WO2023273277A1

WO2023273277A1 - Robot authentication system and method

Info

Publication number: WO2023273277A1
Application number: PCT/CN2021/143775
Authority: WO
Inventors: 李冬; 张跃洋; 谢辉
Original assignee: 达闼机器人股份有限公司
Priority date: 2021-06-29
Filing date: 2021-12-31
Publication date: 2023-01-05
Also published as: CN115225428B; CN115225428A

Abstract

The present disclosure relates to a robot authentication system and method. The system comprises a plurality of virtual private network points of presence (VPN POP), wherein each VPN POP has a robot authentication permission granted by a robot authentication center, and can acquire a blockchain ledger from a blockchain network, the blockchain ledger comprising registration information of registered robots; any VPN POP is used for receiving an authentication request of a target robot, which authentication request comprises first verification information and a verification parameter, and the VPN POP is also used for acquiring, from the blockchain ledger, a target identification code of the target robot according to a target blockchain address in the verification parameter, and for performing calculation according to the verification parameter and the target identification code to obtain second verification information, with the target blockchain address being a blockchain address of the target robot, and the first verification information being obtained by means of the target robot performing calculation on the basis of the verification parameter and the target identification code; and when the first verification information is identical to the second verification information, the target robot passes the authentication of the VPN POP.

Description

System and method for robot authentication

Cross References to Related Applications

This disclosure claims the priority of a Chinese patent application with application number 202110729418.6 and titled "Robot Authentication System and Method" filed with the China Patent Office on June 29, 2021, the entire contents of which are incorporated by reference in this disclosure.

technical field

The present disclosure relates to the technical field of robots, and in particular, to a robot authentication system and method.

Background technique

At present, robots have been more and more widely used in various industries. Moreover, with the development of artificial intelligence technology, the capabilities of robots are becoming stronger and stronger, which in turn leads to the gradual strengthening of the destructiveness brought about by robots when they are illegally invaded.

In order to improve safety, the management and control of the robot can only be carried out after the robot has passed the certification. For example, in related technologies, a robot account and password can be preset in the robot, so that the robot can go to the robot authentication center for authentication through the robot account and password. However, this method still faces security risks, and also increases the burden on the robot certification center.

Contents of the invention

The purpose of the present disclosure is to provide a robot authentication system and method to solve the above related technical problems.

In order to achieve the above object, according to the first aspect of the embodiments of the present disclosure, a robot authentication system is provided, including a plurality of virtual private network service access points VPN POP (Virtual Private Network Point Of Presence, virtual private network service access point) , each VPN POP has the robot authentication authority granted by the robot authentication center, and can obtain the blockchain ledger in the blockchain network, the blockchain ledger includes the registration information of the registered robot, and the registered The information includes a blockchain address of the robot and an identification code corresponding to the blockchain address;

Any one of the VPN POPs is used to receive the authentication request of the target robot, the authentication request includes first verification information and verification parameters, and the target block chain address in the verification parameters is obtained from the block chain ledger. the target identification code of the target robot, and calculate the second verification information according to the verification parameters and the target identification code;

Wherein, the target blockchain address is the blockchain address of the target robot, the first verification information is calculated by the target robot based on the verification parameters and the target identification code, and in the first verification information In the case of the same as the second verification information, the target robot passes the authentication of the VPN POP.

Optionally, the verification parameters include: the target robot's blockchain address, a timestamp, and a random number generated by the target robot;

The target robot is configured to use the target identification code as a key and the verification parameter as calculated data to obtain the first verification information through HMAC-SHA256 algorithm calculation.

Optionally, the VPN POP is also used for:

When the target robot is authenticated by the robot authentication center, send an access token to the target robot and the robot authentication center, so that the robot authentication center sends an access token to the interactive terminal corresponding to the target robot token;

Wherein, the access token is used for the interaction terminal to verify the interaction request of the target robot.

Optionally, the blockchain account book also includes the registration information of the registered VPN POP, the registration information includes the blockchain address of the VPN POP and the public key of the VPN POP, and the robot authentication system Also includes:

A robot certification center, the robot certification center can obtain the block chain account book in the block chain network, and the robot certification center is used to, when receiving the authentication request of the target VPN POP, based on the block chain account book registration information, determine whether the target VPN POP has been registered, and in the case of the target VPN POP registered, carry out two-way authentication with the target VPN POP; wherein, in the case of two-way authentication success, the target VPN POP has robot authentication authority;

The target VPN POP is also used for, when receiving the authentication request of the target robot, if it is determined that the target VPN POP has not succeeded in two-way authentication with the robot authentication center, then sending authentication exception information to the target robot;

The target robot is further configured to, after receiving the authentication exception information, send an authentication request to any VPN POP among the multiple VPN POPs.

Optionally, also include:

The first authentication management terminal, the first authentication management terminal is a block chain node with robot registration authority, and is used to write the registration information in the registration request into the block when receiving the robot registration request chain ledger; and send the startup node information of the block chain network to the robot, wherein the registration information includes the block chain address and identification code of the robot;

The robot is used for storing the starting node information, and accessing the block chain network based on the starting node information.

Optionally, also include:

The second authentication management terminal, the second authentication management terminal is a block chain node with robot registration authority, and is used to generate a private key, a public key, and a block corresponding to the robot when receiving a registration request from the robot. chain address, identification information and identification code; write the public key, blockchain address and identification code into the blockchain ledger as the registration information of the robot; and send the blockchain network to the robot The startup node information, the identification information and the private key;

The robot is used to store the private key, the identification information, and the startup node information, access the blockchain network based on the startup node information, and retrieve the information from the blockchain ledger based on the identification information. Obtain the blockchain address and identification code of the robot.

