TWI625977B - Method for authenticatting communication device lower-level group - Google Patents

Abstract

A method for authenticating a lower-level group of a communication device. The lower-level group of the communication device is established based on the upper-level group of the communication device. The communication device superior group includes a plurality of communication devices. Each communication device has its own first-level device security credentials. The method of the present invention generates a lower-level group authorization certificate for a lower-level group of communication devices, signs a respective second-level device security certificate for each communication device belonging to the lower-level group of communication devices, and authorizes the lower-level group. The credentials are combined with the second-level device security credentials to form multiple credential chains. Each communication device belonging to the lower-level group of communication devices receives its corresponding certificate chain, and replaces its first device security certificate with the second-level security certificate in the received certificate chain.

Description

Method for authenticating lower-level group of communication device

The invention relates to a method for authenticating a lower-level group organization of a communication device, and further relates to a method for authenticating each other in a communication unit of a lower-level group organization of a communication device.

In the past, communication between a communication device and a communication device was performed through a wired network. Therefore, the authentication between the communication device and the communication device depends on the manual password setting method, or the user of the communication device obtains a certificate from the certificate authority, and uses this certificate to complete the authentication process with other communication devices or network servers to obtain a connection. .

Existing communication devices and communication devices have been implemented by wireless networks. The authentication between these communication devices is to manually set a password (for example, a communication device using Bluetooth or Wi-Fi), or to obtain a connection by using frequency correspondence without any security authentication method (for example, a communication device using ZigBee) ).

Based on the foregoing description of the prior art, the prior art of communication device authentication relies on a manual password setting method, which requires manual setting procedures and insufficient security. The certificate is adopted through the wired network. Although it has sufficient security, it needs to obtain a certificate from a third party. The connection after the authentication is established is the relationship between the user (communication device) and the server. After authentication, the communication connection between the communication device and the communication device still needs to pass through the server.

With the rise of the Internet of Things, the need for machine-to-machine communication and exchange of data between communication devices has also increased. One Generally speaking, manufacturers produce a large number of communication devices, and before they leave the factory, the product serial number is stored in the communication device for device identification.

Consumers purchase a certain number of mass-produced communication devices and install them in specific areas, such as homes, schools, and company lines. In order to avoid interference from communication installations of the same type of communication devices in other areas, the communication devices installed in specific areas must be targeted. Devices are grouped and separated from communication devices installed in other areas. Even multiple sub-areas distinguished by a communication device in a specific area, for example, different buildings in a school, the communication devices that have formed the upper-level group for the specific area need to be the communication devices that form the lower-level group. Communication devices in a group need to be authenticated, and communication devices in the same group also need to be authenticated for machine-to-machine communication to exchange data. However, the prior art does not provide consumers with the convenience and security solutions to meet these needs.

Therefore, the technical problem to be solved by the present invention is to provide a method for authenticating a lower-level group organization of a communication device, and further a method for authenticating each other in a communication device lower-level group organization communication room. In particular, the method of the present invention does not need to go through a third party or a server, and further increases the security and convenience of communication device authentication.

