WO2023082190A1

WO2023082190A1 - Device authentication method and apparatus

Info

Publication number: WO2023082190A1
Application number: PCT/CN2021/130393
Authority: WO
Inventors: 钟胤; 魏卓; 李铁岩
Original assignee: 华为技术有限公司
Priority date: 2021-11-12
Filing date: 2021-11-12
Publication date: 2023-05-19

Abstract

Provided in the embodiments of the present application are a device authentication method and apparatus, which can be applied to the authentication of devices in fields of transportation means such as vehicles, ships and airplanes, and devices in fields such as security protection and the Internet of Things. The method comprises: a client acquiring a first fingerprint of a device to be authenticated; the client receiving a first parameter, wherein the first parameter is associated with the first fingerprint, and the first parameter is at least used for authenticating said device; the client sending the first parameter to a blockchain; and the blockchain authenticating said device according to the first parameter. By means of the solution of the present application, the security of a device can be improved.

Description

Device authentication method and device

technical field

The present application relates to the technical field of authentication, and more specifically, to a device authentication method and device.

Background technique

Services involved in vehicles, ships, airplanes and other transportation fields, as well as security, Internet of Things and other fields usually need to be realized through equipment. Taking vehicles as an example, services such as autonomous driving, entertainment information, and vehicle body management all need to be provided to consumers through on-board equipment, so the safety of equipment is particularly important. However, the service architecture in these fields is usually open, and the possibility of equipment being stolen or replaced is high, resulting in that the security of the equipment cannot be guaranteed.

Therefore, how to improve the safety of equipment is a technical problem that needs to be solved urgently.

Contents of the invention

The embodiments of the present application provide a device authentication method and device, which can be applied to the fields of vehicles, ships, airplanes and other means of transportation, as well as the authentication of devices in fields such as security and the Internet of Things, and can improve the security of the devices.

In a first aspect, a device authentication method is provided, and the method is applied to a client. Optionally, taking the application of the method in the field of vehicles as an example, the client may be a control device in the vehicle, for example, a domain controller in the vehicle, a mobile data center (mobile data center, MDC), etc., and may also be a cloud server . It should be understood that, in order to avoid data leakage during the authentication process, in actual operation, the control device in the vehicle can be preferably selected as the client.

The method includes: obtaining a first fingerprint of the device to be authenticated; receiving a first parameter, the first parameter is associated with the first fingerprint, and the first parameter is at least used to authenticate the device to be authenticated; sending the first parameter to blockchain.

It should be understood that when applied to the field of vehicles, the above-mentioned device to be authenticated may be a vehicle-mounted device.

It should be understood that the fingerprint of the device is an identification of the identity of the device, which can reflect the unique physical characteristics of the device.

It should be understood that the above-mentioned first parameter being associated with the first fingerprint includes that the first parameter may be obtained based on the first fingerprint. Optionally, the above-mentioned first parameter may include a hash value of the first fingerprint, or may include a result of directly compressing the first fingerprint, which is not limited in this application.

Optionally, the hash value of the first fingerprint can be generated through the file system. As an example, the file system may be the Interplanetary File System IPFS. Among them, IPFS can generate an independent hash value to identify the file through the content of the file instead of the location where the file is saved, so there will only be one copy of the file with the same content in the system, which can save storage space; in addition, stored in IPFS File data on the Internet can be quickly obtained, making access to data faster, safer, and more open.

In traditional solutions, device authentication is usually based on symmetric keys. However, authentication based on symmetric keys will lead to the following problems: pre-programmed, pre-installed certificates and private keys are required in the device, causing the device to have a secure storage module, which increases hardware costs; symmetric keys are used on different devices, It will inevitably bring challenges to the storage space of different devices; in addition, due to the need for pre-programming and preset keys in the device, it is impossible to realize plug-and-play of the device.

In this embodiment of the application, the first fingerprint of the device to be authenticated is obtained through the client, and the first parameter related to the first fingerprint is sent to the block chain, so that the first parameter can be based on the block chain Authenticate the device to be authenticated, so that on the one hand, it can improve the security of the device; on the other hand, because there is no need to program and pre-key the device, and there is no need to add a hardware security module to the device, thus solving the hardware cost There is no need to worry about the space problem of hardware security storage, and the device can be plug-and-play.

With reference to the first aspect, in some implementation manners of the first aspect, the first parameter includes a first hash value; and receiving the first parameter includes: receiving the first hash value from an interplanetary file system IPFS.

Specifically, in actual operation, the client can first extract the fingerprint of the device to be authenticated, and then send the fingerprint of the device to be authenticated to IPFS, encrypt and store the fingerprint data through IPFS and return a hash value to the client, thereby The storage of fingerprints to be authenticated on the client side can be avoided, saving the storage space of the client side.

With reference to the first aspect, in some implementation manners of the first aspect, the first fingerprint is associated with an output of the device to be authenticated.

It should be understood that the signal or data output by the device usually hides unique physical features that reflect the identity of the device, so the physical features of the device can be determined based on the output of the device as the fingerprint of the device.

With reference to the first aspect, in some implementations of the first aspect, the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals multiple.

With reference to the first aspect, in some implementation manners of the first aspect, the acquiring the first fingerprint of the device to be authenticated includes: acquiring the first fingerprint of the device to be authenticated at a period of T, where T is an integer greater than 0.

Likewise, the receiving the first parameter includes: receiving the first parameter at a period of T; the sending the first parameter to the blockchain includes: sending the first parameter to the blockchain at a period of T.

With reference to the first aspect, in some implementations of the first aspect, before acquiring the first fingerprint of the device to be authenticated, the method further includes: acquiring a second fingerprint of the preset device, where the second fingerprint is a reference fingerprint; receiving a second parameter, the second parameter is associated with the second fingerprint, and the second parameter is at least used to authenticate the device to be authenticated; and sending the second parameter to the block chain.

Among them, the pre-installed device refers to a pre-installed trusted device, whose fingerprint is used as a reference fingerprint, which can be compared with the fingerprint of the device to be authenticated based on the fingerprint to determine whether the device has been maliciously replaced. Optionally, the preset device can be preset under different circumstances. For example, the device can be preset by the vehicle manufacturer or an equipment supplier trusted by the vehicle manufacturer when leaving the factory, or it can be done during subsequent after-sales maintenance. Relevant professional and technical personnel carry out the preset of the equipment or replace the original preset equipment, which is not limited in this application.

In this embodiment of the application, before obtaining the first fingerprint of the device to be authenticated, the second fingerprint of the preset device can be obtained first, and the second fingerprint is a reference fingerprint, and the second parameter related to the second fingerprint is sent to to the block chain, so that the device to be authenticated can be authenticated on the block chain based on the first parameter and the second parameter, thereby improving the security of the device.

With reference to the first aspect, in some implementation manners of the first aspect, the second parameter includes a second hash value; receiving the second parameter includes: receiving the second hash value from an interplanetary file system IPFS.

Specifically, in actual operation, the client can first extract the fingerprint of the preset device, then send the fingerprint of the preset device to IPFS, encrypt and store the fingerprint data through IPFS, and return a hash value to the client, so that It can avoid storing the preset device fingerprint on the client, saving the storage space of the client.

