CN114553428A - Credible verification system, device, storage medium and electronic equipment - Google Patents
Credible verification system, device, storage medium and electronic equipment Download PDFInfo
- Publication number
- CN114553428A CN114553428A CN202210026527.6A CN202210026527A CN114553428A CN 114553428 A CN114553428 A CN 114553428A CN 202210026527 A CN202210026527 A CN 202210026527A CN 114553428 A CN114553428 A CN 114553428A
- Authority
- CN
- China
- Prior art keywords
- server
- exchange key
- equipment
- signature information
- key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
- H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The specification discloses a credibility verification system, a device, a storage medium and an electronic device, wherein the credibility verification system comprises a server and an unmanned device, the unmanned device carries a first device and a second device, the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device. The first device generates an exchange key and sends the exchange key to the second device, and the second device signs the exchange key by adopting a stored private key of the first device to obtain signature information and sends the signature information to the first device. The first device sends the exchange key and the signature information to the server, and the server verifies the signature information. And after the signature information is verified, communicating with the first device by adopting the exchange key. In the system, for the trusted device and the untrusted device carried on the same unmanned device, the private key of the untrusted device is stored in the trusted device, and the security of the private key of the untrusted device is protected while the communication between the first device and the server is not influenced.
Description
Technical Field
The present disclosure relates to the field of unmanned technologies, and in particular, to a trusted verification system, device, storage medium, and electronic device.
Background
During a test phase and/or a use phase of the drone, various devices are typically mounted on the drone. Among them, devices mounted on the unmanned device are generally classified into: trusted devices with trusted computing capabilities, untrusted devices without trusted computing capabilities. Where the trusted device is in a secure, trusted environment and the untrusted device is in an unsecure, normal environment. In actual operation, the number of trusted devices mounted on the unmanned device is usually small, and an untrusted device without trusted computing capability is difficult to install in a trusted computing environment, so that the untrusted device cannot have trusted computing capability.
In the process of operating the unmanned equipment, when each piece of equipment carried on the unmanned equipment needs to communicate with the server, the identity certificate of the equipment needs to be used for carrying out identity verification with the server, wherein the identity certificate mainly comprises a private key of the equipment. In the prior art, the identity credential of each device, i.e. the private key, is usually stored in the device itself.
It is difficult for an attacker to steal the private key stored in the trusted device. For the untrusted device, because the untrusted device is in an insecure ordinary environment, an attacker can steal the private key stored in the untrusted device by using methods such as side channel attack.
Disclosure of Invention
The present specification provides a trusted verification system, method and device to partially solve the above problems in the prior art.
The technical scheme adopted by the specification is as follows:
the present specification provides a trusted verification system for unmanned driving, comprising:
the trusted verification system comprises: a server, an unmanned device; the unmanned equipment is provided with a first device and a second device; the first device is an untrusted device, and the second device is a trusted device; the private key of the first device is stored in the second device;
the first device is used for generating an exchange key and sending the exchange key to the second device; after signature information sent by the second device is received, sending the exchange key and the signature information to the server;
the second device is configured to, when receiving the exchange key sent by the first device, sign the exchange key by using the stored private key of the first device to obtain signature information, and send the signature information to the first device;
the server is used for verifying the signature information when receiving the exchange key and the signature information sent by the first equipment; and after the signature information is verified, communicating with the first equipment by adopting the exchange key.
Optionally, the server is further configured to send, to the first device, a public key of the server when establishing a communication connection with the first device;
the first device is configured to encrypt the exchange key by using the received public key of the server, and send the encrypted exchange key to the second device;
and the second device is used for signing the encrypted exchange key by adopting the stored private key of the first device to obtain signature information.
Optionally, the server is configured to verify the signature information when receiving the encrypted exchange key and the signature information sent by the first device; and after the signature information passes the verification, decrypting the encrypted exchange key by using the private key of the server, and communicating with the first equipment by using the decrypted exchange key.
Optionally, the server is further configured to send a digital certificate of the server to the first device;
and the first equipment is used for carrying out identity authentication on the server according to the digital certificate of the server when the digital certificate of the server is received, and generating an exchange key after the identity authentication of the server is passed.