Optionally, also include:

The third authentication management terminal, the third authentication management terminal is a block chain node with robot cancellation authority, used to determine the robot to be canceled according to the robot identification in the cancellation request when receiving the robot cancellation request, and Updating the registration information of the robot to be canceled in the blockchain account book to the cancellation status.

Optionally, also include:

The fourth authentication management terminal, the fourth authentication management terminal is a block chain node with the registration authority of the robot certification center, and is used to write the registration information in the registration request when receiving the registration request from the robot certification center Into the blockchain account book, the registration information includes the blockchain address and public key of the robot certification center; and/or,

The fifth authentication management terminal, the fifth authentication management terminal is a block chain node with VPN POP registration authority, and is used to write the registration information in the registration request to the In the blockchain ledger, the registration information includes the blockchain address and public key of the VPN POP.

According to the second aspect of the embodiments of the present disclosure, a robot authentication method is provided for a VPN POP, the VPN POP has the robot authentication authority granted by the robot authentication center, and can obtain the blockchain ledger in the blockchain network, The blockchain account book includes the registration information of the registered robot, the registration information includes the blockchain address of the robot and the identification code corresponding to the blockchain address, and the method includes:

receiving an authentication request from a target robot, where the authentication request includes first verification information and verification parameters;

Obtain the target identification code of the target robot from the blockchain account book according to the target blockchain address in the verification parameter, and the target blockchain address is the blockchain address of the target robot;

calculating and obtaining second verification information according to the verification parameter and the target identification code;

If the first verification information is the same as the second verification information, determine that the target robot is authenticated;

Wherein, the first verification information is calculated by the target robot based on the verification parameters and the target identification code.

Optionally, the verification parameters include the target robot's blockchain address, a time stamp, and a random number generated by the target robot, and the second verification information is calculated according to the verification parameters and the target identification code. ,include:

The target identification code is used as a key, and the verification parameter is used as calculated data to obtain the second verification information through HMAC-SHA256 algorithm calculation.

Optionally, the VPN POP obtains the robot authentication authority in the following manner:

Send an identity authentication request to the robot certification center; wherein, the blockchain network includes a robot certification center, and the robot certification center can obtain the blockchain ledger in the blockchain network, and the blockchain ledger Include the registration information of the registered VPN POP, the network authentication request includes the registration verification information of the VPN POP, the registration verification information is used by the robot authentication center to determine whether the VPN POP is registered, and When the POP is registered, initiate a two-way authentication process with the VPN POP;

When the robot authentication center initiates a two-way authentication process, perform two-way authentication with the robot authentication center;

Wherein, in the case that the two-way authentication between the VPN POP and the robot authentication center succeeds, the VPN POP obtains the authentication authority of the robot.

According to a third aspect of an embodiment of the present disclosure, there is provided a robot authentication method for a target robot, the method comprising:

Acquiring verification parameters and the target identification code of the target robot, the verification parameters including the block chain address of the target robot;

calculating and obtaining first verification information according to the verification parameter and the target identification code;

Send an authentication request including the first authentication information and the authentication parameters to any VPN POP in the block chain network;

Wherein, any of the VPN POPs has the robot certification authority granted by the robot certification center, and can obtain the blockchain ledger in the blockchain network, the blockchain ledger includes the registration information of the registered robot, and the The registration information includes the blockchain address of the robot and the identification code corresponding to the blockchain address; the VPN POP obtains the blockchain account book based on the target blockchain address in the verification parameter. The target identification code of the target robot, and calculate the second verification information according to the verification parameters and the target identification code. In the case that the first verification information is the same as the second verification information, the target robot passes Authentication of the VPN POP.

According to a fourth aspect of the embodiments of the present disclosure, there is provided a computer program, including computer readable code, when the computer readable code is run on a computing processing device, the computing processing device is made to perform any of the above-mentioned second aspects. one of the methods described.

According to a fifth aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of any one of the methods described in the above-mentioned second aspect are implemented.

According to a sixth aspect of the embodiments of the present disclosure, there is provided a computing processing device, including:

a memory on which a computer program is stored;

A processor, configured to execute the computer program in the memory, so as to implement the steps of any one of the methods in the second aspect above.

According to a seventh aspect of the embodiments of the present disclosure, there is provided a computer program, including computer readable code, which, when the computer readable code is run on a computing processing device, causes the computing processing device to execute the program described in the third aspect above. described method.

According to an eighth aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the above-mentioned third aspect are implemented.

According to a ninth aspect of the embodiments of the present disclosure, there is provided a computing processing device, including:

a memory on which a computer program is stored;

A processor, configured to execute the computer program in the memory, so as to implement the steps of the method in the above third aspect.

The above technical solution sets multiple VPN POPs in the blockchain network, and each of the VPN POPs has the robot authentication authority granted by the robot authentication center. In this way, any of the VPN POPs can perform network authentication on registered robots, thereby avoiding performance bottlenecks and security risks faced by a single robot authentication center when performing robot authentication.

Moreover, since the registration information of the robot is stored in the blockchain ledger and can be maintained and managed by the blockchain system, the robot certification center no longer needs to maintain the registration information of the robot. Adopting such a method can reduce the complexity of the robot certification center, and also help to improve the reliability of the robot certification center.

Other features and advantages of the present disclosure will be described in detail in the detailed description that follows.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present disclosure, and constitute a part of the description, together with the following specific embodiments, are used to explain the present disclosure, but do not constitute a limitation to the present disclosure. In the attached picture:

Fig. 1 is a schematic diagram of a scenario of robot authentication shown in an exemplary embodiment of the present disclosure.