With reference to the first aspect, in some implementation manners of the first aspect, the method further includes: determining that the provisioning device or the second fingerprint has configuration authority, and the configuration authority is at least used to indicate that the second fingerprint is a reference fingerprint.

With reference to the first aspect, in some implementations of the first aspect, the method further includes: determining that the provisioning device or the second fingerprint has configuration authority; and performing an acquisition and/or configuration operation on the second fingerprint based on the configuration authority .

It should be understood that since the second fingerprint of the pre-provisioned device needs to be used as a reference fingerprint, the client also needs to determine whether the pre-provisioned device or the second fingerprint has configuration authority, so that the second fingerprint can be obtained and/or configured subsequently. , where the configuring operation may include configuring the second fingerprint as the reference fingerprint. If it is determined that the provisioning device or the second fingerprint has configuration authority, the second fingerprint may be configured as a reference fingerprint, or it may be understood that the second fingerprint may be configured as a reference fingerprint or the second fingerprint may be used as a reference fingerprint. For example, before acquiring the second fingerprint, the client may determine whether the provisioning device or the second fingerprint has configuration authority, and if it is determined that there is configuration authority, the second fingerprint may be used as a reference fingerprint. Based on this, the security of device authentication can be guaranteed.

Optionally, it may be determined whether the preset device or the second fingerprint has configuration authority when the client switches to the "reference fingerprint extraction and upload mode" (for example: configuration mode, engineering mode, etc.). It should be understood that in this mode, if it is determined that the pre-installed device or the second fingerprint has the configuration authority, the uploaded second fingerprint will be marked as a reference fingerprint, and the blockchain will use this reference fingerprint with subsequent new fingerprints in the subsequent authentication process. fingerprint (ie the first fingerprint) for comparison. If the blockchain has already recorded a reference fingerprint when uploading, then the newly uploaded reference fingerprint can replace the old reference fingerprint. It should be understood that the switch of the configuration mode can also pass through the authority control process (for example: authentication, password, etc.), to ensure that only authorized persons can perform the operation/configuration of the reference fingerprint, thereby ensuring the security of device authentication.

In a second aspect, a device authentication method is provided, the method is applied to a block chain, and the method includes: receiving a first parameter sent by a client, the first parameter being associated with a first fingerprint of the device to be authenticated; according to the The first parameter is used to authenticate the device to be authenticated.

In the embodiment of this application, the first parameter related to the first fingerprint of the device to be authenticated sent by the client is received through the blockchain, and then the device to be authenticated is authenticated on the blockchain according to the first parameter to ensure that the device Trustworthy, so that on the one hand, the security of the device can be improved; on the other hand, because there is no need to program and pre-key the device, and there is no need to add a hardware security module to the device, thus solving the hardware cost problem, and also There is no need to worry about the space problem of hardware security storage, and the device can be plug-and-play.

With reference to the second aspect, in some implementation manners of the second aspect, the first parameter includes a first hash value, and the first hash value is generated through an interplanetary file system IPFS.

With reference to the second aspect, in some implementation manners of the second aspect, the first fingerprint is associated with an output of the device to be authenticated.

With reference to the second aspect, in some implementations of the second aspect, the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals. item.

With reference to the second aspect, in some implementations of the second aspect, before receiving the first parameter sent by the client, the method further includes: receiving a second parameter sent by the client, and the second parameter is the same as the preset The second fingerprint of the device is associated, and the second fingerprint is a reference fingerprint; authenticating the device to be authenticated according to the first parameter includes: authenticating the device to be authenticated according to the first parameter and the second parameter.

In this embodiment of the application, before the block chain receives the first parameter sent by the client, it can first receive the second parameter related to the second fingerprint (reference fingerprint) of the preset device sent by the client, and then according to the first parameter The first parameter and the second parameter are used to authenticate the device to be authenticated, so that the security of the device can be improved.

With reference to the second aspect, in some implementations of the second aspect, the authenticating the device to be authenticated according to the first parameter and the second parameter includes: obtaining the first parameter according to the first parameter and the second parameter fingerprint and the second fingerprint; authenticating the device to be authenticated according to the first fingerprint and the second fingerprint.

Optionally, the first fingerprint and the second fingerprint are obtained according to the first parameter and the second parameter, and the block chain may obtain the first fingerprint directly from the file system (for example, IPFS) based on the first parameter and the second parameter. The first fingerprint and the second fingerprint can improve the speed and security of fingerprint acquisition.

Optionally, the device to be authenticated is authenticated according to the first fingerprint and the second fingerprint, specifically, the device to be authenticated may be authenticated according to a similarity between the first fingerprint and the second fingerprint.

With reference to the second aspect, in some implementations of the second aspect, the receiving the first parameter sent by the client includes: receiving the first parameter sent by the client at a period of T, where T is an integer greater than 0; Authenticating the device to be authenticated by the first parameter includes: periodically authenticating the device to be authenticated according to the first parameter sent by the client received at a period of T.

In the embodiment of this application, the device to be authenticated can be continuously authenticated by periodically authenticating the device to be authenticated according to the first parameter received from the client at a period of T, thereby improving the security of the device .

With reference to the second aspect, in some implementation manners of the second aspect, authenticating the device to be authenticated according to the first parameter includes: authenticating the device to be authenticated by using a smart contract and the first parameter.

Among them, smart contracts can automatically execute some pre-defined rules and terms based on the data stored on the blockchain. Moreover, the execution of the smart contract does not need to rely on the participation or intervention of a third-party organization. The supervision and arbitration of the contract are completed by the computer; once the smart contract is deployed, all content cannot be modified, and no party can interfere with the execution of the contract. Therefore, in the embodiment of the present application, the device to be authenticated can be authenticated through the smart contract and the first parameter, so that the reliability of device authentication can be improved, and thus the security of the device can be improved.

With reference to the second aspect, in some implementations of the second aspect, after the device to be authenticated is authenticated according to the first parameter, the method further includes: processing the authentication result, the processing operation includes recording a log One or more of triggering a warning and feeding back the authentication result to the client.

In a third aspect, a device authentication device is provided, which is applied to a client, and the device includes: a processing module, used to obtain a first fingerprint of a device to be authenticated; a transceiver module, used to receive a first parameter, the first A parameter is associated with the first fingerprint, and the first parameter is at least used to authenticate the device to be authenticated; the transceiver module is also used to send the first parameter to the block chain.

Wherein, the transceiver module has the capability of data sending and/or receiving.

With reference to the third aspect, in some implementation manners of the third aspect, the first parameter includes a first hash value; the transceiver module is further configured to receive the first hash value from an interplanetary file system IPFS.

With reference to the third aspect, in some implementation manners of the third aspect, the first fingerprint is associated with an output of the device to be authenticated.

In conjunction with the third aspect, in some implementations of the third aspect, the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals. item.

With reference to the third aspect, in some implementation manners of the third aspect, the processing module is further configured to acquire the first fingerprint of the device to be authenticated at a period of T, where T is an integer greater than 0.

With reference to the third aspect, in some implementations of the third aspect, before acquiring the first fingerprint of the device to be authenticated, the processing module is further configured to acquire a second fingerprint of the preset device, and the second fingerprint is a reference Fingerprint; the transceiver module is also used to receive a second parameter, the second parameter is associated with the second fingerprint, and the second parameter is at least used to authenticate the device to be authenticated; and send the second parameter to the block chain.

With reference to the third aspect, in some implementation manners of the third aspect, the second parameter includes a second hash value; the transceiver module is further configured to receive the second hash value from an interplanetary file system IPFS.

With reference to the third aspect, in some implementation manners of the third aspect, the processing module is configured to determine that the preset device or the second fingerprint has configuration authority, and the configuration authority is at least used to indicate that the second fingerprint is a reference fingerprint .

With reference to the third aspect, in some implementation manners of the third aspect, the processing module is configured to determine that the preset device or the second fingerprint has configuration authority, and acquire and/or obtain the second fingerprint based on the configuration authority. Configure operations. Exemplarily, the processing module may determine that the provisioning device or the second fingerprint has configuration authority before acquiring the second fingerprint of the provisioning device.

In a fourth aspect, a device authentication device is provided, the device is applied to a blockchain, and the device includes: a transceiver module, configured to receive a first parameter sent by a client, the first parameter and the first fingerprint of the device to be authenticated Associated; a processing module, configured to authenticate the device to be authenticated according to the first parameter.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the first parameter includes a first hash value, and the first hash value is generated through an interplanetary file system IPFS.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the first fingerprint is associated with an output of the device to be authenticated.

With reference to the fourth aspect, in some implementations of the fourth aspect, the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals. item.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, before receiving the first parameter sent by the client, the transceiver module is further configured to receive a second parameter sent by the client, and the second parameter is the same as The second fingerprint of the preset device is associated, and the second fingerprint is a reference fingerprint; the processing module is also used to authenticate the device to be authenticated according to the first parameter and the second parameter.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is further configured to acquire the first fingerprint and the second fingerprint according to the first parameter and the second parameter; The similarity of the second fingerprint authenticates the device to be authenticated.

With reference to the fourth aspect, in some implementations of the fourth aspect, the transceiver module is further configured to receive the first parameter sent by the client at a period of T, where T is an integer greater than 0; the processing module is also configured to , periodically authenticate the device to be authenticated according to the first parameter sent by the client received at a period of T.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is further configured to authenticate the device to be authenticated by using the smart contract and the first parameter.

With reference to the fourth aspect, in some implementation manners of the fourth aspect, the processing module is further configured to perform processing operations on the authentication results, the processing operations including recording logs, triggering warnings, and feeding back the authentication results to the client in the client. one or more.

In the fifth aspect, a device authentication device is provided, including an input and output interface, a processor and a memory, the processor is used to control the input and output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to Call and run the computer program from the memory, so that the device authentication apparatus executes the authentication method in the first aspect or any possible implementation of the first aspect; and/or executes the authentication method in the second aspect or the second An authentication method in any possible implementation of the aspect.

Wherein, the device authentication device can be applied to scenarios where authentication is required and storage space is limited, for example, it can be applied to the authentication of equipment in vehicles, ships, airplanes, etc., and it can also be applied to the authentication of equipment in the security field, or It can be applied to authentication of devices in fields such as the Internet of Things, which is not limited in this application.

A sixth aspect provides an authentication system for a device, including a client for executing the authentication method in the first aspect or any possible implementation of the first aspect and a client for executing the second aspect or the second aspect Blockchain of authentication methods in any of the possible implementations.

In a seventh aspect, a vehicle component is provided, including a client for executing the authentication method in the first aspect or any possible implementation manner of the first aspect.

In an eighth aspect, a vehicle is provided, including an electronic control unit, and the electronic control unit is configured to execute the authentication method in the first aspect or any possible implementation manner of the first aspect.

In a ninth aspect, there is provided a computer-readable storage medium, which is characterized by comprising instructions; the instructions are used to implement the authentication method in the first aspect or in any possible implementation manner of the first aspect; and/or , implementing the second aspect or the authentication method in any possible implementation manner of the second aspect.

In a tenth aspect, there is provided a computer program product, which is characterized in that it includes: a computer program that, when the computer program is run, causes the computer to perform the authentication in the first aspect or in any possible implementation manner of the first aspect. method; and/or, execute the authentication method in the second aspect or any possible implementation manner of the second aspect.

In an eleventh aspect, a computing device is provided, including: at least one processor and a memory, the at least one processor is coupled to the memory, and is used to read and execute instructions in the memory, so as to execute the An authentication method in one aspect or any possible implementation manner of the first aspect; and/or, execute the authentication method in the second aspect or any possible implementation manner of the second aspect.

In a twelfth aspect, there is provided a chip, the chip includes a processor and a data interface, and the processor reads instructions stored on the memory through the data interface, and executes any of the possible functions of the first aspect or the first aspect. The authentication method in the implementation manner of the second aspect; and/or, execute the authentication method in the second aspect or any possible implementation manner of the second aspect.

Optionally, as an implementation manner, the chip may further include a memory, the memory stores instructions, the processor is configured to execute the instructions stored in the memory, and when the instructions are executed, the The processor is configured to execute the authentication method in the first aspect or any possible implementation manner of the first aspect; and/or execute the authentication method in the second aspect or any possible implementation manner of the second aspect.

In a thirteenth aspect, a chip system is provided, which includes at least one processor, configured to support the implementation of the functions involved in the first aspect or some implementations of the first aspect, for example, receiving or processing the above-mentioned Data and/or information involved in the method.

In a possible design, the chip system further includes a memory, the memory is used to store program instructions and data, and the memory is located inside or outside the processor. The system-on-a-chip may consist of chips, or may include chips and other discrete devices.

Description of drawings

FIG. 1 is an example diagram of a traditional solution for authenticating a vehicle-mounted device.

Fig. 2 is an example diagram of a device authentication method provided by an embodiment of the present application.

Fig. 3 is an example of a continuous authentication method for a vehicle-mounted device provided by an embodiment of the present application.

Fig. 4 is an example diagram of a process of storing and uploading reference fingerprints provided by the embodiment of the present application.

Fig. 5 is an example diagram of a process of storing and uploading a fingerprint to be authenticated according to an embodiment of the present application.

FIG. 6 is an example diagram of a fingerprint acquisition process in a fingerprint authentication process provided by an embodiment of the present application.

Fig. 7 is an apparatus 700 for device authentication provided by an embodiment of the present application.

FIG. 8 is an apparatus 800 for device authentication provided by an embodiment of the present application.

FIG. 9 is a device authentication system 900 provided by an embodiment of the present application.

FIG. 10 is an exemplary block diagram of a hardware structure of a device authentication apparatus 1000 provided by an embodiment of the present application.

Detailed ways

In order to facilitate the understanding of the technical solution of the present application, a brief introduction is first made to the concepts involved in the present application.

Blockchain technology: Blockchain technology is a technical solution that does not rely on third parties and stores, verifies, transmits and communicates network data through its own distributed nodes. Blockchain technology has the advantages of decentralization, openness, security, independence, and anonymity.

Smart contract: Based on the data stored on the blockchain, some pre-defined rules and terms can be automatically executed.

Interplanetary file system (IPFS) technology: IPFS is a point-to-point distributed file system, and its connected computing devices have a file management mode, which is a content-addressable peer-to-peer hypermedia distribution protocol. With IPFS, users search for content rather than filenames.

Working principle of IPFS: Store files in IPFS. After IPFS storage, it will generate a hash value dedicated to this file and return it to the client. The client can store the hash value in the blockchain to prevent tampering. When requesting a file, just Show this hash value, and IPFS will transfer the file to the requesting client from the node storing the file based on this hash value.

Physical unclonable function (PUF): The physical unclonable function uses the inherent physical structure to uniquely identify it, and any input stimulus will output a unique and unpredictable response.

Consensus Algorithm: Can be defined as a mechanism for reaching consensus through a blockchain network. As a distributed system, the public (decentralized) blockchain does not rely on a central authority, but is passed by the distributed nodes to realize transactions. At the same time, the consensus algorithm comes into play, which ensures the normal execution of protocol rules and transactions can occur without trust.

For ease of understanding, the background technology involved in this application will be briefly introduced below.

The authentication of equipment is of great significance to improve the security of equipment. Taking in-vehicle equipment as an example, the service-oriented in-vehicle architecture is the current development direction. Services such as autonomous driving, entertainment information, and vehicle body management all need to be realized through in-vehicle equipment, so the safety of in-vehicle equipment is particularly important. However, the service-oriented in-vehicle architecture is also open. The in-vehicle architecture provides standard interfaces for various in-vehicle devices and sensors. Therefore, the possibility of the in-vehicle devices being stolen or replaced is high, resulting in the inability to guarantee the safety of the in-vehicle devices, which in turn leads to Safety cannot be guaranteed. Therefore, it is necessary to authenticate the vehicle-mounted device to improve the security of the vehicle-mounted device.

In the traditional solution, the authentication of the on-board device is mainly realized based on a symmetric key. As shown in FIG. 1 , the authentication process 100 of the traditional solution mainly includes steps S110 to S170, and these steps are briefly described below.

S110, the vehicle system generates a random number;

S120, the vehicle-mounted system sends the random number to the vehicle-mounted device;

S130, the vehicle system encrypts the random number;

S140, the vehicle device encrypts the random number;

S150, the vehicle-mounted device sends the ciphertext of the random number to the vehicle-mounted system;

S160, the on-board system compares the ciphertexts and determines the authentication result, considers the authentication successful when the ciphertexts are the same, and considers the authentication failure when the ciphertexts are different;

S170, the vehicle system feeds back the authentication result to the vehicle device.

Traditional schemes based on symmetric key authentication will lead to the following problems: pre-programmed, preset certificates and private keys are required in the vehicle-mounted device, resulting in the need for a secure storage module in the vehicle-mounted device, which increases hardware costs; the use of symmetric keys in different devices Above all, it will inevitably bring challenges to the storage space of different devices; in addition, due to the need for pre-programming and preset keys in the vehicle-mounted devices, it is impossible to achieve plug-and-play devices.

Based on this, this application provides a device authentication method and device, which is mainly based on the physical unclonable feature of the device as an identity (i.e. fingerprint), and then combines the blockchain technology to authenticate the device on the blockchain to ensure that the device Trusted, which can improve the security of the device.

In addition, using physical features to authenticate the device requires extracting features from the output of the device and performing feature comparison. It does not require programming and pre-keying in the device, avoiding adding hardware security modules to the device, and solving the hardware cost problem; At the same time, there is no need to worry about the space problem of hardware security storage. Moreover, the device can be plug-and-play without the need for pre-programming and pre-keying.

The technical solution in this application will be described below with reference to the accompanying drawings.

Fig. 2 is an example diagram of a device authentication method provided by an embodiment of the present application. It should be understood that the method 200 can be applied to the fields of vehicles, ships, airplanes and other vehicles, as well as the authentication of devices in fields such as security and Internet of Things, which is not limited in this application. However, for ease of description, in the following embodiments, the application to vehicles is taken as an example.

As shown in FIG. 2 , the method 200 may include S210 to S240 , and each step in the method 200 will be described in detail below.

S210, the client acquires the first fingerprint of the device to be authenticated.

Optionally, taking the application of the method 200 in the field of vehicles as an example, the client may be a control device in the vehicle, for example, a domain controller in the vehicle, a mobile data center (mobile data center, MDC), etc., and may also be a cloud server. It should be understood that, in order to avoid data leakage during data transmission during the authentication process, in actual operation, the control device in the vehicle may be preferably selected as the client.

It should be understood that when applied to a vehicle, the device may be described as an in-vehicle device. Optionally, the vehicle-mounted device can be a sensor such as a camera, a millimeter-wave radar, or a laser radar on the vehicle, or it can be a vehicle-mounted device communicating through a controller area network (CAN) or an Ethernet (ethereum, ETH) on the vehicle. equipment, which is not limited in this application.

It should be understood that the physical characteristics of a device are often hidden in the signal or data output by it. Therefore, the first fingerprint of the device to be authenticated can be obtained according to the output of the device to be authenticated. For example, according to the PUF principle or based on the PUF, the unique physical features reflecting the device identity can be extracted from the output of these devices as the device fingerprint (ie, the first fingerprint). The embodiment of the present application does not limit the manner of obtaining the device fingerprint reflecting the unique physical characteristics of the device through the signal or data output by the device.

It should be understood that in this embodiment of the present application, the first fingerprint of the device to be authenticated is obtained according to the output of the device to be authenticated, which can also be described as that the first fingerprint of the device to be authenticated is associated with the output of the device to be authenticated.

Optionally, the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals, which are not limited in this application.

S220, the client receives a first parameter. Wherein, the first parameter is associated with the first fingerprint, and the first parameter is at least used to authenticate the device to be authenticated.

It should be understood that the foregoing first parameter being associated with the first fingerprint means that the first parameter is obtained based on the first fingerprint. Optionally, the above-mentioned first parameter may include a hash value of the first fingerprint (that is, the first hash value), or may include a result of directly compressing the first fingerprint, which is not limited in this application.

Optionally, the hash value of the first fingerprint may be generated by a file system or by other means, which is not limited in this application. As an example, the file system may be IPFS, then the above-mentioned receiving of the first parameter by the client may be that the client receives the first parameter from IPFS. Specifically, in actual operation, the client can first extract the fingerprint of the device to be authenticated (that is, the first fingerprint), and then send the fingerprint to IPFS, encrypt and store the fingerprint through IPFS and return a hash value to the client, It should be understood that the hash value is obtained based on the fingerprint, so that the storage of the fingerprint to be authenticated at the client can be avoided and the storage space of the client can be saved.

S230, the client sends the first parameter to the blockchain. Correspondingly, the blockchain receives the first parameter sent by the client.

S240, the block chain authenticates the device to be authenticated according to the first parameter.

In the embodiment of this application, the first fingerprint of the device to be authenticated is obtained through the client, and the first parameter related to the first fingerprint is sent to the block chain, and at the same time, device authentication is performed on the block chain based on the first parameter , to ensure the reliability of the device and improve the security of the device. In addition, compared with the traditional solution, the solution of this application does not need to program and pre-set keys in the device, and does not need to add a hardware security module to the device, thus solving the problem of hardware cost, and there is no need to worry about the space for hardware security storage problem, it can also realize the device plug and play.