Optionally, the first device is configured to send the digital certificate of the first device, the digital certificate of the server, and the exchange key to the second device;
the second device is used for performing identity authentication on the first device according to the digital certificate of the first device and performing identity authentication on the server according to the digital certificate of the server; and after the first equipment and the server pass the authentication, encrypting the exchange key by adopting a stored private key of the first equipment.
The specification provides a credibility verification method, wherein unmanned equipment is provided with first equipment and second equipment; the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device; the method is used for a first device, and comprises the following steps:
generating an exchange key, sending the exchange key to the second device, enabling the second device to sign the exchange key by using the stored private key of the first device to obtain signature information, and sending the signature information to the first device;
and responding to the received signature information sent by the second equipment, sending the exchange key and the signature information to the server, verifying the signature information after the server receives the exchange key and the signature information, and communicating with the first equipment by adopting the exchange key after the signature information passes verification.
Optionally, before sending the exchange key to the second device, the method further includes:
receiving the public key of the server, and encrypting the exchange key by adopting the received public key of the server;
sending the exchange key to the second device, specifically including:
and sending the encrypted exchange key to the second equipment, so that the second equipment adopts the private key of the first equipment to sign the encrypted exchange key.
Optionally, generating the exchange key specifically includes:
receiving the digital certificate of the server, and performing identity authentication on the server according to the digital certificate of the server;
and after the server passes the authentication, generating an exchange key.
Optionally, sending the exchange key to the second device specifically includes:
and sending the digital certificate of the first equipment, the digital certificate of the server and the exchange key to the second equipment, so that the second equipment performs identity verification on the first equipment according to the digital certificate of the first equipment, performs identity verification on the server according to the digital certificate of the server, and signs the exchange key by using a stored private key of the first equipment after the identity verification of the first equipment and the server is passed.
The present specification provides a trusted verification method, in which an unmanned device is provided with a first device and a second device; the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device; the method is used for a second device, and the method comprises the following steps:
in response to the received exchange key sent by the first device, signing the exchange key by using a stored private key of the first device to obtain signature information;
and sending the signature information to the first equipment, so that the first equipment sends the received signature information and the exchange key to a server, the server verifies the signature information conveniently, and after the signature information passes the verification, the exchange key is adopted to communicate with the first equipment.
Optionally, in response to the received exchange key sent by the first device, signing the exchange key by using the stored private key of the first device, specifically including:
in response to the received digital certificate of the first device, the digital certificate of the server and the exchange key, which are sent by the first device, the first device is authenticated according to the digital certificate of the first device, and the server is authenticated according to the digital certificate of the server;
and after the first equipment and the server pass the identity verification, signing the exchange key by adopting the stored private key of the first equipment.
This specification provides a trusted authentication device comprising:
the generation module is used for generating an exchange key, sending the exchange key to the second equipment, enabling the second equipment to sign the exchange key by adopting a stored private key of the first equipment to obtain signature information, and sending the signature information to the first equipment;
and the first sending module is used for responding to the received signature information sent by the second equipment, sending the exchange key and the signature information to the server, verifying the signature information after the server receives the exchange key and the signature information, and communicating with the first equipment by adopting the exchange key after the signature information is verified.
This specification provides a trusted authentication device comprising:
the receiving module is used for responding to the received exchange key sent by the first equipment, and signing the exchange key by adopting a stored private key of the first equipment to obtain signature information;
and the second sending module is used for sending the signature information to the first equipment, so that the first equipment sends the received signature information and the exchange key to the server, the server can verify the signature information conveniently, and after the signature information passes the verification, the exchange key is adopted to communicate with the first equipment.
The present specification provides a computer-readable storage medium storing a computer program which, when executed by a processor, implements the above-described trusted authentication method.
The present specification provides an unmanned device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the above trusted authentication method when executing the program.