Fig. 2 is a schematic diagram of a robot authentication system shown in an exemplary embodiment of the present disclosure.

Fig. 3 is a schematic diagram of a robot authentication system shown in an exemplary embodiment of the present disclosure.

Fig. 4 is a flow chart of a robot authentication method shown in an exemplary embodiment of the present disclosure.

Fig. 5 is a flowchart of a robot authentication method shown in an exemplary embodiment of the present disclosure.

Fig. 6 is a schematic structural diagram of a computing processing device shown in an exemplary embodiment of the present disclosure.

Fig. 7 is a schematic diagram of a program code storage unit for implementing the method of the present disclosure shown in an exemplary embodiment of the present disclosure.

Fig. 8 is a schematic structural diagram of a computing processing device shown in an exemplary embodiment of the present disclosure.

Fig. 9 is a schematic diagram of a program code storage unit for implementing the method of the present disclosure shown in an exemplary embodiment of the present disclosure.

detailed description

Specific embodiments of the present disclosure will be described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to illustrate and explain the present disclosure, and are not intended to limit the present disclosure.

Before introducing the robot authentication system and method of the present disclosure, the application scenarios of the present disclosure are firstly introduced, and the various embodiments provided in the present disclosure can be used in robot authentication scenarios, for example.

In order to improve the safety of the robot, the management and control of the robot must be carried out after the robot has passed the certification. In related technologies, a robot account and password can be preset in the robot, so that the robot can go to the robot authentication center for authentication through the robot account and password.

In some implementation scenarios, it is also possible to preset a symmetric key in the robot (the symmetric key is different in each robot), and save the preset symmetric key of the robots within its management scope in the robot certification center. In this way, bots can be authenticated in a manner similar to authentication for mobile network access.

However, in this way, the robot needs to save the robot account information or symmetric key locally, and there is a risk of leakage. To improve security, account information needs to be changed periodically. Moreover, the robot certification center is a centralized component that manages, stores and maintains the account and password information of all robots. Once the robot certification center is out of control, the robot may be counterfeited. At the same time, when the robot certification center stops its service due to related reasons (natural disasters, power outages, etc.), it may also happen that the robot cannot be certified, which will affect business availability. In addition, since all robot certifications are performed in the robot certification center, the complexity of the robot certification center is relatively high. Moreover, in the case of a large number of robots, the robot certification center may also have a performance bottleneck.

To this end, the present disclosure provides a robot authentication system, the system includes a plurality of virtual private network service access points VPN POP, each VPN POP has the robot authentication authority granted by the robot authentication center. Among them, the robot certification center can be set as a node in the blockchain network, for example. Referring to the schematic diagram of a robot authentication scenario shown in Figure 1, the number of VPN POPs can be 3, and each of the VPN POPs can be used as a node in the blockchain network to communicate with other areas in the blockchain network. Block chain nodes (shown as block chain node 1 in the figure) interact.

Through such a setting, the VPN POP can obtain the blockchain ledger in the blockchain network, and the blockchain ledger includes the registration information of the registered robot. Here, the registration information may include, for example, a blockchain address of the robot and an identification code corresponding to the blockchain address. The identification code can be the corresponding PIN (Personal Identification Number, personal identification code) code of each robot, and keep the identification codes between the robots different.

For example, the robot can generate a public key, a private key, and an identification code, and generate a blockchain address based on the public key. In this way, the robot can be registered based on the blockchain address and identification code. After successful registration, the robot's blockchain address and identification code are written into the blockchain ledger.

In some implementation scenarios, the robot's registration information may also include robot-related information, such as robot type, public key, robot ID (Identity document, identity mark), etc., which is not limited in the present disclosure.

Referring to Fig. 1, any one of the VPN POPs is used to receive the authentication request of the target robot, the authentication request includes the first verification information and verification parameters, according to the target blockchain address in the verification parameters from the blockchain account book Obtain the target identification code of the target robot, and calculate the second verification information according to the verification parameters and the target identification code;

Wherein, the target blockchain address is the blockchain address of the target robot, and the first verification information is calculated by the target robot based on the verification parameters and the target identification code. For example, in some implementation scenarios, the verification parameters may include: a target blockchain address, a timestamp, and a random number generated by the target robot;

The target robot is used to use the target identification code as a key and the verification parameter as calculated data to obtain the first verification information through HMAC-SHA256 algorithm calculation.

Specifically, the target robot can obtain its own target blockchain address robot-did, identification code pin-code, and local timestamp timestamp (for example, it can be relative to the timestamp of January 1, 1970 at 0:00:00) , the length is 8 bytes, the unit is millisecond, GMT+00:00), and a random number random (such as 32 bytes) is generated.

After obtaining the above information, the target robot can calculate the HMAC result mac1 (32 bytes) based on the HMAC-SHA256 algorithm, using the pin-code as the HMAC key and random||timestamp||robot-did as the calculated data. as the first verification information. Among them, "||" means splicing.

In this way, the target robot can send an authentication request to the VPN POP, and the authentication request includes the first verification information mac1, the target blockchain address robot-did, random number random and timestamp. Of course, in some scenarios, the robot can also splice mac1, random, timestamp, and robot-id to obtain OTP (One Time Password, one-time password). In this case, the authentication request includes the OTP.