Optionally, before the client acquires the first fingerprint of the device to be authenticated, the method 200 may further include: the client acquires a second fingerprint of the preset device, where the second fingerprint is a reference fingerprint; the client receives a second parameter, the The second parameter is associated with the second fingerprint, and the second parameter is at least used to authenticate the device to be authenticated; the client sends the second parameter to the block chain. Correspondingly, the block chain receives the second parameter sent by the client, and authenticates the device to be authenticated according to the first parameter and the second parameter.

Likewise, the foregoing second parameter being associated with the second fingerprint may also mean that the second parameter is obtained based on the second fingerprint. Optionally, the above-mentioned second parameter may include a hash value of the second fingerprint (that is, the second hash value), or may include a result of directly compressing the second fingerprint, which is not limited in the present application.

Optionally, the hash value of the second fingerprint can be generated through the file system. As an example, the file system may be IPFS, then the above-mentioned receiving of the second parameter by the client may be that the client receives the second parameter from IPFS. Specifically, in actual operation, the client can first extract the fingerprint of the pre-installed device, then send the fingerprint to IPFS, encrypt and store the fingerprint data through IPFS, and return a hash value to the client, thereby avoiding The terminal stores the preset device fingerprints, which saves the storage space of the client.

Optionally, authenticating the device to be authenticated according to the first parameter and the second parameter includes: obtaining the first fingerprint and the second fingerprint according to the first parameter and the second parameter; certified.

Optionally, the acquisition of the first fingerprint and the second fingerprint according to the first parameter and the second parameter above may be that the blockchain directly acquires the first fingerprint and the second fingerprint from the file system (for example, IPFS) based on the first parameter and the second parameter. Two fingerprints, which can improve the speed and security of fingerprint acquisition.

Specifically, based on the first parameter and the second parameter, the blockchain can directly obtain the first fingerprint of the device to be authenticated and the second fingerprint of the preset device sent by the previous client from IPFS, and then compare the first fingerprint and the second fingerprint. Comparison, in order to realize the authentication of the equipment to be authenticated, and then ensure the security of the equipment.

Optionally, the device to be authenticated is authenticated according to the first fingerprint and the second fingerprint, specifically, the device to be authenticated may be authenticated according to the similarity between the first fingerprint and the second fingerprint.

In this embodiment of the present application, before receiving the first parameter sent by the client, the second parameter related to the second fingerprint of the preset device (that is, the reference fingerprint) sent by the client may be received first, and then according to the first parameter and The second parameter authenticates the device to be authenticated, so that the security of the device can be improved.

In an optional implementation manner, the method 200 may further include: determining that the provisioning device or the second fingerprint has configuration authority, where the configuration authority is at least used to indicate that the second fingerprint is a reference fingerprint.

In an optional implementation manner, the method 200 may further include: determining that the provisioning device or the second fingerprint has a configuration authority; and performing an acquisition and/or configuration operation on the second fingerprint based on the configuration authority.

Exemplarily, before obtaining the second fingerprint of the provisioning device, the client may determine that the provisioning device or the second fingerprint has configuration authority.

It should be understood that since the second fingerprint of the pre-provisioned device needs to be used as a reference fingerprint, the client also needs to determine whether the pre-provisioned device or the second fingerprint has configuration authority, so that the second fingerprint can be obtained and/or configured subsequently. , wherein the configuring operation may include configuring the second fingerprint as a reference fingerprint. If the provisioning device or the second fingerprint has configuration authority, the second fingerprint may be a reference fingerprint, or it may be understood that the second fingerprint may be configured as a reference fingerprint or the second fingerprint may be used as a reference fingerprint. For example, before acquiring the second fingerprint, the client may determine whether the provisioning device or the second fingerprint has configuration authority, and if it is determined that there is configuration authority, the second fingerprint may be used as a reference fingerprint. Based on this, the security of device authentication can be guaranteed.

Optionally, it may be determined whether the preset device or the second fingerprint has configuration authority when the client switches to the "reference fingerprint extraction and upload mode" (for example: configuration mode, engineering mode, etc.). It should be understood that in this mode, if it is determined that the preset device or the second fingerprint has configuration authority, the uploaded second fingerprint will be marked as a reference fingerprint, and the blockchain will use this reference fingerprint and Subsequent new fingerprints (ie, the first fingerprint) are compared. If the blockchain has already recorded a reference fingerprint when uploading, then the newly uploaded reference fingerprint can replace the old reference fingerprint. It should be understood that the switch of the configuration mode can also pass through the authority control process (for example: authentication, password, etc.), to ensure that only authorized persons can perform the operation/configuration of the reference fingerprint, thereby ensuring the security of device authentication.

Optionally, the device to be authenticated can also be authenticated through a smart contract, thereby improving the security of the device.

Optionally, after the blockchain authenticates the device to be authenticated, the method 200 may further include: processing the authentication result by the blockchain. Optionally, the processing operation may include one or more of logging, triggering a warning, and feeding back an authentication result to the client. Specifically, if the authentication fails, the blockchain can use background records or trigger warnings for processing, and can also directly feed back the authentication results to the client, so that the client can process itself according to the authentication results. For example, the client can use Refuse communication, record logs, and risk warnings to ensure device security.

Optionally, the client acquires the first fingerprint of the device to be authenticated, which may be that the client acquires the first fingerprint of the device to be authenticated at a period of T, where T is an integer greater than 0. Similarly, the client receiving the first parameter can be: the client receives the first parameter at a period of T; the client sending the first parameter to the blockchain can be: the client sends the first parameter to the blockchain at a period of T . Correspondingly, the block chain receives the first parameter sent by the client may be: the block chain receives the first parameter sent by the client at a period of T; the block chain authenticates the device to be authenticated according to the first parameter may be: block The chain periodically authenticates the device to be authenticated according to the first parameter received from the client at a period of T.

Taking the vehicle-mounted device as an example, the continuous authentication scheme of the vehicle-mounted device will be introduced in detail with reference to FIG. 3 to FIG. 6 .

Fig. 3 is an example of a continuous authentication method for a vehicle-mounted device provided by an embodiment of the present application. As shown in FIG. 3 , the method 300 includes steps S310 to S360 , and these steps will be described in detail below.

S310. Extract a reference fingerprint (that is, the above-mentioned second fingerprint). Specifically, the reference fingerprint is extracted through the client.

The original data output by sensors such as cameras, millimeter-wave radars, and lidars (for example: output images, videos, distances, speeds, point cloud data, etc.) hide their inherent physical characteristics; other vehicle-mounted devices, such as through CAN or For ETH communication equipment, the physical layer signals and messages received from CAN and ETH also carry the physical characteristics of the sending equipment. According to the signals or data output by these vehicle-mounted devices, the unique physical characteristics that can reflect the identity of the vehicle-mounted device in advance can be used as the fingerprint of the vehicle-mounted device. For example, according to the PUF principle, the unique physical characteristics that reflect the identity of the vehicle-mounted device can be extracted from the signals or data output by these vehicle-mounted devices as device fingerprints.

The fingerprint extraction process will be exemplarily introduced below by taking the fingerprint extraction of a pre-installed camera as an example.

Step 1: First, acquire N images from the video stream output by the preset camera, and this application does not limit the number of acquired images.

Step 2: Define the linear relationship between one pixel and other pixels in the pixel blocks included in each of the N images.

It should be understood that each of the N images includes multiple pixel blocks, and each pixel block includes an M*R pixel array. Wherein, M represents the number of horizontal pixels, and R represents the number of vertical pixels, and M and R may be the same or different. It should be understood that the number of pixel blocks included in each image can be the same or different; and the pixel arrays corresponding to different pixel blocks can be the same or different (that is, the M value and R value of the pixel arrays corresponding to different pixel blocks can be the same can also be different), which is not limited in this application. Exemplarily, the pixel array may be 3*3, 3*5, 5*5, 5*9, 9*9, 16*16, etc., which is not limited in this application. For the convenience of description, the description below will take different pixel blocks corresponding to the same pixel array as an example.

Next, define the linear relationship model between the light intensity x _ab corresponding to the pixel in row a and column b in each pixel block and the light intensity of other pixels:

Wherein, a and b respectively satisfy the relationship: 1≤a≤R, 1≤b≤M.

Exemplarily, taking a 5*5 pixel array (as shown in Table 1) as an example, define a linear relationship between the light intensity x ₃₃ of the pixel in the third row and the third column in each pixel block and the light intensity of other pixels.

Table 1:

x ₁₁ x ₁₁	x ₁₂ x ₁₂	x ₁₃ x ₁₃	x ₁₄ x ₁₄	x ₁₅ x ₁₅
x ₂₁ x ₂₁	x ₂₂ x ₂₂	x ₂₃ x ₂₃	x ₂₄ x ₂₄	x ₂₅ x ₂₅
x ₃₁ x ₃₁	x ₃₂ x ₃₂	x ₃₃ x ₃₃	x ₃₄ x ₃₄	x ₃₅ x ₃₅
x ₄₁ x ₄₁	x ₄₂ x ₄₂	x ₄₃ x ₄₃	x ₄₄ x ₄₄	x ₄₅ x ₄₅
x ₅₁ x ₅₁	x ₅₂ x ₅₂	x ₅₃ x ₅₃	x ₅₄ x ₅₄	x ₅₅ x ₅₅

The linear relationship model between the light intensity x ₃₃ of the pixel in the third row and the third column and the light intensity of other pixels is:

Step 3: According to the pixels of K pixel blocks in the above N images (each pixel block in these K pixel blocks can come from a different image, or, multiple pixel blocks in these K pixel blocks can come from The same image, which is not limited in this application), construct the following sample data:

Among them, y _i represents the light intensity of the pixel in row a and column b in the i-th pixel block of K pixel blocks, and x _i,1 , _xi,2 ,...,xi _,n represent the i-th In a pixel block, the light intensity of other pixels except the pixels in the ath row and the bth column, n=M*R-1, where M and R can be understood as the number of horizontal pixels and vertical pixels included in the ith pixel block The values of M and R corresponding to each pixel block in the K pixel blocks are as described above, and will not be repeated here.

Then, based on the constructed sample data, the above-defined model is trained to determine parameters C and B in the model.

It should be understood that after the model is obtained, the light intensity of the pixel in row a and column b in each pixel block can be predicted according to the model, that is, the light intensity that can pass through its surrounding pixels (that is, other pixels except row a and column b The light intensity of the pixel) is used as input, and the light intensity of the pixel in row a and column b is calculated through the model.

Step 4: Predict the pixel value of row a and column b in each pixel block according to the model, and calculate the deviation between the predicted value and the real value, and calculate the deviation between the predicted value of row a and column b and the real value Denoted as (a,b,bias).

Step 5: Take D maximum deviations from K pixel blocks to form a vector, and use this vector as a fingerprint.

S320, storing the reference fingerprint.

After obtaining the reference fingerprint, the client sends the reference fingerprint to IPFS; encrypts and stores the above-mentioned extracted reference fingerprint data through IPFS, and returns the hash value of the reference fingerprint (ie, the above-mentioned second hash value) to the client; then The client sends the second hash value returned by IPFS as a transaction to each node of the blockchain, as shown in Figure 4.

S330, referring to the hash value of the fingerprint on the chain.

It should be understood that the on-chain fingerprint hash value refers to storing the hash value of the fingerprint as a transaction on each node of the blockchain.

For example, each node of the blockchain packs the received second hash value into a block according to the data structure of the blockchain, and uses a consensus algorithm to drive each node to verify the transaction in the block, and the data is broadcast after the verification is completed To all nodes, the data is successfully uploaded to the chain, that is, the storage of fingerprint data is completed.

S340, the fingerprint to be authenticated (that is, the first fingerprint) is extracted and uploaded to the blockchain.

Referring to the above steps S310 to S330, extract the fingerprint to be authenticated and upload it to the chain, as shown in Figure 5.

It should be understood that in this application, the block chain can adopt the Ethereum private chain and the consensus mechanism based on proof of stake (POS). After the fingerprint data is packaged on the chain, there is a block chain data layer. Immutability ensures identity integrity. In this application, smart contracts with Turing completeness can also be deployed on the blockchain, for example, deploying authentication contracts to authenticate fingerprints (see step S350) and anti-counterfeit contracts to process authentication results (see step S360).

S350, fingerprint authentication.

The authentication script algorithm is deployed in the contract layer of the blockchain. When the fingerprint to be authenticated is uploaded to the chain, the authentication smart contract is triggered, and then the smart contract is transferred from IPFS according to the second hash value of the reference fingerprint and the first hash value of the fingerprint to be authenticated. The reference fingerprint and the fingerprint to be authenticated are extracted and compared for authentication, as shown in Figure 6. During the comparison process, it can be judged whether the two fingerprints come from the same vehicle-mounted device according to their similarity.

Optionally, the similarity of two fingerprints can be calculated by cosine similarity. If the cosine similarity is greater than a preset threshold, the authentication is considered successful (that is, the two fingerprints come from the same vehicle-mounted device).

It should be understood that since the value range of cosine similarity is [-1,1], in actual operation, a reasonable preset threshold can be obtained through experiments, for example: 0.4, that is to say, if the cosines of two fingerprints are similar If the degree is greater than 0.4, the authentication is considered successful.

It should be understood that in practice, other existing methods may also be used to calculate the similarity between two fingerprints, which is not limited in this application.

Optionally, based on the above method, the fingerprint to be authenticated may also be collected periodically for comparison with the reference fingerprint, so as to realize continuous authentication of fingerprints (that is, to periodically repeat S340 and S350 to realize continuous authentication).

Optionally, the collection period of fingerprints to be authenticated can be set to 1min, 5min, 10min, 15min, etc., which need to be determined in conjunction with the transaction time and data processing time of the actual blockchain, which is not limited in this application.

S360, processing the authentication result.

In this application, the contract status of successful authentication can be recorded as 0, and the contract status of failed authentication can be recorded as 1. In this way, when the authentication is successful, the contract status is displayed as 0; when the authentication fails, the contract status is displayed as 1. At the same time, when the authentication fails, the anti-counterfeiting contract can also be triggered, and the anti-counterfeiting contract will record that the device has failed authentication. times or do other tasks (for example, prompting the owner, etc.), this application does not limit this.

Fig. 7 is an apparatus 700 for device authentication provided by an embodiment of the present application. The apparatus 700 is applied to a client, and the apparatus includes: a processing module 710 and a transceiver module 720 . It should be understood that the transceiver module has the capability of sending and/or receiving data.

Wherein, the processing module 710 is configured to obtain the first fingerprint of the device to be authenticated.

The transceiver module 720 is configured to receive a first parameter, the first parameter is associated with the first fingerprint, and the first parameter is at least used to authenticate the device to be authenticated.

The transceiver module 720 is also used to send the first parameter to the block chain.

Optionally, the first parameter may include a first hash value; the transceiver module 720 may also be configured to receive the first hash value from the interplanetary file system IPFS.

Optionally, the first fingerprint may be associated with the output of the device to be authenticated.

Optionally, the output of the device to be authenticated may include one or more of images, videos, distances, speeds, point cloud data, controller area network signals, and Ethernet signals.

Optionally, the processing module 710 may also be configured to acquire the first fingerprint of the device to be authenticated at a period of T, where T is an integer greater than 0.

Optionally, before obtaining the first fingerprint of the device to be authenticated, the processing module 710 may also be used to obtain a second fingerprint of the preset device, where the second fingerprint is a reference fingerprint; the transceiver module 720 may also be used to receive the second parameter, the second parameter is associated with the second fingerprint, and the second parameter is at least used to authenticate the device to be authenticated; and the second parameter is sent to the block chain.

Optionally, the second parameter may include a second hash value; the transceiver module 720 may also be configured to receive the second hash value from the interplanetary file system IPFS.

Optionally, the processing module 710 may be further configured to determine that the provisioning device or the second fingerprint has configuration authority, and the configuration authority is at least used to indicate that the second fingerprint is a reference fingerprint.

In an optional implementation manner, the processing module 710 may also be configured to determine that the pre-configured device or the second fingerprint has configuration authority; and perform acquisition and/or configuration operations on the second fingerprint based on the configuration authority.

Exemplarily, the processing module 710 may determine that the provisioning device or the second fingerprint has configuration authority before obtaining the second fingerprint of the provisioning device.

FIG. 8 is an apparatus 800 for device authentication provided by an embodiment of the present application. The device 800 is applied to a block chain, and the device includes: a transceiver module 810 and a processing module 820 . It should be understood that the transceiver module has the capability of sending and/or receiving data.

Wherein, the transceiver module 810 is configured to receive the first parameter sent by the client, and the first parameter is associated with the first fingerprint of the device to be authenticated.

The processing module 820 is configured to authenticate the device to be authenticated according to the first parameter.

Optionally, the first parameter may include a first hash value, and the first hash value may be generated through the interplanetary file system IPFS.

Optionally, before receiving the first parameter sent by the client, the transceiver module 810 may also be configured to receive a second parameter sent by the client, the second parameter is associated with the second fingerprint of the preset device, and the second fingerprint is Referring to the fingerprint; the processing module 820 may also be configured to authenticate the device to be authenticated according to the first parameter and the second parameter.

Optionally, the processing module 820 may also be configured to acquire the first fingerprint and the second fingerprint according to the first parameter and the second parameter; and authenticate the device to be authenticated according to the similarity between the first fingerprint and the second fingerprint.

Optionally, the transceiver module 810 can also be used to receive the first parameter sent by the client at a period of T, where T is an integer greater than 0; the processing module 820 can also be used to receive the first parameter from the client at a period of T. The sent first parameter periodically authenticates the device to be authenticated.

Optionally, the processing module 820 may also be configured to authenticate the device to be authenticated through the smart contract and the first parameter.

Optionally, the processing module 820 may also be configured to perform a processing operation on the authentication result, and the processing operation includes one or more of logging, triggering a warning, and feeding back the authentication result to the client.

FIG. 9 is a device authentication system 900 provided by an embodiment of the present application. As shown in Figure 9, the system 900 includes a device 700 and a device 800, and the device 700 is applied to the client, and can be used to perform related operations corresponding to the client in the method embodiment of the present application. The device 800 is applied to the block The chain can be used to perform related operations corresponding to the blockchain in the method embodiments of this application.

Fig. 10 is an exemplary block diagram of the hardware structure of the device authentication apparatus provided by the embodiment of the present application. Optionally, the apparatus 1000 may specifically be a computer device. The device 1000 includes a memory 1010 , a processor 1020 , a communication interface 1030 and a bus 1040 . Wherein, the memory 1010 , the processor 1020 , and the communication interface 1030 are connected to each other through the bus 1040 .

The memory 1010 may be a read-only memory (read-only memory, ROM), a static storage device, a dynamic storage device or a random access memory (random access memory, RAM). The memory 1010 may store a program, and when the program stored in the memory 1010 is executed by the processor 1020, the processor 1020 is configured to execute each step of the authentication method in the embodiment of the present application.

The processor 1020 may adopt a general-purpose CPU, a microprocessor, an ASIC, a graphics processing unit (graphics processing unit, GPU) or one or more integrated circuits for executing related programs to implement the authentication method of the method embodiment of the present application.

The processor 1020 may also be an integrated circuit chip with signal processing capability. During implementation, the authentication method of the present application may be completed by an integrated logic circuit of hardware in the processor 1020 or instructions in the form of software.

The above-mentioned processor 1020 may also be a general-purpose processor, a digital signal processor (digital signal processor, DSP), ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components. Various methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register. The storage medium is located in the memory 1010, and the processor 1020 reads the information in the memory 1010, and combines its hardware to complete the functions required by the modules included in the device of the embodiment of the present application, or execute the authentication method of the method embodiment of the present application.

The communication interface 1030 implements communication between the apparatus 1000 and other devices or communication networks by using a transceiver device such as but not limited to a transceiver.

Bus 1040 may include pathways for communicating information between various components of device 1000 (eg, memory 1010, processor 1020, communication interface 1030).

The embodiment of the present application also provides an on-vehicle component, including a device for performing related operations corresponding to the client in the method embodiment of the present application.

The embodiment of the present application also provides a vehicle, including an electronic control unit, and the electronic control unit is configured to perform related operations corresponding to the client in the method embodiment of the present application.

The embodiment of the present application also provides a computer-readable storage medium, which is characterized by including instructions; the instructions are used to implement the related operations corresponding to the client in the method embodiments of the application; and/or, to implement the method of the application Related operations corresponding to the blockchain in the embodiment.

The embodiment of the present application also provides a computer program product, which is characterized in that it includes: a computer program that, when the computer program is run, causes the computer to perform the relevant operations corresponding to the client in the method embodiment of the present application; and/or , to execute the relevant operations corresponding to the blockchain in the method embodiment of the present application.

The embodiment of the present application also provides a computing device, including: at least one processor and a memory, the at least one processor is coupled to the memory, and is used to read and execute instructions in the memory to execute the present application The related operations corresponding to the client in the method embodiment; and/or, the execution of the related operation corresponding to the block chain in the method embodiment of the present application.

The embodiment of the present application also provides a chip, the chip includes a processor and a data interface, the processor reads the instructions stored on the memory through the data interface, and executes the instructions corresponding to the client in the method embodiment of the present application. Related operations; and/or, performing related operations corresponding to the blockchain in the method embodiments of the present application.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application. Therefore, the protection scope of the present application should be determined by the protection scope of the claims.

Claims

A device authentication method, characterized in that the method is applied to a client, and the method includes:

Obtain the first fingerprint of the device to be authenticated;

receiving a first parameter, the first parameter is associated with the first fingerprint, and the first parameter is used to at least authenticate the device to be authenticated;

Send the first parameter to the block chain.
The method according to claim 1, wherein the first parameter comprises a first hash value; and the receiving the first parameter comprises:

The first hash value is received from the Interplanetary File System IPFS.
The method according to claim 1 or 2, characterized in that the first fingerprint is associated with the output of the device to be authenticated.
The method according to claim 3, wherein the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals and Ethernet signals.
The method according to any one of claims 1 to 4, wherein said obtaining the first fingerprint of the device to be authenticated comprises:

Acquire the first fingerprint of the device to be authenticated at a period of T, where T is an integer greater than 0.
The method according to any one of claims 1 to 5, wherein, before said obtaining the first fingerprint of the device to be authenticated, said method further comprises:

Obtain a second fingerprint of the preset device, where the second fingerprint is a reference fingerprint;

receiving a second parameter, the second parameter is associated with the second fingerprint, and the second parameter is used to at least authenticate the device to be authenticated;

Send the second parameter to the block chain.
The method according to claim 6, wherein the second parameter comprises a second hash value; and the receiving the second parameter comprises:

The second hash value is received from the Interplanetary File System IPFS.
The method according to claim 6 or 7, wherein the method further comprises:

It is determined that the provisioning device or the second fingerprint has configuration authority, and the configuration authority is at least used to indicate that the second fingerprint is a reference fingerprint.
A device authentication method, characterized in that the method is applied to a block chain, and the method includes:

receiving a first parameter sent by the client, where the first parameter is associated with the first fingerprint of the device to be authenticated;

Authenticate the device to be authenticated according to the first parameter.
The method according to claim 9, wherein the first parameter includes a first hash value, and the first hash value is generated through an interplanetary file system (IPFS).
The method according to claim 9 or 10, characterized in that the first fingerprint is associated with the output of the device to be authenticated.
The method according to claim 11, wherein the output of the device to be authenticated includes one or more of images, videos, distances, speeds, point cloud data, controller area network signals and Ethernet signals.
The method according to any one of claims 9 to 12, wherein before receiving the first parameter sent by the client, the method further comprises:

receiving a second parameter sent by the client, the second parameter is associated with a second fingerprint of the preset device, and the second fingerprint is a reference fingerprint;

The authenticating the device to be authenticated according to the first parameter includes:

Authenticate the device to be authenticated according to the first parameter and the second parameter.
The method according to claim 13, wherein the authenticating the device to be authenticated according to the first parameter and the second parameter comprises:

obtaining the first fingerprint and the second fingerprint according to the first parameter and the second parameter;

Authenticate the device to be authenticated according to the similarity between the first fingerprint and the second fingerprint.
The method according to any one of claims 9 to 14, wherein the first parameter sent by the receiving client includes:

receiving the first parameter sent by the client at a period of T, where T is an integer greater than 0;

The authenticating the device to be authenticated according to the first parameter includes:

Periodically authenticate the device to be authenticated according to the received first parameter sent by the client at a period of T.
The method according to any one of claims 9 to 15, wherein authenticating the device to be authenticated according to the first parameter includes:

Authenticate the device to be authenticated by using the smart contract and the first parameter.
The method according to any one of claims 9 to 16, wherein after the authentication of the device to be authenticated according to the first parameter, the method further comprises:

A processing operation is performed on the authentication result, and the processing operation includes one or more of recording a log, triggering a warning, and feeding back the authentication result to the client.
A device authentication device, characterized in that the device is applied to a client, and the device includes:

A processing module, configured to obtain the first fingerprint of the device to be authenticated;

A transceiver module, configured to receive a first parameter, the first parameter is associated with the first fingerprint, and the first parameter is at least used to authenticate the device to be authenticated;

The transceiver module is further configured to send the first parameter to a block chain.
The apparatus of claim 18, wherein the first fingerprint is associated with an output of the device to be authenticated.
The device according to claim 18 or 19, wherein, before said acquiring the first fingerprint of the device to be authenticated, said processing module is further configured to:

Obtain a second fingerprint of the preset device, where the second fingerprint is a reference fingerprint;

The transceiver module is also configured to receive a second parameter, the second parameter is associated with the second fingerprint, and the second parameter is at least used to authenticate the device to be authenticated; send the second parameter to blockchain.
A device authentication device, characterized in that the device is applied to a block chain, and the device includes:

A transceiver module, configured to receive a first parameter sent by the client, where the first parameter is associated with the first fingerprint of the device to be authenticated;

A processing module, configured to authenticate the device to be authenticated according to the first parameter.
The device according to claim 21, wherein before receiving the first parameter sent by the client, the transceiver module is further configured to:

receiving a second parameter sent by the client, the second parameter is associated with a second fingerprint of the preset device, and the second fingerprint is a reference fingerprint;

The processing module is further configured to authenticate the device to be authenticated according to the first parameter and the second parameter.
The device according to claim 22, wherein the processing module is further configured to:

obtaining the first fingerprint and the second fingerprint according to the first parameter and the second parameter;

Authenticate the device to be authenticated according to the similarity between the first fingerprint and the second fingerprint.
A device authentication device, characterized in that it includes an input and output interface, a processor and a memory, the processor is used to control the input and output interface to send and receive signals or information, the memory is used to store computer programs, and the processor is used to read from the memory call and run the computer program, so that the device authentication device executes the authentication method according to any one of claims 1 to 8; and/or, executes the authentication method according to any one of claims 9 to 17 authentication method.
An authentication system for a device, characterized in that it includes a client for executing the authentication method according to any one of claims 1 to 8 and a client for executing the authentication method according to any one of claims 9 to 17 Blockchain of authentication methods.
An in-vehicle component, characterized by comprising a client for executing the authentication method according to any one of claims 1-8.
A vehicle, characterized by comprising an electronic control unit for executing the authentication method according to any one of claims 1-8.
A chip, characterized in that the chip includes a processor and a data interface, the processor reads instructions stored on the memory through the data interface, and performs the authentication as described in any one of claims 1 to 8 method; and/or, execute the authentication method as described in any one of claims 9-17.
A computer-readable storage medium, characterized by comprising instructions; the instructions are used to implement the authentication method according to any one of claims 1 to 8; and/or, to implement the authentication method according to any one of claims 9 to 17 One of the described authentication methods.
A computer program product, characterized in that it includes: a computer program, when the computer program is executed, the computer executes the authentication method according to any one of claims 1 to 8; and/or executes the authentication method according to any one of claims 1 to 8; The authentication method described in any one of 9 to 17.