TWI822417B - A authentication method - Google Patents

Abstract

A authentication method, includes the steps of：(A)upon reception of the authentication request via a communication network, obtaining a first verification information; (B)obtaining a first authentication hash value and a first verification hash value by first hash operation the first certification information and the first verification information; (C)determining whether the first authentication hash value and the first verification hash value are consistent; (D)upon determining that is same, transmitting a legal judgment result that the first authentication information is legal to the second device; and (E)upon determining that is not same, transmitting the illegal judgment result that the first authentication information is illegal to the second device.

Description

Identity authentication method

The present invention relates to an electronic digital data processing method, and in particular to an identity authentication method based on the Industrial Internet of Things.

In order to produce a large number of goods in a manufacturing factory environment, the equipment of the manufacturing factory usually needs to be kept in operation for a long time, and there are many devices in the factory. If you want to update the firmware of the equipment or report the status of the equipment, it is common to use The factory's internal network transmits data wirelessly.

However, in the environment of a manufacturing factory, if data needs to be transmitted and the device needs to receive data, there is usually a lack of a way to authenticate the identity, and it is impossible to confirm whether the device that wants to receive the data is legal in the manufacturing factory. equipment, so that the data may be at risk of being leaked, or the data may be subject to unknown malicious tampering and other attacks. Therefore, if a method can be proposed to ensure whether the data receiving end is legitimate before the data is transmitted, it can reduce the risk of data leakage. Reduce the risk of leakage and effectively block possible malicious attacks to improve the security of data transmission.

Therefore, the purpose of the present invention is to provide an identity authentication method that can ensure whether the device is legal through identity authentication to enhance data security.

Therefore, an identity authentication method of the present invention is implemented by an authentication system. The authentication system includes a central control device, a first device, and a second device. The second device communicates with the central control device through a communication network. Connected to the first device, the central control device stores multiple pieces of verification information respectively corresponding to multiple codes. The method includes one step (A), one step (B), one step (C), and one step (D). , and step (E).

In step (A), when the central control device receives an authentication request from the second device via the communication network and includes first authentication information and a first code related to the first device, the central control device The central control device obtains a pair of first verification information corresponding to the first code based on the first code.

In step (B), the central control device performs a first hash operation on the first authentication information and the first verification information to obtain a pair of first authentication hash values corresponding to the first authentication information, and a pair of first authentication hash values corresponding to the first authentication information. The first verification hash value that should be first verified.

In this step (C), the central control device determines whether the first authentication hash value and the first verification hash value are consistent.

In step (D), when it is determined that the first authentication hash value and the first verification hash value are consistent, the central control device generates and transmits through the communication network a legal determination indicating that the first authentication information is legal. The result is passed to the second device.

In step (E), when it is determined that the first authentication hash value and the first verification hash value are inconsistent, the central control device sends an illegal determination result indicating that the first authentication information is illegal to the third Two devices.

The effect of the present invention is to: obtain the first verification information through the central control device, and perform the first hash operation on the first authentication information and the first verification information to obtain the first authentication hash value and the first Verify the hash value, and determine whether the first authentication hash value and the first verification hash value are consistent to determine whether the first authentication information is legal, thereby ensuring the identity of the first device.

1: Authentication system

10:Communication network

11: Central control device

12:First device

13: Second device

14:Management device

601~608: Steps

701~712: Steps

801~811: Steps

Other features and functions of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating an authentication system for executing the identity authentication method of the present invention; Figure 2 is a process Figures illustrate a first authentication procedure of the embodiment of the identity authentication method of the present invention; Figure 3 is a flow chart illustrating a second authentication procedure of the embodiment; and Figure 4 is a flow chart illustrating a second authentication procedure of the embodiment. 1. Document authentication procedure.

Before the present invention is described in detail, attention should be paid to the following description , similar components are represented by consistent numbers.

Referring to Figure 1, an embodiment of the identity authentication method of the present invention is implemented by an authentication system 1. The authentication system 1 includes a central control device 11 and a first device connected to the central control device 11 through a communication network 10. The device 12 , a second device 13 connected to the central control device 11 via the communication network 10 and a management device 14 connected to the central control device 11 via the communication network 10 .

The central control device 11 stores multiple pieces of verification information corresponding to multiple codes, where each verification information includes a device account and a device password, but is not limited to this.

The first device 12 stores a first authentication information and a first code, wherein the first authentication information includes a first device account and a first device password, but is not limited to this.

The second device 13 stores a second authentication information and a second code, wherein the second authentication information includes a second device account and a second device password, but is not limited to this.

In this embodiment, the authentication system 1 can be an industrial Internet of Things system, or a public equipment authentication system composed of multiple public devices installed in a specific place, or multiple Raspberry Pis. One microcomputer authentication system, but not limited to this. The implementation form of the central control device 11 is, for example, a personal computer, a server or a cloud host, but is not limited thereto. The first device 12 and the second device The implementation form of 13 is, for example, a personal computer, a tablet computer, a notebook computer or an industrial personal computer (IPC), but is not limited to this.