After receiving the authentication request from the target robot, the VPN POP can analyze and obtain the target blockchain address robot-did, random number random and timestamp. And the target identification code of the target robot is obtained from the blockchain ledger based on the target blockchain address. In this way, VPN POP can also be based on the HMAC-SHA256 algorithm, use the obtained pin-code as the HMAC key, use random||timestamp||robot-did as the calculated data, and calculate the HMAC result mac2 as the second verification information .

By comparing the first verification information with the second verification information, the VPN POP can authenticate the target robot. For example, if the first verification information is the same as the second verification information, the target robot is authenticated by the VPN POP. If the first verification information is different from the second verification information, the authentication fails.

It should be noted that, the above embodiments illustrate the robot authentication process of the present disclosure by taking verification parameters as an example of a target blockchain address, a timestamp, and a random number generated by the target robot. Those skilled in the art should know that during specific implementation, the above parameters may also be adjusted accordingly (for example, adding relevant robot information). Meanwhile, the one-way hash function used in HMAC may not be limited to the above example, and a related high-strength one-way hash function (such as SHA-1) may also be used in HMAC, which is not limited in the present disclosure.

The above technical solution sets multiple VPN POPs in the blockchain network, and each of the VPN POPs has the robot authentication authority granted by the robot authentication center. In this way, any of the VPN POPs can perform network authentication on registered robots, thereby avoiding the performance bottleneck problem faced by a single robot authentication center when performing robot authentication and the security risks caused by centralization.

In a possible implementation manner, the VPN POP is also used for:

When the target robot is authenticated by the robot certification center, an access token (access-token) is sent to the target robot and the robot certification center, so that the robot certification center can provide the corresponding The interactive end sends the access token.

Wherein, the robot authentication center may be a system component of the service side, and by sending an access token to the robot authentication center, the robot authentication center may further send an access token to the interaction terminal corresponding to the target robot. The interaction end may be, for example, a robot management system, a business system, etc. involved in the target robot. The access token is used by the interaction terminal to verify the interaction request of the target robot.

In some implementation scenarios, the access token may also correspond to the robot's identity (such as an ID number). In this case, the VPN POP may also send the identity of the target robot and the corresponding access token to the robot authentication center when the target robot is authenticated. Correspondingly, the robot authentication center may send the identity of the target robot and the corresponding access token to the interaction terminal corresponding to the target robot.

In some implementation scenarios, the access token may also include a corresponding validity period, such as 1 hour, 1 day, and so on. During the validity period of the access token, the target robot can interact with the robot interaction terminal through the access token. After the validity of the access token expires, the target robot needs to re-authenticate with the VPN POP according to the above process.

In this way, certified robots can be managed, which helps to improve the safety of the robot.

Fig. 2 is a schematic diagram of a robot authentication system shown in the present disclosure. In some implementation scenarios, the blockchain account book also includes the registration information of the registered VPN POP, and the registration information includes the VPN POP blockchain address and the public key of the VPN POP, the robot authentication system also includes:

A robot certification center, the robot certification center can obtain the block chain account book in the block chain network, and the robot certification center is used to, when receiving the authentication request of the target VPN POP, based on the block chain account book registration information, determine whether the target VPN POP has been registered, and in the case of the target VPN POP registered, carry out two-way authentication with the target VPN POP; wherein, in the case of two-way authentication success, the target VPN POP has robot authentication authority.

For example, the target VPN POP may send a network authentication request to the robot authentication center, and the network authentication request may include, for example, the second block chain address and the second random number A of the target VPN POP. In this way, the robot certification center can query the second blockchain address in the blockchain ledger. In the case that the robot authentication center does not find the address of the second block chain, it can be determined that the target VPN POP is not registered, so that the authentication process can be terminated. When the robot authentication center inquires about the second blockchain address, it can be determined that the target VPN POP has been registered, and then a two-way authentication process can be initiated.

The following is an exemplary description of the two-way authentication process. For example, the robot certification center can send the first random number B and the first blockchain address of the robot certification center to the target VPN POP.

The target VPN POP can receive the first random number B and the first blockchain address, and sign the first random number B based on the private key of the target VPN POP, obtain the signature result SIGN(A), and send SIGN(A) to the Robot Certification Center.

The robot certification center can obtain the public key PK(A) of the target VPN POP by querying the blockchain account book based on the second blockchain address, and decrypt and verify the SIGN(A) through the public key PK(A) . When the decryption fails and/or the decryption result is not the first random number B, the authentication fails and the authentication process is terminated. When the decryption is successful and the decryption result is the first random number B, the authentication is successful. In this way, the robot certification center can sign the second random number A based on its own private key to obtain SIGN (B), and send SIGN (B) to the target VPN POP, so that the target VPN POP can issue a signature to the target VPN POP. Certification by Robot Certification Center.

Correspondingly, the target VPN POP can obtain the public key PK(B) of the robot certification center by querying the blockchain ledger based on the first blockchain address, and use the public key PK(B) to SIGN(B) Perform decryption verification. When the decryption is successful and the decryption result is the second random number A, the authentication is successful. When the decryption fails and/or the decryption result is not the second random number A, the authentication fails.

In the above technical solution, only the VPN POP authenticated by the robot authentication center can authenticate the robot, thereby improving the security of the robot authentication system.

The above embodiments illustrate the two-way authentication process between the target VPN POP of the present disclosure and the robot authentication center. However, those skilled in the art should know that, in actual implementation, there may be multiple ways of performing two-way authentication through an asymmetric cryptographic mechanism (for example, there may be corresponding deformations of two-way authentication ways under different communication standards), for the sake of brevity in the description, The present disclosure will not be repeated here.

Using the above example, the target VPN POP is also used to send authentication exception information to the target robot if it is determined that the target VPN POP has not successfully authenticated with the robot authentication center when receiving the authentication request from the target robot ;

The target robot is also used to send an authentication request to any VPN POP in the plurality of VPN POPs after receiving the authentication exception information.

In this way, the problem of robots being unable to access the VPN network due to the outage of a certain VPN POP can be reduced, and the availability of the system is improved.

In addition, it is worth noting that the robot information, robot certification center information, and VPN POP information recorded in the blockchain ledger are important data for access authentication. Therefore, in some implementation scenarios, related permission control policies may also be set for the process of adding and modifying the robot and the robot certification center.

For example, in a possible implementation manner, authority control may be performed based on a permission chain. In the permission chain, it is possible to restrict whether different blockchain accounts have the permission to write and modify certain data. For example, data write permissions and data modification permissions can be configured for blockchain accounts in OSS (Business Support System, business support system) and/or BSS (Operation Support System, operation support system), and for robots, VPN POP, The blockchain account involved in the robot certification center sets data read permissions.

In some possible implementations, the robot and the relevant data of the robot certification center can also be managed based on the formulated smart contract. For example, corresponding smart contracts can be written to store information through smart contracts. The smart contract can provide interfaces such as registration, modification, cancellation, and query. Among them, assign the call authority of registration, modification, cancellation, query and other interfaces to the blockchain account corresponding to OSS/BSS, and set the blockchain account corresponding to the robot, VPN POP, and robot certification center to have the call of the query interface permission.

In this way, in some implementation scenarios, the system may further include a first authentication management terminal. Referring to the schematic diagram of a robot authentication scenario shown in FIG. 3 , the first authentication management terminal is a blockchain node with robot registration authority, which can correspond to the relevant account of OSS/BSS.

The first authentication management terminal is used to, when receiving a robot registration request, write the registration information in the registration request into the blockchain ledger; and write the startup node information of the blockchain network sent to the robot, wherein the registration information includes the robot's blockchain address and identification code;

The robot is used for saving the starting node information, and accessing the block chain network based on the starting node information.

For example, the robot can generate a public key, a private key, and an identification code, and generate a blockchain address through the public key. In this way, the robot can send a registration request including the blockchain address and the identification code to the first authentication management terminal.

After the first authentication management terminal receives the registration request, it can write the robot's blockchain address and identification code into the blockchain ledger by sending a transaction to the blockchain network, thereby Complete the registration.

Of course, in some implementations, the robot's registration information may also include the robot's type, serial number, public key, and so on. After receiving the registration request, the first authentication management terminal may also verify the relevant information of the robot, which is not limited in the present disclosure.

In addition, the first authentication management terminal can also send the startup node information of the blockchain network to the robot. Correspondingly, the robot can be used to save the starting node information, and access to the blockchain network based on the starting node information.

For example, the robot can connect to the blockchain network through the blockchain connection protocol, light node protocol or RPC according to the recorded starting node information. In this way, after connecting to the blockchain network, the robot can send an authentication request to any VPN POP in the blockchain network, and then perform authentication.

By adopting the above technical solution, the registration process of the robot can be managed by setting the first authentication management terminal, and at the same time, the writing authority of the robot information can be controlled.

In some implementation scenarios, the system further includes a second authentication management terminal, the second authentication management terminal is a blockchain node with robot registration authority, which may correspond to the relevant account of OSS/BSS.

The second authentication management terminal is used to, when receiving the registration request of the robot, generate the private key, public key, block chain address, identification information and identification code corresponding to the robot; The address and the identification code are written into the blockchain account book as the registration information of the robot; and the startup node information, the identification information and the private key of the blockchain network are sent to the robot;

In this way, the robot's public key, blockchain address, identification information, and identification code are generated by relevant nodes of OSS/BSS and saved on the chain. Every time the robot authenticates, it obtains its own blockchain address and identification code from the chain, and then performs authentication.

That is to say, the authentication process of the robot does not require an account password, and the relevant information (blockchain address, identification code, etc.) involved in the authentication process is not maintained locally by the robot. Therefore, the above technical solution avoids the risk of the robot's account leaking, and also reduces the risk of the robot being counterfeited.

In some implementation scenarios, the system may further include a third authentication management terminal. The third authentication management terminal is a block chain node with robot logout authority, which can correspond to the relevant account of OSS/BSS.

The third authentication management terminal is used to, when receiving a robot logout request, determine the robot to be canceled according to the robot identification in the logout request, and store the robot's ID in the block chain ledger The registration information is updated to an invalid state.

Here, the robot logout request may be sent by the relevant robot management terminal or sent by the robot. In some implementation manners, the robot logout request may also be automatically generated by the third authentication management terminal based on preset rules. For example, when a robot is registered, a corresponding valid time interval can be set for each robot, and a robot logout request is automatically generated after the valid time interval is exceeded. The robot identifier in the robot logout request may be, for example, an identifier that can distinguish robots such as a robot number, which is not limited in the present disclosure.

In this way, when the third authentication management terminal receives the robot logout request, it can determine the robot to be logged out according to the robot identifier in the logout request. The third authentication management terminal may also update the registration information of the robot to be canceled in the blockchain ledger to an invalid state by sending a transaction to the blockchain network. Since the registration information is updated to an invalid state, the robot to be deregistered can no longer pass the authentication of the VPN POP.

In this way, the registered robot can be managed based on the third authentication management terminal, and at the same time, the logout authority of the robot information can be controlled.

In a possible implementation manner, the system further includes a fourth authentication management terminal, which is a blockchain node with the registration authority of the robot certification center, which can communicate with the relevant account of the OSS/BSS. correspond.

The fourth authentication management terminal is used to write the registration information in the registration request into the block chain ledger when receiving the registration request from the robot authentication center, the registration information including the robot authentication The central blockchain address and public key.

Exemplarily, the robot certification center can generate a public key and a private key, and generate a blockchain address through the public key. In this way, the robot certification center can send a registration request including the blockchain address and public key to the fourth certification management terminal.

After the fourth authentication management terminal receives the registration request, it can write the blockchain address and public key of the robot certification center into the blockchain ledger by sending a transaction to the blockchain network , to complete the registration.

By adopting the above technical solution, the registration process of the robot certification center can be managed by setting the fourth certification management terminal, and at the same time, the writing authority of the robot certification center information can be controlled.

Similarly, the system may include a fifth authentication management terminal, the fifth authentication management terminal is a block chain node with VPN POP registration authority, and is used to send the registration request to the VPN POP upon receiving the registration request The registration information in is written into the blockchain account book, and the registration information includes the blockchain address and public key of the VPN POP.

It is worth noting that, for the convenience and brevity of description, the embodiments described in the specification belong to preferred embodiments, and the parts involved are not necessarily essential to the present invention. For example, the first authentication management terminal, the second authentication management terminal, etc. may be independent system components or the same system component during specific implementation. In addition, the first authentication management terminal, the second authentication management terminal, etc. may also correspond to relevant blockchain management accounts, and these blockchain management accounts may not correspond to OSS/BSS, which is not limited in this disclosure.

Based on the same inventive concept, the present disclosure also provides a robot authentication method for VPN POP, the VPN POP has the robot authentication authority granted by the robot authentication center, and can obtain the blockchain ledger in the blockchain network, said The blockchain ledger includes the registration information of registered robots.

Here, the registration information may include, for example, a blockchain address of the robot and an identification code corresponding to the blockchain address. The identification code may be a PIN code corresponding to each robot, and the identification codes of the robots shall be kept different.

In some implementation scenarios, the registration information of the robot may also include related information of the robot, such as robot type, public key, robot ID, etc., which is not limited in the present disclosure.

Fig. 4 is a flow chart of a robot authentication method shown in the present disclosure, the method comprising:

S41. Receive an authentication request from the target robot, where the authentication request includes first verification information and verification parameters;

S42. Obtain the target identification code of the target robot from the blockchain ledger according to the target blockchain address in the verification parameter, where the target blockchain address is the blockchain address of the target robot;

S43. Calculate and obtain second verification information according to the verification parameter and the target identification code;

S44. If the first verification information is the same as the second verification information, determine that the target robot has passed the verification;

Exemplarily, the verification parameters may include: a target blockchain address, a timestamp, and a random number generated by the target robot. The target robot calculates the first verification information by using the target identification code as a key and the verification parameter as calculated data through HMAC-SHA256 algorithm.

Moreover, since the registration information of the robot is stored in the blockchain ledger and can be maintained and managed by the blockchain system, the robot certification center no longer needs to maintain the registration information of the robot. In this way, the complexity of the robot certification center can be reduced, and it can also help to improve the reliability of the robot certification center.

In a possible implementation manner, the VPN POP obtains the robot authentication authority in the following manner:

For example, the VPN POP may send a network authentication request to the robot authentication center, and the network authentication request may include, for example, the second blockchain address of the VPN POP and the second random number A. In this way, the robot certification center can query the second blockchain address in the blockchain ledger. In the case that the robot authentication center does not query the address of the second block chain, it can be determined that the VPN POP is not registered, so that the authentication process can be terminated. When the robot authentication center inquires the address of the second blockchain, it can be determined that the VPN POP has been registered, and then a two-way authentication process can be initiated.

The following is an exemplary description of the two-way authentication process. For example, the robot certification center can send the first random number B and the first blockchain address of the robot certification center to the VPN POP.

VPN POP can receive the first random number B and the first blockchain address, and sign the first random number B based on the private key of VPN POP, get the signature result SIGN(A), and send SIGN(A) to the The robot certification center mentioned above.

The robot certification center can obtain the public key PK(A) of the VPN POP by querying the blockchain ledger based on the second blockchain address, and decrypt and verify the SIGN(A) through the public key PK(A). When the decryption fails and/or the decryption result is not the first random number B, the authentication fails and the authentication process is terminated. When the decryption is successful and the decryption result is the first random number B, the authentication is successful. In this way, the robot certification center can sign the second random number A based on its own private key to obtain SIGN (B), and send SIGN (B) to the VPN POP, so that the VPN POP can authenticate the robot Center for certification.

Correspondingly, VPN POP can obtain the public key PK(B) of the robot certification center by querying the blockchain ledger based on the first blockchain address, and perform SIGN(B) verification through the public key PK(B). Decryption verification. When the decryption is successful and the decryption result is the second random number A, the authentication is successful. When the decryption fails and/or the decryption result is not the second random number A, the authentication fails.

In this way, through the authentication between the VPN POP and the robot authentication center, the security of the robot authentication system can be improved.

The present disclosure also provides a robot authentication method for a target robot, and the target robot may be the robot described in the foregoing embodiments. The methods include:

S51. Obtain a verification parameter and a target identification code of the target robot, where the verification parameter includes a blockchain address of the target robot;

S52. Calculate and obtain first verification information according to the verification parameter and the target identification code;

S53, sending an authentication request including the first authentication information and the authentication parameters to any VPN POP in the blockchain network;

Wherein, for the authentication process between the target robot and the VPN POP, please refer to the description of the above-mentioned embodiments, and for the sake of brevity of the description, this disclosure does not repeat it here.

