CN114666074B - Product identification authentication method and device - Google Patents

Abstract

The invention provides a product identification authentication method and device, wherein the method comprises the following steps: reading a target identifier of a target product stored in a security chip and an identifier key corresponding to the target identifier; performing authentication calculation on the target identifier by adopting an identifier key to obtain a first authentication calculation result; generating a first identification analysis authentication request message, wherein the first identification analysis authentication request message comprises the first authentication calculation result; sending the first identification analysis authentication request message to an identifiable identification analysis platform; and receiving a first identification authentication result fed back by the trusted identification analysis platform, wherein the first identification authentication result carries identification information corresponding to the target identification. In the invention, a product is supported to write a plurality of identifications and corresponding multiple groups of identification keys, and all enterprise product identifications, identification keys and enterprise information are uniformly managed by means of the capability of an identifiable identification analysis platform, so that safe data interaction is performed, and online maintenance and management of information in the whole life cycle of the product are realized.

Description

A product identification authentication method and device

Technical Field

The embodiments of the present invention relate to the field of Internet of Things security authentication, and in particular to a product identification authentication method and device.

Background technique

In order to make the interconnection between people, machines and things more convenient and efficient, and to achieve the traceability of important products and the full life cycle management of smart products. At present, there are two major ways to trace the identification and authentication of products. One is to install external identification tags such as barcodes, QR codes, RFID (Radio Frequency Identification) electronic tags, among which RFID (Radio Frequency Identification) electronic tags require terminals to embed radio frequency modules to read identification authentication, and barcodes or QR codes require scanners to read identification authentication, which are all passive identification; the second is to embed internal identification tags such as SIM (Subscriber Identity Module) carriers in products. This identification can only be written into the product with the installation of the SIM carrier during the manufacturing stage, and it is not possible to store multiple products in one SIM carrier and have multiple identifications for one product.

As an active identification carrier, the security chip has certain advantages. It can quickly help customers integrate identification issuance and storage capabilities, ensure the non-tamperability of the identification, and provide secure communication and authentication services to ensure the security and reliability of the identification system. In different life cycle stages of products, such as production, warehousing, logistics, sales and services, the identification service platform writes the product's trusted identification and security identification key of the corresponding stage into the security chip. One identification can be indexed to a business service platform. After the identification is authenticated, the product can be managed for the business of the life cycle stage. Through the association of multiple trusted identifications, effective anti-counterfeiting authentication and full life cycle management of smart products can be achieved. At the same time, the main product with integrated security chip can connect multiple subsidiary products through multiple interfaces during the service provision stage. Through the main product, the trusted identification and security identification key of the subsidiary product can also be applied to the identification service platform through the main product, and written into the security chip. The main product in the narrowband Internet of Things, 2G, 4G, 5G and other networks can realize the security authentication of the subsidiary product and the identification service platform and the business interaction with the corresponding business service platform.

Summary of the invention

The embodiment of the present invention provides a product identification authentication method and device, which are used to solve the problem that in the existing product identification authentication method based on SIM carrier, one product corresponds to one identification and is stored in one SIM carrier, and the identification can only be written into the product during the production stage when the SIM carrier is installed.

In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

In a first aspect, an embodiment of the present invention provides a product identification authentication method, which is applied to a terminal and includes:

Reading a target identification of a target product and an identification key corresponding to the target identification stored in a security chip;

Using the identification key to perform authentication calculation on the target identification to obtain a first authentication calculation result;

Generate a first identity resolution authentication request message, wherein the first identity resolution authentication request message includes the first authentication calculation result;

Sending the first identity resolution authentication request message to the trusted identity resolution platform;

A first identification authentication result fed back by the trusted identification resolution platform is received, wherein the first identification authentication result carries identification information corresponding to the target identification.

Optionally, before reading the target identification of the target product and the identification key corresponding to the target identification stored in the security chip, the method further includes:

If the security chip stores multiple identifications of the target product, obtaining the currently activated identification index of the target product;

The target identification corresponding to the identification index and the identification key corresponding to the target identification stored in the security chip are read.

Optionally, the business data of the target product is encrypted by the security chip to obtain encrypted business data;

Performing authentication calculation on the encrypted business data using the identification key of the target identification;

Generate a business data message, wherein the business data message includes encrypted business data after authentication calculation;

The business data message is sent to the business service platform.

Optionally, the product identification stored in the security chip is written in a preset manner or a post-write manner.

Optionally, connect with other Internet of Things terminals; receive product identification writing applications sent by the other Internet of Things terminals; and write the received product identification into the security chip.