It should be noted that in this embodiment, the first device 12 is an edge computing device with edge computing functions, such as an OPC Unified Architecture Client (OPC UA Client) or a Message Queuing Telemetry Transmission Agent (MQTT Broker). , or Advanced Message Queuing Protocol Broker (AMQP Broker), the second device 13 is a terminal device with the function of controlling terminal equipment, such as OPC Unified Architecture Server (OPC UA Sever), Message Queue Telemetry Transmission Publisher (MQTT Publisher) , Message Queue Telemetry Transmission Subscriber (MQTT Subscriber), Advanced Message Queuing Protocol Publisher (AMQP Publisher), or Advanced Message Queuing Protocol Consumer (AMQP Consumer). In other implementations, the first device 12 can also be a terminal. The device and the second device 13 are edge computing devices, or the first device 12 and the second device 13 are both terminal devices or edge computing devices, and are not limited to this.

The following describes the embodiment of the identity authentication method of the present invention. The embodiment includes a first authentication process, a second authentication process, and a data authentication process.

Referring to Figures 1 and 2, the first authentication procedure illustrates how the second device 13 determines whether the first device 12 is legal when the first device 12 requests a connection from the second device 13, and includes the following steps .

In step 601, the first device 12 generates and sends a connection request to the second device 13 via the communication network 10, wherein the connection request includes the first authentication Information and the first code number.

In step 602, the second device 13 stores the first authentication information and sends an authentication request including the first authentication information and the first code to the central control device 11 via the communication network 10.

In step 603, the central control device 11 obtains a pair of first verification information corresponding to the first code from the verification information based on the first code.

In step 604, the central control device 11 performs a first hash operation on the first authentication information and the first verification information to obtain a pair of first authentication hash values corresponding to the first authentication information and a pair of corresponding first authentication hash values. The first verification hash value of a verification message.

It is worth noting that in this embodiment, the first hash operation uses Secure Hash Algorithm 256-bit (SHA-256), but it is not limited to this.

In step 605, the central control device 11 determines whether the first authentication hash value and the first verification hash value are consistent to determine whether the first authentication information is legal. When the central control device 11 determines that the first authentication hash value is consistent with the first verification hash value, it determines that the first authentication information is legal, and the process proceeds to step 606; when the central control device 11 determines that the first authentication information is legal. When the hash value and the first verification hash value are inconsistent, it is determined that the first device 12 is illegal, and the process proceeds to step 607.

In step 606, the central control device 11 generates an indication indicating the first Verify the legal determination result and a key that the information is legal, and transmit the legal determination result and the key to the second device 13 via the communication network 10 .

In step 607, the central control device 11 generates and sends an illegal determination result indicating that the first authentication information is illegal to the second device 13 via the communication network 10, and generates and sends an illegal determination result via the communication network 10. A warning message is sent to the management device 14.

In step 608, the second device 13 removes the first authentication information according to the illegal determination result.

In this way, it is determined whether the identity of the first device 12 matches the corresponding first verification information stored in the central control device 11, and whether it is a legitimate first device 12, so as to implement identity authentication.

It is worth noting that after the first authentication process is successfully authenticated, that is, after step 606, the second authentication process will be executed to perform double authentication to enhance security. In other implementations, only this process may be performed. The first certification process is not limited to this.

Referring to FIGS. 1 and 3 , the second authentication procedure illustrates how the first device 12 and the second device 13 authenticate each other, and includes the following steps.

In step 701 , the second device 13 transmits the second authentication information and the key to the first device 12 via the communication network 10 .

In step 702, the first device 12 transfers the key, the second authentication information message, and performs a second hash operation on the first authentication information to obtain a first hash-based message authentication code (HMAC).

It is worth noting that the second hash operation also uses a secure hash algorithm of 256 bits, but unlike the first hash operation, the second hash operation first combines the key, the second authentication information, and The first authentication information performs logical operations such as OR, exclusive-OR, XOR, etc., but is not limited to this.

In step 703, the first device 12 transmits the first hash message identification code to the second device 13 via the communication network 10.

In step 704, the second device 13 performs the second hash operation on the key, the first authentication information, and the second authentication information to obtain a second hash message authentication code.

In step 705, the second device 13 determines whether the first hash message authentication code and the second hash message authentication code are consistent. When the second device 13 determines that the first hash message identification code and the second hash message identification code are consistent, the second device 13 determines that the first device 12 is legitimate, and the process proceeds to step 707; when the second device 13 When it is determined that the first hash message authentication code and the second hash message authentication code are inconsistent, the second device 13 determines that the first device 12 is illegal, and the process proceeds to step 706.

