设备120处实现。
在框810,如果第二设备接收到来自第一设备的校验请求,则在框820,第二设备利用第二非对称密钥对中的第二公钥对校验请求进行签名验证。该第二非对称密钥对在与第一设备相关联的可信任环境中被生成。在框830,第二设备根据签名验证的结果,向第一设备发送相应的验证响应。
示例装置和设备
本公开的实施例还提供了用于实现上述方法或过程的相应装置。图9示出了根据本公开的一些实施例的用于设备认证的装置900的示意性结构框图。
如图9所示,装置900可以包括激活请求发送模块910,被配置为向第二设备发送设备激活请求。设备激活请求包括第一设备的身份认证信息。装置900可以包括激活证书存储模块920,被配置为响应于从第二设备接收到激活证书,将激活证书存储在与第一设备相关联的可信任环境中。装置900还可以包括证书签名请求发送模块930,被配置为向第二设备发送证书签名请求,证书签名请求在可信任环境中至少部分地基于激活证书而生成以及设备证书存储模块940,被配置为将从第二设备接收的设备证书存储在可信任环境中。设备证书基于证书签名请求而生成。
在一些实施例中,装置900还可以被配置为建立第一设备与设备之间的安全连接,以用于设备激活请求、激活证书、证书签名请求和设备证书中至少一个的传输。
在一些实施例中,激活证书存储模块920还可以被配置为基于第一非对称密钥对中的第一公钥,对激活证书进行签名验证,该第一非对称密钥对中的第一私钥由第二设备用来对激活证书进行签名。如果确定签名验证通过,将该激活证书存储在可信任环境中。
在一些实施例中,装置900还可以被配置为生成第二非对称密钥对以及利用该第二非对称密钥对中的第二私钥对证书签名请求进行签名并且将第二非对称要对中的第二公钥发送给第二设备。
在一些实施例中,装置900还可以被配置为向第二设备发送激活确认。
图10示出了根据本公开的一些实施例的用于设备校验的装置1000的示意性结构框图。
如图10所示,装置1000可以包括激活证书查找模块1010,被配置为在与第一设备相关联的可信任环境中查找激活证书.激活证书由用于认证第一设备的第二设备生成。装置1000可以包括本地验证模块1020,被配置为响应于确定激活证书存在于可信任环境中,对激活证书进行本地验证。装置1000还可以包括已激活校验标识生成模块1030,被配置为响应于激活证书通过本地验证,生成已激活校验标识以用于第一设备针对本地服务的身份校验。
在一些实施例中,对激活证书进行本地验证包括验证激活证书的合法性以及激活证书的有效期中至少一项。
在一些实施例中,装置1000还可以包括响应于激活证书通过本地验证,生成校验请求;利用第二非对称密钥对中的第二私钥对校验请求进行签名,第二非对称密钥对在可信任环境中被生成,其中第二非对称密钥对的第二公钥在先前的设备认证过程中已由第一设备发送给第二设备;以及向第二设备发送经过签名的校验请求,以用于第一设备在远程服务中的身份校验。
图11示出了根据本公开的一些实施例的用于设备认证的装置1100的示意性结构框图。
如图11所示,装置1100可以包括认证信息验证模块1110,被配置为响应于接收到来自第一设备的设备激活请求,验证设备激活请求中指示的第一设备的身份认证信息。装置1100可以包括激活证书发送模块1120,被配置为响应于对身份认证信息的验证成功,向第一设备发送激活证书。装置1100还可以包括设备证书发送模块1130,被
配置为响应于接收到来自第一设备的证书签名请求,向第一设备发送设备证书。设备证书基于证书签名请求而生成。
在一些实施例中,激活请求、激活证书、证书签名请求和设备证书中至少一个是通过第一设备与第二设备之间的安全连接传输的。
在一些实施例中,装置1100还可以被配置为利用第一非对称密钥对中的第一私钥对激活证书进行签名;以及将第一非对称密钥对中的第一公钥发送给第一设备。
在一些实施例中,装置1100还可以被配置为从证书签名请求中获取第二非对称密钥对中的第二公钥,第二非对称密钥对在与第一设备相关联的可信任环境中被生成;以及通过对第二公钥进行签名来生成设备证书。
在一些实施例中,装置1100还可以被配置为从第一设备接收针对第一设备的激活确认。
图12示出了根据本公开的一些实施例的用于设备校验的装置1200的示意性结构框图。
如图12所示,装置1200可以包括签名验证模块1210,被配置为响应于接收到来自第一设备的校验请求,利用第二非对称密钥对中的第二公钥对校验请求进行签名验证,第二非对称密钥对在与第一设备相关联的可信任环境中被生成;以及验证响应发送模块1220,被配置为根据签名验证的结果,向第一设备发送相应的验证响应。
装置900、装置1000、装置1100和/或装置1200中所包括的单元可以利用各种方式来实现,包括软件、硬件、固件或其任意组合。在一些实施例中,一个或多个单元可以使用软件和/或固件来实现,例如存储在存储介质上的机器可执行指令。除了机器可执行指令之外或者作为替代,装置900、装置1000、装置1100和/或装置1200中的部分或者全部单元可以至少部分地由一个或多个硬件逻辑组件来实现。作为示例而非限制,可以使用的示范类型的硬件逻辑组件包括现场可编程门阵列(FPGA)、专用集成电路(ASIC)、专用标准品(ASSP)、片上***(SOC)、复杂可编程逻辑器件(CPLD),等等。
图13示出了其中可以实施本公开的一个或多个实施例的计算设备/服务器1300的框图。应当理解,图13所示出的计算设备/服务器1300仅仅是示例性的,而不应当构成对本文所描述的实施例的功能和范围的任何限制。
如图13所示,计算设备/服务器1300是通用计算设备的形式。计算设备/服务器1300的组件可以包括但不限于一个或多个处理器或处理单元1310、存储器1320、存储设备1330、一个或多个通信单元1340、一个或多个输入设备1360以及一个或多个输出设备1360。处理单元1310可以是实际或虚拟处理器并且能够根据存储器1320中存储的程序来执行各种处理。在多处理器***中,多个处理单元并行执行计算机可执行指令,以提高计算设备/服务器1300的并行处理能力。
计算设备/服务器1300通常包括多个计算机存储介质。这样的介质可以是计算设备/服务器1300可访问的任何可以获得的介质,包括但不限于易失性和非易失性介质、可拆卸和不可拆卸介质。存储器1320可以是易失性存储器(例如寄存器、高速缓存、随机访问存储器(RAM))、非易失性存储器(例如,只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、闪存)或它们的某种组合。存储设备1330可以是可拆卸或不可拆卸的介质,并且可以包括机器可读介质,诸如闪存驱动、磁盘或者任何其他介质,其可以能够用于存储信息和/或数据(例如用于训练的训练数据)并且可以在计算设备/服务器1300内被访问。
计算设备/服务器1300可以进一步包括另外的可拆卸/不可拆卸、易失性/非易失性存储介质。尽管未在图13中示出,可以提供用于从可拆卸、非易失性磁盘(例如“软盘”)进行读取或写入的磁盘驱动和用于从可拆卸、非易失性光盘进行读取或写入的光盘驱动。在这些情况中,每个驱动可以由一个或多个数据介质接口被连接至总线(未示出)。存储器1320可以包括计算机程序产品1325,其具有一个或多个程序模块,这些程序模块被配置为执行本公开的各种实施例的各种方法或动作。
通信单元1340实现通过通信介质与其他计算设备进行通信。附加地,计算设备/服务器1300的组件的功能可以以单个计算集群或多个计算机器来实现,这些计算机器能够通过通信连接进行通信。因此,计算设备/服务器1300可以使用与一个或多个其他服务器、网络个人计算机(PC)或者另一个网络节点的逻辑连接来在联网环境中进行操作。
输入设备1350可以是一个或多个输入设备,例如鼠标、键盘、追踪球等。输出设备1360可以是一个或多个输出设备,例如显示器、扬声器、打印机等。计算设备/服务器1300还可以根据需要通过通信单元1340与一个或多个外部设备(未示出)进行通信,外部设备诸如存储设备、显示设备等,与一个或多个使得用户与计算设备/服务器1300交互的设备进行通信,或者与使得计算设备/服务器1300与一个或多个其他计算设备通信的任何设备(例如,网卡、调制解调器等)进行通信。这样的通信可以经由输入/输出(I/O)接口(未示出)来执行。
根据本公开的示例性实现方式,提供了一种计算机可读存储介质,其上存储有一条或多条计算机指令,其中一条或多条计算机指令被处理器执行以实现上文描述的方法。
这里参照根据本公开实现的方法、装置(***)和计算机程序产品的流程图和/或框图描述了本公开的各个方面。应当理解,流程图和/或框图的每个方框以及流程图和/或框图中各方框的组合,都可以由计算机可读程序指令实现。
这些计算机可读程序指令可以提供给通用计算机、专用计算机或其他可编程数据处理装置的处理单元,从而生产出一种机器,使得这些指令在通过计算机或其他可编程数据处理装置的处理单元执行时,产生了实现流程图和/或框图中的一个或多个方框中规定的功能/动作的装置。也可以把这些计算机可读程序指令存储在计算机可读存储介质中,这些指令使得计算机、可编程数据处理装置和/或其他设备以特定方式工作,从而,存储有指令的计算机可读介质则包括一个制造品,
其包括实现流程图和/或框图中的一个或多个方框中规定的功能/动作的各个方面的指令。
也可以把计算机可读程序指令加载到计算机、其他可编程数据处理装置、或其他设备上,使得在计算机、其他可编程数据处理装置或其他设备上执行一系列操作步骤,以产生计算机实现的过程,从而使得在计算机、其他可编程数据处理装置、或其他设备上执行的指令实现流程图和/或框图中的一个或多个方框中规定的功能/动作。
附图中的流程图和框图显示了根据本公开的多个实现的***、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上,流程图或框图中的每个方框可以代表一个模块、程序段或指令的一部分,模块、程序段或指令的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。在有些作为替换的实现中,方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如,两个连续的方框实际上可以基本并行地执行,它们有时也可以按相反的顺序执行,这依所涉及的功能而定。也要注意的是,框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合,可以用执行规定的功能或动作的专用的基于硬件的***来实现,或者可以用专用硬件与计算机指令的组合来实现。
以上已经描述了本公开的各实现,上述说明是示例性的,并非穷尽性的,并且也不限于所公开的各实现。在不偏离所说明的各实现的范围和精神的情况下,对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。本文中所用术语的选择,旨在最好地解释各实现的原理、实际应用或对市场中的技术的改进,或者使本技术领域的其他普通技术人员能理解本文公开的各实现。
Claims (19)
- 一种设备认证的方法,包括:在第一设备处向第二设备发送设备激活请求,所述设备激活请求包括所述第一设备的身份认证信息;响应于从所述第二设备接收到激活证书,将所述激活证书存储在与所述第一设备相关联的可信任环境中;向所述第二设备发送证书签名请求,所述证书签名请求在所述可信任环境中至少部分地基于所述激活证书而生成;以及将从所述第二设备接收的设备证书存储在所述可信任环境中,所述设备证书基于所述证书签名请求而生成。
- 根据权利要求1所述的方法,还包括:建立所述第一设备与所述设备之间的安全连接,以用于所述设备激活请求、所述激活证书、所述证书签名请求和所述设备证书中至少一个的传输。
- 根据权利要求1所述的方法,其中将所述激活证书存储在与所述第一设备相关联的可信任环境中包括:基于第一非对称密钥对中的第一公钥,对所述激活证书进行签名验证,所述第一非对称密钥对中的第一私钥由所述第二设备用来对所述激活证书进行签名;以及响应于所述签名验证通过,将所述激活证书存储在所述可信任环境中。
- 根据权利要求1所述的方法,还包括:在所述可信任环境中,生成第二非对称密钥对;利用所述第二非对称密钥对中的第二私钥对所述证书签名请求进行签名;以及将所述第二非对称要对中的第二公钥发送给所述第二设备。
- 根据权利要求1所述的方法,还包括:向所述第二设备发送激活确认。
- 一种设备校验的方法,包括:在与第一设备相关联的可信任环境中查找激活证书,所述激活证书由用于认证所述第一设备的第二设备生成;响应于确定所述激活证书存在于所述可信任环境中,对所述激活证书进行本地验证;以及响应于所述激活证书通过本地验证,生成已激活校验标识以用于所述第一设备针对本地服务的身份校验。
- 根据要求6所述的方法,其中对所述激活证书进行本地验证包括验证如下至少一项:所述激活证书的合法性,以及所述激活证书的有效期。
- 根据权利要求6所述的方法,还包括:响应于所述激活证书通过本地验证,生成校验请求;利用第二非对称密钥对中的第二私钥对所述校验请求进行签名,所述第二非对称密钥对在所述可信任环境中被生成,其中所述第二非对称密钥对的第二公钥在先前的设备认证过程中已由所述第一设备发送给所述第二设备;以及向所述第二设备发送经过签名的所述校验请求,以用于所述第一设备在远程服务中的身份校验。
- 一种设备认证的方法,包括:响应于接收到来自第一设备的设备激活请求,在第二设备处验证所述设备激活请求中指示的所述第一设备的身份认证信息;响应于对所述身份认证信息的所述验证成功,向所述第一设备发送激活证书;以及响应于接收到来自第一设备的证书签名请求,向所述第一设备发送设备证书,所述设备证书基于证书签名请求而生成。
- 根据权利要求9所述的方法,其中所述激活请求、所述激活证书、所述证书签名请求和所述设备证书中至少一个是通过所述第一设备与所述第二设备之间的安全连接传输的。
- 根据权利要求9所述的方法,还包括:利用第一非对称密钥对中的第一私钥对所述激活证书进行签名;以及将所述第一非对称密钥对中的第一公钥发送给所述第一设备。
- 根据权利要求9所述的方法,还包括以如下方式生成所述设备证书:从所述证书签名请求中获取第二非对称密钥对中的第二公钥,所述第二非对称密钥对在与所述第一设备相关联的可信任环境中被生成;以及通过对所述第二公钥进行签名来生成所述设备证书。
- 根据权利要求9所述的方法,还包括:从所述第一设备接收针对所述第一设备的激活确认。
- 根据权利要求9所述的方法,还包括以如下方式对第一设备进行校验:响应于接收到来自第一设备的校验请求,利用第二非对称密钥对中的第二公钥对所述校验请求进行签名验证,所述第二非对称密钥对在与所述第一设备相关联的可信任环境中被生成;以及根据所述签名验证的结果,向所述第一设备发送相应的验证响应。
- 一种用于设备认证的装置,包括:激活请求发送模块,被配置为向第二设备发送设备激活请求,所述设备激活请求包括所述第一设备的身份认证信息;激活证书存储模块,被配置为响应于从所述第二设备接收到激活证书,将所述激活证书存储在与所述第一设备相关联的可信任环境中;证书签名请求发送模块,被配置为向所述第二设备发送证书签名请求,所述证书签名请求在所述可信任环境中至少部分地基于所述激活证书而生成;以及设备证书存储模块,被配置为将从所述第二设备接收的设备证书存储在所述可信任环境中,所述设备证书基于所述证书签名请求而生成。
- 一种用于设备校验的装置,包括:激活证书查找模块,被配置为在与第一设备相关联的可信任环境中查找激活证书,所述激活证书由用于认证所述第一设备的第二设备生成;本地验证模块,被配置为响应于确定所述激活证书存在于所述可信任环境中,对所述激活证书进行本地验证;以及已激活校验标识生成模块,被配置为响应于所述激活证书通过本地验证,生成已激活校验标识以用于所述第一设备针对本地服务的身份校验。
- 一种用于设备认证的装置,包括:认证信息验证模块,被配置为响应于接收到来自第一设备的设备激活请求,验证所述设备激活请求中指示的所述第一设备的身份认证信息;激活证书发送模块,被配置为响应于对所述身份认证信息的所述验证成功,向所述第一设备发送激活证书;以及设备证书发送模块,被配置为响应于接收到来自第一设备的证书签名请求,向所述第一设备发送设备证书,所述设备证书基于证书签名请求而生成。
- 一种电子设备,包括:至少一个处理单元;以及至少一个存储器,所述至少一个存储器被耦合到所述至少一个处理单元并且存储用于由所述至少一个处理单元执行的指令,所述指令在由所述至少一个处理单元执行时使所述电子设备执行根据权利要求1至5中任一项,根据权利要求6至8中任一项,根据权利要求9至13中任一项或根据权利要求14所述的方法。
- 一种计算机可读存储介质,其上存储有计算机程序,所述程序被处理器执行时实现根据权利要求1至5中任一项,根据权利要求6至8中任一项,根据权利要求9至13中任一项或根据权利要求14所述的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210642088.1 | 2022-06-07 | ||
CN202210642088.1A CN115037480A (zh) | 2022-06-07 | 2022-06-07 | 设备认证和校验的方法、装置、设备和存储介质 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2023236720A1 true WO2023236720A1 (zh) | 2023-12-14 |
Family
ID=83123762
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2023/093556 WO2023236720A1 (zh) | 2022-06-07 | 2023-05-11 | 设备认证和校验的方法、装置、设备和存储介质 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN115037480A (zh) |
WO (1) | WO2023236720A1 (zh) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115037480A (zh) * | 2022-06-07 | 2022-09-09 | 抖音视界(北京)有限公司 | 设备认证和校验的方法、装置、设备和存储介质 |
CN117858088A (zh) * | 2023-12-29 | 2024-04-09 | 慧之安信息技术股份有限公司 | 一种面向自组网物联网设备的认证方法及*** |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108990060A (zh) * | 2017-06-05 | 2018-12-11 | ***通信集团公司 | 一种基站设备的证书分发***及方法 |
CN111625781A (zh) * | 2020-08-03 | 2020-09-04 | 腾讯科技(深圳)有限公司 | Sdk授权认证方法、装置、设备及存储介质 |
CN115037480A (zh) * | 2022-06-07 | 2022-09-09 | 抖音视界(北京)有限公司 | 设备认证和校验的方法、装置、设备和存储介质 |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105978682A (zh) * | 2016-06-27 | 2016-09-28 | 武汉斗鱼网络科技有限公司 | 移动端令牌生成***及其判断登录用户身份的方法 |
CN108769043B (zh) * | 2018-06-06 | 2021-02-02 | 中国联合网络通信集团有限公司 | 可信应用认证***和可信应用认证方法 |
KR20210017083A (ko) * | 2019-08-06 | 2021-02-17 | 삼성전자주식회사 | 퓨즈된 키에 기반하여 증명 인증서를 생성하는 전자 장치 및 방법 |
CN112511316B (zh) * | 2020-12-08 | 2023-04-07 | 深圳依时货拉拉科技有限公司 | 单点登录接入方法、装置、计算机设备及可读存储介质 |
-
2022
- 2022-06-07 CN CN202210642088.1A patent/CN115037480A/zh active Pending
-
2023
- 2023-05-11 WO PCT/CN2023/093556 patent/WO2023236720A1/zh unknown
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN108990060A (zh) * | 2017-06-05 | 2018-12-11 | ***通信集团公司 | 一种基站设备的证书分发***及方法 |
CN111625781A (zh) * | 2020-08-03 | 2020-09-04 | 腾讯科技(深圳)有限公司 | Sdk授权认证方法、装置、设备及存储介质 |
CN115037480A (zh) * | 2022-06-07 | 2022-09-09 | 抖音视界(北京)有限公司 | 设备认证和校验的方法、装置、设备和存储介质 |
Also Published As
Publication number | Publication date |
---|---|
CN115037480A (zh) | 2022-09-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3619889B1 (en) | Retrieving public data for blockchain networks using highly available trusted execution environments | |
CN110537346B (zh) | 安全去中心化域名*** | |
CN109075976B (zh) | 取决于密钥认证的证书发布 | |
US9838205B2 (en) | Network authentication method for secure electronic transactions | |
WO2020062668A1 (zh) | 一种身份认证方法、身份认证装置及计算机可读介质 | |
US8689290B2 (en) | System and method for securing a credential via user and server verification | |
CN110832519A (zh) | 提高区块链网络与外部数据源之间的通信的完整性 | |
AU2019204708A1 (en) | Retrieving public data for blockchain networks using highly available trusted execution environments | |
WO2023236720A1 (zh) | 设备认证和校验的方法、装置、设备和存储介质 | |
TW201732669A (zh) | 受控的安全碼鑑認 | |
US7693286B2 (en) | Method of delivering direct proof private keys in signed groups to devices using a distribution CD | |
CN109905360B (zh) | 数据验证方法及终端设备 | |
TW201918049A (zh) | 可信遠端證明方法、裝置和系統 | |
EP3206329B1 (en) | Security check method, device, terminal and server | |
US20220247576A1 (en) | Establishing provenance of applications in an offline environment | |
TWM595792U (zh) | 跨平台授權存取資源的授權存取系統 | |
WO2016173211A1 (zh) | 一种管理应用标识的方法及装置 | |
CN116458117A (zh) | 安全数字签名 | |
JP2018117185A (ja) | 情報処理装置、情報処理方法 | |
WO2023284691A1 (zh) | 一种账户的开立方法、***及装置 | |
CN116388992A (zh) | 针对分布式tee应用的远程认证方法及装置 | |
CN114065170A (zh) | 平台身份证书的获取方法、装置和服务器 | |
KR100897075B1 (ko) | 배포 cd를 사용하는 장치에 서명 그룹의 다이렉트 증명개인 키들을 전달하는 방법 | |
US20240143730A1 (en) | Multi-factor authentication using blockchain | |
TWI673621B (zh) | 資訊註冊、認證方法及裝置 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23818885 Country of ref document: EP Kind code of ref document: A1 |