The above technical solution sets multiple VPN POPs in the blockchain network, and each of the VPN POPs has the robot authentication authority granted by the robot authentication center. In this way, any of the VPN POPs can perform network authentication on registered robots, thereby avoiding performance bottlenecks and security risks faced by a single robot authentication center when performing robot authentication. For example, when a VPN POP fails, the target robot can also authenticate through other VPN POPs.

The present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the robot authentication method applied to VPN POP provided by the present disclosure are implemented.

In another exemplary embodiment, there is also provided a computer program product comprising a computer program executable by a programmable device, the computer program having a function for performing the above-mentioned The part of the code that applies to the bot authentication method of VPN POP.

The present disclosure also provides a computing processing device, including:

a memory having computer readable code stored therein; and

One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device executes the steps of the robot authentication method applied to VPN POP provided by the present disclosure.

FIG. 6 is a schematic structural diagram of a computing processing device provided by the present disclosure. The computing processing device may include a processor 610 and a computer program product or computer readable medium in the form of memory 630 . Memory 630 may be electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. The memory 630 may include a storage space 650, which may include program codes for performing any method steps in the methods described above. For example, the storage space 650 may include various program codes 651 for respectively implementing various steps in the above robot authentication method applied to VPN POP. These program codes can be read from or written into one or more computer program products. These computer program products comprise program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as shown in FIG. 7 . The storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 630 in the computing processing device of FIG. 6 . The program code can, for example, be compressed in a suitable form. Here, the memory unit may include computer readable code 651', i.e. code readable by a processor such as 610, which when executed by the server, causes the server to execute the robot described above for VPN POP The individual steps in the authentication method.

The present disclosure also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the robot authentication method applied to a robot provided in the present disclosure are implemented.

In another exemplary embodiment, there is also provided a computer program product comprising a computer program executable by a programmable device, the computer program having a function for performing the above-mentioned The code section of the bot authentication method applied to the bot.

The present disclosure also provides a computing processing device, including:

a memory having computer readable code stored therein; and

One or more processors, when the computer readable code is executed by the one or more processors, the computing processing device executes the steps of the robot authentication method applied to robots provided by the present disclosure.

FIG. 8 is a schematic structural diagram of a computing processing device provided by the present disclosure. The computing processing device may include a processor 810 and a computer program product or computer readable medium in the form of memory 830 . Memory 830 may be electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM. The memory 830 may include a storage space 850, and the storage space 850 may include program codes for performing any method steps in the methods described above. For example, the storage space 850 may include various program codes 851 for respectively implementing various steps in the above robot authentication method applied to a robot. These program codes can be read from or written into one or more computer program products. These computer program products comprise program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as shown in FIG. 9 . The storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 830 in the computing processing device of FIG. 8 . The program code can, for example, be compressed in a suitable form. Here, the storage unit may include computer readable code 851', i.e. code readable by a processor such as 810, which when executed by the server causes the server to perform the robot authentication described above for the robot. steps in the method.

The preferred embodiments of the present disclosure have been described in detail above in conjunction with the accompanying drawings. However, the present disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present disclosure, various simple modifications can be made to the technical solutions of the present disclosure. These simple modifications all belong to the protection scope of the present disclosure.

In addition, it should be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner if there is no contradiction. The combination method will not be described separately.

In addition, various implementations of the present disclosure can be combined arbitrarily, as long as they do not violate the idea of the present disclosure, they should also be regarded as the content disclosed in the present disclosure.

Claims

A robot authentication system is characterized in that it includes a plurality of virtual private network service access points VPN POP, each of the VPN POP has the robot authentication authority granted by the robot authentication center, and can obtain the blocks in the block chain network A chain ledger, the blockchain ledger includes the registration information of the registered robot, and the registration information includes the blockchain address of the robot and the identification code corresponding to the blockchain address;

Any one of the VPN POPs is used to receive the authentication request of the target robot, the authentication request includes first verification information and verification parameters, and the target block chain address in the verification parameters is obtained from the block chain ledger. the target identification code of the target robot, and calculate the second verification information according to the verification parameters and the target identification code;

Wherein, the target blockchain address is the blockchain address of the target robot, the first verification information is calculated by the target robot based on the verification parameters and the target identification code, and in the first verification information In the case of the same as the second verification information, the target robot passes the authentication of the VPN POP.
The robot authentication system according to claim 1, wherein the verification parameters include: a block chain address, a timestamp of the target robot, and a random number generated by the target robot;

The target robot is configured to use the target identification code as a key and the verification parameter as calculated data to obtain the first verification information through HMAC-SHA256 algorithm calculation.
The robot authentication system according to claim 1, wherein the VPN POP is also used for:

When the target robot is authenticated by the robot authentication center, send an access token to the target robot and the robot authentication center, so that the robot authentication center sends an access token to the interactive terminal corresponding to the target robot token;

Wherein, the access token is used for the interaction terminal to verify the interaction request of the target robot.
The robot authentication system according to claim 1, wherein the block chain account book also includes registration information of a registered VPN POP, and the registration information includes the block chain address of the VPN POP and the The public key of the VPN POP, the robot authentication system also includes:

A robot certification center, the robot certification center can obtain the block chain account book in the block chain network, and the robot certification center is used to, when receiving the authentication request of the target VPN POP, based on the block chain account book registration information, determine whether the target VPN POP has been registered, and in the case of the target VPN POP registered, carry out two-way authentication with the target VPN POP; wherein, in the case of two-way authentication success, the target VPN POP has robot authentication authority;

The target VPN POP is also used for, when receiving the authentication request of the target robot, if it is determined that the target VPN POP has not succeeded in two-way authentication with the robot authentication center, then sending authentication exception information to the target robot;

The target robot is further configured to, after receiving the authentication exception information, send an authentication request to any VPN POP among the multiple VPN POPs.
The robot authentication system according to claim 1, further comprising:

The first authentication management terminal, the first authentication management terminal is a block chain node with robot registration authority, and is used to write the registration information in the registration request into the block when receiving the robot registration request chain ledger; and send the startup node information of the block chain network to the robot, wherein the registration information includes the block chain address and identification code of the robot;

The robot is used for saving the starting node information, and accessing the block chain network based on the starting node information.
The robot authentication system according to claim 1, further comprising:

The second authentication management terminal, the second authentication management terminal is a block chain node with robot registration authority, and is used to generate a private key, a public key, and a block corresponding to the robot when receiving a registration request from the robot. chain address, identification information and identification code; write the public key, blockchain address and identification code into the blockchain ledger as the registration information of the robot; and send the blockchain network to the robot The startup node information, the identification information and the private key;

The robot is used to store the private key, the identification information, and the startup node information, access the blockchain network based on the startup node information, and retrieve the information from the blockchain ledger based on the identification information. Obtain the blockchain address and identification code of the robot.
The robot authentication system according to claim 1, further comprising:

The third authentication management terminal, the third authentication management terminal is a block chain node with robot cancellation authority, used to determine the robot to be canceled according to the robot identification in the cancellation request when receiving the robot cancellation request, and Updating the registration information of the robot to be canceled in the blockchain account book to the cancellation status.
The robot authentication system according to claim 1, further comprising:

The fourth authentication management terminal, the fourth authentication management terminal is a block chain node with the registration authority of the robot certification center, and is used to write the registration information in the registration request when receiving the registration request from the robot certification center Into the blockchain account book, the registration information includes the blockchain address and public key of the robot certification center; and/or,

The fifth authentication management terminal, the fifth authentication management terminal is a block chain node with VPN POP registration authority, and is used to write the registration information in the registration request to the In the blockchain ledger, the registration information includes the blockchain address and public key of the VPN POP.
A kind of robot authentication method, it is characterized in that, be used for VPN POP, described VPN POP has the robot authentication authority that robot authentication center grants, and can obtain the block chain account book in the block chain network, in the block chain account book Including the registration information of the registered robot, the registration information includes the block chain address of the robot and the identification code corresponding to the block chain address, the method includes:

receiving an authentication request from a target robot, where the authentication request includes first verification information and verification parameters;

Obtain the target identification code of the target robot from the blockchain account book according to the target blockchain address in the verification parameter, and the target blockchain address is the blockchain address of the target robot;

calculating and obtaining second verification information according to the verification parameter and the target identification code;

If the first verification information is the same as the second verification information, determine that the target robot is authenticated;

Wherein, the first verification information is calculated by the target robot based on the verification parameters and the target identification code.
The method according to claim 9, wherein the verification parameters include the blockchain address of the target robot, a timestamp and a random number generated by the target robot, and according to the verification parameters and the The target identification code is calculated to obtain the second verification information, including:

The target identification code is used as a key, and the verification parameter is used as calculated data to obtain the second verification information through HMAC-SHA256 algorithm calculation.
The method according to claim 9, wherein the VPN POP obtains the robot authentication authority in the following manner:

Send an identity authentication request to the robot certification center; wherein, the blockchain network includes a robot certification center, and the robot certification center can obtain the blockchain ledger in the blockchain network, and the blockchain ledger Including the registration information of the registered VPN POP, the network authentication request includes the registration verification information of the VPN POP, and the registration verification information is used for the robot authentication center to determine whether the VPN POP is registered, and in the VPN When the POP is registered, initiate a two-way authentication process with the VPN POP;

When the robot authentication center initiates a two-way authentication process, perform two-way authentication with the robot authentication center;

Wherein, in the case that the two-way authentication between the VPN POP and the robot authentication center succeeds, the VPN POP obtains the authentication authority of the robot.
A robot authentication method, characterized in that it is used for a target robot, the method comprising:

Acquiring verification parameters and the target identification code of the target robot, the verification parameters including the block chain address of the target robot;

calculating and obtaining first verification information according to the verification parameter and the target identification code;

Send an authentication request including the first authentication information and the authentication parameters to any VPN POP in the block chain network;

Wherein, any of the VPN POPs has the robot certification authority granted by the robot certification center, and can obtain the blockchain ledger in the blockchain network, the blockchain ledger includes the registration information of the registered robot, and the The registration information includes the blockchain address of the robot and the identification code corresponding to the blockchain address; the VPN POP obtains the blockchain account book based on the target blockchain address in the verification parameter. The target identification code of the target robot, and calculate the second verification information according to the verification parameters and the target identification code. In the case that the first verification information is the same as the second verification information, the target robot passes Authentication of the VPN POP.
A computer program, characterized in that it comprises computer readable codes, which, when the computer readable codes are run on a computing processing device, cause the computing processing device to execute the method according to any one of claims 9 to 12 method.
A computer-readable storage medium, on which a computer program is stored, wherein, when the program is executed by a processor, the steps of the method according to any one of claims 9 to 12 are realized.
A computing processing device, characterized in that it includes:

a memory on which a computer program is stored;

A processor configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 9 to 12.