The method according to a preferred embodiment of the present invention is used to authenticate a lower-level group of a communication device. The lower-level group of the communication device is established based on the upper-level group of the communication device. The communication device superior group includes a plurality of communication devices. The first manager device stores an upper-level group private key and a higher-level group public key paired with the upper-level group private key. Each communication device stores its own first-level device security certificate, its own device serial number, and its upper-level group public key. The method of the present invention firstly generates a lower-level group private key and a lower-level group public key paired with the lower-level group private key by the second manager device. Next, in the method of the present invention, the public key of the lower-level group and the serial number range of the authorized device are signed by the private key of the higher-level group of the first manager device, thereby generating a lower-level group authorization certificate. Subordinate group authorization certificate contains Lower-level group public key, authorized device serial number range, and authorization certificate signature. Then, the method of the present invention is to sign the second-level device security by the second-level manager device ’s lower-level group private key to a plurality of communication devices whose device serial numbers are authorized communication device serial numbers respectively. certificate. Among the plurality of communication devices, the communication devices whose device serial numbers are within the authorized device serial number range belong to the lower-level group of communication devices. Then, the method of the present invention forms a plurality of certificate chains by combining the lower-level group authorization credentials with the second-level device security credentials. Each certificate chain corresponds to a communication device belonging to a lower-level group of communication devices. Finally, in the method of the present invention, each communication device belonging to the lower-level group of the communication device receives its corresponding certificate chain, and the received certificate chain is used to verify the lower-level group authorization certificate, And if the test result is positive, then the lower-level group public key in the lower-level group authorization certificate is used to verify the second-level device security certificate in the corresponding certificate chain, and if the test result is positive, then it is The corresponding second-level device security certificate replaces the first-level device security certificate in its memory, and the lower-level group public key replaces the upper-level group public key to verify the new group-device security certificate.

In a specific embodiment, each communication device generates a respective device private key and a respective device public key paired with the device private key. The private key of the lower-level group of the second manager device signs its corresponding second-level device security certificate based on the device serial number, device public key, and certificate of each communication device belonging to the lower-level group of communication devices. Each second-level device security certificate includes the device serial number of the corresponding communication device, the device public key, the validity period of the certificate, and the device certificate signature.

In a specific embodiment, the lower-level group authorization certificate includes an authorization certificate signature.

Compared with the prior art, the method of the present invention does not require a third party or a server, and further increases the security and convenience of communication device authentication. In addition, the method of the present invention can divide the upper-level group of communication devices into multiple different lower-level groups of communication devices by providing a certificate chain, which can make the lower-level groups of communication devices After the group obtains the authorization certificate from the upper-level group of the communication device, it has its own security authentication certificate, which is independent of the upper-level group of the communication device or other lower-level groups of the communication device.

The advantages and spirit of the present invention can be further understood through the following detailed description of the invention and the accompanying drawings.

10‧‧‧First Manager Device

12‧‧‧ communication device superior group

122, 124‧‧‧ Communication device lower group

122a, 122b, 122c, 124a, 124b, 124c‧‧‧ communication devices

14‧‧‧Second Manager Device

2‧‧‧ internet

3‧‧‧Method

S30 ~ S42‧‧‧Process steps

S50 ~ S64‧‧‧Process steps

FIG. 1 is a schematic diagram of an environmental architecture for implementing the method of the present invention.

FIG. 2 is a flowchart illustrating a preferred embodiment of the method of the present invention.

FIG. 3 is a further flowchart of the method of the present invention.

Please refer to FIG. 1 and FIG. 2, which is a flowchart illustrating a method 3 according to a preferred embodiment of the present invention. The method 3 of the present invention is used to authenticate the lower-level group 122 of the communication device. The implementation environment architecture of the method 3 of the present invention is shown in FIG. 1.

As shown in FIG. 1, the lower-level group 122 of the communication device is established based on the upper-level group 12 of the communication device. The communication device upper-level group 12 includes a plurality of communication devices (122a, 122b, 122c, 124a, 124b, 124c). In FIG. 1, in addition to the lower-level group 122 of the communication device, another lower-level group 124 of the communication device is also shown.

The first manager device 10 shown in FIG. 1 stores an upper-level group private key and an upper-level group public key paired with the upper-level group private key. Each communication device (122a, 122b, 122c, 124a, 124b, 124c) stores a respective first-level device security certificate and a respective device serial number.

In a specific embodiment, the first manager device 10 may be a server of a manufacturer or a coordination device in a first-order group above the upper-order group 12 of the communication device.