The technical scheme adopted by the specification can achieve the following beneficial effects:
the trusted verification system for unmanned driving provided in this specification includes a server and an unmanned device, where the unmanned device carries a first device and a second device, where the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device. Before the first device establishes communication with the server, the first device generates an exchange key and sends the exchange key to the second device, the second device obtains signature information after signing the exchange key by adopting a stored private key of the first device, and the second device sends the signature information to the first device. The first device sends the exchange key and the signature information to the server, the server verifies the signature information, and after the signature information is verified, the exchange key is adopted to communicate with the first device.
It can be seen from the above system that, in order to avoid the private key stored in the untrusted device from being stolen by an attacker, in the system, for the trusted device and the untrusted device mounted on the same unmanned device, the private key of the untrusted device is stored in the trusted device, which does not affect the establishment of the communication connection between the first device and the server, i.e., the private key of the first device can still be used normally to sign the exchange key, and meanwhile, the private key of the untrusted device can be stored in a secure trusted environment all the time, thereby protecting the private key of the untrusted device from being stolen by the attacker.
Drawings
The accompanying drawings, which are included to provide a further understanding of the specification and are incorporated in and constitute a part of this specification, illustrate embodiments of the specification and together with the description serve to explain the specification and not to limit the specification in a non-limiting sense. In the drawings:
FIG. 1 is a schematic flow chart of a trusted authentication system according to the present disclosure;
FIG. 2 is a schematic diagram of a trusted authentication unit provided herein;
FIG. 3 is a schematic diagram of a trusted authentication unit provided herein;
fig. 4 is a schematic diagram of an electronic device corresponding to fig. 1 provided in the present specification.
Detailed Description
In order to make the objects, technical solutions and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below with reference to the specific embodiments of the present disclosure and the accompanying drawings. It is to be understood that the embodiments described are only a few embodiments of the present disclosure, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present specification without any creative effort belong to the protection scope of the present specification.
When the unmanned device operates, each device mounted on the unmanned device needs to communicate with the server, and in the prior art, the process of establishing communication between the device and the server is as follows: first, the device transmits a connection request for establishing a communication connection to the server, and the server transmits a digital certificate of the server itself to the device upon receiving the connection request transmitted by the device. After receiving the digital certificate of the server, the equipment firstly verifies the identity of the server according to the digital certificate of the server, generates an exchange key after the identity of the server passes the verification, signs the exchange key by using a private key of the equipment to obtain signature information, and can send the exchange key and the signature information to the server. And then, after receiving the exchange key and the signature information sent by the equipment, the server verifies the signature information, and after the signature information is verified, the server can communicate with the equipment by adopting the exchange key.
Devices mounted on unmanned equipment are generally classified into: the trusted device and the untrusted device. A trusted device refers to a device with trusted computing capabilities that is in a secure, trusted environment, and an untrusted device refers to a device without trusted computing capabilities that is in an unsecure, normal environment.
In this case, the trusted computing can improve the security of the device, and therefore, it can be understood that, in actual operation, a trusted device having trusted computing capability and being in a secure trusted environment is not easily stolen by an attacker to any data stored therein, for example, a private key, whereas data stored in an untrusted device not having trusted computing capability and being in an unsecure ordinary environment is often easily stolen by the attacker.
In general, the number of trusted devices installed on the unmanned device is small, and the untrusted device is difficult to install a trusted environment in the subsequent process, so that the untrusted device cannot be converted into a trusted device.
In order to solve the above problem, the present specification provides a trusted verification system, which stores a private key of an untrusted device in a trusted device mounted on an unmanned device, so that the private key of the untrusted device is always in a secure trusted environment, in order to avoid an attacker from stealing the private key of the untrusted device mounted on the unmanned device.
The technical solutions provided by the embodiments of the present description are described in detail below with reference to the accompanying drawings.
Fig. 1 is a schematic flowchart of a trusted authentication process in this specification, which specifically includes the following steps:
s100: the first device generates an exchange key.
S102: the first device sends the exchange key to the second device.
Because the private key stored in the trusted device is difficult to be stolen by an attacker, and the private key stored in the untrusted device is often easy to be stolen by the attacker, based on this, the core thought of the trusted verification method provided in the specification is as follows: the private key of the untrusted device is stored in the trusted device, so that the private key is always in a safe trusted environment, and the private key of the untrusted device can be prevented from being stolen by an attacker.
