WO2016176902A1

WO2016176902A1 - Terminal authentication method, management terminal and application terminal

Info

Publication number: WO2016176902A1
Application number: PCT/CN2015/082896
Authority: WO
Inventors: 钟焰涛; 傅文治; 林荣辉; 谭中军
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2015-05-06
Filing date: 2015-06-30
Publication date: 2016-11-10
Also published as: CN105578457B; CN105578457A

Abstract

Provided in embodiments of the present invention are a terminal authentication method, management terminal and application terminal. The method comprises: upon receiving a group joining application message carrying a first digital certificate and transmitted by an application terminal, encrypting, according to the first digital certificate, a first target value to obtain a first encryption result; transmitting the first encryption result and a second digital certificate of a local terminal to the application terminal, such that the application terminal decrypts the first encryption result to obtain a second target value, and encrypts, according to the second digital certificate, the second target value to obtain a second encryption result; and acquiring the second encryption result transmitted by the application terminal, decrypting the second encryption result to obtain a third target value, and if the third target value and the first target value are the same, then enabling the application terminal to pass the authentication. The embodiments of the present invention improve security of an authentication process.

Description

Terminal authentication method, management terminal and application terminal

This application claims priority to Chinese Patent Application No. 201510226966.1, entitled "A Terminal Authentication Method, Management Terminal, and Application Terminal" on May 6, 2015, the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of mobile communications technologies, and in particular, to a terminal authentication method, a management terminal, and an application terminal.

Background technique

Device-to-Device (D2D) communication is a new technology that allows terminals to communicate directly by multiplexing cell resources under the control of the system. It can increase the spectrum efficiency of the cellular communication system and reduce the terminal transmission. Power, to a certain extent, solves the problem of lack of spectrum resources in wireless communication systems. According to the definition of D2D communication in the 3rd Generation Partnership Project (3GPP) document, D2D communication includes different communication methods such as one-to-one communication and group communication. In D2D group communication, one user equipment acts as a group manager to establish a group, other user equipments join a group, and end-to-end communication is implemented within the group.

When a user equipment applies to join a communication group, the administrator of the group must authenticate the user equipment. The current authentication method is that the applicant sends his digital certificate to the administrator, and the administrator verifies the digital certificate. The legality of the digital signature, if legal, accepts the applicant's application and joins the applicant to the communication group. However, since the digital certificate is easily acquired by other user equipments, once the applicant's digital certificate is stolen by other user equipment and participates in the authentication process, the applicant cannot join the communication group, thereby affecting the security of the authentication process.

Summary of the invention

The embodiment of the invention provides a terminal authentication method, a management terminal and an application terminal, which can improve the security of the authentication process.

A first aspect of the embodiments of the present invention provides a terminal authentication method, which may include:

When the management terminal receives the application that is sent by the application terminal and carries the first digital certificate, joins the group. And the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result;

The management terminal sends the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to the The second digital certificate encrypts the second target value to obtain a second encryption result;

The management terminal acquires the second encryption result sent by the application terminal, and decrypts the second encryption result to obtain a third target value, and the third target value is compared with the first target value. At the same time, the authentication of the application terminal is passed.

The second aspect of the embodiment of the present invention provides another terminal authentication method, which may include:

The application terminal sends an application for carrying the first digital certificate of the local end to join the group message to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result;

Receiving, by the application terminal, the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypting the first encryption result to obtain a second target value and according to the second number The certificate encrypts the second target value to obtain a second encryption result;

Transmitting, by the application terminal, the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and the third target value and the When the first target value is the same, the authentication of the local end is passed.

A third aspect of the embodiments of the present invention provides a management terminal, which may include:

An encryption unit, configured to: when the management terminal receives the application that is sent by the application terminal and carries the first digital certificate, join the group message, and encrypt the first target value according to the first digital certificate to obtain the first encryption result;

a sending unit, configured to send the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to the The second digital certificate encrypts the second target value to obtain a second encryption result;

a decrypting unit, configured to acquire the second encryption result sent by the application terminal, and decrypt the second encryption result to obtain a third target value, and the third target value and the first target value The same is true for the authentication of the application terminal.

A fourth aspect of the embodiments of the present invention provides an application terminal, which may include:

a message sending unit, configured to send an application that joins the first digital certificate of the local end to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result;

a decryption encryption unit, configured to receive the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypt the first encryption result to obtain a second target value and according to the first The second digital certificate encrypts the second target value to obtain a second encryption result;

a result sending unit, configured to send the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and at the third target value When the first target value is the same, the authentication of the local end is performed.

In the embodiment of the present invention, when the management terminal receives the application that carries the first digital certificate and sends the group message, the management terminal encrypts the first target value according to the first digital certificate to obtain the first encryption result. And then the management terminal sends the first encryption result and the second digital certificate of the management terminal to the application terminal, and the application terminal decrypts the first encryption result to obtain a second target value, and encrypts the second target value according to the second digital certificate. The second encryption result is that the application terminal sends the second encryption result to the management terminal, the management terminal decrypts the second encryption result to obtain a third target value, and the third terminal value is the same as the first target value, and the authentication is performed on the application terminal. The management terminal completes the authentication process of the application terminal according to the encryption and decryption result, and improves the security of the authentication process.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

FIG. 1 is a schematic flowchart of a method for authenticating a terminal according to an embodiment of the present disclosure;

2 is a schematic flowchart of another terminal authentication method according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of still another terminal authentication method according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart diagram of still another terminal authentication method according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a management terminal according to an embodiment of the present disclosure;

6 is a schematic structural diagram of an encryption unit provided by the embodiment shown in FIG. 5;

7 is a schematic structural diagram of a decryption unit provided by the embodiment shown in FIG. 5;

FIG. 8 is a schematic structural diagram of an application terminal according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of a decryption and encryption unit provided by the embodiment shown in FIG. 8.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terminal authentication method, the management terminal, and the application terminal provided by the embodiment of the present invention can be applied to the scenario in which the management terminal authenticates the application terminal in the D2D communication. For example, the management terminal and the application terminal are not in the network coverage, that is, the current network. The signal difference does not support cellular communication between terminals, and D2D communication can be performed between terminals. When the application terminal wants to join the D2D communication group where the management terminal is located and communicates with the group members in the group, the management terminal needs to apply for the terminal. The authentication of the authentication process can be implemented by using the embodiment of the present invention to implement authentication of the application terminal by the management terminal, preventing the digital certificate of the application terminal from being intercepted and utilized by other terminals. When the digital certificate of the application terminal is acquired by other terminals, the other terminal cannot decrypt the result of the management terminal encryption, and prevents the criminals from joining the group where the management terminal is located.

The management terminal and the application terminal provided by the embodiments of the present invention may include, but are not limited to, an electronic device such as a mobile phone, a PAD (tablet computer), and a smart wearable device. The management terminal provided by the embodiment of the present invention is a manager who establishes a group in the D2D communication, and is responsible for authenticating other terminals that apply to join the group, and realizing communication between any two terminals in the group, and the terminals pass the wireless channel. The communication is performed. Therefore, the premise of the embodiment of the present invention is that the frequency of the wireless channel used by the application terminal and the management terminal is the same.

The terminal authentication method provided by the embodiment of the present invention will be described in detail below with reference to FIG.

FIG. 1 is a schematic flowchart of a method for authenticating a terminal according to an embodiment of the present invention. The method may include steps S101 to S103.

S101. When the management terminal receives the application that is sent by the application terminal and carries the first digital certificate, the application joins. And the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result.

Specifically, when the management terminal and the application terminal use the same radio channel frequency, the management terminal may receive an application joining group message sent by the application terminal, where the application joining group message carries a first digital certificate, The first digital certificate is a digital certificate of the application terminal, and the digital certificate is a file containing the public key owner information and the public key digitally signed by the certificate authority. The simplest certificate contains a public key, a name, and a digital signature from the certificate authority. The digital certificate adopts a public key system, that is, a pair of mutually matching keys are used for encryption and decryption.

When the management terminal receives the application joining group message, the management terminal first checks whether the digital signature of the first digital certificate is correct, and when the digital signature of the first digital certificate is correct, the management The terminal acquires the public key of the first digital certificate, and encrypts the first target value by using the public key of the first digital certificate to obtain a first encryption result. The first target value is a value arbitrarily selected by the management terminal.

S102, the management terminal sends the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to The second digital certificate encrypts the second target value to obtain a second encryption result.

Specifically, the management terminal reads the second digital certificate of the local end, and sends the first encryption result and the second digital certificate obtained by the step S101 to the application terminal, where the second digital certificate includes The public key of the second digital certificate. When the application terminal receives the first encryption result and the second digital certificate sent by the management terminal, the application terminal performs the first encryption result by using a private key of the first digital certificate of the local end. Decrypting to obtain a second target value, and then the application terminal encrypts the second target value by using a public key of the second digital certificate to obtain a second encryption result. The second target value may be the same as the first target value, or may be different. When the management terminal sends the first encryption result and the second digital certificate, it is not attacked by the outside world. And the second target value is the same as the first target value, otherwise the second target value obtained by the application terminal decryption is different from the first target value. Since the first encryption result is obtained by encrypting the public key of the first digital certificate, and the second encryption result is obtained by encrypting the public key of the second digital certificate, the public key is different, so the first The second encryption result is different from the first encryption result, even if the second target value is the same as the first target value, The second encryption result is also different from the first encryption result.

S103. The management terminal acquires the second encryption result sent by the application terminal, and decrypts the second encryption result to obtain a third target value, and the third target value and the first target. The authentication of the application terminal is made when the values are the same.

Specifically, the management terminal acquires the second encryption result sent by the application terminal, and reads a private key of the second digital certificate, and then uses the private key of the second digital certificate to the second The encrypted result is decrypted to obtain a third target value. The third target value may be the same as the second target value, and may be different. When the application terminal is not attacked by the outside world in sending the second encryption result, the third target value Same as the second target value, otherwise the third target value obtained by the management terminal decryption is not the same as the second target value. Therefore, when the wireless channel between the management terminal and the application terminal does not receive an external attack, the first target value is the same as the third target value. When the third target value is the same as the first target value, the management terminal adds the application terminal to the group by using the authentication of the application terminal, and notifies the application terminal that the application is successful. It is possible to participate in communication between the groups.

It should be noted that, in the case that the digital certificate of the application terminal is stolen by other terminals, for example, the digital certificate of the application terminal is stolen by the terminal A and participates in the authentication process of the embodiment of the present invention, the terminal A may not be able to Decrypting the first encryption result with its own private key, or the terminal A may forge the second target value. If the terminal A falsifies the second target value, the second target value is The first target value is different from the first target value, so the management terminal rejects the authentication application for the terminal A, and does not allow the terminal A to join the group, thereby improving the security of the group and the authentication process.

FIG. 2 is a schematic flowchart of another method for authenticating a terminal according to an embodiment of the present invention. The method may include steps S201 to S206.

S201: When the management terminal receives the group message that is sent by the application terminal and carries the first digital certificate, the management terminal checks whether the digital signature of the first digital certificate is correct.

When the management terminal receives the application joining group message, the management terminal first checks whether the digital signature of the first digital certificate is correct, and when the digital signature of the first digital certificate is correct, the management The terminal can perform the subsequent authentication process; when the digital signature of the first digital certificate is incorrect, the management terminal rejects the middle calling terminal to join the group.

S202. When the digital signature of the first digital certificate is correct, the management terminal acquires the public key of the first digital certificate, and encrypts the first target value by using the public key of the first digital certificate. An encrypted result.

Specifically, when the digital signature of the first digital certificate is correct, it can be understood that the first digital certificate is a legal digital certificate of the application terminal, and therefore the management terminal acquires the publicity of the first digital certificate. Key, and encrypting the first target value by using the public key of the first digital certificate to obtain a first encryption result. The first target value is a value arbitrarily selected by the management terminal. For example, the first target value is r ₁ , the public key of the first digital certificate is pk ₁ , and the first encryption result obtained by the management terminal is e ₁ .

S203, the management terminal reads the second digital certificate of the local end, and sends the first encryption result and the second digital certificate to the application terminal, so that the application terminal adopts the first digital certificate. The private key decrypts the first encryption result to obtain a second target value, and encrypts the second target value by using the public key of the second digital certificate to obtain a second encryption result.

Specifically, the management terminal reads the second digital certificate of the local end, and sends the first encryption result and the second digital certificate obtained by the step S202 to the application terminal, where the second digital certificate includes The public key of the second digital certificate. When the application terminal receives the first encryption result and the second digital certificate sent by the management terminal, the application terminal performs the first encryption result by using a private key of the first digital certificate of the local end. Decrypting to obtain a second target value, and then the application terminal encrypts the second target value by using a public key of the second digital certificate to obtain a second encryption result. For example, the public key of the second digital certificate is pk ₂ , the management terminal sends the first encryption result e ₁ and pk ₂ to the application terminal, and the second target obtained by the application terminal decrypts The value is r ₂ , and the second encrypted result obtained by encryption is e ₂ .

The second target value may be the same as the first target value, or may be different. When the management terminal sends the first encryption result and the second digital certificate, it is not attacked by the outside world. And the second target value is the same as the first target value, otherwise the second target value obtained by the application terminal decryption is different from the first target value. Since the first encryption result is obtained by encrypting the public key of the first digital certificate, and the second encryption result is obtained by encrypting the public key of the second digital certificate, the public key is different, so the first The second encryption result is different from the first encryption result, and the second encryption result is different from the first encryption result even if the second target value is the same as the first target value.

S204. The management terminal acquires a second encryption result sent by the application terminal.

Specifically, the application terminal sends the second encryption result encrypted by using the public key of the second digital certificate to the management terminal, and the management terminal acquires a second encryption result sent by the application terminal.

S205. The management terminal reads the private key of the second digital certificate, and decrypts the second encryption result by using a private key of the second digital certificate to obtain a third target value.

Specifically, the result of encrypting with a digital certificate public key can only be decrypted by using the private key of the digital certificate, so the management terminal reads the private key of the second digital certificate, and uses the second number. The private key of the certificate results in the second encryption result to obtain a third target value. For example, the management terminal decrypts the second encryption result e ₂ to obtain the third target value r ₃ .

The third target value may be the same as the second target value, and may be different. When the application terminal is not attacked by the outside world in sending the second encryption result, the third target value Same as the second target value, otherwise the third target value obtained by the management terminal decrypting The second target value is not the same. Therefore, when the wireless channel between the management terminal and the application terminal does not receive an external attack, the first target value is the same as the third target value.

S206. Pass the authentication of the application terminal when the third target value is the same as the first target value.

Specifically, when the third target value is the same as the first target value, it may be understood that the wireless channel between the management terminal and the application terminal is not attacked by the outside, and the management terminal passes the The authentication of the application terminal adds the application terminal to the group, and notifies the application terminal that the application is successful, and can participate in communication between the groups.

FIG. 3 is a schematic flowchart of still another method for authenticating a terminal according to an embodiment of the present invention. The method may include steps S301 to S303.

S301. The application terminal sends an application requesting the first digital certificate of the local end to join the group message to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result.

Specifically, the application terminal wants to join the group created by the management terminal, and sends an application to join the group message to the management terminal, and sends the first digital certificate of the local end to the management terminal. When receiving the application to join the group message, the management terminal first checks whether the digital signature of the first digital certificate is correct. When the digital signature of the first digital certificate is correct, the management terminal acquires the The public key of the first digital certificate, and encrypting the first target value by using the public key of the first digital certificate to obtain a first encryption result. The first target value is a value arbitrarily selected by the management terminal. For example, the first target value is r ₁ , the public key of the first digital certificate is pk ₁ , and the first encryption result obtained by the management terminal is e ₁ .

S302. The application terminal receives the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypts the first encryption result to obtain a second target value and according to the first The second digital certificate encrypts the second target value to obtain a second encrypted result.

Specifically, the application terminal receives the first encryption result sent by the management terminal and the second digital certificate of the management terminal. The application terminal reads the private key of the first digital certificate, and decrypts the first encryption result by using the private key of the first digital certificate to obtain the second target value. The application terminal acquires the public key of the second digital certificate, and encrypts the second target value by using the public key of the second digital certificate to obtain a second encryption result. For example, the public key of the second digital certificate is pk ₂ , the application terminal receives the first encryption result e ₁ and pk ₂ sent by the management terminal, and the second obtained by the application terminal 20 decrypts The target value is r ₂ , and the second encrypted result obtained by encryption is e ₂ .

S303. The application terminal sends the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and the third target value is When the first target value is the same, the authentication of the local end is performed.

Specifically, the application terminal sends the second encryption result to the management terminal, and the management terminal uses the private key pair of the second digital certificate when receiving the second encryption result. Decrypting the second encryption result to obtain a third target value, and determining whether the third target value is the same as the first target value, and when the third target value is the same as the first target value, Apply for terminal certification. The third target value may be the same as the second target value, and may be different. When the application terminal is not attacked by the outside world during the process of sending the second encryption result, The third target value is the same as the second target value, otherwise the third target value obtained by the management terminal decryption is not the same as the second target value. Therefore, when the wireless channel between the management terminal and the application terminal does not receive an external attack, the first target value is the same as the third target value.

In the embodiment of the present invention, the application terminal joins the group message to the management terminal by sending an application for carrying the first digital certificate of the local end, and the management terminal encrypts the first target value according to the first digital certificate to obtain the first encryption result, and applies for the terminal. Receiving a first encryption result sent by the management terminal and a second digital certificate of the management terminal, decrypting the first encryption result to obtain a second target value, and encrypting the second target value according to the second digital certificate to obtain a second encryption result, The terminal sends the second encryption result to the management terminal, and the management terminal decrypts the second encryption result to obtain a third target value, and implements management by authenticating the application terminal when the third target value is the same as the first target value. The terminal authenticates the application terminal and improves the security of the authentication process.

FIG. 4 is a schematic flowchart of still another method for authenticating a terminal according to an embodiment of the present invention. The method may include steps S401 to S405.

S401. The application terminal sends a group message to the management terminal to send the first digital certificate of the local end, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result.

S402. The application terminal receives the first encryption result sent by the management terminal and a second digital certificate of the management terminal.

S403. The application terminal reads a private key of the first digital certificate, and decrypts the first encryption result by using a private key of the first digital certificate to obtain the second target value.

The second target value may be the same as the first target value, or may be different. When the management terminal sends the first encryption result and the second digital certificate, it is not attacked by the outside world. And the second target value is the same as the first target value, otherwise the second target value obtained by the application terminal decryption is different from the first target value.

S404. The application terminal acquires a public key of the second digital certificate, and encrypts the second target value by using a public key of the second digital certificate to obtain a second encryption result.

Specifically, the application terminal acquires a public key of the second digital certificate, and encrypts the second target value by using a public key of the second digital certificate to obtain a second encryption result. Since the first encryption result is obtained by encrypting the public key of the first digital certificate, and the second encryption result is obtained by encrypting the public key of the second digital certificate, the public key is different, so the first The second encryption result is different from the first encryption result, and the second encryption result is different from the first encryption result even if the second target value is the same as the first target value.

S405. The application terminal sends the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and the third target value is When the first target value is the same, the authentication of the local end is performed.

Specifically, the application terminal sends the second encryption result to the management terminal, and the management terminal uses the private key pair of the second digital certificate when receiving the second encryption result. Decrypting the second encryption result to obtain a third target value, and determining whether the third target value is the same as the first target value, and when the third target value is the same as the first target value, Apply for terminal certification. The third target value may be the same as the second target value, and may be different. When the application terminal is not attacked by the outside world in sending the second encryption result, the third target value Same as the second target value, otherwise the third target value obtained by the management terminal decryption is not the same as the second target value. Therefore, when the wireless channel between the management terminal and the application terminal does not receive an external attack, the first target value is the same as the third target value.

In the embodiment of the present invention, the application terminal joins the group message to the management terminal by sending an application for carrying the first digital certificate of the local end, and the management terminal encrypts the first target value according to the first digital certificate to obtain the first encryption result, and applies for the terminal. Receiving a first encryption result sent by the management terminal and a second digital certificate of the management terminal, decrypting the first encryption result to obtain a second target value, and encrypting the second target value according to the second digital certificate to obtain a second encryption result, The application terminal sends the second encryption result to The management terminal decrypts the second encryption result to obtain a third target value, and authenticates the application terminal when the third target value is the same as the first target value, thereby implementing the authentication process of the management terminal to the application terminal, and improving The security of the certification process.

The management terminal provided by the embodiment of the present invention will be described in detail below with reference to FIG. 5 to FIG. It should be noted that the management terminal shown in FIG. 5 to FIG. 7 is used to perform the method of the embodiment shown in FIG. 1 and FIG. 2 of the present invention. For the convenience of description, only the embodiments related to the embodiment of the present invention are shown. In part, specific technical details are not disclosed, please refer to the embodiment shown in FIG. 1 and FIG. 2 of the present invention.

FIG. 5 is a schematic structural diagram of a management terminal according to the present invention. The management terminal 10 may include an encryption unit 101, a sending unit 102, and a decryption unit 103.

The encryption unit 101 is configured to: when the management terminal receives the application to join the group message that is sent by the application terminal and carries the first digital certificate, encrypt the first target value according to the first digital certificate to obtain the first encryption result.

In a specific implementation, when the management terminal 10 and the application terminal use the same radio channel frequency, the management terminal 10 may receive an application joining group message sent by the application terminal, where the application joining group message carries the first And a digital certificate, wherein the first digital certificate is a digital certificate of the application terminal, and the digital certificate is a file that is digitally signed by the certificate authority and includes public key owner information and a public key. The simplest certificate contains a public key, a name, and a digital signature from the certificate authority. The digital certificate adopts a public key system, that is, a pair of mutually matching keys are used for encryption and decryption.

When the management terminal 10 receives the application that is sent by the application terminal and carries the first digital certificate to join the group message, the encryption unit 101 encrypts the first target value according to the first digital certificate to obtain the first encryption result. .

Referring to FIG. 6, a schematic structural diagram of an encryption unit provided in the embodiment shown in FIG. 5; the encryption unit 101 may include a verification unit 1011 and a first encryption unit 1012.

The checking unit 1011 is configured to check whether the digital signature of the first digital certificate is correct when the management terminal receives the group message that is sent by the application terminal and carries the first digital certificate.

In a specific implementation, when the management terminal 10 receives the application joining group message, the checking unit 1011 first checks whether the digital signature of the first digital certificate is correct, when the first number is When the digital signature of the word certificate is correct, the management terminal can perform the subsequent authentication process; when the digital signature of the first digital certificate is incorrect, the management terminal rejects the application terminal to join the group.

a first encryption unit 1012, configured to acquire a public key of the first digital certificate when the digital signature of the first digital certificate is correct, and encrypt the first target value by using a public key of the first digital certificate The first encrypted result is obtained.

In a specific implementation, when the digital signature of the first digital certificate is correct, it can be understood that the first digital certificate is a legal digital certificate of the application terminal, and therefore the first encryption unit 1012 obtains the first The public key of the digital certificate, and encrypting the first target value by using the public key of the first digital certificate to obtain a first encryption result. The first target value is a value arbitrarily selected by the management terminal 10. For example, the first target value is r ₁ , the public key of the first digital certificate is pk ₁ , and the first encryption result obtained by the first encryption unit 1012 is e ₁ .

The sending unit 102 is configured to send the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to The second digital certificate encrypts the second target value to obtain a second encryption result.

In a specific implementation, the sending unit 102 reads the second digital certificate of the local end, and sends the first encryption result and the second digital certificate encrypted by the first encryption unit 1012 to the application terminal. The second digital certificate includes a public key of the second digital certificate. When the application terminal receives the first encryption result and the second digital certificate sent by the sending unit 102, the application terminal uses the private key of the first digital certificate of the local end to the first encryption result. Decrypting to obtain a second target value, and then the application terminal encrypts the second target value by using a public key of the second digital certificate to obtain a second encryption result. For example, the public key of the second digital certificate is pk ₂ , the sending unit 102 sends the first encryption result e ₁ and pk ₂ to the application terminal, and the second obtained by the application terminal decrypts The target value is r ₂ , and the second encrypted result obtained by encryption is e ₂ .

The second target value may be the same as the first target value, or may be different. When the sending unit 102 is not in the process of transmitting the first encryption result and the second digital certificate, When the attack is performed, the second target value is the same as the first target value, otherwise the second target value obtained by the application terminal decryption is different from the first target value. Since the first encryption result is obtained by encrypting a public key of the first digital certificate, and the second encryption result is by the The public key of the second digital certificate is encrypted, and the public key is different, so the second encryption result is different from the first encryption result, even if the second target value is the same as the first target value. The second encryption result is also different from the first encryption result.

The decrypting unit 103 is configured to acquire the second encryption result sent by the application terminal, and decrypt the second encryption result to obtain a third target value, and the third target value and the first target The authentication of the application terminal is made when the values are the same.

In a specific implementation, the decryption unit 103 acquires the second encryption result sent by the application terminal, and decrypts the second encryption result to obtain a third target value, and the third target value and the The authentication of the application terminal is performed when the first target value is the same.

Referring to FIG. 7, a schematic structural diagram of a decryption unit provided in the embodiment shown in FIG. 5; the decryption unit 103 may include an obtaining unit 1031, a first decryption unit 1032, and an authentication unit 1033.

The obtaining unit 1031 is configured to obtain a second encryption result sent by the application terminal.

In a specific implementation, the application terminal sends the second encryption result encrypted by using the public key of the second digital certificate to the management terminal, and the obtaining unit 1031 acquires the second encryption sent by the middle requesting terminal. result.

The first decryption unit 1032 is configured to read a private key of the second digital certificate, and decrypt the second encryption result by using a private key of the second digital certificate to obtain a third target value.

In a specific implementation, the result of encrypting with a digital certificate public key can only be decrypted by using the private key of the digital certificate, so the first decryption unit 1032 reads the private key of the second digital certificate, and adopts the The private key of the second digital certificate results in the second encryption result to obtain a third target value. For example, the first decryption unit 1032 decrypts the second encryption result e ₂ to obtain the third target value r ₃ .

The third target value may be the same as the second target value, and may be different. When the application terminal is not attacked by the outside world in sending the second encryption result, the third target value Same as the second target value, otherwise the third target value obtained by the first decryption unit 1032 is not the same as the second target value. Therefore, when the wireless channel between the management terminal and the application terminal does not receive an external attack, the first target value is the same as the third target value.

The authentication unit 1033 is configured to authenticate the application terminal when the third target value is the same as the first target value.

In a specific implementation, when the third target value is the same as the first target value, it can be understood that the wireless channel between the management terminal and the application terminal is not attacked by the outside world, and the authentication unit 1033 The application terminal is added to the group by the authentication of the application terminal, and the application terminal is notified that the application is successful, and the communication between the groups may be participated.

The application terminal provided by the embodiment of the present invention will be described in detail below with reference to FIG. 8 and FIG. It should be noted that the application terminals shown in FIG. 8 and FIG. 9 are used to perform the method of the embodiment shown in FIG. 3 and FIG. 4 of the present invention. For the convenience of description, only the embodiments related to the embodiments of the present invention are shown. In part, specific technical details are not disclosed, please refer to the embodiment shown in FIG. 3 and FIG. 4 of the present invention.

FIG. 8 is a schematic structural diagram of an application terminal according to the present invention. The application terminal 20 may include: a message sending unit 201, a decryption and encrypting unit 202, and a result sending unit 203.

The message sending unit 201 is configured to send an application that joins the first digital certificate of the local end to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result. .

In a specific implementation, the application terminal 20 wants to join the group created by the management terminal, and the message sending unit 201 sends an application to join the group message to the management terminal 10, and sends the first digital certificate of the local end together. To the management terminal 10. When receiving the application to join the group message, the management terminal 10 first checks whether the digital signature of the first digital certificate is correct. When the digital signature of the first digital certificate is correct, the management terminal acquires Decoding a public key of the first digital certificate, and encrypting the first target value by using a public key of the first digital certificate to obtain a first encryption result. The first target value is a value arbitrarily selected by the management terminal. For example, the first target value is r ₁ , the public key of the first digital certificate is pk ₁ , and the first encryption result obtained by the management terminal is e ₁ .

The decryption encryption unit 202 is configured to receive the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypt the first encryption result to obtain a second target value and according to the The second digital certificate encrypts the second target value to obtain a second encrypted result.

In a specific implementation, the decryption and encryption unit 202 receives the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypts the first encryption result to obtain a second target value and Encrypting the second target value according to the second digital certificate to obtain a second encryption result.

The second target value may be the same as the first target value, or may be different. When the management terminal 10 sends the first encryption result and the second digital certificate, the external terminal is not received by the outside world. When attacking, the second target value is the same as the first target value, otherwise the decrypted encryption unit 202 decrypts the obtained second target value and the first target value is a different value. Since the first encryption result is obtained by encrypting the public key of the first digital certificate, and the second encryption result is obtained by encrypting the public key of the second digital certificate, the public key is different, so the first The second encryption result is different from the first encryption result, and the second encryption result is different from the first encryption result even if the second target value is the same as the first target value.

Referring to FIG. 9, a schematic structural diagram of a decryption encryption unit provided in the embodiment shown in FIG. 8; the decryption encryption unit 202 may include a receiving unit 2021, a second decryption unit 2022, and a second encryption unit 2023.

The receiving unit 2021 is configured to receive the first encryption result sent by the management terminal and the second digital certificate of the management terminal.

In a specific implementation, the receiving unit 2021 receives the first encryption result sent by the management terminal and the second digital certificate of the management terminal.

The second decryption unit 2022 is configured to read a private key of the first digital certificate, and decrypt the first encryption result by using a private key of the first digital certificate to obtain the second target value.

In a specific implementation, the second decryption unit 2022 reads the private key of the first digital certificate, and decrypts the first encryption result by using the private key of the first digital certificate to obtain the second target value. . For example, the first encryption result is e ₁ , and the second target value decrypted by the second decryption unit 2022 is r ₂ .

The second encryption unit 2023 is configured to obtain a public key of the second digital certificate, and encrypt the second target value by using a public key of the second digital certificate to obtain a second encryption result.

In a specific implementation, the second encryption unit 2023 obtains the public key of the second digital certificate, and encrypts the second target value by using the public key of the second digital certificate to obtain a second encryption result. Since the first encryption result is obtained by encrypting the public key of the first digital certificate, and the second encryption result is obtained by encrypting the public key of the second digital certificate, the public key is different, so the first The second encryption result is different from the first encryption result, and the second encryption result is different from the first encryption result even if the second target value is the same as the first target value.

a result sending unit 203, configured to send the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and at the third target value The authentication of the local end is performed when the first target value is the same.

In a specific implementation, the result sending unit 203 sends the second encryption result to the management terminal, and the management terminal 10 adopts the private of the second digital certificate when receiving the second encryption result. Decrypting the second encryption result to obtain a third target value, and determining whether the third target value is the same as the first target value, when the third target value is the same as the first target value By the authentication of the application terminal 20. The third target value may be the same as the second target value, and may be different. When the result sending unit 203 is not attacked by the outside world in the process of sending the second encryption result, the third The target value is the same as the second target value, otherwise the third target value obtained by the management terminal 10 is not the same as the second target value. Therefore, when the wireless channel between the management terminal 10 and the application terminal 20 does not receive an external attack, the first target value is the same as the third target value.

In the embodiment of the present invention, the application terminal joins the group message to the management terminal by sending an application for carrying the first digital certificate of the local end, and the management terminal encrypts the first target value according to the first digital certificate to obtain the first encryption result, and applies for the terminal. Receiving a first encryption result sent by the management terminal and a second digital certificate of the management terminal, decrypting the first encryption result to obtain a second target value, and encrypting the second target value according to the second digital certificate to obtain a second encryption result, The application terminal sends the second encryption result to the management terminal, and the management terminal decrypts the second encryption result to obtain a third target value, and implements the management terminal by authenticating the application terminal when the third target value is the same as the first target value. Recognition of the application terminal Certification process and improve the security of the certification process.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and thus equivalent changes made in the claims of the present invention are still within the scope of the present invention.

Claims

A terminal authentication method, comprising:

When the management terminal receives the application that is sent by the application terminal and carries the first digital certificate to join the group message, the management terminal encrypts the first target value according to the first digital certificate to obtain the first encryption result;

The management terminal sends the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to the The second digital certificate encrypts the second target value to obtain a second encryption result;

The management terminal acquires the second encryption result sent by the application terminal, and decrypts the second encryption result to obtain a third target value, and the third target value is compared with the first target value. At the same time, the authentication of the application terminal is passed.
The method according to claim 1, wherein the management terminal receives the group message carrying the first digital certificate sent by the application terminal, and the management terminal according to the first digital certificate pair The first target value is encrypted to obtain the first encrypted result, including:

When the management terminal receives the application that is sent by the application terminal and carries the first digital certificate to join the group message, the management terminal checks whether the digital signature of the first digital certificate is correct;

When the digital signature of the first digital certificate is correct, the management terminal acquires the public key of the first digital certificate, and encrypts the first target value by using the public key of the first digital certificate to obtain the first encryption. result.
The method according to claim 2, wherein the management terminal sends the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal encrypts the first The result is decrypted to obtain a second target value, and the second target value is encrypted according to the second digital certificate to obtain a second encryption result, which specifically includes:

The management terminal reads the second digital certificate of the local end, and sends the first encryption result and the second digital certificate to the application terminal, so that the application terminal adopts the private of the first digital certificate. Decrypting the first encryption result to obtain a second target value, and using the second digital certificate The public key encrypts the second target value to obtain a second encrypted result.
The method according to claim 3, wherein the management terminal acquires the second encryption result sent by the application terminal, and decrypts the second encryption result to obtain a third target value, and The authentication of the application terminal when the third target value is the same as the first target value includes:

The management terminal acquires a second encryption result sent by the application terminal;

The management terminal reads the private key of the second digital certificate, and decrypts the second encryption result by using the private key of the second digital certificate to obtain a third target value;

The authentication of the application terminal is performed when the third target value is the same as the first target value.
A terminal authentication method, comprising:

The application terminal sends an application for carrying the first digital certificate of the local end to join the group message to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result;

Receiving, by the application terminal, the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypting the first encryption result to obtain a second target value and according to the second number The certificate encrypts the second target value to obtain a second encryption result;

Transmitting, by the application terminal, the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and the third target value and the When the first target value is the same, the authentication of the local end is passed.
The method according to claim 5, wherein the application terminal receives the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and performs the first encryption result Decrypting to obtain a second target value and encrypting the second target value according to the second digital certificate to obtain a second encryption result, including:

The application terminal receives the first encryption result sent by the management terminal and a second digital certificate of the management terminal;

The application terminal reads a private key of the first digital certificate, and adopts the first digital certificate Decrypting the first encryption result by the private key to obtain the second target value;

The application terminal acquires the public key of the second digital certificate, and encrypts the second target value by using the public key of the second digital certificate to obtain a second encryption result.
A management terminal, comprising:

An encryption unit, configured to: when the management terminal receives the application that is sent by the application terminal and carries the first digital certificate, join the group message, and encrypt the first target value according to the first digital certificate to obtain the first encryption result;

a sending unit, configured to send the first encryption result and the second digital certificate of the local end to the application terminal, so that the application terminal decrypts the first encryption result to obtain a second target value, and according to the The second digital certificate encrypts the second target value to obtain a second encryption result;

a decrypting unit, configured to acquire the second encryption result sent by the application terminal, and decrypt the second encryption result to obtain a third target value, and the third target value and the first target value The same is true for the authentication of the application terminal.
The management terminal according to claim 7, wherein the encryption unit comprises:

The checking unit is configured to: when the management terminal receives the application that is sent by the application terminal and carries the first digital certificate to join the group message, check whether the digital signature of the first digital certificate is correct;

a first encryption unit, configured to acquire a public key of the first digital certificate when the digital signature of the first digital certificate is correct, and encrypt the first target value by using a public key of the first digital certificate The first encryption result.
The management terminal according to claim 8, wherein the sending unit is configured to read a second digital certificate of the local end, and send the first encryption result and the second digital certificate to the application a terminal, so that the application terminal decrypts the first encryption result by using a private key of the first digital certificate to obtain a second target value, and uses the public key of the second digital certificate to the second target The value is encrypted to obtain the second encrypted result.
The management terminal according to claim 9, wherein the decryption unit comprises:

An obtaining unit, configured to acquire a second encryption result sent by the application terminal;

a first decryption unit, configured to read a private key of the second digital certificate, and decrypt the second encryption result by using a private key of the second digital certificate to obtain a third target value;

And an authentication unit, configured to authenticate the application terminal when the third target value is the same as the first target value.
An application terminal, comprising:

a message sending unit, configured to send an application that joins the first digital certificate of the local end to the management terminal, so that the management terminal encrypts the first target value according to the first digital certificate to obtain a first encryption result;

a decryption encryption unit, configured to receive the first encryption result sent by the management terminal and the second digital certificate of the management terminal, and decrypt the first encryption result to obtain a second target value and according to the first The second digital certificate encrypts the second target value to obtain a second encryption result;

a result sending unit, configured to send the second encryption result to the management terminal, so that the management terminal decrypts the second encryption result to obtain a third target value, and at the third target value When the first target value is the same, the authentication of the local end is performed.
The application terminal according to claim 11, wherein the decryption encryption unit comprises:

a receiving unit, configured to receive the first encryption result sent by the management terminal and a second digital certificate of the management terminal;

a second decryption unit, configured to read a private key of the first digital certificate, and decrypt the first encryption result by using a private key of the first digital certificate to obtain the second target value;

And a second encryption unit, configured to acquire a public key of the second digital certificate, and encrypt the second target value by using a public key of the second digital certificate to obtain a second encryption result.