Optionally, writing the received product identifier into the security chip includes:

Performing an authentication calculation on the product identification using the identification key in the product identification to obtain a second authentication calculation result;

Generate a second identity resolution authentication request message for the identity of the product, wherein the second identity resolution authentication request message includes the second authentication calculation result;

Sending the second identity resolution authentication request message to the trusted identity resolution platform;

Receive a second identification authentication result fed back by the trusted identification resolution platform;

The product identification and the corresponding identification key are written into the security chip.

Optionally, a universal asynchronous receiver/transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, or a short-range wireless communication technology can be used to connect to other IoT terminals.

Optionally, the security chip stores at least one product identification, each product includes at least one identification, and each identification corresponds to an identification key.

Optionally, the security chip further stores at least one of the following: an identification index; and an address of a trusted identification resolution platform.

In a second aspect, an embodiment of the present invention provides a product identification authentication method, which is applied to a trusted identification resolution platform, including:

A first identity resolution authentication request message sent by a receiving terminal; the first identity resolution authentication request message includes a first authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

Sending the first identity resolution authentication request message to the security authentication service platform for identity authentication;

Receive a first identification authentication result fed back by the security authentication service platform;

If the identification authentication is passed, the identification authentication result is sent to the trusted identification resolution platform, and the first identification authentication result carries the identification information corresponding to the target identification.

In a third aspect, an embodiment of the present invention provides a product identification authentication device, including:

A reading module, used for reading a target identification of a target product and an identification key corresponding to the target identification stored in a security chip;

An authentication calculation module, used to perform authentication calculation on the target identifier using the identifier key to obtain a first authentication calculation result;

A first processing module, configured to generate a first identity resolution authentication request message, wherein the first identity resolution authentication request message includes the first authentication calculation result;

A first sending module, used to send the first identity resolution authentication request message to a trusted identity resolution platform;

The first receiving module is used to receive a first identification authentication result fed back by the trusted identification resolution platform. If the identification authentication is successful, the identification authentication result carries identification information corresponding to the target identification.

In a fourth aspect, an embodiment of the present invention provides a product identification authentication device, including:

A second receiving module receives an identity resolution authentication request message sent by a terminal; the identity resolution authentication request message includes an authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

A second sending module is used to send the identity resolution authentication request message to the security authentication service platform for identity authentication;

A third receiving module is used to receive the identification authentication result fed back by the security authentication service platform;

The third sending module is used to send the identification authentication result to the trusted identification resolution platform if the identification authentication passes, and the identification authentication result carries the identification information corresponding to the target identification.

In a fifth aspect, an embodiment of the present invention provides a product identification authentication device, including: a transceiver and a processor;

The processor is used to read the target identification of the target product and the identification key corresponding to the target identification stored in the security chip;

The processor is configured to generate an identity resolution authentication request message, wherein the identity resolution authentication request message includes a first authentication calculation result;

The processor is configured to generate a first identity resolution authentication request message, wherein the first identity resolution authentication request message includes the first authentication calculation result;

The transceiver is used to send the first identity resolution authentication request message to the trusted identity resolution platform;

The transceiver is used to receive the first identification authentication result fed back by the trusted identification resolution platform. If the identification authentication is successful, the identification authentication result carries the identification information corresponding to the target identification.

In a sixth aspect, an embodiment of the present invention provides a product identification authentication device, including: a transceiver and a processor;

The transceiver is used to receive an identity resolution authentication request message sent by a terminal; the identity resolution authentication request message includes an authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

The transceiver is used to send the identity resolution authentication request message to the security authentication service platform for identity authentication;

The transceiver is used to receive the identification authentication result fed back by the security authentication service platform;

The transceiver is used to send the identification authentication result to the trusted identification resolution platform if the identification authentication passes, and the identification authentication result carries the identification information corresponding to the target identification.

In the seventh aspect, a terminal is provided, characterized in that it includes: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the product identification authentication method described in the first aspect are implemented.

In an eighth aspect, a trusted identification resolution platform is provided, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of the product identification authentication method as described in the first aspect are implemented.

In a ninth aspect, a computer-readable storage medium is provided, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the product identification authentication method as described in the first aspect are implemented.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product, and relying on the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

BRIEF DESCRIPTION OF THE DRAWINGS

Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used to identify the same components throughout the accompanying drawings. In the accompanying drawings:

FIG1 is a schematic diagram of a process of applying a product identification authentication method provided by an embodiment of the present invention to a terminal;

FIG2 is a schematic diagram of a security chip storage structure in a product identification authentication method provided by an embodiment of the present invention;

FIG3 is a schematic diagram of a flow chart of identification writing in a product identification authentication method provided by an embodiment of the present invention;

FIG4 is a schematic diagram of a process of applying a product identification authentication method provided by an embodiment of the present invention to a trusted identification resolution platform;

FIG5 is a schematic diagram of the structure of a product identification authentication device provided by an embodiment of the present invention applied to a terminal;

FIG6 is a schematic diagram of the structure of a product identification authentication device provided by an embodiment of the present invention applied to a trusted identification resolution platform;

FIG7 is a schematic diagram of a transceiver structure applied to a terminal provided by an embodiment of the present invention;

FIG8 is a schematic diagram of a structure of a trusted identity resolution platform provided by an embodiment of the present invention;

FIG9 is a schematic diagram of the structure of a terminal provided by an embodiment of the present invention;

FIG10 is a schematic diagram of the structure of a trusted identity resolution platform provided in an embodiment of the present invention.

Detailed ways

The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

Referring to FIG. 1 , an embodiment of the present invention provides a product identification authentication method, which is applied to a terminal and includes:

Step 11: Read the target identification of the target product and the identification key corresponding to the target identification stored in the security chip;

Step 12: Using the identification key to perform authentication calculation on the target identification to obtain a first authentication calculation result;

Step 13: Generate a first identity resolution authentication request message, where the first identity resolution authentication request message includes the first authentication calculation result;

Step 14: Send the first identity resolution authentication request message to a trusted identity resolution platform;

Step 15: Receive a first identification authentication result fed back by the trusted identification resolution platform, wherein the first identification authentication result carries identification information corresponding to the target identification.

In an embodiment of the present invention, in step 11, if there are multiple identifiers in the target product, only the currently activated target identifier is found through the identifier index; the authentication calculation is not limited to the use of symmetric keys, asymmetric keys, international algorithms, national secret algorithms, etc.; the identification key is not limited to symmetric keys, asymmetric keys, etc.; in step 14, the trusted identification resolution platform performs an authentication calculation verification on the product identification and the identification resolution authentication request through the security authentication service platform. If the verification passes, it means that the current resolution request comes from a legitimate product; in step 15, the trusted identification resolution platform stores the identification information of the target identification, and the identification information includes information such as the enterprise node location.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

In the embodiment of the present invention, optionally, before reading the target identification of the target product and the identification key corresponding to the target identification stored in the security chip, the method further includes:

If the security chip stores multiple identifications of the target product, obtaining the currently activated identification index of the target product;

The target identification corresponding to the identification index and the identification key corresponding to the target identification stored in the security chip are read.

In an embodiment of the present invention, the storage structure of the target identification of the target product, please refer to Figure 2, the identification 0 to identification N identify the identification information of the target product in different life cycles or different usage stages; the identification index represents the identification information currently activated by the product, which is used to identify the current life cycle status or service stage of the product; the trusted identification resolution platform address is used to store the platform address of the identification resolution service corresponding to the product; other information is optional to write, and can be used to store customized information such as the security configuration information of the product, wherein the products such as water meters, electricity meters, and gas meters can be connected to the industry resolution platform through a home gateway, and then indexed to the service platform.

In the embodiment of the present invention, optionally, the business data of the target product is encrypted by the security chip to obtain encrypted business data;

Performing authentication calculation on the encrypted business data using the identification key of the target identification;

Generate a business data message, wherein the business data message includes encrypted business data after authentication calculation;

The business data message is sent to the business service platform.

In an embodiment of the present invention, the business service platform may request a security authentication service platform to perform authentication calculations on the business data message according to the identification of the target product to confirm the legal identity, and at the same time use the corresponding business communication identification key to decrypt the business data message to obtain the business data, and return the business data to the business service platform to carry out subsequent business interaction processes.

In the embodiment of the present invention, optionally, the product identification stored in the security chip is written in a preset manner or a post-write manner.

In an embodiment of the present invention, the product embeds a cellular module and a security chip during the production and manufacturing stage. The identification writing of the product can usually be done by a preset method and a post-write method. However, due to the high degree of customization of product identifications of various enterprises and industries, writing personalized information in the initial stage of the security chip will greatly reduce production efficiency. In order to improve the production efficiency of the identification carrier and ensure the security level of the subsequent written identification, the security authentication service platform uniformly allocates the initial identification of the security chip and the identification key of its corresponding identification during the production stage of the security chip, and pre-sets the identification key together with the joint authentication center identification into the security chip in a secure environment to complete the production. The identification can be written by a post-write method throughout the entire life cycle of the product.

In the embodiment of the present invention, optionally, connecting with other Internet of Things terminals; receiving a product identification writing application sent by the other Internet of Things terminals; and writing the received product identification into the security chip.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In the embodiment of the present invention, optionally, writing the received product identification into the security chip includes:

Step 31: using the identification key in the identification of the product to perform authentication calculation on the identification of the product to obtain a second authentication calculation result;

Step 32: Generate a second identity resolution authentication request message for the identity of the product, wherein the second identity resolution authentication request message includes the second authentication calculation result;

Step 33: Send the second identity resolution authentication request message to the trusted identity resolution platform;

Step 34: receiving the second identification authentication result fed back by the trusted identification resolution platform;

Step 35: Write the product identification and the corresponding identification key into the security chip.

In an embodiment of the present invention, after the other Internet terminals are connected to the security chip, they actively obtain the initial identification of the security chip and send the product information of the other Internet terminals to the security chip; in step 33, the trusted identification resolution platform sends the received information to the security authentication service platform for authentication calculation authentication. If the authentication calculation authentication passes, it means that the identification is a trusted identification. If the authentication fails, it means that the identification is sent by a counterfeit device and the subsequent process will be rejected. The security authentication service platform will also push the product information to the enterprise business platform for centralized management.

In an embodiment of the present invention, during the identification writing process, the initial identification is used in the identification request message for authentication calculation, the security authentication service platform performs authentication calculation and authentication on the message, completes the platform's authentication of the security chip, uses the security authentication service platform to authenticate and calculate the information, and the chip performs authentication calculation and authentication on the information, completes the chip's authentication of the platform; thereby, a security trust chain for the entire identification is constructed, and the customization of the identification and the issuance of security identification keys are realized; during the identification resolution process, a security authentication process is added to the identification resolution process to confirm that the resolution request comes from a legitimate industrial Internet product terminal, which can effectively prevent the issuance of resolution requests for forged and tampered identification, causing information leakage and damage; and in the business interaction process, based on the trusted authentication of identification resolution, while utilizing the identification key storage and computing capabilities of the security chip, it helps corporate customers to interact with secure data and achieve end-to-end security capabilities.

In the embodiment of the present invention, optionally, a universal asynchronous receiver/transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, or a short-range wireless communication technology is used to connect with other Internet of Things terminals.

In the embodiment of the present invention, optionally, the security chip stores an identification of at least one product, each product includes at least one identification, and each identification corresponds to an identification key.

In the embodiment of the present invention, optionally, the security chip further stores at least one of the following: an identification index; and an address of a trusted identification resolution platform.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In an embodiment of the present invention, by writing multiple identifiers and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifiers, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

Referring to FIG. 4 , an embodiment of the present invention provides a product identification authentication method, which is applied to a trusted identification resolution platform, including:

Step 41: receiving a first identity resolution authentication request message sent by a terminal; the first identity resolution authentication request message includes a first authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

Step 42: Send the first identity resolution authentication request message to the security authentication service platform for identity authentication;

Step 43: receiving the first identification authentication result fed back by the security authentication service platform;

Step 44: If the identification authentication is passed, the identification authentication result is sent to the trusted identification resolution platform, and the first identification authentication result carries the identification information corresponding to the target identification.

In the embodiment of the present invention, with the help of the capabilities of the trusted identity resolution platform, all enterprise product identities, identity keys and enterprise information are managed in a unified manner, identity resolution and trusted authentication of identities are achieved, and then indexed to the business platform for secure data interaction.

Referring to FIG. 5 , an embodiment of the present invention provides a product identification authentication device, including:

A reading module 51, used to read the target identification of the target product and the identification key corresponding to the target identification stored in the security chip;

An authentication calculation module 52, configured to perform an authentication calculation on the target identifier using the identifier key to obtain a first authentication calculation result;

A first processing module 53 is configured to generate a first identity resolution authentication request message, wherein the first identity resolution authentication request message includes the first authentication calculation result;

A first sending module 54, configured to send the first identity resolution authentication request message to a trusted identity resolution platform;

The first receiving module 55 is used to receive the first identification authentication result fed back by the trusted identification resolution platform. If the identification authentication is successful, the identification authentication result carries the identification information corresponding to the target identification.

In an embodiment of the present invention, in the reading module 51, if there are multiple identifiers in the target product, only the currently activated target identifier is found through the identifier index; in the first sending module 54, the trusted identifier resolution platform performs authentication calculation verification on the product identifier and the identifier resolution authentication request through the security authentication service platform. If the verification passes, it means that the current resolution request comes from a legitimate product; in the first receiving module 55, the trusted identifier resolution platform stores the identification information of the target identifier, and the identification information includes information such as the enterprise node location.

In an embodiment of the present invention, by writing multiple identifiers and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifiers, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

In the embodiment of the present invention, optionally, before reading the target identification of the target product and the identification key corresponding to the target identification stored in the security chip, the method further includes:

A first processing submodule, configured to obtain a currently activated identification index of the target product if multiple identifications of the target product are stored in the security chip;

The first reading submodule is used to read the target identification corresponding to the identification index and the identification key corresponding to the target identification stored in the security chip.

In an embodiment of the present invention, the storage structure of the target identification of the target product, please refer to Figure 2, the identification 0 to identification N identify the identification information of the target product in different life cycles or different usage stages; the identification index represents the identification information currently activated by the product, which is used to identify the current life cycle status or service stage of the product; the trusted identification resolution platform address is used to store the platform address of the identification resolution service corresponding to the product; other information is optional to write, and can be used to store customized information such as the security configuration information of the product, wherein the products such as water meters, electricity meters, and gas meters can be connected to the industry resolution platform through a home gateway, and then indexed to the service platform.

In the embodiment of the present invention, optionally,

A second processing submodule, configured to encrypt the business data of the target product through the security chip to obtain encrypted business data;

A third processing submodule, configured to perform authentication calculation on the encrypted business data using the identification key of the target identification;

A fourth processing submodule, configured to generate a service data message, wherein the service data message includes encrypted service data after authentication calculation;

The first sending submodule is used to send the business data message to the business service platform.

In an embodiment of the present invention, the business service platform may request a security authentication service platform to perform authentication calculations on the business data message according to the identification of the target product to confirm the legal identity, and at the same time use the corresponding business communication identification key to decrypt the business data message to obtain the business data, and return the business data to the business service platform to carry out subsequent business interaction processes.

In the embodiment of the present invention, optionally, the product identification stored in the security chip is written in a preset manner or a post-write manner.

In an embodiment of the present invention, the product embeds a cellular module and a security chip during the production and manufacturing stage. The identification writing of the product can usually be done by a preset method and a post-write method. However, due to the high degree of customization of product identifications of various enterprises and industries, writing personalized information in the initial stage of the security chip will greatly reduce production efficiency. In order to improve the production efficiency of the identification carrier and ensure the security level of the subsequent written identification, the security authentication service platform uniformly allocates the initial identification of the security chip and the identification key of its corresponding identification during the production stage of the security chip, and pre-sets the identification key together with the joint authentication center identification into the security chip in a secure environment to complete the production. The identification can be written by a post-write method throughout the entire life cycle of the product.

In the embodiment of the present invention, optionally, it also includes: a fifth processing submodule, connected to other Internet of Things terminals; receiving a product identification writing application sent by the other Internet of Things terminals; and writing the received product identification into the security chip.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In the embodiment of the present invention, optionally, a universal asynchronous receiver/transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, or a short-range wireless communication technology is used to connect with other Internet of Things terminals.

In the embodiment of the present invention, optionally, the security chip stores an identification of at least one product, each product includes at least one identification, and each identification corresponds to an identification key.

In the embodiment of the present invention, optionally, the security chip further stores at least one of the following: an identification index; and an address of a trusted identification resolution platform.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

Referring to FIG. 6 , an embodiment of the present invention provides a product identification authentication device, including:

The second receiving module 61 receives an identity resolution authentication request message sent by a terminal; the identity resolution authentication request message includes an authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

The second sending module 62 is used to send the identity resolution authentication request message to the security authentication service platform for identity authentication;

The third receiving module 63 is used to receive the identification authentication result fed back by the security authentication service platform;

The third sending module 64 is used to send the identification authentication result to the trusted identification resolution platform if the identification authentication is passed, and the identification authentication result carries the identification information corresponding to the target identification.

In the embodiment of the present invention, with the help of the capabilities of the trusted identity resolution platform, all enterprise product identities, identity keys and enterprise information are managed in a unified manner, identity resolution and trusted authentication of identities are achieved, and then indexed to the business platform for secure data interaction.

Please refer to FIG. 7 , an embodiment of the present invention provides a product identification authentication device, including: a transceiver and a processor;

The processor is used to read the target identification of the target product and the identification key corresponding to the target identification stored in the security chip;

The processor is configured to generate an identity resolution authentication request message, wherein the identity resolution authentication request message includes a first authentication calculation result;

The processor is configured to generate a first identity resolution authentication request message, wherein the first identity resolution authentication request message includes the first authentication calculation result;

The transceiver is used to send the first identity resolution authentication request message to the trusted identity resolution platform;

The transceiver is used to receive the first identification authentication result fed back by the trusted identification resolution platform. If the identification authentication is successful, the identification authentication result carries the identification information corresponding to the target identification.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

In the embodiment of the present invention, optionally, before reading the target identification of the target product and the identification key corresponding to the target identification stored in the security chip, the method further includes:

The processor is configured to obtain a currently activated identification index of the target product if multiple identifications of the target product are stored in the security chip;

The transceiver is used to read the target identification corresponding to the identification index and the identification key corresponding to the target identification stored in the security chip.

In an embodiment of the present invention, the storage structure of the target identification of the target product, please refer to Figure 2, the identification 0 to identification N identify the identification information of the target product in different life cycles or different usage stages; the identification index represents the identification information currently activated by the product, which is used to identify the current life cycle status or service stage of the product; the trusted identification resolution platform address is used to store the platform address of the identification resolution service corresponding to the product; other information is optional to write, and can be used to store customized information such as the security configuration information of the product, wherein the products such as water meters, electricity meters, and gas meters can be connected to the industry resolution platform through a home gateway, and then indexed to the service platform.

In the embodiment of the present invention, optionally, the method further includes:

The processor is used to encrypt the business data of the target product through the security chip to obtain encrypted business data;

The processor is used to perform authentication calculation on the encrypted business data through the identification key of the target identification;

The processor is used to generate a service data message, wherein the service data message includes encrypted service data after authentication calculation;

The transceiver is used to send the business data message to the business service platform.

In an embodiment of the present invention, the business service platform may request a security authentication service platform to perform authentication calculations on the business data message according to the identification of the target product to confirm the legal identity, and at the same time use the corresponding business communication identification key to decrypt the business data message to obtain the business data, and return the business data to the business service platform to carry out subsequent business interaction processes.

In the embodiment of the present invention, optionally, the product identification stored in the security chip is written in a preset manner or a post-write manner.

In an embodiment of the present invention, the product embeds a cellular module and a security chip during the production and manufacturing stage. The identification writing of the product can usually be done by a preset method and a post-write method. However, due to the high degree of customization of product identifications of various enterprises and industries, writing personalized information in the initial stage of the security chip will greatly reduce production efficiency. In order to improve the production efficiency of the identification carrier and ensure the security level of the subsequent written identification, the security authentication service platform uniformly allocates the initial identification of the security chip and the identification key of its corresponding identification during the production stage of the security chip, and pre-sets the identification key together with the joint authentication center identification into the security chip in a secure environment to complete the production. The identification can be written by a post-write method throughout the entire life cycle of the product.

In the embodiment of the present invention, optionally, it also includes: the processor is connected to other Internet of Things terminals; receives a product identification writing application sent by the other Internet of Things terminals; and writes the received product identification into the security chip.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In the embodiment of the present invention, optionally, a universal asynchronous receiver/transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, or a short-range wireless communication technology is used to connect with other Internet of Things terminals.

In the embodiment of the present invention, optionally, the security chip stores an identification of at least one product, each product includes at least one identification, and each identification corresponds to an identification key.

In the embodiment of the present invention, optionally, the security chip further stores at least one of the following: an identification index; and an address of a trusted identification resolution platform.

In an embodiment of the present invention, it can be connected to other Internet of Things terminals through a universal asynchronous receiver-transmitter, a two-wire synchronous serial bus, a serial peripheral interface, Bluetooth, and a short-range wireless communication technology, so that the security chip can store one or more identifications of multiple products and identification keys corresponding to the identifications. These products equipped with the security chip can interact with the security authentication service platform and the business service platform through the products equipped with the security chip.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

Please refer to FIG8 , an embodiment of the present invention provides a product identification authentication device, including: a transceiver and a processor;

The transceiver is used to receive an identity resolution authentication request message sent by a terminal; the identity resolution authentication request message includes an authentication calculation result of performing an authentication calculation on a target identity using an identity key of the target identity;

The transceiver is used to send the identity resolution authentication request message to the security authentication service platform for identity authentication;

The transceiver is used to receive the identification authentication result fed back by the security authentication service platform;

The transceiver is used to send the identification authentication result to the trusted identification resolution platform if the identification authentication passes, and the identification authentication result carries the identification information corresponding to the target identification.

In an embodiment of the present invention, by writing multiple identifications and corresponding multiple groups of identification keys to a product and leveraging the capabilities of a trusted identification resolution platform, all enterprise product identifications, identification keys, and enterprise information are uniformly managed, secure data interaction is performed, and online maintenance and management of information throughout the product life cycle is achieved.

Please refer to Figure 9. An embodiment of the present invention further provides a terminal 90, including a processor 91, a memory 92, and a computer program stored in the memory 92 and executable on the processor 91. When the computer program is executed by the processor 91, the various processes of the above-mentioned product identification authentication method embodiment applied to the terminal are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

Please refer to Figure 10. An embodiment of the present invention further provides a trusted identity resolution platform 100, including a processor 101, a memory 102, and a computer program stored in the memory 102 and executable on the processor 101. When the computer program is executed by the processor 101, each process of the product identification authentication method embodiment applied to the trusted identity resolution platform is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned product identification authentication method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims (16)

1. A product identification authentication method applied to a terminal, comprising the following steps:

reading a target identifier of a target product stored in a security chip and an identifier key corresponding to the target identifier;

performing authentication calculation on the target identifier by adopting the identifier key to obtain a first authentication calculation result;

generating a first identification analysis authentication request message, wherein the first identification analysis authentication request message comprises the first authentication calculation result;

sending the first identification analysis authentication request message to an identifiable identification analysis platform;

receiving a first identification authentication result fed back by the trusted identification analysis platform, wherein the first identification authentication result carries identification information corresponding to the target identification;

before reading the target identifier of the target product stored in the security chip and the identifier key corresponding to the target identifier, the method further comprises the following steps:

if a plurality of identifiers of the target product are stored in the security chip, acquiring a currently activated identifier index of the target product; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product;

And reading a target identifier corresponding to the identifier index and an identifier key corresponding to the target identifier stored in the security chip.

2. The product identification authentication method of claim 1, further comprising:

encrypting the service data of the target product through the security chip to obtain encrypted service data;

carrying out authentication calculation on the encrypted service data through the identification key of the target identification;

generating a service data message, wherein the service data message comprises encrypted service data after authentication calculation;

and sending the service data message to a service platform.

3. The product identification authentication method of claim 1, wherein the identification of the product stored in the security chip is written in a preset manner and a post-writing manner.

4. The product identification authentication method of claim 1, further comprising:

the terminal is connected with other terminals of the Internet of things;

receiving an identification writing application of a product sent by the other internet of things terminal;

and writing the identification of the product which is received and sent by the trusted identification analysis platform into the security chip.

5. The product identification authentication method of claim 4, wherein writing the received identification of the product to the security chip comprises:

Performing authentication calculation on the identification of the product by adopting an identification key in the identification of the product to obtain a second authentication calculation result;

generating a second identification analysis authentication request message of the identification of the product, wherein the second identification analysis authentication request message contains the second authentication calculation result;

sending the second identification analysis authentication request message to an identifiable identification analysis platform;

receiving a second identification authentication result fed back by the trusted identification analysis platform;

and writing the product identifier and the corresponding identifier key into the security chip.

6. The product identification authentication method as claimed in claim 4, wherein,

the universal asynchronous receiving and transmitting transmitter, the two-wire synchronous serial bus, the serial peripheral interface, the Bluetooth and the near field wireless communication technology are adopted to be connected with other terminals of the Internet of things.

7. The product identification authentication method as claimed in claim 1, wherein,

the security chip stores identifications of at least one product, each product including at least one identification, each identification corresponding to an identification key.

8. The product identification authentication method as claimed in claim 7, wherein,

the security chip further stores a memory comprising at least one of: identifying an index; the trusted identifier resolves the platform address.

9. The product identification authentication method is applied to an identifiable analysis platform and is characterized by comprising the following steps of:

receiving a first identification analysis authentication request message sent by a terminal; the first identification analysis authentication request message comprises a first authentication calculation result of performing authentication calculation on the target identification by adopting an identification key of the target identification; the terminal reads a target identifier of a target product stored in the security chip and an identifier key corresponding to the target identifier; performing authentication calculation on the target identifier by adopting the identifier key to obtain a first authentication calculation result; generating a first identification analysis authentication request message, wherein the first identification analysis authentication request message comprises the first authentication calculation result; if a plurality of identifiers of the target product are stored in the security chip, acquiring a currently activated identifier index of the target product; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product; reading a target identifier corresponding to the identifier index and an identifier key corresponding to the target identifier stored in the security chip;

The first identification analysis authentication request message is sent to a security authentication service platform for identification authentication;

receiving a first identification authentication result fed back by the security authentication service platform;

if the identification authentication is passed, the identification authentication result is sent to an identifiable identification analysis platform, and the first identification authentication result carries identification information corresponding to the target identification.

10. A product identification authentication device, comprising:

the reading module is used for reading the target identifier of the target product stored in the security chip and the identification key corresponding to the target identifier;

the authentication calculation module is used for carrying out authentication calculation on the target identifier by adopting the identifier key to obtain a first authentication calculation result;

the first processing module is used for generating a first identification analysis authentication request message which contains the first authentication calculation result;

the first sending module is used for sending the first identification analysis authentication request message to an identifiable identification analysis platform;

the first receiving module is used for receiving a first identification authentication result fed back by the identification analysis platform, and if the identification authentication is passed, the identification authentication result carries identification information corresponding to the target identification;

Further comprises:

the first processing sub-module is used for acquiring the currently activated identification index of the target product if a plurality of identifications of the target product are stored in the security chip; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product;

and the first reading submodule is used for reading the target identifier corresponding to the identifier index and the identifier key corresponding to the target identifier stored in the security chip.

11. A product identification authentication device, comprising:

the second receiving module is used for receiving an identification analysis authentication request message sent by the terminal; the identification analysis authentication request message comprises an authentication calculation result of performing authentication calculation on the target identification by adopting an identification key of the target identification; the terminal reads a target identifier of a target product stored in the security chip and an identifier key corresponding to the target identifier; performing authentication calculation on the target identifier by adopting the identifier key to obtain a first authentication calculation result; generating a first identification analysis authentication request message, wherein the first identification analysis authentication request message comprises the first authentication calculation result; if a plurality of identifiers of the target product are stored in the security chip, acquiring a currently activated identifier index of the target product; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product; reading a target identifier corresponding to the identifier index and an identifier key corresponding to the target identifier stored in the security chip;

The second sending module is used for sending the identification analysis authentication request message to a security authentication service platform for identification authentication;

the third receiving module is used for receiving the identification authentication result fed back by the security authentication service platform;

and the third sending module is used for sending the identification authentication result to the bearable identification analysis platform if the identification authentication is passed, wherein the identification authentication result carries identification information corresponding to the target identification.

12. A product identification authentication device, comprising: a transceiver and a processor;

the processor is used for reading a target identifier of a target product stored in the security chip and an identification key corresponding to the target identifier; if a plurality of identifiers of the target product are stored in the security chip, acquiring a currently activated identifier index of the target product; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product; reading a target identifier corresponding to the identifier index and an identifier key corresponding to the target identifier stored in the security chip;

the processor is used for generating an identification analysis authentication request message which contains a first authentication calculation result;

The processor is configured to generate a first identifier resolution authentication request packet, where the first identifier resolution authentication request packet includes the first authentication calculation result;

the transceiver is used for sending the first identification analysis authentication request message to an identifiable identification analysis platform;

the transceiver is configured to receive a first identifier authentication result fed back by the trusted identifier analysis platform, and if the identifier authentication is passed, the identifier authentication result carries identifier information corresponding to the target identifier.

13. A product identification authentication device, comprising: a transceiver and a processor;

the transceiver is used for receiving an identification analysis authentication request message sent by the terminal; the identification analysis authentication request message comprises an authentication calculation result of performing authentication calculation on the target identification by adopting an identification key of the target identification; the terminal reads a target identifier of a target product stored in the security chip and an identifier key corresponding to the target identifier; performing authentication calculation on the target identifier by adopting the identifier key to obtain a first authentication calculation result; generating a first identification analysis authentication request message, wherein the first identification analysis authentication request message comprises the first authentication calculation result; if a plurality of identifiers of the target product are stored in the security chip, acquiring a currently activated identifier index of the target product; the identification index represents the identification information of the current activation of the product and is used for identifying the current life cycle state or service stage of the target product; reading a target identifier corresponding to the identifier index and an identifier key corresponding to the target identifier stored in the security chip;

The transceiver is used for sending the identification analysis authentication request message to a security authentication service platform for identification authentication;

the transceiver is used for receiving the identification authentication result fed back by the security authentication service platform;

and the transceiver is used for sending the identification authentication result to the bearable identification analysis platform if the identification authentication is passed, wherein the identification authentication result carries identification information corresponding to the target identification.

14. A terminal, comprising: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the product identification authentication method according to any one of claims 1 to 9.

15. An trusted identification resolution platform, comprising: a processor, a memory and a program stored on the memory and executable on the processor, which when executed by the processor implements the steps of the product identification authentication method according to any one of claims 1 to 9.

16. A computer readable storage medium, characterized in that the computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the product identification authentication method according to any of claims 1 to 9.