Based on the core idea, the present specification provides a trusted verification system for unmanned driving, wherein the trusted verification system comprises: the system comprises a server and the unmanned equipment, wherein the unmanned equipment is provided with first equipment and second equipment, the first equipment is untrusted equipment, the second equipment is trusted equipment, and a private key of the first equipment is stored in the second equipment.
The unmanned device mentioned in the present specification may refer to a device capable of realizing automatic driving, such as an unmanned vehicle, an unmanned aerial vehicle, a robot, and an automatic distribution device. Based on this, the unmanned device to which the method of credibility verification provided by this specification is applied can be used for executing delivery tasks in the delivery field, such as business scenes of deliveries, logistics, takeaway and the like using the unmanned device.
The first device may generate an exchange key during the process of establishing communication with the server. After the first device establishes communication connection with the server, the first device and the server can use the exchange key for encrypting/decrypting data to be exchanged.
Since the exchange key needs to be signed by the private key of the first device before being sent to the exchange key sending server, and the private key of the first device is stored in the second device, the first device may send the exchange key generated in step S100 to the second device, so that the second device signs the exchange key by using the stored private key of the first device.
It should be noted that the first device and the second device are not a specific device mounted on the unmanned device, the first device may be any untrusted device mounted on the unmanned device, and the second device may be any trusted device mounted on the unmanned device where the first device is located.
S104: and the second equipment signs the exchange key by adopting the stored private key of the first equipment to obtain signature information.
S106: the second device sends the signature information to the first device.
When the second device receives the exchange key sent by the first device, the second device may sign the exchange key by using the private key of the first device stored in the second device, and may obtain signature information, and then the second device may send the signature information to the first device.
S108: the first device sends the exchange key and the signature information to a server.
The first device may send the exchange key and the signature information to the server after receiving the signature information sent by the second device.
S110: and the server verifies the signature information and adopts the exchange key to communicate with the first equipment after the signature information passes the verification.
The server may verify the signature information after receiving the signature information and the exchange key sent by the first device, specifically, the server may decrypt the signature information with the public key of the first device, compare the decrypted signature information with the exchange key, and if the decrypted signature information is consistent with the exchange key, the signature information is verified. After the signature information is verified, the server may use the exchange key to communicate with the first device, that is, encrypt and decrypt the information to be transmitted by using the exchange key during communication.
And if the decrypted signature information is inconsistent with the content of the exchange key, determining that the signature information is not verified, and failing to establish communication connection between the server and the first equipment.
As can be seen from the trusted verification system shown in fig. 1, in the prior art, the private key of each device is usually stored in itself, and when the device is in an insecure untrusted environment, the private key stored in itself is easily stolen by an attacker. Therefore, in the description, the private key of the untrusted device is stored in the trusted device, so that the private key is always stored in the secure trusted environment, thereby avoiding the theft of an attacker and ensuring the security of the private key. In addition, in the process of establishing communication between the first device and the server, the private key of the first device can still be normally adopted to sign the exchange key, and the establishment of communication connection between the first device and the server is not influenced.
Further, in order to ensure communication security, when the first device is in communication connection with the server, the public key of the server may be used to encrypt the exchange key generated in step S100, the first device may send the encrypted exchange key to the second device, and when the second device receives the encrypted exchange key sent by the first device, the second device may sign the encrypted exchange key with the stored private key of the first device to obtain signature information, and then the second device may send the signature information to the first device, and the first device may send the encrypted exchange key and the signature information to the server. The server verifies the signature information when receiving the encrypted exchange key and the signature information sent by the first device, after the signature information is verified, the server can decrypt the encrypted exchange key by using a private key of the server, and then the first device and the server can communicate by using the decrypted exchange key.
The method for acquiring the public key of the server by the first device may include: the server actively sends the public key of the server to the first device, which may further include: the first device acquires the public key of the server from a Certificate Authority (CA), and may also acquire the public key of the server by using other acquisition manners, which is not limited in this specification.