In a specific embodiment, each communication device (122a, 122b, 122c, 124a, 124b, 124c) has its own first-level device security certificate, which includes its own device serial number, its own public key, and a limited period of time. As shown in FIG. 2, the method 3 of the present invention first performs step S30, and the second manager device 14 generates a lower-level group private key and a lower-level group public key paired with the lower-level group private key. As shown in FIG. 1, the second manager device 14 can be connected to the first manager device 10 via the network 2.

In a specific embodiment, the type of the second manager device 14 may be various personal data processing devices, such as a desktop computer, a notebook computer, a smart phone, a tablet computer, or the like. (122a, 122b, 122c, 124a, 124b, 124c).

In a specific embodiment, the network 2 may be the Internet, an extranet, a local area network, a wide area network, or an Ethernet network. ), Cable TV network, radio telecommunication network, public switched telephone network, 3G network, 4G network, 5G network, HSPA network, Wi-Fi -Fi network, WiMAX network, LTE network, or other commercially available networks.

Then, the method 3 of the present invention executes step S32, and the lower-level group public key is signed by the first-level manager private device 10 or higher-level group private key, thereby generating a lower-level group authorization certificate. The lower-level group authorization certificate includes the lower-level group public key, the authorized device serial number range, and the authorization certificate signature.

Next, the method of the present invention executes step S34, and the private key of the lower-level group of the second manager device 14 is a plurality of communication devices (122a, 122b, 122c, 124a, 124b, 124c) whose device serial numbers are authorized respectively. The communication devices (122a, 122b, 122c) included in the device serial number range sign their respective Second-level device security credentials. Here, only the lower-level group 122 of the communication device is used as an example for description. Therefore, among multiple communication devices (122a, 122b, 122c, 124a, 124b, 124c), the device serial number is the communication devices (122a, 122b, 122c) included in the authorized device serial number range (excluding these communication devices) (124a, 124b, 124c)) belongs to the lower-level group 122 of the communication device.

Next, the method of the present invention executes step S36 to form a plurality of certificate chains by combining the lower-level group authorization credentials with the second-level device security credentials. Each certificate chain corresponds to a communication device (122a, 122b, 122c) belonging to the lower-level group 122 of the communication device.

Next, the method 3 of the present invention executes step S38. Each communication device 122a belonging to the lower-level group 122 of the communication device receives its corresponding certificate chain, and verifies the received certificate chain with the public key of the higher-level group. Its authorization credentials.

Next, if the verification of step S38 is affirmative, the present invention executes step S40 to verify by the public key of the lower-level group in the lower-level group authorization certificate of each communication device 122a belonging to the lower-level group 122 of the communication device. A second-level device security certificate in its corresponding certificate chain.

Finally, if the result of the check in step S40 is affirmative, step S42 is executed, and each communication device 122a belonging to the communication device lower-level group 122 replaces its corresponding second-level device security certificate with its first-level memory. Device security certificate, and the lower-level group public key replaces the higher-level group public key to verify the new group device security certificate.

In a specific embodiment, each communication device (122a, 122b, 122c, 124a, 124b, 124c) generates a respective device private key and a respective device public key paired with the device private key. The private key of the lower-level group of the second manager device 14 signs its corresponding first-party number based on the device serial number, device public key, and certificate of each communication device (122a, 122b, 122c) belonging to the lower-level group 122 of the communication device. Second-level device security credentials. Every second order The security certificate includes the device serial number of the corresponding communication device, the device public key, the validity period of the certificate, and the device certificate signature.

In a specific embodiment, the lower-level group authorization certificate includes an authorization certificate signature.

In practical applications, the method 3 of the present invention authorizes different lower-level groups in a manner of authorizing a credential chain, and is not limited to being executed between two levels. It can also be performed in a recursive manner. The manager device of the lower-level group then authorizes the manager device of the lower-level group in the same way, and the new device authentication certificate is issued by the private key of the last-level authorized manager of the lower-level group. The communication device manufactured by the factory always uses the original certificate to complete the authentication and establish a secure connection. When the authorization certificate chain is received, the original group public key is used to start the first-level authorization certificate inspection and obtain the next-level group. Group public key, and use this to verify the next-level certificate until the communication device certificate is verified, and use the last-level device certificate and group public key to update the previous-level device certificate and group public key to form a new authentication group group.

Please refer to FIG. 3, which is a further flowchart of method 3 of the present invention. The procedure shown in FIG. 3 is to perform authentication between the communication devices (122a, 122b, 122c). In the following, the first communication device 122a and the second communication device 122b of the communication devices (122a, 122b, 122c) belonging to the lower-level group 122 of the communication device will be taken as an example for illustration.

As shown in FIG. 3, the method 3 of the present invention further performs step S50, and the first communication device 122a and the second communication device 122b exchange their corresponding second-level device security credentials with each other.

Next, the method 3 of the present invention executes step S52, and the first communication device 122a verifies the second-level device security certificate of the second communication device 122b with its lower-level group public key to determine whether the second communication device 122b belongs to the communication. The lower-level group 122 of the device, and the second communication device 122b verifies the second-level device security certificate of the first communication device 122a with the public key of the lower-level group and judges Whether the first communication device 122a belongs to the lower-level group 122 of the communication device, and if the test results are all positive, step S54 is performed.

In step S54, the first communication device 122a and the second communication device 122b continue to exchange their respective random variables.

After step S54, the method 3 of the present invention executes step S56, the first temporary private key generated by the first communication device 122a and the first temporary public key paired with the first temporary private key, and generated by the second communication device 122b The second temporary private key and a second temporary public key paired with the second temporary private key.

After step S56, the method 3 of the present invention executes step S58, and the first communication device 122a transmits the first temporary public key to the second communication device 122b, and the second communication device 122b transmits the second temporary public key to the first Communication device 122a.

After step S58, the method 3 of the present invention executes step S60 by the first communication device 122a through the device public key of the second communication device 122b, the second temporary public key, the random variable of the second communication device 122b, and the first The device private key, the first temporary private key of the communication device 122a and the conference key are generated according to the key exchange protocol.

After step S60, the method 3 of the present invention executes step S62. The second communication device 122b uses the device public key of the first communication device 122a, the first temporary public key, the random variable of the first communication device 122a, and the second The device private key and the second temporary private key of the communication device 122b also generate a conference key in accordance with the key exchange protocol.

After step S62, the method 3 of the present invention executes step S64, and the first communication device 122a and the second communication device 122b establish a first communication secure channel with the second communication device 122b with the conference key.

Further, in the method 3 of the present invention, the first communication device 122a encrypts the network key with the conference key, and then transmits the encrypted network key. To other communication devices (122b, 122c) belonging to the communication device lower-level group 122. The first communication device 122a acts as a coordinator. The communication devices (122a, 122b, 122c) belonging to the lower-level group 122 of the communication device establish a second communication secure channel between the networks of the same group with each other by using a network key, thereby achieving the communication devices ( 122a, 122b, 122c) can perform machine-to-machine communication and exchange data.

Based on the detailed description of the above preferred embodiments, it is believed that the method of the present invention can be clearly understood without the need for a third party or a server, and the security and convenience of communication device authentication are further increased. In addition, the method of the present invention can divide the upper-level group of communication devices into multiple different lower-level groups of communication devices by providing a certificate chain, so that the lower-level groups of communication devices can obtain authorization from the upper-level groups of communication devices. After the certificate, it has its own security authentication certificate, which is independent of the upper-level group of communication devices or other lower-level groups of communication devices.

With the above detailed description of the preferred embodiments, it is hoped that the features and spirit of the present invention may be more clearly described, rather than limiting the aspects of the present invention with the preferred embodiments disclosed above. On the contrary, the intention is to cover various changes and equivalent arrangements within the scope of the patent scope of the present invention. Therefore, the aspect of the patent scope of the present invention should be explained in the broadest sense according to the above description, so that it covers all possible changes and equal arrangements.

Claims (5)

A method for authenticating a lower-level group of a communication device. The lower-level group of the communication device is established based on a higher-level group of the communication device. The upper-level group of the communication device includes a plurality of communication devices. Each device has a higher-level group private key and a higher-level group public key paired with the higher-level group private key. Each communication device has a respective first-level device security certificate and a higher-level group public key. The key and a respective device serial number include the following steps: a lower-level group private key is generated by a second manager device and a lower-level group public key paired with the lower-level group private key; and the first manager The device signs the lower-level group public key and an authorized device serial number range with the upper-level group private key, thereby generating a lower-level group authorization certificate. The lower-level group authorization certificate includes the lower-level group public key, the Authorized device serial number range and an authorization certificate signature; the second manager device uses the lower-level group private key as the communication number included in the authorized device serial number range among the multiple communication devices Device signing Respective second-level device security credentials, wherein the communication device of the plurality of communication devices whose device serial number is the authorized device serial number range belongs to the lower-level group of the communication device; authorize the lower-level group The certificate combines the second-level device security credentials to form multiple certificate chains, each of which corresponds to a communication device belonging to a lower-level group of the communication device; and each communication belonging to a lower-level group of the communication device The device receives its corresponding certificate chain, verifies the lower-level group authorization certificate with the upper-level group public key, and if the test result is positive, it uses the lower-level group public certificate in the lower-level group authorization certificate. Key to verify the second-order device security certificate in its corresponding certificate chain, and if the test result is affirmative, its corresponding second-tier device security certificate replaces the first-layer device security certificate in its memory. The method according to claim 1, wherein each communication device generates a respective device private key and a respective device public key paired with the device private key, and the second-level manager device uses the lower-level group The private key signs its corresponding second-level device security certificate based on the device serial number, the device public key, and a certificate of each communication device belonging to the lower-level group of the communication device, and each second-level device security certificate It includes the device serial number of the corresponding communication device, the device public key, the validity period of the certificate, and a device certificate signature. The method according to claim 2, wherein the lower-level group authorization certificate further includes an authorization certificate signature. The method according to claim 3, wherein the communication devices belonging to a lower-level group of the communication device include a first communication device and a second communication device, and the method further includes the following steps: the first communication device Exchange the corresponding second-tier device security certificate with the second communication device with each other; the first communication device verifies the second-layer device security certificate of the second communication device with its lower-level group public key to determine the first Whether the second communication device belongs to the lower-level group of the communication device, and the second communication device checks the second-level device security certificate of the first communication device with the public key of the lower-level group to determine whether the first communication device Belong to the lower-level group of the communication device, and if the test results are positive, then perform the following steps: the first communication device and the second communication device continue to exchange each other with each of its generated random variables; The first communication device generates a first temporary private key and a first temporary public key paired with the first temporary private key, and a second temporary private key is generated by the second communication device. Key and a second temporary public key paired with the second temporary private key; the first temporary public key is transmitted from the first communication device to the second communication device, and the second temporary device is transmitted by the second communication device A public key to the first communication device; and the device public key, the second temporary public key, the random variable of the second communication device, and the first communication by the first communication device through the second communication device The device private key, the first temporary private key of the device and a conference key are generated according to a key exchange protocol; the second communication device uses the device public key of the first communication device, the first temporary public key Key, the random variable of the first communication device and the device private key of the second communication device, the second temporary private key, and the conference key is also generated according to the key exchange protocol; and the first communication The device and the second communication device use the conference key to establish a first communication secure channel between each other. The method according to claim 4, further comprising the steps of: encrypting a network key by the first communication device with the conference key, and then transmitting the encrypted network key to the communication belonging to the communication The other communication devices of the lower-level device group, wherein the communication devices belonging to the lower-level group of the communication device establish a second communication security channel between each other by using the network key.