In step 706, the second device 13 generates and sends a verification failure message to the central control device 11 via the communication network 10, and the process proceeds to step 712.

In step 707, the second device 13 performs a third hash operation on the stored key, the first authentication information, and the second authentication information to obtain a third hash message authentication code.

It is worth noting that the third hash operation is similar to the second hash operation, except that the logical operation performed is different, but is not limited thereto.

In step 708, the second device 13 transmits the third hash message authentication code to the first device 12 via the communication network 10.

In step 709, the first device 12 performs the third hash operation on the key, the first authentication information, and the second authentication information to obtain a fourth hash message authentication code.

In step 710, the first device 12 determines whether the third hash message authentication code and the fourth hash message authentication code are consistent. When the first device 12 determines that the third hash message identification code and the fourth hash message identification code are consistent, the first device 12 determines that the second device 13 is legitimate, and the process proceeds with the data authentication process; when the first device 12 determines that the second device 13 is legitimate. When the device 12 determines that the third hash message authentication code and the fourth hash message authentication code are inconsistent, the first device 12 determines that the second device 13 is illegal, and the process proceeds to step 711.

In step 711 , the first device 12 generates and sends the verification failure message to the central control device 11 via the communication network 10 .

In step 712 , the central control device 11 generates and sends the warning message to the management device 14 via the communication network 10 according to the verification failure message.

In this way, the first device 12 and the second device 13 can authenticate each other's identities to further ensure whether they are the objects that need to communicate with each other.

Referring to Figures 1 and 4, the data authentication procedure illustrates how the second device 13 verifies the message sent by the first device 12, and includes the following steps.

In step 801, the first device 12 performs the first hash operation on a communication information to obtain a communication hash value. The communication information includes, for example, the temperature, humidity, and operating status related to the first device 12, but is not limited to this.

In step 802, the first device 12 encrypts the communication information using the key to obtain encrypted communication information.

In step 803, the first device 12 encodes the communication hash value and the encrypted communication information. The first device 12 encodes the communication hash value and the encrypted communication information into UTF-8 (8-bit Unicode Transformation Format) format, but is not limited to this.

In step 804, the first device 12 transmits the encoded communication hash value and the encrypted communication information to the second device 13 via the communication network 10.

In step 805, the second device 13 decodes the encoded communication hash value and the encrypted communication information.

In step 806, the second device 13 decrypts the encrypted communication information using the key to obtain decrypted communication information.

In step 807, the second device 13 performs the decrypted communication information on A first hash operation is performed to obtain a decrypted communication hash value.

In step 808, the second device 13 determines whether the communication hash value and the decrypted communication hash value are consistent to determine whether the decrypted communication information is legal. When the second device 13 determines that the communication hash value and the decrypted communication hash value are consistent, it determines that the decrypted communication information is legal, and the process proceeds to step 809; when the second device 13 determines that the communication hash value and the decrypted communication hash value are consistent When the values are inconsistent, it is determined that the decrypted communication information is illegal, and the process proceeds to step 810.

In step 809, the second device 13 performs corresponding actions based on the decrypted communication information. The corresponding action may be to analyze whether the operating status, temperature, or humidity of the first device 12 is normal, but is not limited to this.

In step 810 , the second device 13 generates and sends the verification failure message to the central control device 11 via the communication network 10 .

In step 811 , the central control device 11 generates and sends the warning message to the management device 14 via the communication network 10 .

It is worth mentioning that if the authentication system 1 is a microcomputer authentication system, and the central control device 11, the first device 12 and the second device 13 included in the authentication system 1 are all of the Shumei system, compared to In terms of computer hardware, the hardware architecture can be more lightweight to implement the identity authentication method of the present invention.

To sum up, the identity authentication method of the present invention uses the central control device 11 to determine the first authentication process when the central control device 11 performs the first authentication procedure. Whether the hash value is consistent with the first verification hash value is used to determine whether the first authentication information is legal and to ensure the legal identity of the first device 12. In the second authentication process after determining that the first device 12 is legal, The second device 13 determines whether the first hash message authentication code and the second hash message authentication code are consistent, and the first device 12 determines whether the third hash message authentication code and the fourth hash message authentication code are consistent, so as to Mutually verify each other's identities to ensure the legal identity of the parties communicating with each other. In the data authentication process after mutually verifying that both the first device 12 and the second device 13 are legal, the first device 12 uses the communication information to The key is encrypted, and the second device 13 determines whether the communication hash value and the decrypted communication hash value are consistent, which can further ensure the accuracy of data transmission between the first device 12 and the second device 13. To ensure data security, the purpose of the present invention can indeed be achieved.

However, the above are only examples of the present invention. They cannot be used to limit the scope of the present invention. All simple equivalent changes and modifications made based on the patent scope of the present invention and the contents of the patent specification are still within the scope of the present invention. within the scope covered by the patent of this invention.

601~608: Steps

Claims (6)

An identity authentication method is implemented through an authentication system. The authentication system includes a central control device, a first device, and a second device. The second device communicates with the central control device and the first device through a communication network. Device connection, the central control device stores a plurality of verification information corresponding to multiple codes, the second device stores a second authentication information, the method includes the following steps: (A) When the central control device receives through the communication network When an authentication request comes from the second device and includes first authentication information and a first code related to the first device, the central control device obtains a first code corresponding to the first code based on the first code. Verification information; (B) The central control device performs a first hash operation on the first authentication information and the first verification information to obtain a pair of first authentication hash values corresponding to the first authentication information, and a pair of corresponding first authentication hash values. A first verification hash value of verification information; (C) The central control device determines whether the first certification hash value and the first verification hash value are consistent; (D) When it is determined that the first certification hash value and the first verification hash value are When verifying that the hash values are consistent, the central control device generates and transmits a key and a legal determination result indicating that the first authentication information is legal to the second device through the communication network; (E) when it is determined that the first authentication information is legal When the hash value and the first verification hash value are inconsistent, the central control device sends an illegal determination result indicating that the first authentication information is illegal to the second device; (F) The second device transmits the second authentication information and the key to the first device via the communication network; (G) The first device transmits the key, the second authentication information, and the first The authentication information performs a second hash operation to obtain a first hash message authentication code; (H) the first device transmits the first hash message authentication code to the second device via the communication network; (I) the first device The two devices perform the second hash operation on the key, the first authentication information, and the second authentication information to obtain a second hash message authentication code; (J) the second device determines the first hash message authentication code Whether the code and the second hash message authentication code are consistent; (K) when it is determined that the first hash message authentication code and the second hash message authentication code are consistent, the second device determines that the first device is legitimate; and (L) ) When it is determined that the first hash message identification code and the second hash message identification code are inconsistent, the second device determines that the first device is illegal. As for the identity authentication method described in claim 1, the first device stores the first authentication information and the first code, and the following steps are further included before step (A): (M) the first device generates and passes the The communication network sends a connection request to the second device, wherein the connection request includes the first authentication information and the first code; and (N) the second device stores the first authentication information and includes the first authentication information. A certification information and a certification request for the first code are transmitted through the communication network Sent to the central control device; after step (E), the following steps are also included: (O) the second device removes the first authentication information based on the illegal determination result. The identity authentication method as described in claim 1, wherein in step (K), the second device also performs a third hash on the stored key, the first authentication information, and the second authentication information. The operation is performed to obtain a third hash message authentication code. After step (K), the following steps are also included: (P) The second device performs a first step on the key, the first authentication information, and the second authentication information. Three hash operations are performed to obtain a third hash message authentication code; (Q) the second device transmits the third hash message authentication code to the first device through the communication network; (R) the first device sends the password The key, the first authentication information, and the second authentication information perform the third hash operation to obtain a fourth hash message authentication code; (S) the first device determines the third hash message authentication code and the fourth Whether the hash message authentication code is consistent; (T) when it is determined that the third hash message authentication code and the fourth hash message authentication code are consistent, the first device determines that the second device is legitimate; and (U) when it is determined that the When the third hash message identification code and the fourth hash message identification code are consistent, the first device determines that the second device is illegal. As for the identity authentication method described in claim 3, the authentication system further includes a management device connected to the central control device via the communication network, wherein, In step (L), the second device also generates and sends a verification failure message to the central control device through the communication network. In step (U), the first device also generates and sends the verification message through the communication network. The failure message is sent to the central control device, and the following steps are also included after steps (L) and (U): (V) the central control device generates and sends a warning message to the management device through the communication network based on the verification failure message. The identity authentication method described in claim 3 further includes the following steps after step (T): (X) The first device performs the first hash operation on a communication information to obtain a communication hash value; (Y) ) The first device encrypts the communication information with the key to obtain an encrypted communication information, and transmits the communication hash value and the encrypted communication information to the second device through the communication network; (Z) the first device The second device decrypts the encrypted communication information using the key to obtain a decrypted communication information; (α) the second device performs the first hash operation on the decrypted communication information to obtain a decrypted communication hash value; (β ) The second device determines whether the communication hash value and the decrypted communication hash value are consistent; (γ) when it is determined that the communication hash value and the decrypted communication hash value are consistent, the second device determines that the decrypted communication information is legal; and (δ) When it is determined that the communication hash value and the decryption communication hash value are inconsistent, the second device determines that the decryption communication information is illegal. The identity authentication method as described in claim 5, wherein in step (Y), the The first device first transmits the communication hash value and the encrypted communication information code to the second device. In step (Z), the second device first decodes the communication hash value and the encrypted communication information and then decrypts it. The first hash operation.

Images