In addition, in order to ensure communication security, during the process of establishing a communication connection between the first device and the server, the first device, the server and the second device may verify the identity of the sender before performing the steps of the trusted verification method. Specifically, when establishing the communication connection, the first device may first send a connection request for establishing the communication connection to the server, and after receiving the connection request sent by the first device, the server sends the digital certificate of the server to the first device, and at the same time, requests the digital certificate of the first device from the first device. After receiving the digital certificate of the server, the first device may perform authentication on the server according to the digital certificate of the server, and after the authentication of the server is passed, perform step S100, that is, generate the exchange key. Similarly, when the first device sends the exchange key to the second device, the digital certificate of the first device and the digital certificate of the server may be sent to the second device at the same time.
When the second device receives the digital certificate of the first device, the digital certificate of the server and the exchange key sent by the first device, the second device can perform identity authentication on the first device according to the digital certificate of the first device and perform identity authentication on the server according to the digital certificate of the server. And after the first device and the server pass the authentication, executing step S104, namely signing the exchange key by using the stored private key of the first device to obtain signature information, and sending the signature information to the first device. Similarly, the first device may send the digital certificate of the first device, the exchange key, and the signature information to the server after receiving the signature information sent by the second device.
When receiving the exchange key, the signature information, and the digital certificate of the first device sent by the first device, the server may perform authentication on the first device according to the digital certificate of the first device, and after the authentication of the first device is passed, perform step S110, that is, verify the signature information. After the signature information is verified, the server may establish a communication with the first device using the exchange key.
It should be noted that, in the process of establishing or communicating with the server, the untrusted device mounted on the unmanned device may use, in addition to the private Key of the untrusted device, other identity credentials such as a user name, a password, an Access Key ID (AK), and a Secret Access Key (SK) of the untrusted device. In order to avoid the private key and other identity credentials of the untrusted device from being stolen by an attacker, in this specification, the private key and the identity credentials of the untrusted device may be stored in the trusted device, where the trusted device and the untrusted device are mounted on the same unmanned device.
Based on the same idea, the above trust verification method provided for one or more embodiments of the present specification further provides a corresponding trust verification apparatus, as shown in fig. 2.
Fig. 2 is a schematic diagram of a trusted verification apparatus provided in this specification, which specifically includes:
a generating module 201 and a first sending module 202, wherein:
a generating module 201, configured to generate an exchange key, send the exchange key to the second device, enable the second device to sign the exchange key by using the stored private key of the first device, obtain signature information, and send the signature information to the first device;
a first sending module 202, configured to send the exchange key and the signature information to the server in response to the received signature information sent by the second device, so that the server verifies the signature information after receiving the exchange key and the signature information, and after the signature information passes verification, communicates with the first device using the exchange key.
Optionally, the generating module 201 is further configured to receive a public key of the server, and encrypt the exchange key by using the received public key of the server; the generating module 201 is specifically configured to send the encrypted exchange key to the second device, so that the second device signs the encrypted exchange key by using the private key of the first device.
Optionally, the generating module 201 is specifically configured to receive the digital certificate of the server, and perform identity authentication on the server according to the digital certificate of the server; and after the server passes the authentication, generating an exchange key.
Optionally, the first sending module 202 is specifically configured to send the digital certificate of the first device, the digital certificate of the server, and the exchange key to the second device, so that the second device performs identity verification on the first device according to the digital certificate of the first device, performs identity verification on the server according to the digital certificate of the server, and after the identity verification of the first device and the server is passed, signs the exchange key with a stored private key of the first device.
Based on the same idea, the above trust verification method provided for one or more embodiments of the present specification further provides a corresponding trust verification apparatus, as shown in fig. 3.
Fig. 3 is a schematic diagram of a trusted verification apparatus provided in this specification, which specifically includes:
a receiving module 301 and a second sending module 302, wherein:
a receiving module 301, configured to respond to a received exchange key sent by the first device, and sign the exchange key by using a stored private key of the first device to obtain signature information;
a second sending module 302, configured to send the signature information to the first device, so that the first device sends the received signature information and the exchange key to a server, so that the server verifies the signature information, and after the signature information passes verification, communicates with the first device by using the exchange key.
Optionally, the receiving module 301 is specifically configured to, in response to the received digital certificate of the first device, the digital certificate of the server, and the exchange key, perform identity authentication on the first device according to the digital certificate of the first device, and perform identity authentication on the server according to the digital certificate of the server; and after the first equipment and the server pass the identity verification, signing the exchange key by adopting the stored private key of the first equipment.
The present specification also provides a computer-readable storage medium having stored thereon a computer program operable to execute the trusted authentication method provided in figure 1 above.
This specification also provides a schematic block diagram of the electronic device shown in fig. 4. As shown in fig. 4, the drone includes, at the hardware level, a processor, an internal bus, a network interface, a memory, and a non-volatile memory, although it may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs the computer program to implement the above-described trusted authentication method of fig. 1. Of course, besides the software implementation, the present specification does not exclude other implementations, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logic unit, and may be hardware or logic devices.
In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD), such as a Field Programmable Gate Array (FPGA), is an integrated circuit whose Logic functions are determined by programming the Device by a user. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Hardware Description Language), traffic, pl (core universal Programming Language), HDCal (jhdware Description Language), lang, Lola, HDL, laspam, hardward Description Language (vhr Description Language), vhal (Hardware Description Language), and vhigh-Language, which are currently used in most common. It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.
The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic for the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may thus be considered a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functions of the various elements may be implemented in the same one or more software and/or hardware implementations of the present description.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
As will be appreciated by one skilled in the art, embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
This description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
The above description is only an example of the present specification, and is not intended to limit the present specification. Various modifications and alterations to this description will become apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification.
Claims (15)
1. A trusted verification system for unmanned driving, the trusted verification system comprising: a server, an unmanned device; the unmanned equipment is provided with a first device and a second device; the first device is an untrusted device, and the second device is a trusted device; the private key of the first device is stored in the second device;
the first device is used for generating an exchange key and sending the exchange key to the second device; after signature information sent by the second device is received, sending the exchange key and the signature information to the server;
the second device is configured to, when receiving the exchange key sent by the first device, sign the exchange key by using the stored private key of the first device to obtain signature information, and send the signature information to the first device;
the server is used for verifying the signature information when receiving the exchange key and the signature information sent by the first equipment; and after the signature information is verified, communicating with the first equipment by adopting the exchange key.
2. The trusted verification system of claim 1, wherein the server is further configured to send a public key of the server to the first device upon establishing a communication connection with the first device;
the first device is configured to encrypt the exchange key by using the received public key of the server, and send the encrypted exchange key to the second device;
and the second device is used for signing the encrypted exchange key by adopting the stored private key of the first device to obtain signature information.
3. The trusted verification system of claim 2, wherein the server is configured to verify the signature information upon receiving the encrypted exchange key and the signature information sent by the first device; and after the signature information passes the verification, decrypting the encrypted exchange key by using the private key of the server, and communicating with the first equipment by using the decrypted exchange key.
4. The trusted verification system of claim 1, wherein the server is further configured to send a digital certificate of the server to the first device;
the first device is configured to, when the digital certificate of the server is received, perform authentication on the server according to the digital certificate of the server, and generate an exchange key after the authentication of the server is passed.
5. The trusted verification system of claim 1, wherein the first device is to send the digital certificate of the first device, the digital certificate of the server, and the exchange key to the second device;
the second device is used for performing identity authentication on the first device according to the digital certificate of the first device and performing identity authentication on the server according to the digital certificate of the server; and after the first equipment and the server pass the authentication, encrypting the exchange key by adopting a stored private key of the first equipment.
6. A credibility verification method is characterized in that unmanned equipment is provided with a first device and a second device; the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device; the method is used for a first device, and comprises the following steps:
generating an exchange key, sending the exchange key to the second device, enabling the second device to sign the exchange key by using the stored private key of the first device to obtain signature information, and sending the signature information to the first device;
and responding to the received signature information sent by the second equipment, sending the exchange key and the signature information to a server, verifying the signature information after the server receives the exchange key and the signature information, and communicating with the first equipment by adopting the exchange key after the signature information passes verification.
7. The method of claim 6, wherein prior to sending the exchange key to the second device, the method further comprises:
receiving the public key of the server, and encrypting the exchange key by adopting the received public key of the server;
sending the exchange key to the second device, specifically including:
and sending the encrypted exchange key to the second equipment, so that the second equipment adopts the private key of the first equipment to sign the encrypted exchange key.
8. The method of claim 6, wherein generating the exchange key comprises:
receiving the digital certificate of the server, and performing identity authentication on the server according to the digital certificate of the server;
and after the server passes the authentication, generating an exchange key.
9. The method of claim 6, wherein sending the exchange key to the second device specifically comprises:
and sending the digital certificate of the first equipment, the digital certificate of the server and the exchange key to the second equipment, so that the second equipment performs identity verification on the first equipment according to the digital certificate of the first equipment and performs identity verification on the server according to the digital certificate of the server, and after the identity verification of the first equipment and the server is passed, signing the exchange key by adopting a stored private key of the first equipment.
10. A credibility verification method is characterized in that unmanned equipment is provided with a first device and a second device; the first device is an untrusted device, the second device is a trusted device, and a private key of the first device is stored in the second device; the method is for a second device, the method comprising:
in response to the received exchange key sent by the first device, signing the exchange key by adopting the stored private key of the first device to obtain signature information;
and sending the signature information to the first equipment, so that the first equipment sends the received signature information and the exchange key to a server, the server verifies the signature information conveniently, and after the signature information passes the verification, the exchange key is adopted to communicate with the first equipment.
11. The method of claim 10, wherein signing the exchange key with the stored private key of the first device in response to receiving the exchange key sent by the first device comprises:
responding to the received digital certificate of the first equipment, the digital certificate of the server and the exchange key which are sent by the first equipment, and performing identity verification on the first equipment according to the digital certificate of the first equipment and performing identity verification on the server according to the digital certificate of the server;
and after the first equipment and the server pass the identity verification, signing the exchange key by adopting the stored private key of the first equipment.
12. A trusted authentication apparatus, comprising:
the generation module is used for generating an exchange key, sending the exchange key to second equipment, enabling the second equipment to sign the exchange key by adopting a stored private key of the first equipment to obtain signature information, and sending the signature information to the first equipment;
and the first sending module is used for responding to the received signature information sent by the second equipment, sending the exchange key and the signature information to a server, verifying the signature information after the server receives the exchange key and the signature information, and communicating with the first equipment by adopting the exchange key after the signature information is verified.
13. A trusted authentication apparatus, comprising:
the receiving module is used for responding to the received exchange key sent by the first equipment, adopting the stored private key of the first equipment to sign the exchange key, and obtaining signature information;
and the second sending module is used for sending the signature information to the first equipment, so that the first equipment sends the received signature information and the exchange key to the server, the server can verify the signature information conveniently, and after the signature information passes the verification, the exchange key is adopted to communicate with the first equipment.
14. A computer-readable storage medium, characterized in that the storage medium stores a computer program which, when executed by a processor, implements the method of any of the preceding claims 6 to 11.
15. An unmanned aerial device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor when executing the program implements the method of any of claims 6 to 11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210026527.6A CN114553428B (en) | 2022-01-11 | 2022-01-11 | Trusted verification system, trusted verification device, trusted verification storage medium and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210026527.6A CN114553428B (en) | 2022-01-11 | 2022-01-11 | Trusted verification system, trusted verification device, trusted verification storage medium and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114553428A true CN114553428A (en) | 2022-05-27 |
| CN114553428B CN114553428B (en) | 2023-09-22 |
Family
ID=81669002
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210026527.6A Active CN114553428B (en) | 2022-01-11 | 2022-01-11 | Trusted verification system, trusted verification device, trusted verification storage medium and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114553428B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009051471A2 (en) * | 2007-09-20 | 2009-04-23 | Mimos Berhad | Trusted computer platform method and system without trust credential |
| US20100191973A1 (en) * | 2009-01-27 | 2010-07-29 | Gm Global Technology Operations, Inc. | System and method for establishing a secure connection with a mobile device |
| CN102428675A (en) * | 2009-05-20 | 2012-04-25 | 微软公司 | Portable secure computing network |
| CN105450406A (en) * | 2014-07-25 | 2016-03-30 | 华为技术有限公司 | Data processing method and device |
| US20200084042A1 (en) * | 2018-09-10 | 2020-03-12 | Dell Products L.P. | Information handling system entitlement validation |
| US20210092604A1 (en) * | 2018-09-05 | 2021-03-25 | Whitefox Defense Technologies, Inc. | Integrated secure device manager systems and methods for cyber-physical vehicles |
-
2022
- 2022-01-11 CN CN202210026527.6A patent/CN114553428B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2009051471A2 (en) * | 2007-09-20 | 2009-04-23 | Mimos Berhad | Trusted computer platform method and system without trust credential |
| US20100191973A1 (en) * | 2009-01-27 | 2010-07-29 | Gm Global Technology Operations, Inc. | System and method for establishing a secure connection with a mobile device |
| CN102428675A (en) * | 2009-05-20 | 2012-04-25 | 微软公司 | Portable secure computing network |
| CN105450406A (en) * | 2014-07-25 | 2016-03-30 | 华为技术有限公司 | Data processing method and device |
| US20210092604A1 (en) * | 2018-09-05 | 2021-03-25 | Whitefox Defense Technologies, Inc. | Integrated secure device manager systems and methods for cyber-physical vehicles |
| US20200084042A1 (en) * | 2018-09-10 | 2020-03-12 | Dell Products L.P. | Information handling system entitlement validation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114553428B (en) | 2023-09-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107743133B (en) | Mobile terminal and access control method and system based on trusted security environment | |
| US10614216B2 (en) | Paravirtualized security threat protection of a computer-driven system with networked devices | |
| CN111680305B (en) | Data processing method, device and equipment based on block chain | |
| CN110222531B (en) | Method, system and equipment for accessing database | |
| KR101641809B1 (en) | Method and system for distributed off-line logon using one-time passwords | |
| US9515832B2 (en) | Process authentication and resource permissions | |
| CN106899571B (en) | Information interaction method and device | |
| KR102361884B1 (en) | Use of hardware-based security isolation areas to prevent piracy and piracy of electronic devices | |
| US20150244711A1 (en) | Method and apparatus for authenticating client credentials | |
| CN113010870B (en) | Service processing method, device and equipment based on digital certificate | |
| WO2002060121A1 (en) | A platform and method for securely transmitting authorization data | |
| US11520859B2 (en) | Display of protected content using trusted execution environment | |
| CN113704826A (en) | Privacy protection-based business risk detection method, device and equipment | |
| EP3885954B1 (en) | Security reinforcement architecture, encryption and decryption method, car networking terminal, and vehicle | |
| WO2022052665A1 (en) | Wireless terminal and interface access authentication method for wireless terminal in uboot mode | |
| WO2024152798A1 (en) | Data risk assessment method and apparatus, storage medium, and electronic device | |
| KR101206735B1 (en) | Apparatus for protecting information associated with security of mobile terminal and method thereof | |
| US20240113898A1 (en) | Secure Module and Method for App-to-App Mutual Trust Through App-Based Identity | |
| CN113672973B (en) | Database system of embedded device based on RISC-V architecture of trusted execution environment | |
| CN115603943A (en) | Method and device for off-line identity authentication, storage medium and electronic equipment | |
| CN114553428A (en) | Credible verification system, device, storage medium and electronic equipment | |
| CN108449753B (en) | Method for reading data in trusted computing environment by mobile phone device | |
| CN111046440A (en) | Tamper verification method and system for secure area content | |
| CN114301606B (en) | Unmanned equipment key management system, method, device, equipment and storage medium | |
| CN117744117B (en) | Authority setting method, authority setting device, electronic equipment and computer readable storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |