CN116318637A - Method and system for secure network access communication of equipment - Google Patents

Method and system for secure network access communication of equipment Download PDF

Info

Publication number
CN116318637A
CN116318637A CN202111572609.2A CN202111572609A CN116318637A CN 116318637 A CN116318637 A CN 116318637A CN 202111572609 A CN202111572609 A CN 202111572609A CN 116318637 A CN116318637 A CN 116318637A
Authority
CN
China
Prior art keywords
key
data
authentication
equipment
service platform
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111572609.2A
Other languages
Chinese (zh)
Inventor
唐联武
李又彬
虞欢
王国庆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
National Technology Shenzhen Co ltd
Original Assignee
National Technology Shenzhen Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by National Technology Shenzhen Co ltd filed Critical National Technology Shenzhen Co ltd
Priority to CN202111572609.2A priority Critical patent/CN116318637A/en
Publication of CN116318637A publication Critical patent/CN116318637A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

The application relates to a method and a system for secure network access communication of intelligent equipment, wherein the method comprises the following steps: generating factory information in response to a factory information application of the intelligent equipment, wherein the factory information comprises an equipment serial number, an equipment key, an equipment certificate and a public key of a server; discretizing a file transmission key through a root file protection key, wherein the file transmission key is used for encrypting the factory information to form ciphertext factory information; discretizing a first data protection key according to the data protection key, wherein the first data protection key is used for encrypting the main control key and other equipment keys; and sending the ciphertext factory information, the first data protection key and the file transmission key to the intelligent device. By the scheme, the authentication of the intelligent equipment and the intelligent terminal is realized, the credibility of the identity of the network access equipment and the credibility of the identity of the service accessed by the equipment are ensured, and the safety and confidentiality of communication data between the equipment and the service are ensured.

Description

Method and system for secure network access communication of equipment
Technical Field
The present application relates to the field of information security, and in particular, to a method and system for secure network access communication of devices.
Background
The modern society has entered the internet of everything age, and intelligent house, terminal have gradually got into ordinary family, and the home networking is gone into to the step simultaneously, accepted service merchant networking management. Network society survives until now and is faced with being illegally counterfeited, stolen and tampered with data, even damaged by viruses; if the intelligent home and the terminal are attacked by the attack after entering the Internet, immeasurable results are caused.
The intelligent home system centrally manages various devices (such as intelligent lighting, air conditioners, curtains, televisions, audio equipment, door locks and the like) in the house in a networking mode, so that the safety, convenience, comfort, artistry and the like of the house can be improved, and the quality of life is improved. When external threat enters the intelligent home system, normal home operation is destroyed if the external threat is light, and personal identity is imitated and personal privacy information is stolen if the external threat is heavy, so that safety protection and management are required for equipment management of the intelligent home system and even for communication between the equipment.
Besides intelligent home, other intelligent terminals have wider application range and more complex network communication, such as intelligent terminals used in the directions of automobile electronics, energy sources, cities, public services and the like, and the behavior of accessing to the network is required to be managed, if the intelligent terminals are not protected safely, the network communication is very easy to be invaded by people, and data stealing and equipment failure are caused.
Therefore, the intelligent home system and the intelligent terminal system need to ensure that the identity of the communication object is credible and the transmitted communication data cannot be stolen, destroyed and tampered.
The current network communication needs to realize safe and reliable data communication, and identity authentication is often carried out first to ensure the credibility of the identity of the opposite party. The existing identity authentication system generally uses one authentication factor and two authentication factors for identity authentication, wherein the two authentication factors are also called body-building authentication. An identity authentication mode of authentication factors is generally realized by using a symmetric key algorithm, and a body-building authentication mode is generally realized by using an asymmetric algorithm. The body-building authentication mode often uses a CA certificate, private key authorization and private key signature, such as a private key authorization password+CA certificate+private key signature, a private key authorization fingerprint+CA certificate+private key signature, and the like, so that the identities of both communication parties are ensured to be trusted, and although the body-building authentication mode is safe and reliable, intelligent equipment and an intelligent terminal often communicate frequently to cause that private key authorization cannot be performed for each communication. The single type identity authentication mode is simple to implement, but it is a difficult problem how to ensure that a communication party has the authentication key of the other party without revealing the authentication key of the other party.
When the intelligent equipment and the intelligent terminal are communicated with the service server, the existing system generally encrypts and transmits data, so that confidentiality of communication data is guaranteed. Before encrypting data, it is necessary for both parties to securely negotiate a key to encrypt the data. When an asymmetric algorithm is used for negotiating the key, the length of data required for negotiation is often far greater than the length of a target key, and multiple negotiations of a communication process are required for obtaining one key; when a symmetric algorithm is used to negotiate a key, how to ensure the security and confidentiality of the key remains a primary problem.
Ali ID 2 The product provides identity authentication, secure connection, service data protection and key management, and the product architecture is shown in figure 1. The identity authentication mode is based on ID 2 Providing two-way identity authentication service to prevent the equipment from being tampered and imitated; the safe connection provides an iTLS/iDTLS lightweight security protocol compatible with TLS and DTLS, so that the resource consumption of the equipment is reduced while the security is ensured; the service data protection is based on a key derived from a trusted root of the equipment, can support a plurality of algorithms, is equipment firmware,Providing protection for sensitive data such as service data and application authorization; key management provides centralized management of key usage by IOT devices, applications, and services, including key generation, key destruction, and end-to-end secure distribution of keys. Current ali ID 2 The correlation system is suitable for the chip/module manufacturer, and the chip/module manufacturer can apply for the Ali ID online 2 Such as in a chip/module. Ali ID 2 The characteristics are three features as follows:
1. lightweight, use ID 2 The CA certificate is replaced, so that the storage space and network resources are saved;
2. the cloud trusted root is provided for the equipment, the trusted root is used for providing trusted service for upper-layer service, and the legality of the equipment and the safety of data are ensured from the source;
3. the application range is wide, and the method is suitable for equipment application scenes with various security levels and supports carriers with different security levels.
Ali ID 2 Although the prior art realizes the key management, identity authentication and data encryption and decryption service technology, the key management, identity authentication and data encryption and decryption service technology are realized from ID 2 The technical scheme is insufficient, and is firstly not suitable for application scenes using CA certificates; second ID 2 The data can only be distributed on line from the start of application to the burning-in chip module, the transmission mode is single, the network security and the burning-in desktop environment security are seriously depended, and when potential safety hazards exist in the network and the burning-in desktop, the ID is threatened to be used 2 Is a device of (a).
Disclosure of Invention
Aiming at the problems existing in the prior art, the application provides a method and a system for equipment security network access communication, which solve the problems that the identity is credible and data is not damaged or stolen when intelligent equipment and an intelligent terminal communicate with business services, realize the authentication of the identity of the intelligent equipment and the intelligent terminal, ensure the credibility of the identity of the network access equipment and the identity of the service accessed by the equipment, and ensure the security and confidentiality of communication data between the equipment and the service.
According to a first aspect of the present application, there is provided a method for secure network access communication of an intelligent device, including:
generating factory information in response to a factory information application of the intelligent equipment, wherein the factory information comprises an equipment serial number, an equipment key, an equipment certificate and a public key of a server;
discretizing a file transmission key through a root file protection key, wherein the file transmission key is used for encrypting the factory information to form ciphertext factory information;
and sending the ciphertext factory information and the file transmission key to the intelligent device, wherein the ciphertext factory information is used for being filled into a security chip of the intelligent device.
According to a second aspect of the application, a system for secure network access communication of an intelligent device is provided, which comprises the intelligent device, a service platform and a secure cloud device, wherein a secure chip is arranged in the intelligent device, the service platform comprises an authentication key distribution service platform, an identity authentication service platform and a data ciphertext communication service platform, and the secure cloud device executes the method according to the first aspect.
According to the method and the system for the secure network access communication of the equipment, the following benefits can be brought:
1. And the factory information is safely provided for the intelligent equipment/intelligent terminal, stored in the safety chip, and filled into the safety chip by using a special tool. The factory information comprises a device serial number, a device key, a device certificate and a public key of a server, and is used in the processes of authentication key distribution, identity authentication and data encryption and decryption;
2. under the condition that the master control key in the factory information is not stored, the security cloud equipment can recalculate the master control key in the factory information according to the equipment serial number;
3. safely distributing a ciphertext authentication key for the intelligent device/intelligent terminal on line; when distributing the authentication key, the network does not need to transmit a key protecting the authentication key;
4. identity authentication supporting multiple key algorithms and multiple identity authentication modes is provided. The method supports the unidirectional confirmation of the identity of the intelligent equipment/intelligent terminal by using an authentication key or an asymmetric key, and realizes identity authentication; the authentication key or asymmetric key is supported to mutually confirm the identity of the other party between the security cloud and the intelligent equipment/intelligent terminal, so that identity authentication is realized; the identity authentication process only needs to transmit a small amount of random numbers (for example, 16 bytes), does not transmit the plaintext content of the identity authentication, and enhances the security of the identity authentication.
5. The keys for encrypting data and decrypting data are provided safely and quickly. After the intelligent device/intelligent terminal and the security cloud finish identity authentication, the intelligent device/intelligent terminal and the security cloud can locally negotiate and calculate a key of protecting data of the other party by using data transmitted in the identity authentication process, wherein the key of encrypting the data is used for encrypting the data sent to the other party, and the key of decrypting the data is the data encrypted by the other party.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present application, and that other drawings can be obtained by those skilled in the art from these drawings without departing from the scope of protection of the present application.
FIG. 1 is an AliID 2 And a product architecture diagram.
Fig. 2 is a logic diagram of a system for implementing secure network access of devices according to an embodiment of the present application.
Fig. 3 is a flowchart of a method of generating factory information according to an embodiment of the present application.
Fig. 4 is a flowchart of a method for secure cloud devices to distribute symmetric authentication keys to smart devices according to an embodiment of the present application.
Fig. 5 is a flowchart of a method for a secure cloud device to authenticate a smart device identity using a symmetric authentication key, in accordance with an embodiment of the present application.
Fig. 6 is a flowchart of a method for a secure cloud device to mutually authenticate the identity of a partner using a symmetric authentication key with a smart device according to an embodiment of the present application.
Fig. 7 is a flowchart of a method for authenticating an intelligent device identity by a secure cloud device using an RSA key algorithm according to an embodiment of the present application.
Fig. 8 is a flowchart of a method for a secure cloud device to mutually identify an opposite party with an intelligent device using an RSA key algorithm according to an embodiment of the present application.
Fig. 9 is a flowchart of a method for a secure cloud device to authenticate an identity of a smart device using an SM2 key algorithm according to an embodiment of the present application.
Fig. 10 is a flowchart of a method for a secure cloud device to mutually identify an opposite party with an intelligent device using an SM2 key algorithm according to an embodiment of the present application.
Fig. 11 is a flowchart of a method for a secure cloud device to authenticate an identity of a smart device using an SM9 key algorithm according to an embodiment of the present application.
Fig. 12 is a flowchart of a method for a secure cloud device to mutually identify a partner identity with an intelligent device using an SM9 key algorithm according to an embodiment of the present application.
Fig. 13 is a flowchart of a method for a secure cloud device to negotiate data encryption and decryption keys using symmetric authentication keys, in accordance with an embodiment of the present application.
Fig. 14 is another flow chart of a method for a secure cloud device to negotiate data encryption and decryption keys using asymmetric keys in accordance with an embodiment of the application.
Detailed Description
The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all, of the embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments herein without making any inventive effort, are intended to be within the scope of the present application.
Fig. 2 is a logic diagram of a system for implementing secure network access of devices according to an embodiment of the present application. As shown in fig. 2, the system comprises a security cloud device, an intelligent device/intelligent terminal, a security chip of the intelligent device/intelligent terminal and three service platforms, wherein the security cloud device comprises a security cloud and a password device, the three service platforms are a symmetric authentication key service distribution platform, an identity authentication service platform and a data ciphertext communication service platform respectively, the identity authentication service platform comprises a symmetric identity authentication service platform and an asymmetric identity authentication service platform, and the asymmetric identity authentication service platform comprises an RSA identity authentication service platform, an SM2 identity authentication service platform and an SM9 identity authentication service platform.
In the system shown in fig. 2, the password device in the security cloud device can adopt a password device with a PKI algorithm to provide functions of key management, identity authentication and data encryption and decryption, and ensure the credible identity and the secure data transfer of both communication parties when the intelligent device or the terminal is connected with a specific service for communication; simultaneously, four cipher text root keys are used for safely managing various keys required by the security chip, wherein the four root keys are a root master control key, a root application key, a root data protection key and a root file protection key, and are sequentially used for dispersing the master control key, the authentication key, the data protection key for protecting the master control key of the security chip and the file protection key for protecting production data of the security chip. The four ciphertext root keys are each stored encrypted by a cryptographic device (e.g., by SM2 public key encryption) in a secure carrier, such as a dedicated server. The cipher device is responsible for all used key operations in the system, the key cannot be out of the cipher device in the operations and is destroyed immediately after the cipher device is used, and the cipher device is basic equipment for realizing the safety function of the system.
In the system shown in fig. 2, the intelligent device has a security chip, for example, a security chip adopting a PKI algorithm, and when the intelligent device is connected with a service in a networking manner, the intelligent device can identify the identity of the service, prove the identity to the service, and transmit encrypted data to the service, decrypt ciphertext data from the service, so that safe and reliable communication is realized.
In the system shown in fig. 2, the service platform adopts the system function, can identify the identity of the access intelligent device or terminal, simultaneously prove the identity of the access intelligent device or terminal, and realize the encryption and decryption of the transmitted data, thereby achieving the credibility of the access device or terminal and confidentiality of service data transmission. The service platform is logically divided into three service platforms, namely a symmetric authentication key service distribution platform, an identity authentication service platform and a data ciphertext communication service platform, and it should be noted that the three service platforms can be respectively distributed in one or more devices or servers, and can be respectively in the same device or server together.
Fig. 3 is a flowchart of a method of generating factory information according to an embodiment of the present application. The applicant applies factory information (can apply for a plurality of security chips for factory information once) to the security cloud equipment through the intelligent equipment, the password device of the security cloud equipment generates factory information and a secret key for encrypting the factory information, encrypts the factory information and sends ciphertext factory information and the secret key to the applicant; the applicant decrypts the factory information with the key through the special tool and fills the factory information into the security chip with the tool. Specifically, the method shown in fig. 3 includes the following steps.
1. The security chip of the intelligent device applies for factory information from the security cloud device.
2. And the security cloud equipment generates factory information after receiving the factory information application.
In one embodiment, the factory information includes a device serial number, a device key, a public key of the server; when the factory information contains an RSA key or an SM2 key, the factory information also comprises a device certificate, wherein the public key of the server is the public key of the server certificate; when the factory information contains the SM9 key, the public key of the server signs and encrypts the master public key for the server SM 9. The device key includes a master key. The device serial number is allocated to the security chip, and the master key is generated by taking the device serial number as a discrete factor and using the root master key.
3. The secure cloud device discretizes a file transmission key through the root file protection key, wherein the file transmission key is used for encrypting factory information to form ciphertext factory information.
4. The secure cloud device discretizes a first data protection key through a root data protection key, wherein the first data protection key is used for encrypting the master control key.
5. And sending the ciphertext factory information, the first data protection key and the file transmission key to the intelligent equipment.
In one embodiment, the ciphertext factory information and the file transmission key are separately submitted to a security producer, wherein the ciphertext factory information is submitted to the security producer through an encrypted email; and loading the file transmission key into a security card with a security chip, and safely submitting the security card to security production personnel. When the security chip is produced, production personnel can fill cipher text factory information into the security chip of the intelligent device through a special production tool inserted with the security card under the security environment.
In one embodiment, the method shown in fig. 3 may further comprise: carrying out data integrity calculation on the ciphertext factory information to obtain an MD5 value; and sending the MD5 value to the smart device. The MD5 value is used for guaranteeing the data integrity of the ciphertext factory information.
In one embodiment, the secure cloud device uses cryptographic means to generate a required asymmetric key, such as RSA or SM2, for the secure chip and generates a certificate, i.e. a device certificate, for the key; wherein the public key is a device public key and the private key is a device private key. In this way, the device key further includes a device public key and a device private key, which are asymmetric keys generated by the secure cloud device for the secure chip of the smart device. For the asymmetric key, the method shown in fig. 3 may further include: discretizing a second data protection key according to the data protection key, wherein the second data protection key is used for encrypting the equipment private key; and sending the second data protection key to the smart device.
The intelligent device uses a special tool to pour the ciphertext factory information into the security chip. And decrypting the ciphertext factory information by using the received file transmission key and the data protection key in the special tool, and storing the decrypted factory information in a security area of the security chip.
By the method described in fig. 3, factory information is safely provided for the intelligent device, stored in a secure chip, and filled into the chip using a special tool. The security chip presets information required for generating a subsequent encryption key and a subsequent decryption key and authentication key in the factory process, and online distribution is not needed, so that network security or security of a burning desktop environment in the key distribution process is not seriously relied on.
Fig. 4 is a flowchart of a method for secure cloud devices to distribute symmetric authentication keys to smart devices according to an embodiment of the present application. When the intelligent device uses a symmetric key algorithm to carry out identity authentication, an authentication key is required to be applied to the security cloud device through the service platform, a unique authentication key is distributed to the security chip by a password device in the security cloud device, and the unique authentication key is transmitted to the intelligent device in a ciphertext mode; finally, the intelligent device decrypts the ciphertext authentication key in the security chip and stores the ciphertext authentication key in a security area of the security chip. Specifically, the method shown in fig. 4 includes the following steps.
1. The security chip generates a random number, the intelligent device acquires the random number and the device serial number from the security chip to form authentication key application information, and the authentication key application information is transmitted to the authentication key distribution service platform to apply for an authentication key;
2. the authentication key distribution service platform acquires a random number and a device serial number according to the authentication key application information, transmits the random number and the device serial number to the security cloud device, and requests the security cloud device to distribute an authentication key;
3. the security cloud device uses the device serial number to inquire whether the production data of the security chip exists, if not, the security cloud device informs the authentication key distribution service platform to terminate the application; if so, executing step 4;
4. the security cloud equipment uses the root master control key and takes the equipment serial number as a discrete factor, and the master control key of the security chip is calculated in the password device again;
5. the password device of the security cloud equipment encrypts the random number by using the main control key to obtain a protection key for protecting the authentication key;
6. the secure cloud equipment uses a root application key to generate an authentication key in the cryptographic device, encrypts the authentication key by using a protection key, calculates an MAC value for the ciphertext authentication key, encapsulates the ciphertext authentication key and the MAC value into authentication key data, and returns the authentication key data to the authentication key distribution service platform;
7. The authentication key distribution service platform transmits authentication key data to the intelligent device;
8. the intelligent device uses the security chip to verify the MAC value in the authentication key data, and if the MAC value is correct, the ciphertext authentication key is written into the security chip;
9. and decrypting the ciphertext authentication key in the security chip, and storing the decrypted authentication key in a security area of the security chip.
By the method shown in fig. 4, an authentication key is securely distributed to the intelligent device on line; when distributing the authentication key, the network does not need to transmit a key that protects the authentication key.
Fig. 5 is a flowchart of a method for a secure cloud device to authenticate a smart device identity using a symmetric authentication key, in accordance with an embodiment of the present application. Fig. 6 is a flowchart of a method for a secure cloud device to mutually authenticate the identity of a partner using a symmetric authentication key with a smart device according to an embodiment of the present application. When the intelligent equipment performs identity authentication with the security cloud equipment through the business service platform, the security chip is used for generating authentication information (authentication code and other information) and submitting the authentication information to the security cloud equipment; when the security cloud equipment receives authentication information of the intelligent equipment, a password device is used for checking whether the authentication information is valid or not, and a result is returned to the business service; and if the identity authentication is bidirectional and the authentication information of the intelligent device is valid, the security cloud device generates the authentication information and returns the authentication information to the intelligent device, and finally the intelligent device uses the security chip to verify the authentication information of the security cloud device, and if the authentication information is detected to be invalid, the communication is terminated.
Specifically, the method shown in fig. 5 includes the following steps.
1. The intelligent equipment initiates an identity verification application to the symmetrical identity authentication service platform;
2. after receiving the authentication application, the symmetric identity authentication service platform requests the security cloud equipment to generate a random number for the application and participates in the intelligent equipment to generate identity authentication information;
3. the password device of the security cloud equipment generates a random number, marks the random number as a random number A and submits the random number A to the symmetric identity authentication service platform;
4. the symmetric identity authentication service platform sends the random number A to intelligent equipment;
5. after receiving the random number A, the intelligent device applies for the security chip to generate identity information capable of verifying the security chip;
6. the security chip generates a random number B, takes the random numbers A and B as authentication information metadata, uses a symmetric authentication key to generate a first authentication code from the metadata, and returns identity authentication information containing the first authentication code and a device serial number to the intelligent device;
7. the intelligent equipment submits identity authentication information to the symmetrical identity authentication service platform;
8. the symmetric identity authentication service platform sends identity authentication information to the security cloud equipment to request to verify the validity of the information;
9. the security cloud equipment takes out the equipment serial number, the random number B and the first authentication code of the security chip from the identity authentication information, re-calculates the authentication key of the security chip in the password device by using the root application key, re-calculates the random numbers A and B to obtain the second authentication code by using the authentication key, compares the two authentication codes, and notifies the symmetric identity authentication service platform of successful identity authentication if the two authentication codes are identical, and notifies the symmetric identity authentication service platform of failed identity authentication if the two authentication codes are identical.
Fig. 6 is a flow chart of a method for a secure cloud device to mutually authenticate the identity of a partner using a symmetric authentication key with a smart device. Compared with fig. 5, the difference is that after the symmetric identity authentication service platform receives the security cloud authentication result, if not successful, the identity authentication service is terminated, and if successful, the following steps are further executed:
1. the security cloud equipment returns security cloud identity authentication information, wherein the security cloud identity authentication information comprises a third authentication code, the third authentication code is obtained by calculating based on random numbers A and B according to a combination rule by using the authentication key, and the symmetric identity authentication service platform returns the security cloud identity authentication information to the intelligent terminal;
2. after receiving the security cloud identity authentication information, the intelligent terminal sends a third authentication code to the security chip to authenticate whether the security cloud equipment identity is credible or not;
3. and the security chip recalculates a fourth authentication code according to the rule of calculating the authentication code by the security cloud equipment and the combination rule by taking the random number A and the random number B as metadata, compares the third authentication code with the fourth authentication code, and notifies the security cloud equipment of the trusted identity if the third authentication code is the same as the fourth authentication code, or notifies the security cloud equipment of the untrusted identity if the third authentication code is not the same as the fourth authentication code.
After the two-way identity authentication is successful, other services or ciphertext communication services can be accessed.
By the methods shown in fig. 5 and 6, identity authentication supporting a plurality of key algorithms and a plurality of identity authentication modes is provided. The authentication key is supported to carry out unidirectional confirmation on the identity of the intelligent equipment/intelligent terminal, so that identity authentication is realized; the authentication key is supported to mutually confirm the identity of the other party between the security cloud and the intelligent equipment/intelligent terminal, so that identity authentication is realized; the identity authentication process only needs to transmit a small amount of random numbers (for example, 16 bytes), does not transmit the plaintext content of the identity authentication, and enhances the security of the identity authentication.
Fig. 7 is a flowchart of a method for authenticating an intelligent device identity by a secure cloud device using an RSA key algorithm according to an embodiment of the present application. As shown in fig. 7, the process of the security cloud device using the RSA key pair key algorithm to unidirectionally authenticate the device or the terminal identity information includes the following specific steps:
1. the intelligent device obtains a device certificate and a device serial number of the security chip, generates a random number A by using the security chip, takes the random number A and the device serial number as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device certificate, the device serial number, the random number A and the signature data to an RSA identity authentication service platform, and initiates an identity authentication application;
2. After receiving the authentication application, the RSA identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. the security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the RSA identity authentication service platform is informed of authentication failure; verifying whether the equipment certificate in the authentication information is valid or not by using the root certificate through the password device, and if not, notifying the RSA identity authentication service platform that the authentication fails; verifying whether the signature is valid in the password device by using a public key in the equipment certificate and metadata in the authentication information, and if the signature is invalid, notifying an RSA identity authentication service platform of authentication failure; after all the verification is effective, sending verification success information, for example, using a password device to generate a random number B, and returning the random number B to an RSA identity authentication service platform to indicate that the authentication is successful;
4. the RSA identity authentication service platform sends the random number B to intelligent equipment;
5. after the intelligent device receives the random number B, the identity authentication is finished.
Fig. 8 is a flowchart of a method for a secure cloud device to mutually identify an opposite party with an intelligent device using an RSA key algorithm according to an embodiment of the present application. As shown in fig. 8, the process of mutual authentication of identity information with the intelligent device by the secure cloud device using the RSA key pair key algorithm includes the following specific steps:
1. The intelligent device obtains a device certificate and a device serial number of the security chip, generates a random number A by using the security chip, takes the random number A and the device serial number as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device certificate, the device serial number, the random number A and the signature data to an RSA identity authentication service platform, and initiates an identity authentication application;
2. after receiving the authentication application, the RSA identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. the security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the RSA identity authentication service platform is informed of authentication failure; verifying whether the equipment certificate in the authentication information is valid or not by using the root certificate through the password device, and if not, notifying the RSA identity authentication service platform that the authentication fails; verifying whether the signature is valid in the password device by using a public key in the equipment certificate and metadata in the authentication information, and if the signature is invalid, notifying an RSA identity authentication service platform of authentication failure; after all the verification is effective, a password device is used for generating a random number B, the random number B and a device serial number are used as metadata, a secure cloud root private key is used for signing the metadata in the password device, and secure cloud authentication information B containing the random number B and signature data is returned to an RSA identity authentication service platform to indicate that authentication is successful;
4. The RSA identity authentication service platform sends the security cloud authentication information B to the intelligent equipment;
5. after receiving the security cloud authentication information B, the intelligent device verifies the signature of the signature data in the authentication information B by using the security cloud public key in the security chip, and if verification fails, the intelligent device indicates that the security cloud is not trusted and ends communication.
Fig. 9 is a flowchart of a method for a secure cloud device to authenticate an identity of a smart device using an SM2 key algorithm according to an embodiment of the present application. As shown in fig. 9, the process of the security cloud device for unidirectionally authenticating identity information of the device or the terminal by using the SM2 key pair key algorithm includes the following specific steps:
1. the intelligent device obtains a device certificate and a device serial number of the security chip, generates a random number A by using the security chip, takes the random number A, the device serial number and a default user ID as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device certificate, the device serial number, the random number A and the signature data to the SM2 identity authentication service platform, and initiates an identity authentication application;
2. after receiving the authentication application, the SM2 identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. The security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the SM2 identity authentication service platform is informed of authentication failure; verifying whether the equipment certificate in the authentication information is valid or not by using the root certificate through the password device, and if not, notifying the SM2 identity authentication service platform that authentication fails; verifying whether the signature is valid in the password device by using the public key in the equipment certificate, the metadata in the authentication information and the default user ID, and if the signature is invalid, notifying the SM2 identity authentication service platform that authentication fails; after all the verification is effective, a password device is used for generating an SM2 key negotiation public key and a private key, and security cloud authentication information B containing the key negotiation public key and security cloud identification data is returned to an SM2 identity authentication service platform to indicate that authentication is successful;
4. the SM2 identity authentication service platform sends the security cloud authentication information B to the intelligent equipment;
5. and after receiving the security cloud authentication information B, the intelligent equipment finishes identity authentication.
Fig. 10 is a flowchart of a method for a secure cloud device to mutually identify an opposite party with an intelligent device using an SM2 key algorithm according to an embodiment of the present application. As shown in fig. 10, the process of mutual authentication of identity information with the intelligent device by the secure cloud device using the SM2 key pair key algorithm includes the following specific steps:
1. The intelligent device obtains a device certificate and a device serial number of the security chip, generates a random number A by using the security chip, takes the random number A, the device serial number and a default user ID as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device certificate, the device serial number, the random number A and the signature data to the SM2 identity authentication service platform, and initiates an identity authentication application;
2. after receiving the authentication application, the SM2 identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. the security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the SM2 identity authentication service platform is informed of authentication failure; verifying whether the equipment certificate in the authentication information is valid or not by using the root certificate through the password device, and if not, notifying the SM2 identity authentication service platform that authentication fails; verifying whether the signature is valid in the password device by using the public key in the equipment certificate, the metadata in the authentication information and the default user ID, and if the signature is invalid, notifying the SM2 identity authentication service platform that authentication fails; after all the verification is effective, a password device is used for generating a random number B, the random number B, a device serial number and a default user ID are used as metadata, a secure cloud root private key is used for signing the metadata in the password device, an SM2 key negotiation public key and a private key are generated at the same time, and authentication information B containing the random number B, the secure cloud identification data, the signature data and the key negotiation public key is returned to an SM2 identity authentication service platform to indicate successful authentication;
4. The SM2 identity authentication service platform sends authentication information B to the intelligent equipment;
5. after receiving the security cloud authentication information B, the intelligent device verifies the signature of the signature data in the authentication information B by using the security cloud public key in the security chip, and if verification fails, the intelligent device indicates that the security cloud is not trusted and ends communication.
Fig. 11 is a flowchart of a method for a secure cloud device to authenticate an identity of a smart device using an SM9 key algorithm according to an embodiment of the present application. As shown in fig. 11, the process of the security cloud device for unidirectionally authenticating identity information of the device or the terminal by using the SM9 key pair key algorithm includes the following specific steps:
1. the intelligent device obtains a device serial number, generates a random number A by using a security chip, takes the random number A and the device serial number as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device serial number, the random number A and the signature data to an SM9 identity authentication service platform, and initiates an identity authentication application;
2. after receiving the authentication application, the SM9 identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. the security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the SM9 identity authentication service platform is informed of authentication failure; acquiring a user ID of the equipment through the equipment serial number, verifying whether the signature is valid or not in the password device by using the signature main public key, metadata in authentication information and the user ID, and if the signature is invalid, notifying the SM9 identity authentication service platform that authentication fails; after all the verification is effective, a password device is used for generating an SM9 key negotiation public key and a private key, and security cloud information B containing the key negotiation public key and security cloud identification data is returned to an SM9 identity authentication service platform to indicate that authentication is successful;
4. The SM9 identity authentication service platform sends the security cloud information B to the intelligent equipment;
5. after receiving the security cloud information B, the intelligent device finishes identity authentication.
Fig. 12 is a flowchart of a method for a secure cloud device to mutually identify a partner identity with an intelligent device using an SM9 key algorithm according to an embodiment of the present application. As shown in fig. 12, the process of mutual authentication of identity information with the intelligent device by the secure cloud device using the SM9 key pair key algorithm includes the following specific steps:
1. the intelligent device obtains a device serial number of the security chip, generates a random number A by using the security chip, takes the random number A and the device serial number as metadata, signs the metadata by using a device private key in the security chip to generate signature data, submits device authentication information containing the device serial number, the random number A and the signature data to the SM9 identity authentication service platform, and initiates an identity authentication application;
2. after receiving the authentication application, the SM9 identity authentication service platform sends equipment authentication information to the security cloud equipment to request the security cloud equipment to verify the validity of the information;
3. the security cloud equipment checks whether the equipment serial number in the authentication information is valid or not, and if the equipment serial number is invalid, the SM9 identity authentication service platform is informed of authentication failure; acquiring a user ID of the equipment through the equipment serial number, verifying whether the signature is valid or not in the password device by using the signature main public key, metadata in authentication information and the user ID, and if the signature is invalid, notifying the SM9 identity authentication service platform that authentication fails; after all the verification is effective, a password device is used for generating a random number B, the random number B and the security cloud identification data are used as metadata, a security cloud root private key is used for signing the metadata in the password device, an SM9 key negotiation public key and a private key are generated at the same time, and authentication information B containing the random number B, the security cloud identification data, the signature data and the key negotiation public key is returned to an SM9 identity authentication service platform to indicate successful authentication;
4. The SM9 identity authentication service platform sends authentication information B to the intelligent device;
5. after receiving the security cloud authentication information B, the intelligent device verifies the signature of the signature data in the authentication information B by using the security cloud signature main public key and the security cloud identification data in the security chip, and if verification fails, the intelligent device indicates that the security cloud is not trusted, and the communication is ended.
When the intelligent device and the service platform carry out ciphertext communication, the data in the identity authentication information must be used for generating a key for encrypting or decrypting the data, which is collectively called a session key, and the generation mode of the key for encrypting or decrypting is different according to different identity authentication modes. The authentication mode of identity authentication by using a symmetric authentication key and an RSA key has the same process of generating a session key, and the symmetric authentication key is used for generating the session key, which is called a symmetric authentication key generation mode; the authentication mode of using SM 2 and SM9 keys to carry out identity authentication has similar session key flow, and is generated according to the corresponding key negotiation principle in the national secret standard document, and is called a key negotiation generation mode. The following is a detailed description thereof.
Fig. 13 is a flowchart of a method for a secure cloud device to negotiate data encryption and decryption keys using symmetric authentication keys, in accordance with an embodiment of the present application. Fig. 14 is another flow chart of a method for a secure cloud device to negotiate data encryption and decryption keys using asymmetric keys in accordance with an embodiment of the application. After the intelligent device and the security cloud device pass through identity authentication, the intelligent device calculates an encryption key of encryption data of the intelligent device and an encryption key of encryption data of the security cloud device. When sensitive data is transmitted between the intelligent equipment and the business service platform, the communication flow is as follows:
And (5) ciphertext uploading: when the intelligent equipment and the service platform carry out sensitive information communication, the data are encrypted by using the encryption key of the intelligent equipment and are sent to the service platform. The service platform transmits the ciphertext data to the security cloud equipment to request decryption; the security cloud equipment calculates a secret key of encrypted data of the intelligent equipment by using a password device, decrypts the ciphertext and returns plaintext data to the business service platform;
and (3) ciphertext issuing: when the service platform needs to transmit ciphertext to the intelligent device, transmitting plaintext data to the security cloud device; the security cloud equipment uses a password device to calculate a secret key of encrypted data and encrypted plaintext data of the security cloud equipment, and returns the secret key and the encrypted plaintext data to the business service platform; finally, the business service platform returns the ciphertext result to the intelligent equipment; after receiving the ciphertext data, the intelligent device calculates a key of encrypted data of the security cloud device by using the security chip, and decrypts the ciphertext.
Fig. 13 is a diagram of a method for generating a session key using an authentication key. After the identity authentication is successful, the security cloud equipment generates a corresponding encryption key or decryption key in the password device according to the encryption or decryption application, and completes the application request. Specifically, fig. 13 includes the following steps.
1. When the intelligent device transmits ciphertext data to the data ciphertext communication service platform, the random number A in the identity authentication process is transmitted to the security chip, and the security chip is required to encrypt data to be transmitted;
2. the security chip repackages the random numbers A and B into a group of data according to a specified protocol, takes the data as a discrete factor, uses an authentication key to discrete an encryption session key, marks the encryption session key as a session key A, uses the session key A to encrypt the data to be transmitted, and returns the data to the intelligent device;
3. the intelligent device packages the ciphertext data and the device serial number into service data, and transmits the service data to the data ciphertext communication service platform for service communication;
4. after receiving service data from intelligent equipment, the data ciphertext communication service platform acquires ciphertext data and an equipment serial number from the service data, and transmits the ciphertext data and the equipment serial number to the security cloud equipment to request the security cloud equipment to decrypt the ciphertext data;
5. the security cloud equipment uses the equipment serial number to recalculate the authentication key in the password device, takes the random numbers A and B in the cached identity authentication information as discrete factors, discretizes a decryption session key (same as the session key A), decrypts ciphertext data, and then safely returns to the data ciphertext communication service platform;
6. After receiving the decrypted data, the data ciphertext communication service platform performs service processing, and if the data is required to be returned to the intelligent device in a ciphertext mode, the data ciphertext communication service platform safely transmits the data to be encrypted and the device serial number to the security cloud device to request the encryption of the data;
7. after receiving the data to be encrypted, the security cloud equipment calculates an authentication key in the cryptographic device again by using the equipment serial number, takes random numbers A and B in the cached identity authentication information as discrete factors, discretizes an encrypted session key, marks the encrypted session key as a session key B, encrypts the data to be encrypted by using the key, and safely transmits the encrypted data to the data ciphertext communication service platform;
8. the data ciphertext communication service platform encapsulates ciphertext data into service data and returns the service data to the intelligent equipment;
9. after receiving the service data containing the ciphertext, the intelligent equipment takes out the ciphertext data and transmits the ciphertext data to the security chip to require decryption of the ciphertext data;
10. the security chip uses the random numbers A and B as discrete factors, calculates a decryption session key (same as the session key B) by using the authentication key, decrypts the ciphertext data, and returns the ciphertext data to the intelligent device;
11. after the intelligent device acquires the plaintext data, one ciphertext communication is ended.
Fig. 14 is a diagram of a method for generating a session key using key agreement. After the identity authentication is successful, an Quanyun equipment generates unique session keys in the password devices according to encryption and decryption applications respectively to finish application requests. Specifically, fig. 14 includes the following steps.
1. The intelligent device transmits key agreement data in the identity authentication process to the security chip, and the security chip is required to generate a session key; the key negotiation data is composed of key negotiation parameters, a secure cloud key negotiation public key and a secure chip response public key; when the identity authentication is SM2 key identity authentication, the key negotiation parameters are security cloud identification data, a security cloud public key, a device public key and a user ID; when the identity authentication is SM9 key identity authentication, the key negotiation parameters comprise a security cloud encryption main public key, security cloud identification data and a user ID, wherein the user ID is public key identification data corresponding to an SM9 private key of the equipment;
2. the security chip correctly generates a session key according to the key negotiation data and the key negotiation principle (for example, SM2 or SM 9), and returns a response public key generated in the process of generating the session key to the intelligent device, wherein the response public key is a temporary public key of the security chip generated when the security chip generates the session key according to the key negotiation data based on the key negotiation principle;
3. The intelligent device packages the response public key, the user ID and the device serial number into key response data, transmits the key response data to a key negotiation service platform (for example, SM2 or SM9 key negotiation service platform) and applies for key negotiation;
4. the key negotiation service platform transmits key response data to the security cloud equipment to request completion of key negotiation;
5. the security cloud device extracts the user ID, the response public key and the device serial number from the key response data, and performs key negotiation according to the key negotiation type. If the key agreement is SM2 key agreement, acquiring a device public key through a device serial number, and generating a session key according to a national secret SM2 key agreement principle by using key agreement data, namely the device public key, a response public key, a user ID, security cloud identification data and a security cloud public key; if the key agreement is SM9 key agreement, using key agreement data, namely a user ID, a response public key, security cloud identification data, a security cloud encryption master public key and a security cloud key agreement public key, and generating a session key according to a national secret SM9 key agreement principle; binding the session key with the equipment serial number, safely caching and storing, and informing the key negotiation service platform that the key negotiation is completed;
6. the key negotiation service platform informs the intelligent device that the key negotiation is successful;
7. The intelligent device transmits the data to be encrypted to the security chip, and the security chip is required to encrypt the data;
8. the security chip uses the session key plus data encryption and returns to the intelligent device;
9. the intelligent device transmits the communication data containing the device serial number and the encryption to a data ciphertext communication service platform for communication;
10. after receiving service data from intelligent equipment or a terminal, the data ciphertext communication service platform acquires ciphertext data and equipment serial numbers from the service data, and transmits the ciphertext data to the security cloud equipment to request the intelligent equipment to decrypt the ciphertext data;
11. the secure cloud device uses the device serial number to find out a session key from the cache, decrypts the ciphertext data by using the session key through the password device, and then returns the ciphertext data to the data ciphertext communication service platform safely;
12. after receiving the decrypted data, the data ciphertext communication service platform performs service processing, and if the data is required to be returned to the intelligent device in a ciphertext mode, the data ciphertext communication service platform safely transmits the data to be encrypted and the device serial number to the security cloud device to request the encryption of the data;
13. after receiving the data to be encrypted, the security cloud equipment finds out a session key from the cache by using the equipment serial number, encrypts the data to be encrypted by using the session key through the password device, and then safely returns the encrypted data to the data ciphertext communication service platform;
14. The data ciphertext communication service platform encapsulates ciphertext data into service data and returns the service data to the intelligent equipment;
15. after receiving the service data containing the ciphertext, the intelligent equipment takes out the ciphertext data and transmits the ciphertext data to the security chip to require decryption of the ciphertext data;
16. the security chip decrypts the ciphertext data by using the session key and returns the ciphertext data to the intelligent device;
17. after the intelligent device acquires the plaintext data, one ciphertext communication is ended.
By the methods shown in fig. 13 and 14, keys for encrypting data and decrypting data are securely and quickly provided. After the intelligent device/intelligent terminal and the security cloud finish identity authentication, the intelligent device/intelligent terminal and the security cloud can use data transmitted in the identity authentication process to locally co-calculate a key of encrypting data of the other party, wherein the key of encrypting the data is used for encrypting data sent to the other party, and the key of decrypting the data is the data encrypted by the other party.
The foregoing has outlined rather broadly the more detailed description of embodiments of the present application, wherein specific examples have been provided herein to illustrate the principles and embodiments of the present application, and wherein the above examples are provided to assist in the understanding of the methods and concepts of the present application. Meanwhile, based on the ideas of the present application, those skilled in the art can make changes or modifications on the specific embodiments and application scope of the present application, which belong to the scope of the protection of the present application. In view of the foregoing, this description should not be construed as limiting the application.

Claims (21)

1. A method for secure network access communication of an intelligent device, comprising:
generating factory information in response to a factory information application of the intelligent equipment, wherein the factory information comprises an equipment serial number, an equipment key, an equipment certificate and a public key of a server;
discretizing a file transmission key through a root file protection key, wherein the file transmission key is used for encrypting the factory information to form ciphertext factory information;
and sending the ciphertext factory information and the file transmission key to the intelligent device, wherein the ciphertext factory information is used for being filled into a security chip of the intelligent device.
2. The method of claim 1, further comprising:
carrying out data integrity calculation on the ciphertext factory information to obtain an MD5 value; and
and sending the MD5 value to the intelligent equipment.
3. The method of claim 1 or 2, wherein the device key comprises a master key, wherein the master key is generated using a root master key with a device serial number as a discrete factor.
4. A method as in claim 3, further comprising:
a first data protection key is discretized according to the data protection key, and the first data protection key is used for encrypting the master control key to form a ciphertext master control key; and sending the first data protection key and the ciphertext master key to the intelligent device.
5. The method of claim 1 or 2, wherein the device key further comprises a device public key and a device private key, the device public key and the device private key being asymmetric keys generated by a secure cloud device for a secure chip of the smart device.
6. The method of claim 5, further comprising:
discretizing a second data protection key through the root data protection key, wherein the second data protection key is used for encrypting the equipment private key to form a ciphertext equipment private key; and sending the second data protection key and the ciphertext device private key to the intelligent device.
7. The method of claim 3 or 4, further comprising:
receiving authentication key application information sent by an authentication key distribution service platform, wherein the authentication key application information comprises a random number and a device serial number, and the random number is generated by a security chip of intelligent equipment;
inquiring whether factory information distribution data of the security chip exists or not according to the equipment serial number;
responding to the factory information distribution data of the security chip, and calculating a master control key of the security chip by taking the equipment serial number as a discrete factor;
Encrypting the random number by using the main control key to obtain a protection key for protecting the authentication key;
and generating an authentication key according to the root application key, encrypting the authentication key by adopting the protection key to form a ciphertext authentication key, performing MAC authentication on the ciphertext authentication key to obtain an MAC value, and transmitting the ciphertext authentication key and the MAC value to the authentication key distribution service platform.
8. The method of claim 7, further comprising:
generating a first random number in response to an identity verification application, and sending the first random number to an identity authentication service platform;
receiving identity authentication information, wherein the identity authentication information comprises a device serial number of the security chip, a second random number generated by the security chip and a first authentication code calculated by the security chip according to the first random number and the second random number by using the authentication key, generating an authentication key by using the root application key, and calculating a second authentication code according to the first random number and the second random number by using the authentication key;
and sending verification success information to the identity authentication service platform in response to the consistency of the first authentication code and the second authentication code.
9. The method of claim 8, further comprising:
and sending the security cloud identity authentication information to the intelligent device through the identity authentication service platform, wherein the security cloud identity authentication information comprises a third authentication code, and a security chip of the intelligent device authenticates the identity of the security cloud device according to the third authentication code, wherein the third authentication code is obtained by using the authentication key to calculate based on the first random number and the second random number according to a combination rule.
10. The method of claim 6, wherein the asymmetric key comprises an RSA key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a first random number and first signature data generated by the equipment certificate, the equipment serial number and a security chip of the intelligent equipment, and the first signature data is generated by the security chip of the intelligent equipment by signing the first random number and the equipment serial number by using the equipment private key;
executing authentication of the equipment serial number, the equipment certificate and the first signature data in the identity verification application;
And transmitting verification success information to the identity authentication service platform in response to the equipment serial number, the equipment certificate and the first signature data being valid, wherein the verification success information comprises a second random number.
11. The method of claim 6, wherein the asymmetric key comprises an RSA key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a first random number and first signature data generated by the equipment certificate, the equipment serial number and a security chip of the intelligent equipment, and the first signature data is generated by the security chip of the intelligent equipment by signing the first random number and the equipment serial number by using the equipment private key;
executing authentication of the equipment serial number, the equipment certificate and the first signature data in the identity verification application;
and in response to the device serial number, the device certificate and the first signature data being valid, sending security cloud authentication information to the identity authentication service platform, wherein the security cloud authentication information comprises a second random number and second signature data, and the second signature data is generated by signing the second random number and the device serial number by a password device of the security cloud device by using a security cloud root private key.
12. The method of claim 6, wherein the asymmetric key comprises an SM2 key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a third random number and third signature data generated by the equipment certificate, the equipment serial number and a security chip of the intelligent equipment, and the third signature data is generated by the security chip of the intelligent equipment by signing the third random number, the equipment serial number and a user ID by using the equipment private key;
executing authentication of the equipment serial number, the equipment certificate and the third signature data in the identity verification application;
and transmitting security cloud authentication information to the identity authentication service platform in response to the equipment serial number, the equipment certificate and the third signature data being valid, wherein the security cloud authentication information comprises security cloud identification data and an SM2 key negotiation public key generated by the cryptographic device.
13. The method of claim 6, wherein the asymmetric key comprises an SM2 key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a fourth random number and fourth signature data generated by the equipment certificate, the equipment serial number and a security chip of the intelligent equipment, and the fourth signature data is generated by the security chip of the intelligent equipment by signing the fourth random number, the equipment serial number and a user ID by using the equipment private key;
Executing authentication of the equipment serial number, the equipment certificate and the fourth signature data in the identity verification application;
and in response to the device serial number, the device certificate and the fourth signature data being valid, sending security cloud authentication information to the identity authentication service platform, wherein the security cloud authentication information comprises a fifth random number, security cloud identification data, fifth signature data and an SM2 key negotiation public key generated by the password device, and the fifth signature data is generated by the password device through a security cloud root private key to sign the fifth random number and the security cloud identification data.
14. The method of claim 6, wherein the asymmetric key comprises an SM9 key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a device serial number and a sixth random number and sixth signature data generated by a security chip of the intelligent device, and the sixth signature data is generated by the security chip of the intelligent device by signing the sixth random number and the device serial number by using the device private key;
Executing authentication of the equipment serial number and the sixth signature data in the identity verification application;
and transmitting security cloud authentication information to the identity authentication service platform in response to the equipment serial number and the sixth signature data being valid, wherein the security cloud authentication information comprises security cloud identification data and an SM9 key negotiation public key generated by the cryptographic device.
15. The method of claim 6, wherein the asymmetric key comprises an SM9 key pair, the method further comprising:
receiving an identity verification application from an identity authentication service platform, wherein the identity verification application comprises a seventh random number and seventh signature data generated by the equipment serial number and a security chip of the intelligent equipment, and the seventh signature data is generated by the security chip of the intelligent equipment by signing the seventh random number and the equipment serial number by using the equipment private key;
performing authentication of the device serial number and the seventh signature data in the authentication application;
and transmitting security cloud authentication information to the identity authentication service platform in response to the equipment serial number and the seventh signature data being valid, wherein the security cloud authentication information comprises an eighth random number, security cloud identification data, eighth signature data and an SM9 key negotiation public key generated by the password device, and the eighth signature data is generated by signing the eighth random number and the security cloud identification data through a security cloud root private key by the password device.
16. The method of any of claims 8-11, further comprising:
receiving ciphertext data and a device serial number from a data ciphertext communication service platform;
calculating an authentication key by using the equipment serial number, and discretizing a decryption session key by using the authentication key by taking the first random number and the second random number as discrete factors;
decrypting the ciphertext data according to the decryption session key; and returning the decrypted data to the data ciphertext communication service platform.
17. The method of any one of claims 8-11, further comprising;
receiving data to be encrypted from a data ciphertext communication service platform;
calculating an authentication key by using the equipment serial number, and discretizing an encryption session key by using the authentication key by taking the first random number and the second random number as discrete factors;
encrypting the data to be encrypted according to the encryption session key; and returning the encrypted data to the data ciphertext communication service platform.
18. The method of any of claims 12 to 15, further comprising:
receiving key response data of a key negotiation service platform, wherein the key response data comprises a response public key, a user ID and the equipment serial number, and the response public key is a temporary public key generated when the security chip generates a session key based on a key negotiation principle according to the key negotiation data and the user ID;
Generating a session key according to a key negotiation principle according to the response public key, the user ID and the security cloud identification data;
and binding and storing the session key and the equipment serial number, and notifying a data key negotiation service platform that key negotiation is completed.
19. The method of any of claims 12 to 15, further comprising:
receiving ciphertext data and a device serial number from a data ciphertext communication service platform;
obtaining a corresponding session key through the equipment serial number as a decryption session key;
decrypting the ciphertext data according to the decryption session key; and returning the decrypted data to the data ciphertext communication service platform.
20. The method of any of claims 12 to 15, further comprising:
receiving data to be encrypted from a data ciphertext communication service platform;
using the equipment serial number to obtain a corresponding session key as an encryption session key;
encrypting the data to be encrypted according to the encryption session key; and returning the encrypted data to the data ciphertext communication service platform.
21. A system for secure network access communication of an intelligent device, comprising the intelligent device, a service platform and a secure cloud device, wherein a secure chip is arranged in the intelligent device, the service platform comprises an authentication key distribution service platform, an identity authentication service platform and a data ciphertext communication service platform, and the secure cloud device executes the method of any one of claims 1-15.
CN202111572609.2A 2021-12-21 2021-12-21 Method and system for secure network access communication of equipment Pending CN116318637A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111572609.2A CN116318637A (en) 2021-12-21 2021-12-21 Method and system for secure network access communication of equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111572609.2A CN116318637A (en) 2021-12-21 2021-12-21 Method and system for secure network access communication of equipment

Publications (1)

Publication Number Publication Date
CN116318637A true CN116318637A (en) 2023-06-23

Family

ID=86798297

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111572609.2A Pending CN116318637A (en) 2021-12-21 2021-12-21 Method and system for secure network access communication of equipment

Country Status (1)

Country Link
CN (1) CN116318637A (en)

Similar Documents

Publication Publication Date Title
US9847882B2 (en) Multiple factor authentication in an identity certificate service
US7688975B2 (en) Method and apparatus for dynamic generation of symmetric encryption keys and exchange of dynamic symmetric key infrastructure
US7334255B2 (en) System and method for controlling access to multiple public networks and for controlling access to multiple private networks
CA2357792C (en) Method and device for performing secure transactions
CN111147460B (en) Block chain-based cooperative fine-grained access control method
CN106790261B (en) Distributed file system and method for authenticating communication between its interior joint
CN108809633B (en) Identity authentication method, device and system
US20200320178A1 (en) Digital rights management authorization token pairing
JPH06223041A (en) Rarge-area environment user certification system
JP2020530726A (en) NFC tag authentication to remote servers with applications that protect supply chain asset management
JP5992535B2 (en) Apparatus and method for performing wireless ID provisioning
ES2665887T3 (en) Secure data system
CN112165386B (en) Data encryption method and system based on ECDSA
CN113411187A (en) Identity authentication method and system, storage medium and processor
CN107566393A (en) A kind of dynamic rights checking system and method based on trust certificate
CN114091009A (en) Method for establishing secure link by using distributed identity
CN110912685A (en) Establishing a protected communication channel
KR102053993B1 (en) Method for Authenticating by using Certificate
CN113676330B (en) Digital certificate application system and method based on secondary secret key
KR20190115489A (en) IOT equipment certification system utilizing security technology
CN112437436B (en) Identity authentication method and device
CN112069487B (en) Intelligent equipment network communication safety implementation method based on Internet of things
CN116318637A (en) Method and system for secure network access communication of equipment
KR20170111809A (en) Bidirectional authentication method using security token based on symmetric key
Hsu et al. ECDSA Certificate Enrollment and Authentication for SCEP Protocol in Smart Grid PKI

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination