WO2016197555A1 - 网络监控设备及其远程加密、远程激活方法、装置及系统 - Google Patents

网络监控设备及其远程加密、远程激活方法、装置及系统 Download PDF

Info

Publication number
WO2016197555A1
WO2016197555A1 PCT/CN2015/095447 CN2015095447W WO2016197555A1 WO 2016197555 A1 WO2016197555 A1 WO 2016197555A1 CN 2015095447 W CN2015095447 W CN 2015095447W WO 2016197555 A1 WO2016197555 A1 WO 2016197555A1
Authority
WO
WIPO (PCT)
Prior art keywords
monitoring device
network monitoring
activation
client
password
Prior art date
Application number
PCT/CN2015/095447
Other languages
English (en)
French (fr)
Inventor
朱振磊
潘亚东
李奎
斯鲁杰
张小媛
Original Assignee
杭州海康威视数字技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州海康威视数字技术股份有限公司 filed Critical 杭州海康威视数字技术股份有限公司
Priority to EP15894810.9A priority Critical patent/EP3309997B1/en
Priority to ES15894810T priority patent/ES2914087T3/es
Priority to US15/735,340 priority patent/US11019041B2/en
Priority to PL15894810T priority patent/PL3309997T3/pl
Publication of WO2016197555A1 publication Critical patent/WO2016197555A1/zh
Priority to US17/238,031 priority patent/US11456999B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3249—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using RSA or related signature schemes, e.g. Rabin scheme
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • the present invention relates to the field of network security technologies, and in particular, to a network monitoring device and a remote encryption and remote activation method, device and system thereof.
  • the network monitoring equipment has the following problems when it leaves the factory:
  • the network monitoring device will have a default username and password when it leaves the factory (for example, default administrator username: admin, default administrator password: 12345).
  • default administrator username: admin, default administrator password: 12345 For the default username and password status, it is common practice to remind the user that the password should be changed when the user logs in, but the nature of the reminder can be ignored by the user. There are very few users who actually choose to change the default password. In this case, network monitoring devices that use default passwords, especially when these devices are connected to the World Wide Web, are very susceptible to being illegally controlled.
  • the object of the present invention is to provide a network monitoring device and a remote encryption and remote activation method, device and system thereof.
  • an aspect of the present invention provides a remote activation method for a network monitoring device, including: receiving an encrypted activation password input by a user through a client; decrypting the encrypted activation password to obtain user input.
  • the original activation password determining whether the original activation password meets a preset password strength requirement, and if so, initiating activation, and setting the original activation password as an administrator password; returning device activation success information to the user.
  • the encrypted activation password input by the receiving user through the client includes: receiving a public key generated by the client by using a first algorithm, and encrypting the original random string generated by the public key by using the public key. Generating an encrypted random string, returning the encrypted random string to the client, and decrypting the encrypted random string by using the private key of the first algorithm by the client to obtain the original random string; receiving the client to send An activation password encrypted by the second algorithm, wherein the activation password is generated by the client by using a second algorithm to encrypt the original activation password input by the user, and the key of the second algorithm is the original random string.
  • the decrypting the encrypted activation password to obtain the original activation password input by the user includes: decrypting the activation password by using a second algorithm, and obtaining an original activation password input by the user.
  • the method further includes: reporting a MAC address to the client, where the MAC address is used to uniquely identify the device identity.
  • the receiving, by the client, the public key generated by using the first algorithm specifically: receiving a public key that matches the MAC address of the client.
  • the returning the encrypted random string to the client further includes: reporting a MAC address to the client, where the MAC address is used to uniquely identify the device identity.
  • the receiving the activation password sent by the client and encrypted by using the second algorithm is specifically: receiving an activation password that matches the MAC address of the user.
  • the first algorithm is an asymmetric encryption RSA algorithm.
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and the original input for the user.
  • the activation password is used for strength verification. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • a network monitoring device including: an interface unit, configured to receive an encrypted activation password input by a user through a client, and a decryption unit configured to decrypt the encrypted activation password and obtain The original activation password input by the user; the determining unit is configured to determine whether the original activation password meets a preset password strength requirement; and the activation unit is configured to start the activation network when the original activation password meets a preset password strength requirement Monitoring the device and setting the original activation password as an administrator password; the interface unit is further configured to return device activation success information to the user.
  • the interface unit is configured to receive a public key generated by the client by using a first algorithm, encrypt the original random string generated by the public key, generate an encrypted random string, and return the result to the client.
  • the encrypted random string wherein the client decrypts the encrypted random string by using a private key of the first algorithm to obtain the original random string
  • the interface unit is further configured to receive the client to send Second calculation
  • the activation password of the method is encrypted, wherein the activation password is generated by the client by using a second algorithm to encrypt the original activation password input by the user, and the key of the second algorithm is the original random string.
  • the decryption unit is configured to decrypt the activation password by using a second algorithm to obtain an original activation password input by the user.
  • the interface unit reports the MAC address to the client before receiving the public key sent by the client by using the first algorithm, where the MAC address is used to uniquely identify the device identity.
  • the interface unit receives the public key that is sent by the client and is generated by using the first algorithm. Specifically, the interface unit receives a public key that matches its own MAC address.
  • the interface unit returns the encrypted random string to the client, and further includes: reporting a MAC address to the client, where the MAC address is used to uniquely identify a device identity.
  • the interface unit receives the activation password that is sent by the client and is encrypted by using the second algorithm. Specifically, the interface unit receives an activation password that matches its own MAC address.
  • the first algorithm is an asymmetric encryption RSA algorithm.
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and the strength of the original activation password input by the user. Verification, it is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or because the password is too simple to guess the current password, thereby remotely controlling the monitoring device and improving the security of the password.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • An embodiment of the present invention provides an encryption method for a client-based network monitoring device, including: receiving an original activation password input by a user to a network monitoring device; encrypting the original activation password; and encrypting the activated activation
  • the password is sent to the network monitoring device; after the network monitoring device is successfully activated according to the encrypted activation password, the returned activation success information is received.
  • the sending the encrypted activation password to the network monitoring device includes: generating a public key and a private key by using a first algorithm, and sending the public key to the network monitoring device, where the network monitoring device Encrypting the original random string generated by itself by using the public key to generate an encrypted random string; receiving the network monitoring device Sending the encrypted random string, decrypting the encrypted random string by using the private key, obtaining the original random string, using the obtained original random string as a key of the second algorithm; using the second algorithm to input the user
  • the original activation password is encrypted, and the encrypted activation password is sent to the network monitoring device.
  • the method further includes: receiving a MAC address sent by the network monitoring device, where the MAC address is used to uniquely identify a device identity.
  • the receiving the encrypted random string sent by the network monitoring device further includes: receiving a MAC address sent by the network monitoring device, where the MAC address is used to uniquely identify the device identity.
  • the sending the encrypted activation password to the network monitoring device is specifically: sending an activation password that matches the MAC address of the network to the network monitoring device.
  • the first algorithm is an asymmetric encryption RSA algorithm; the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and input for the user.
  • the original activation password is checked for strength, and it is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the password. safety.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • An embodiment of the present invention provides a client, including: an interface unit, configured to receive an original activation password input by a user to a network monitoring device, and an encryption and decryption unit, configured to encrypt the original activation password;
  • the interface unit is further configured to send the encrypted activation password to the network monitoring device, and receive the returned activation success information after the network monitoring device activates according to the encrypted activation password.
  • the encryption and decryption unit is configured to generate a public key and a private key by using a first algorithm, and send, by the interface unit, the public key to the network monitoring device, where the network monitoring device adopts the public key Encrypting the original random string generated by itself to generate an encrypted random string, the interface unit receives the encrypted random string sent by the network monitoring device, and decrypts the encrypted random string by using a private key, and obtains the original random string.
  • the first a key of the second algorithm
  • the encryption and decryption unit is configured to encrypt the original activation password input by the user by using the second algorithm, and send the encrypted activation password to the network monitoring device by the interface unit.
  • the interface unit receives a MAC address sent by the network monitoring device before sending the public key to the network monitoring device, where the MAC address is used to uniquely identify a device identity.
  • the interface unit sends the public key to the network monitoring device, where the interface unit sends a public key that matches its own MAC address to the network monitoring device.
  • the interface unit receives the encrypted random string sent by the network monitoring device, and further includes: the interface unit receives a MAC address sent by the network monitoring device, where the MAC address is used to uniquely identify the device identity.
  • the interface unit sends the encrypted activation password to the network monitoring device, where the interface unit sends an activation password matching the MAC address of the network to the network monitoring device.
  • the first algorithm is an asymmetric encryption RSA algorithm; the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and the strength of the original activation password input by the user. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • An embodiment of another aspect of the present invention provides a network monitoring device-based remote activation system, including: a client, configured to receive a user-entered original activation password for a network monitoring device, and
  • the network monitoring device is configured to receive an encrypted activation password from the client, decrypt the encrypted activation password, obtain an original activation password input by the user, and determine the Whether the original activation password meets the preset password strength requirement, if yes, initiates activation, and sets the original activation password as an administrator password, and returns activation success information to the client; the client is also used to After receiving the activation success information, the user is prompted to activate successfully.
  • the client receives the original activation password of the network monitoring device input by the user, and encrypts the original activation password, including: the client sends the public key generated by the first algorithm to the network. a monitoring device, wherein the network monitoring device encrypts the original random string generated by the public key by using the public key to generate an encrypted random string, and the client returns the returned by the network monitoring device by using a private key generated by the first algorithm.
  • the encrypted random string is decrypted to obtain the original random string, and the obtained original random string is used as the key of the second algorithm, and the second activation algorithm is used to encrypt the original activation password input by the user, and the encrypted activation password is obtained and sent to The network monitoring device.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and input for the user.
  • the original activation password is used for strength verification. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password. Sex.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • FIG. 1 is a flow chart of a remote activation method of a network monitoring device in accordance with a preferred embodiment of the present invention
  • FIG. 2 is a flow diagram of remote activation based on an IP address in accordance with a preferred embodiment of the present invention
  • FIG. 3 is a flow diagram of remote activation based on a MAC address in accordance with a preferred embodiment of the present invention
  • FIG. 4 is a structural diagram of a network monitoring device in accordance with a preferred embodiment of the present invention.
  • FIG. 5 is a flowchart of an encryption method of a client-based network monitoring device in accordance with a preferred embodiment of the present invention
  • FIG. 6 is a structural diagram of a client in accordance with a preferred embodiment of the present invention.
  • FIG. 7 is a structural diagram of a network monitoring device based remote activation system in accordance with a preferred embodiment of the present invention.
  • FIG. 8 is a flow chart showing activation of a network monitoring device based remote activation system in accordance with a preferred embodiment of the present invention.
  • the present invention provides a network monitoring device, a remote encryption and remote activation method, device and system thereof, which re-encrypt the original activation password input by the user, so that the original activation password is on the network. Hard to crack, enhances security during activation.
  • the network monitoring device refers to a security monitoring device with a network module that can be accessed through an IP address. For example: DVR (Digital Video Recorder), DVS (Digital Video Server), NVR (Network Video Recorder), CVR (Central Video Recorder), IPC (IP camera, Network cameras), transmission and display devices, etc.
  • FIG. 1 is a flow chart of a remote activation method of a network monitoring device in accordance with a preferred embodiment of the present invention. It should be noted that the execution entity of the remote activation method of the network monitoring device is a network monitoring device, that is, the network monitoring device performs the following steps.
  • Step S11 Receive an encrypted activation password input by the user through the client.
  • the user accesses the network monitoring device through the client. Since the network monitoring device has not been activated yet, the inactive device cannot perform any other operations, such as modifying the IP address.
  • the network operation can be realized only after the activation operation of the network monitoring device is completed.
  • the network monitoring device informs the client that the device needs to be activated before it can be used. After the user inputs the original activation password, the client encrypts the original activation password, and then sends the encrypted activation password to the network monitoring device.
  • step S12 the encrypted activation password is decrypted, and the original activation password input by the user is obtained.
  • the network monitoring device decrypts the encrypted activation password received in the above step S11, thereby obtaining the original activation password input by the user.
  • step S13 it is determined whether the original activation password meets the preset password strength requirement, and if so, the activation is initiated, and the original activation password is set as the administrator password.
  • the network monitoring device performs a complexity analysis on the original activation password obtained by decrypting, that is, whether the password complexity (password strength) set by the user meets the preset password strength requirement.
  • the preset password strength requirement satisfies the following conditions: a combination of numbers, uppercase letters, lowercase letters, and a password length of at least 8 bits.
  • the network monitoring device is activated and the original activation password is used as the device administrator password. If the requirements are not met, the network monitoring device returns an activation failure message to the client.
  • step S14 the device activation success information is returned to the user.
  • the activation success message is sent to the client, and the client prompts the user device to activate successfully. Then, the user can log in to the network monitoring device as an administrator by using the set original activation password, and perform other network operations.
  • the remote activation method of the network monitoring device of the present invention may include: an IP address-based activation mode and a MAC address-based activation mode according to different network interaction modes, and the difference between the two activation modes is only In the network interaction, the encryption methods of the two are consistent.
  • the activation mode based on the IP address is to connect to a network monitoring device through the network to implement activation.
  • step S21 the client invokes the first algorithm to generate a public key and a private key, and the client sends the public key to the inactive network monitoring device.
  • Step S22 The network monitoring device receives the public key generated by the client by using the first algorithm, and encrypts the original random string generated by the public key by using the public key to generate an encrypted random string.
  • the network monitoring device returns the encrypted random string to the client. Specifically, the network monitoring device encrypts an original random string (a random string without any encryption operation after generation) by using a public key, obtains an encrypted random string, and returns the encrypted random string to the client.
  • step S23 the client decrypts the encrypted random string by using the private key of the first algorithm to obtain an original random string.
  • step S24 the client uses the decrypted original random string as the key encrypted by the second algorithm, and uses the second algorithm to encrypt the original activation password input by the user to obtain an activation password.
  • the activation password is then sent to the network monitoring device.
  • Step S25 The network monitoring device receives the activation password encrypted by the client by using the second algorithm. Because the encryption key is the original random string generated by the network monitoring device itself, the network monitoring device may use the second algorithm to decrypt the activation password. The original activation password entered by the user.
  • step S26 the network monitoring device determines whether the complexity of decrypting the original activation password meets the preset password strength requirement. If yes, the activation is initiated, and the activation success information is returned to the client.
  • step S27 the client prompts the user that the device activation is successful.
  • FIG. 3 is a flow diagram of remote activation based on a MAC address in accordance with a preferred embodiment of the present invention.
  • the network monitoring device since the network monitoring device generally has a fixed IP address when it leaves the factory, when many devices are put together, the IP addresses are the same. In this case, the IP-based activation method cannot intuitively know which network monitoring device is activated.
  • the MAC address is unique to each network monitoring device, that is, the MAC address is used to uniquely identify the device identity. Therefore, the MAC address-based activation mode can solve the above problem and implement network interaction through multicast.
  • Multicast is a point-to-multipoint communication method.
  • the information sent by the monitoring device and the client to the other party is first sent to a specific multicast group, and any network device that joins the multicast group can receive the data.
  • the client can intuitively know which device is currently activated, especially for the scenario of mass activation of the device, which can save network bandwidth.
  • step S31 the MAC address of the device is reported to the client.
  • Each network monitoring device sends its own MAC address to the client through multicast.
  • step S32 the client generates a public key and a private key by using the first algorithm, and sends the public key and the MAC address to the network monitoring device.
  • step S33 the network monitoring device determines whether the received MAC address matches the MAC address of the local device. If the matching is successful, step S34 is performed. In other words, the network monitoring device receives the public key matching the own MAC address, and returns to step S34.
  • Step S34 The network monitoring device generates an original random string, and encrypts the original random string by using a public key to obtain an encrypted random string, and sends the encrypted random string and the MAC address to the client.
  • Step S35 The client decrypts the encrypted random string by using the private key of the first algorithm to obtain the original random string, and uses the original random string as the key of the second algorithm, and encrypts the original activation password input by the user to obtain an activation password. And sending an activation password and a MAC address encrypted by the second algorithm to the network monitoring device.
  • step S36 the network monitoring device determines again whether the received MAC address matches the MAC address of the local device. If yes, step S37 is performed. In other words, the network monitoring device receives an activation password that matches its own MAC address, and then proceeds to step S37.
  • step S37 the network monitoring device uses the second algorithm to decrypt the activation password. Since the encryption key is the original random string generated by the network monitoring device itself, the network monitoring device can decrypt the activation password and obtain the original activation password input by the user.
  • Step S38 The network monitoring device determines whether the complexity of the original activation password meets the preset password strength requirement, and if yes, initiates activation, and returns activation success information to the client.
  • step S39 the client prompts the user that the device activation is successful.
  • the activation method of the MAC address is identical to the activation method of the IP address in the encryption algorithm and the password, and only differs in the network interaction.
  • the MAC address-based activation mode adopts the multicast mode to achieve one-to-many. Network interaction.
  • the first algorithm is an asymmetric encryption RSA algorithm
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the RSA algorithm is an asymmetric encryption algorithm, which can generate a pair of public and private keys, the public key is publicly disclosed, and the private key is kept by the producer.
  • the private key generated by the RSA algorithm is stored by the producer client.
  • the data is encrypted by using the public key during encryption.
  • the encrypted data can only be solved by using the private key. dense. As long as the key is long enough, the password cannot be cracked.
  • the AES algorithm is a symmetric encryption algorithm in which both encryption and decryption use the same key to encrypt or decrypt data.
  • the symmetric encryption method is inherently insecure, since the present invention performs the encryption processing of the RSA algorithm on the key of the AES algorithm in advance, the network capture packet and the like cannot obtain the key, thereby improving the security.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of the user who has used the default password before, and input to the user.
  • the original activation password is used for strength verification. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password. Sex.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • FIG. 4 is a structural diagram of a network monitoring device in accordance with a preferred embodiment of the present invention.
  • the interface unit 41 is configured to receive the encrypted activation password input by the user through the client. That is, after the user inputs the original activation password, the client encrypts the original activation password, and then sends the encrypted activation password to the interface unit 41.
  • the encryption and decryption unit 42 is configured to decrypt the encrypted activation password and obtain the original activation password input by the user.
  • the determining unit 43 is configured to determine whether the original activation password meets the preset password strength requirement.
  • the determining unit 43 performs a complexity analysis on the decrypted original activation password, that is, verifies whether the password complexity (password strength) set by the user meets the preset password strength requirement.
  • the preset password strength requirement satisfies the following conditions: a combination of numbers, uppercase letters, lowercase letters, and a password length of at least 8 bits.
  • the activation unit 44 is configured to activate the network monitoring device when the original activation password meets the preset password strength requirement, and set the original activation password to the administrator password, and then return the device activation success information to the user by the interface unit 41. If the requirements are not met, the network monitoring device returns an activation failure message to the client.
  • the network monitoring device of the present invention may include: an IP address-based activation mode and a MAC address-based activation mode according to different network interaction modes, and the two activation modes differ only in network interaction, and two The encryption method is the same.
  • Activation method based on IP address A certain network monitoring device is directionally connected through the network to achieve activation.
  • the client invokes the first algorithm to generate a public key and a private key, and the client sends the public key to the inactive interface unit 41.
  • the interface unit 41 receives the public key generated by the client using the first algorithm, and returns a random string encrypted by the public key to the client.
  • the encrypted random string is obtained by the encryption/decryption unit 42 using the public key to encrypt the original random string generated by itself.
  • the client decrypts the encrypted random string by using the private key of the first algorithm to obtain the original random string, and uses the decrypted original random string as the key encrypted by the second algorithm, and uses the second algorithm to encrypt the original activation password input by the user.
  • the activation password is obtained, and then the activation password is sent to the interface unit 41.
  • the interface unit 41 receives the activation password encrypted by the client using the second algorithm, and the encryption and decryption unit 42 uses the second algorithm to decrypt the activation password to obtain the original activation password input by the user.
  • the determining unit 43 determines whether the complexity of the original activation password meets the preset password strength requirement, and if so, the activation unit 44 initiates activation and returns activation success information to the client.
  • the client further prompts the user that the device activation is successful.
  • (2) MAC address-based activation mode The MAC address is unique to each network monitoring device, that is, the MAC address is used to uniquely identify the device identity, so the MAC address-based activation mode can solve the above problem and implement through multicast.
  • Network interaction Since the network monitoring device is multiple, the network interaction between the client and multiple network monitoring devices is implemented in a multicast manner.
  • Multicast is a point-to-multipoint communication method. The information sent by the monitoring device and the client to the other party is first sent to a specific multicast group, and any network device that joins the multicast group can receive the data. Because the MAC address is used as the matching basis for each network monitoring device, the client can intuitively know which device is currently activated, especially for the scenario of mass activation of the device, which can save network bandwidth.
  • Each network monitoring device sends its own MAC address to the client through multicast.
  • the client generates a public key and a private key by using the first algorithm, and sends the public key and the MAC address to the interface unit 41.
  • Interface The unit 41 receives the returned public key and MAC address generated by the first algorithm, and after determining that the received MAC address matches the MAC address of the device, that is, after the network monitoring device receives the public key matching the MAC address of the device,
  • the client returns a random string encrypted by the public key, and the client decrypts the encrypted random string by using the private key of the first algorithm to obtain the original random string, and uses the original random string as the key of the second algorithm, and adopts the second algorithm.
  • the original activation password entered by the user is encrypted to obtain an activation password.
  • the interface unit 41 receives the activation password and the MAC address encrypted by the client using the second algorithm, wherein the key of the second algorithm is the original random string.
  • the decryption unit 42 determines that the re-received MAC address matches the MAC address of the device, in other words, after the network monitoring device receives the activation password that matches its own MAC address, the second algorithm is used to decrypt the activation password to obtain user input.
  • the original activation password The determining unit 43 determines whether the complexity of the original activation password meets the preset password strength requirement, and if so, the activation unit 44 initiates activation and returns activation success information to the client. The client further prompts the user that the device activation is successful.
  • the above-mentioned interface unit 41, decryption unit 42, determination unit 43 and activation unit 44 may be operated in a computer terminal as part of the device, and the functions implemented by the above modules may be performed by a processor in the computer terminal.
  • the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (MID), a PAD, and the like.
  • the first algorithm is an asymmetric encryption RSA algorithm
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and does the original activation password input by the user. Intensity check, it is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • FIG. 5 is a flow chart of an encryption method of a client-based network monitoring device in accordance with a preferred embodiment of the present invention. It should be noted that the execution method of the encryption method of the client-based network monitoring device is a client, that is, the following steps are performed by the client.
  • Step S51 receiving an original activation password input by the user to the network monitoring device.
  • step S52 the original activation password is encrypted.
  • the client further sends the encrypted activation password to the network monitoring device, and the network monitoring device determines whether the original activation password meets the preset password strength requirement, and if so, activates and sets the original activation password as the administrator password. , return the device activation success message to the client.
  • the encryption method of the client-based network monitoring device of the present invention when used for activating the network monitoring device, may include: an IP address-based activation mode and a MAC address-based activation mode according to different network interaction modes. The difference between the two activation methods is only in the network interaction, and the encryption methods of the two are consistent.
  • the client uses the first algorithm to generate a public key and a private key, and sends the public key to the network monitoring device.
  • the network monitoring device encrypts the original random string generated by itself by using the public key to generate an encrypted random string.
  • the client receives the encrypted random string sent by the network monitoring device, decrypts the public key encrypted by the network monitoring device by using the private key, and uses the obtained original random string as the key of the second algorithm.
  • the second algorithm is used to encrypt the original activation password input by the user, obtain an activation password, and send the encrypted activation password to the network monitoring device.
  • the client receives the MAC address reported by multiple network monitoring devices, where the MAC address is used to uniquely identify the device identity.
  • the client uses the first algorithm to generate a public key and a private key, and sends the public key and the MAC address to the network monitoring device. Specifically, the client sends a public key that matches its own MAC address to the network monitoring device.
  • the network monitoring device uses the public key to encrypt the original random string generated by itself, and generates an encrypted random string.
  • the client then receives the encrypted random string sent by the network monitoring device. Further, the client receives the encrypted random string sent by the network monitoring device, and further includes: receiving a MAC address sent by the network monitoring device, where the MAC address is used to uniquely identify the device identity.
  • the client decrypts the encrypted random string by using the private key, and uses the obtained original random string as the key of the second algorithm.
  • the second algorithm is used to encrypt the original activation password input by the user to obtain an activation password, and the encrypted activation password is sent to the network monitoring device. Specifically, the client sends an activation password that matches its own MAC address to the network monitoring device.
  • the first algorithm is an asymmetric encryption RSA algorithm
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • Step S53 the encrypted activation password is sent to the network monitoring device.
  • the network monitoring device can use the second algorithm to decrypt the activation password to obtain the original activation password input by the user.
  • Step S54 After the network monitoring device activates successfully according to the encrypted activation password, the returned activation success information is received.
  • the network monitoring device determines whether the complexity of decrypting the original activation password meets the preset password strength requirement. If it is met, the activation is started, and the activation success information is returned to the client, otherwise the activation failure information is returned to the client. The client prompts the user that the device activation is successful.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of the user who has used the default password before, and input the user for the user.
  • the original activation password is checked for strength, and it is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the password. safety.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • FIG. 6 is a structural diagram of a client in accordance with a preferred embodiment of the present invention.
  • the client of the embodiment of the present invention includes an interface unit 61 and an encryption and decryption unit 62.
  • the interface unit 61 is configured to receive an original activation password input by the user to the network monitoring device.
  • the encryption and decryption unit 62 is configured to encrypt the original activation password.
  • the interface unit 61 further sends the encrypted activation password to the network monitoring device, and the network monitoring device determines whether the original activation password meets the preset password strength requirement, and if so, activates the activation password and sets the original activation password as the administrator password.
  • the client returns a device activation success message.
  • the network interaction mode may include: an IP address-based activation mode and a MAC address-based activation mode, and the difference between the two activation modes.
  • the only way to encrypt the network is to encrypt the two.
  • the encryption and decryption unit 62 generates a public key and a private key by using the first algorithm, and sends the public key to the network monitoring device.
  • the network monitoring device encrypts the original random string generated by itself by using the public key to generate an encrypted random string.
  • Interface unit 61 Receive the encrypted random string sent by the network monitoring device, decrypt the random string encrypted by the public key returned by the network monitoring device by using the private key, and use the obtained original random string as the key of the second algorithm.
  • the encryption and decryption unit 62 then encrypts the original activation password input by the user by using the second algorithm to obtain an activation password, and sends the encrypted activation password to the network monitoring device.
  • the interface unit 61 receives the MAC address reported by the plurality of network monitoring devices, wherein the MAC address is used to uniquely identify the device identity.
  • the encryption and decryption unit 62 generates a public key and a private key using the first algorithm, and transmits the public key and the MAC address to the network monitoring device. Specifically, the interface unit 61 transmits a public key that matches its own MAC address to the network monitoring device.
  • the network monitoring device uses the public key to encrypt the original random string generated by itself, and generates an encrypted random string.
  • the interface unit 61 then receives the encrypted random string transmitted by the network monitoring device.
  • the interface unit 61 receives the encrypted random string sent by the network monitoring device, and further includes: receiving a MAC address sent by the network monitoring device, where the MAC address is used to uniquely identify the device identity.
  • the encryption and decryption unit 62 decrypts the encrypted random string by using the private key to obtain an activation password, and uses the obtained original random string as the key of the second algorithm.
  • the encryption/decryption unit 62 encrypts the original activation password input by the user by using the second algorithm, and sends the encrypted activation password to the network monitoring device. Specifically, the interface unit 61 transmits to the network monitoring device an activation password that matches its own MAC address.
  • the first algorithm is an asymmetric encryption RSA algorithm
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • the interface unit 61 sends the encrypted activation password to the network monitoring device. Since the encryption key is the original random string generated by the network monitoring device itself, the network monitoring device can use the second algorithm to decrypt the activation password to obtain the user input. Original activation password.
  • the network monitoring device determines whether the complexity of decrypting the original activation password meets the preset password strength requirement. If yes, the activation is initiated, and the activation success information is returned to the interface unit 61, otherwise the activation failure information is returned to the interface unit 61.
  • the client prompts the user that the device activation is successful.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of using the default password before the user, and the strength of the original activation password input by the user. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • FIG. 7 is a structural diagram of a network monitoring device based remote activation system in accordance with a preferred embodiment of the present invention.
  • the network monitoring device-based remote activation system of the embodiment of the present invention includes: a client 1 and a network monitoring device 2.
  • the client 1 is configured to receive the original activation password entered by the user for the network monitoring device 2 and encrypt the original activation password. Specifically, the client 1 sends the public key generated by the first algorithm to the network monitoring device 2. The network monitoring device 2 encrypts the original random string generated by itself using the public key to generate an encrypted random string. The client 1 decrypts the 2 encrypted random string returned by the network monitoring device 2 by using the private key generated by the first algorithm to obtain 2 original random strings. The client 1 uses the obtained original random string as the key of the second algorithm, and uses the second algorithm to encrypt the original activation password input by the user, and obtains the encrypted activation password, and sends the encrypted activation password to the network monitoring device 2.
  • the foregoing encryption of the original activation password may be implemented in two ways based on the IP address and the MAC address.
  • the network monitoring device 2 is configured to receive the encrypted activation password from the client 1, decrypt the encrypted activation password, obtain the original activation password input by the user, and determine whether the original activation password meets the preset password strength requirement, if If it matches, the activation is activated, and the original activation password is set to the administrator password, and the activation success information is returned to the client 1. After receiving the activation success message, the client 1 issues a successful activation prompt to the user.
  • the network monitoring device-based remote activation system of the present invention may include: an IP address-based activation mode and a MAC address-based activation mode, and the difference between the two activation modes is only In terms of network interaction, the encryption methods of the two are consistent.
  • the client 1 sends the public key to the network monitoring device 2 by using the first algorithm, and decrypts the public key encrypted random string returned by the network monitoring device 2, so that the obtained original random string is used as the key of the second algorithm.
  • the second algorithm encrypts the original activation password input by the user, obtains the encrypted activation password, and sends the encrypted activation password to the network monitoring device 2.
  • the client receives the MAC address reported by multiple network monitoring devices, generates a public key and a private key by using the first algorithm, and sends the public key and the MAC address to the network monitoring device. Then, the public key encrypted by the network monitoring device is decrypted by using the private key, and the obtained original random string is used as the key of the second algorithm.
  • Pick The second activation algorithm encrypts the original activation password input by the user, and sends the encrypted activation password to the network monitoring device.
  • the first algorithm is an asymmetric encryption RSA algorithm
  • the second algorithm is a symmetric encryption advanced encryption standard AES algorithm.
  • FIG. 8 is a flow chart showing activation of a network monitoring device based remote activation system in accordance with a preferred embodiment of the present invention.
  • step S81 the user sends a power-on command to the inactive network monitoring device 2 through the client 1, and the inactive device 2 completes the power-on action after receiving the command.
  • step S82 the user further sends a network access request to the inactive network monitoring device 2 through the client 1. Since the device is not activated, the access fails, and the user needs to perform an activation operation first.
  • step S83 the client 1 encrypts the original activation password input by the user to the network monitoring device 2, obtains an activation password, and sends the encrypted activation password to the network monitoring device 2.
  • Step S84 the network monitoring device 2 receives the encrypted activation password from the client 1, decrypts the encrypted activation password, obtains the original activation password input by the user, and determines whether the original activation password meets the preset password strength requirement. If yes, step S85 is performed.
  • step S85 the network monitoring device 2 starts activation and sets the original activation password as an administrator password.
  • step S86 the network monitoring device 2 returns the activation success information to the client 1.
  • step S87 the client 1 sends a specific network operation request to the already activated network monitoring device 2.
  • step S88 the network monitoring device 2 returns a network operation response to the client 1 according to the network operation request.
  • the factory network monitoring device does not set a default password, and needs to be activated after the user activates the device, and can change the habit of the user who has used the default password before, and input to the user.
  • the original activation password is used for strength verification. It is not allowed to use an overly simple password to activate the device, so that the illegal user will no longer be able to use the default password or guess the current password because the password is too simple, thereby remotely controlling the monitoring device and improving the security of the password. Sex.
  • the invention encrypts the original activation password input by the user by using an asymmetric encryption RSA algorithm and a symmetric encryption AES algorithm. It is difficult to crack the activation password input by the user from the network, and further enhance the activation process. safety.
  • Embodiments of the present invention may provide a computer terminal, which may be any one of computer terminal groups.
  • the foregoing computer terminal may also be replaced with a terminal device such as a mobile terminal.
  • the computer terminal may be located in at least one network device of the plurality of network devices of the computer network.
  • the computer terminal may execute the program code of the following steps in the remote activation method of the network monitoring device: receiving the encrypted activation password input by the user through the client; decrypting the encrypted activation password to acquire the user Enter the original activation password; determine whether the original activation password meets the preset password strength requirement, and if so, activate activation and set the original activation password to the administrator password; return the device activation success information to the user.
  • the computer terminal can include: one or more processors, memory, and transmission means.
  • the memory can be used to store software programs and modules, such as program instructions/modules corresponding to the remote activation method of the network monitoring device in the embodiment of the present invention, and the processor executes various programs by running software programs and modules stored in the memory.
  • Functional application and data processing that is, a remote activation method for implementing the above network monitoring device.
  • the memory may include a high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • the memory can further include memory remotely located relative to the processor, which can be connected to the terminal over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the above transmission device is for receiving or transmitting data via a network.
  • Specific examples of the above network may include a wired network and a wireless network.
  • the transmission device includes a Network Interface Controller (NIC) that can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network.
  • the transmission device is a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the memory is used to store preset action conditions and information of the preset rights user, and an application.
  • the processor can call the memory stored information and the application by the transmitting device to execute the program code of the method steps of each of the alternative or preferred embodiments of the above method embodiments.
  • the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (MID), a PAD, and the like.
  • a smart phone such as an Android phone, an iOS phone, etc.
  • a tablet computer such as an iPad, Samsung Galaxy Tab, Samsung Galaxy Tab, etc.
  • MID mobile Internet device
  • PAD PAD
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be used to save program code executed by the remote activation method of the network monitoring device provided by the foregoing method embodiment and the device embodiment.
  • the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.
  • the storage medium is configured to store program code for performing the following steps: receiving an encrypted activation password input by the user through the client; decrypting the encrypted activation password to obtain the user Enter the original activation password; determine whether the original activation password meets the preset password strength requirement, and if so, activate activation and set the original activation password to the administrator password; return the device activation success information to the user.
  • the storage medium may also be arranged to store program code for performing various preferred or optional method steps provided by the remote activation method of the network monitoring device.
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are only schematic.
  • the division of the unit may be a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • Another point, The mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Power Engineering (AREA)
  • Small-Scale Networks (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Selective Calling Equipment (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种网络监控设备及其远程加密、远程激活方法、装置及系统，其中，方法包括如下步骤：接收用户通过客户端输入的经过加密后的激活密码；对加密后的激活密码进行解密，获取用户输入的原始激活密码；判断原始激活密码是否符合预设的密码强度要求，如果是，则启动激活，并将原始激活密码设置为管理员密码；向用户返回设备激活成功信息。本发明还提出一种网络监控设备、基于客户端的网络监控设备的加密方法、客户端及基于网络监控设备的远程激活系统。本发明采用非对称加密和对称加密两种方式组合使用，增强激活过程中的安全性。

Description

网络监控设备及其远程加密、远程激活方法、装置及系统 技术领域
本发明涉及网络安全技术领域，具体而言，涉及一种网络监控设备及其远程加密、远程激活方法、装置及系统。
背景技术
目前在安防监控行业内，网络监控设备出厂时存在以下问题：
网络监控设备在出厂时会有默认用户名密码(例如默认管理员用户名：admin，默认管理员密码：12345)。目前针对这种默认用户名密码的状况，通用的做法是在用户登录时提醒用户应该修改密码，但是这种提醒的性质是可以被用户忽略的。实际上会选择修改默认密码的用户非常少。在此情形下，使用默认密码的网络监控设备，特别是当这些设备接通了万维网的时候，非常容易被非法控制。
发明内容
本发明的目的是提供一种网络监控设备及其远程加密、远程激活方法、装置及系统。
为实现上述目的，本发明一方面提供一种网络监控设备的远程激活方法，包括：接收用户通过客户端输入的经过加密后的激活密码；对所述加密后的激活密码进行解密，获取用户输入的原始激活密码；判断所述原始激活密码是否符合预设的密码强度要求，如果是，则启动激活，并将所述原始激活密码设置为管理员密码；向所述用户返回设备激活成功信息。
其中，所述接收用户通过客户端输入的经过加密后的激活密码，包括：接收所述客户端发送的采用第一算法生成的公钥，采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，向所述客户端返回所述加密随机串，由所述客户端采用第一算法的私钥对加密随机串进行解密，得到所述原始随机串；接收所述客户端发送的采用第二算法加密的激活密码，其中，所述激活密码由客户端采用第二算法对用户输入的原始激活密码加密生成，所述第二算法的密钥为所述原始随机串。
其中，所述对所述加密后的激活密码进行解密，获取用户输入的原始激活密码，包括：采用第二算法对所述激活密码进行解密，获得所述用户输入的原始激活密码。 其中，在接收所述客户端发送的采用第一算法生成的公钥之前，还包括：向客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接收所述客户端发送的采用第一算法生成的公钥，具体为：接收和自身MAC地址相匹配的公钥。
其中，所述向所述客户端返回所述加密随机串，还包括：向客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接收所述客户端发送的采用第二算法加密的激活密码，具体为：接收和自身MAC地址相匹配的激活密码。
其中，所述第一算法为非对称加密RSA算法。
其中，所述第二算法为对称加密的高级加密标准AES算法。
本发明实施方式提供的网络监控设备的远程激活方法，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
本发明另一方面提供一种网络监控设备，包括：接口单元，用于接收用户通过客户端输入的经过加密后的激活密码；解密单元，用于对所述加密后的激活密码进行解密，获取用户输入的原始激活密码；判断单元，用于判断所述原始激活密码是否符合预设的密码强度要求；激活单元，用于在所述原始激活密码符合预设的密码强度要求时，启动激活网络监控设备，并将所述原始激活密码设置为管理员密码；所述接口单元还用于向所述用户返回设备激活成功信息。
其中，所述接口单元用于接收所述客户端发送的采用第一算法生成的公钥，采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，向所述客户端返回所述加密随机串，其中，所述客户端采用第一算法的私钥对所述加密随机串进行解密，得到所述原始随机串，并且，所述接口单元还用于接收所述客户端发送的采用第二算 法加密的激活密码，其中，所述激活密码由所述客户端采用第二算法对用户输入的原始激活密码加密生成，所述第二算法的密钥为所述原始随机串。
其中，所述解密单元用于采用第二算法对所述激活密码进行解密，获得所述用户输入的原始激活密码。
其中，所述接口单元在接收所述客户端发送的采用第一算法生成的公钥之前，向客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接口单元接收所述客户端发送的采用第一算法生成的公钥，具体为：所述接口单元接收和自身MAC地址相匹配的公钥。
其中，所述接口单元向所述客户端返回所述加密随机串，还包括：向所述客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接口单元接收所述客户端发送的采用第二算法加密的激活密码，具体为：所述接口单元接收和自身MAC地址相匹配的激活密码。
其中，所述第一算法为非对称加密RSA算法。
其中，所述第二算法为对称加密的高级加密标准AES算法。
本发明实施方式提供的网络监控设备，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
本发明又一方面的实施例提供一种基于客户端的网络监控设备的加密方法，包括：接收用户输入的对网络监控设备的原始激活密码；对所述原始激活密码进行加密；将加密后的激活密码发送给所述网络监控设备；在所述网络监控设备根据所述加密后的激活密码激活成功后，接收返回的激活成功信息。
其中，所述将加密后的激活密码发送给所述网络监控设备，包括：采用第一算法生成公钥和私钥，并将所述公钥发送至所述网络监控设备，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串；接收所述网络监控设备 发送的加密随机串，采用所述私钥对所述加密随机串进行解密，得到所述原始随机串，将得到的原始随机串作为第二算法的密钥；采用所述第二算法对用户输入的原始激活密码进行加密，将加密后的激活密码发送至所述网络监控设备。
其中，在将所述公钥发送至所述网络监控设备之前，还包括：接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
所述将所述公钥发送至所述网络监控设备，具体为：向所述网络监控设备发送与其自身MAC地址相匹配的公钥。
其中，所述接收所述网络监控设备发送的加密随机串，还包括：接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述将加密后的激活密码发送至所述网络监控设备，具体为：向所述网络监控设备发送与其自身MAC地址相匹配的激活密码。
其中，所述第一算法为非对称加密RSA算法；所述第二算法为对称加密的高级加密标准AES算法。
本发明实施方式提供的基于客户端的网络监控设备的加密方法，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
本发明再一方面的实施例提供一种客户端，包括：接口单元，用于接收用户输入的对网络监控设备的原始激活密码；加解密单元，用于对所述原始激活密码进行加密；所述接口单元还用于将加密后的激活密码发送给所述网络监控设备，并在所述网络监控设备根据所述加密后的激活密码激活成功后，接收返回的激活成功信息。
其中，所述加解密单元用于采用第一算法生成公钥和私钥，并由所述接口单元向所述网络监控设备发送所述公钥，其中，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，所述接口单元接收所述网络监控设备发送的加密随机串，并采用私钥对所述加密随机串进行解密，将得到的原始随机串作为第 二算法的密钥，并且，所述加解密单元用于采用所述第二算法对用户输入的原始激活密码进行加密，由所述接口单元将加密后的激活密码发送至所述网络监控设备。
其中，所述接口单元在将所述公钥发送至所述网络监控设备之前，接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接口单元将将所述公钥发送至所述网络监控设备，具体为：所述接口单元向所述网络监控设备发送与其自身MAC地址相匹配的公钥。
其中，所述接口单元接收所述网络监控设备发送的加密随机串，还包括：所述接口单元接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
其中，所述接口单元将加密后的激活密码发送至所述网络监控设备，具体为：所述接口单元向所述网络监控设备发送与其自身MAC地址相匹配的激活密码。
其中，所述第一算法为非对称加密RSA算法；所述第二算法为对称加密的高级加密标准AES算法。
本发明实施方式提供的客户端，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
本发明另一方面的实施例提供一种基于网络监控设备的远程激活系统，包括：客户端，用于接收用户输入的对网络监控设备的原始激活密码，并
对所述原始激活密码进行加密；网络监控设备，用于接收来自所述客户端的经过加密的激活密码，对所述加密后的激活密码进行解密，获取用户输入的原始激活密码，并判断所述原始激活密码是否符合预设的密码强度要求，如果符合，则启动激活，并将所述原始激活密码设置为管理员密码，向所述客户端返回激活成功信息；所述客户端还用于在接收到所述激活成功信息后，向用户发出激活成功提示。
其中，所述客户端接收用户输入的对网络监控设备的原始激活密码，并对所述原始激活密码进行加密，包括：所述客户端将采用第一算法生成的公钥发送给所述网络 监控设备，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，所述客户端采用第一算法生成的私钥对所述网络监控设备返回的所述加密随机串进行解密，得到所述原始随机串，将得到的原始随机串作为第二算法的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到加密后的激活密码，发送至所述网络监控设备。
本发明实施方式提供的基于网络监控设备的远程激活系统，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。通过附图所示，本发明的上述及其它目的、特征和优势将更加清晰。在全部附图中相同的附图标记指示相同的部分。并未刻意按实际尺寸等比例缩放绘制附图，重点在于示出本发明的主旨。
图1是根据本发明优选实施方式的网络监控设备的远程激活方法的流程图；
图2是根据本发明优选实施方式的基于IP地址进行远程激活的流程图；
图3是根据本发明优选实施方式的基于MAC地址进行远程激活的流程图；
图4是根据本发明优选实施方式的网络监控设备的结构图；
图5是根据本发明优选实施方式的基于客户端的网络监控设备的加密方法的流程图；
图6是根据本发明优选实施方式的客户端的结构图；
图7是根据本发明优选实施方式的基于网络监控设备的远程激活系统的结构图；以及
图8是根据本发明优选实施方式的基于网络监控设备的远程激活系统的激活流程图。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本发明为解决现有技术中的问题，提供一种网络监控设备及其远程加密、远程激活方法、装置及系统，通过对用户输入的原始激活密码进行再加密，使得该原始激活密码在网络上难以被破解，增强了激活过程中的安全性。其中，网络监控设备是指带有网络模块，可以通过IP地址访问的安防监控设备。例如：DVR(Digital Video Recorder，硬盘录像机)、DVS(Digital Video Server，网络视频服务器)、NVR(Network Video Recorder，网络硬盘录像机)、CVR(Central Video Recorder，视频云存储)、IPC(IP camera，网络摄像机)、传输和显示设备等。
图1是根据本发明优选实施方式的网络监控设备的远程激活方法的流程图。需要说明的是，该网络监控设备的远程激活方法的执行主体为网络监控设备，即由网络监控设备完成下述步骤。
步骤S11，接收用户通过客户端输入的经过加密后的激活密码。
用户在开机之后，通过客户端访问网络监控设备。由于此时网络监控设备尚未被激活，而未激活设备无法进行任何其它操作，例如修改IP地址等。只有完成对网络监控设备的激活操作，才能实现对其的网络操作。
网络监控设备告知客户端需要先激活设备才能使用，客户端在用户输入原始激活密码后，对该原始激活密码进行加密，然后将加密后的激活密码发送给网络监控设备。
步骤S12，对加密后的激活密码进行解密，获取用户输入的原始激活密码。
网络监控设备对上述步骤S11中接收到的加密后的激活密码进行解密，从而获得用户输入的原始激活密码。
步骤S13，判断原始激活密码是否符合预设的密码强度要求，如果是，则启动激活，并将原始激活密码设置为管理员密码。
网络监控设备对解密得到的原始激活密码进行复杂度分析，即校验用户设置的密码复杂度(密码强度)是否符合预设的密码强度要求。例如，预设的密码强度要求同时满足以下条件：数字、大写字母、小写字母的组合，且密码长度至少为8位。此时，如果用户输入的原始激活密码为U0123CRRT，则因为不具有小写字母且密码长度未达到8位而判断为不符合要求。
如果符合要求，则网络监控设备被激活，并将该原始激活密码作为设备的管理员密码。如果不符合要求，则网络监控设备向客户端返回激活失败信息。
步骤S14，向用户返回设备激活成功信息。
网络监控设备在激活成功之后，向客户端发送激活成功信息，由客户端提示用户设备激活成功，而后用户可以使用设置的原始激活密码以管理员身份登录网络监控设备，并进行其它网络操作。
需要说明的是，本发明的网络监控设备的远程激活方法，根据网络交互方式的不同可以包括：基于IP地址的激活方式和基于MAC地址的激活方式两种，这两种激活方式的区别仅在于网络交互上，两者的加密方式是一致的。
下面分别参考图2和图3对上述两种激活方式进行说明。
图2是根据本发明优选实施方式的基于IP地址进行远程激活的流程图。其中，基于IP地址的激活方式是通过网络定向连接某一个网络监控设备，实现激活。
步骤S21，客户端调用第一算法生成一个公钥和一个私钥，客户端将公钥发给未激活的网络监控设备。
步骤S22，网络监控设备接收客户端采用第一算法生成的公钥，采用公钥对自身生成的原始随机串进行加密，生成加密随机串。网络监控设备向客户端返回该加密随机串。具体地，网络监控设备对一个原始随机串(生成后未经任何加密操作的随机串)采用公钥进行加密，得到加密随机串，并将该加密随机串返回给客户端。
步骤S23，客户端采用第一算法的私钥对加密随机串进行解密，得到原始随机串。
步骤S24，客户端用解密出来的原始随机串作为第二算法加密的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到激活密码。之后将该激活密码发送给网络监控设备。
步骤S25，网络监控设备接收客户端采用第二算法加密的激活密码，由于加密密钥是网络监控设备自身生成的原始随机串，因此网络监控设备可以采用第二算法对该激活密码进行解密，获得用户输入的原始激活密码。
步骤S26，网络监控设备判断解密得到原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则启动激活，并向客户端返回激活成功信息。
步骤S27，客户端向用户提示设备激活成功。
图3是根据本发明优选实施方式的基于MAC地址进行远程激活的流程图。其中，由于网络监控设备出厂时一般会有一个固定的IP地址，所以当许多设备放在一起时，IP地址都是相同。这种情况下基于IP的激活方式无法直观的知道自己激活的是哪个网络监控设备。而MAC地址对于每个网络监控设备则是唯一的，即MAC地址用于唯一标识设备身份，因此基于MAC地址的激活方式可以解决上述问题，并通过多播实现网络交互。
需要说明的是，在下述步骤中，由于网络监控设备是多个，采用多播形式实现客户端与多个网络监控设备的网络交互。多播是一点对多点的通信方式，络监控设备与客户端发送至对方的信息均是首先发送到特定的多播组，凡是加入到该多播组的网络设备都可以接收到该数据，由于有MAC地址作为每个网络监控设备的匹配依据，客户端可以直观的知道当前激活的是哪个设备，尤其适用于批量激活设备的场景，可以节省网络带宽。
步骤S31，将设备的MAC地址上报至客户端。
各个网络监控设备将各自的MAC地址通过多播形式发送至客户端。
步骤S32，客户端采用第一算法生成一个公钥和一个私钥，并将公钥和MAC地址发送给网络监控设备。
步骤S33，网络监控设备判断接收到的MAC地址与本设备的MAC地址是否匹配，如果匹配成功，执行步骤S34。换言之，网络监控设备接收和自身MAC地址相匹配的公钥，返回执行步骤S34。
步骤S34，网络监控设备生成原始随机串，并采用公钥对原始随机串进行加密，得到加密随机串，并将该加密随机串和MAC地址发送给客户端。
步骤S35，客户端采用第一算法的私钥对加密随机串进行解密，得到原始随机串，并将原始随机串作为第二算法的密钥，对用户输入的原始激活密码进行加密，得到激活密码，并向网络监控设备发送采用第二算法加密的激活密码和MAC地址。
步骤S36，网络监控设备再次判断接收到的MAC地址与本设备的MAC地址是否匹配，如果匹配，则执行步骤S37。换言之，网络监控设备接收和自身MAC地址相匹配的激活密码，然后执行步骤S37。
步骤S37，网络监控设备采用第二算法对激活密码进行解密，由于加密密钥是网络监控设备自身生成的原始随机串，因此网络监控设备可以对激活密码进行解密，获得用户输入的原始激活密码。
步骤S38，网络监控设备判断原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则启动激活，并向客户端返回激活成功信息。
步骤S39，客户端向用户提示设备激活成功。
综上可知，采用MAC地址的激活方式，在加密算法和密码方面与IP地址的激活方式完全相同，只在网络交互上有所不同，基于MAC地址的激活方式采用多播形式，实现一对多的网络交互。
在本发明的一个实施例中，在上述基于IP地址的激活和基于MAC地址的激活中，第一算法为非对称加密RSA算法，第二算法为对称加密的高级加密标准AES算法。
其中，RSA算法是一种非对称的加密算法，使用该算法可以生成一对公私钥，公钥对外公开，私钥由生成方保管。在本发明中，RSA算法生成的私钥由生成方客户端进行保管。加密时使用公钥对数据进行加密，加密后的数据只有使用私钥才能完成解 密。只要密钥够长，密码是不可能被破解的。在每次激活网络监控设备时，都会生成新的RSA密钥对，私钥存储在客户端内存中，不易被截取。
AES算法是一种对称的加密算法，加解密双方使用相同的密钥对数据进行加密或者解密。虽然对称加密方式本来是不安全的，但是由于本发明预先对AES算法的密钥进行了RSA算法的加密处理，网络抓包等手段无法获得密钥，从而提升了其安全性。
根据本发明优选实施方式的网络监控设备的远程激活方法，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
图4是根据本发明优选实施方式的网络监控设备的结构图。
如图4所示，本发明提供的网络监控设备，包括：接口单元41、解密单元42、判断单元43和激活单元44。
具体地，接口单元41用于接收用户通过客户端输入的经过加密后的激活密码。即，客户端在用户输入原始激活密码后，对该原始激活密码进行加密，然后将加密后的激活密码发送给接口单元41。
加解密单元42用于对加密后的激活密码进行解密，获取用户输入的原始激活密码。
判断单元43用于判断原始激活密码是否符合预设的密码强度要求。判断单元43对解密得到的原始激活密码进行复杂度分析，即校验用户设置的密码复杂度(密码强度)是否符合预设的密码强度要求。例如，预设的密码强度要求同时满足以下条件：数字、大写字母、小写字母的组合，且密码长度至少为8位。此时，如果用户输入的原始激活密码为U0123CRRT，则因为不具有小写字母且密码长度未到达8位而判断为不符合要求。
激活单元44用于在原始激活密码符合预设的密码强度要求时，启动激活网络监控设备，并将原始激活密码设置为管理员密码，然后由接口单元41向用户返回设备激活成功信息。如果不符合要求，则网络监控设备向客户端返回激活失败信息。
需要说明的是，本发明的网络监控设备根据网络交互方式的不同可以包括：基于IP地址的激活方式和基于MAC地址的激活方式两种，这两种激活方式的区别仅在于网络交互上，两者的加密方式是一致的。
下面分别对上述两种激活方式进行说明。
(1)基于IP地址的激活方式：通过网络定向连接某一个网络监控设备，实现激活。
客户端调用第一算法生成一个公钥和一个私钥，客户端将公钥发给未激活的接口单元41。接口单元41接收客户端采用第一算法生成的公钥，并向客户端返回采用公钥加密随机串。加密随机串为加解密单元42采用该公钥对自身生成的原始随机串加密得到。
客户端采用第一算法的私钥对加密随机串进行解密，得到原始随机串，并用解密出来的原始随机串作为第二算法加密的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到激活密码，之后将该激活密码发送给接口单元41。接口单元41接收客户端采用第二算法加密的激活密码，由加解密单元42用于采用第二算法对激活密码进行解密，获得用户输入的原始激活密码。判断单元43判断原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则由激活单元44启动激活，并向客户端返回激活成功信息。客户端进一步向用户提示设备激活成功。
(2)基于MAC地址的激活方式：MAC地址对于每个网络监控设备则是唯一的，即MAC地址用于唯一标识设备身份，因此基于MAC地址的激活方式可以解决上述问题，并通过多播实现网络交互。由于网络监控设备是多个，采用多播形式实现客户端与多个网络监控设备的网络交互。多播是一点对多点的通信方式，络监控设备与客户端发送至对方的信息均是首先发送到特定的多播组，凡是加入到该多播组的网络设备都可以接收到该数据，由于有MAC地址作为每个网络监控设备的匹配依据，客户端可以直观的知道当前激活的是哪个设备，尤其适用于批量激活设备的场景，可以节省网络带宽。
各个网络监控设备将各自的MAC地址通过多播形式发送至客户端。客户端采用第一算法生成一个公钥和一个私钥，并将公钥和MAC地址发送给接口单元41。接口 单元41接收返回的采用第一算法生成的公钥和MAC地址，在判断接收到的MAC地址与本设备的MAC地址匹配后，即网络监控设备接收和自身MAC地址相匹配的公钥后，向客户端返回采用公钥加密随机串，由客户端采用第一算法的私钥对加密随机串进行解密，得到原始随机串，并将该原始随机串作为第二算法的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到激活密码。
接口单元41接收客户端采用第二算法加密的激活密码和MAC地址，其中，第二算法的密钥为原始随机串。解密单元42在判断再次接收到的MAC地址与本设备的MAC地址匹配后，换言之，网络监控设备接收和自身MAC地址相匹配的激活密码后，采用第二算法对激活密码进行解密，获得用户输入的原始激活密码。判断单元43判断原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则由激活单元44启动激活，并向客户端返回激活成功信息。客户端进一步向用户提示设备激活成功。
此处需要说明的是，上述接口单元41、解密单元42、判断单元43和激活单元44可以作为装置的一部分运行在计算机终端中，可以通过计算机终端中的处理器来执行上述模块实现的功能，计算机终端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌声电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。
在本发明的一个实施例中，在上述基于IP地址的激活和基于MAC地址的激活中，第一算法为非对称加密RSA算法，第二算法为对称加密的高级加密标准AES算法。
根据本发明优选实施方式的网络监控设备，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
图5是根据本发明优选实施方式的基于客户端的网络监控设备的加密方法的流程图。需要说明的是，该基于客户端的网络监控设备的加密方法的执行主体为客户端，即由客户端完成下述步骤。
步骤S51，接收用户输入的对网络监控设备的原始激活密码。
步骤S52，对原始激活密码进行加密。
具体地，客户端进一步将加密后的激活密码发送给网络监控设备，网络监控设备判断原始激活密码是否符合预设的密码强度要求，如果是则启动激活，并将原始激活密码设置为管理员密码，向客户端返回设备激活成功信息。
其中，本发明的基于客户端的网络监控设备的加密方法在用于对网络监控设备进行激活时，根据网络交互方式的不同可以包括：基于IP地址的激活方式和基于MAC地址的激活方式两种，这两种激活方式的区别仅在于网络交互上，两者的加密方式是一致的。
(1)基于IP地址
客户端采用第一算法生成公钥和私钥，并将公钥发送至网络监控设备，网络监控设备采用公钥对自身生成的原始随机串进行加密，生成加密随机串。客户端接收网络监控设备发送的加密随机串，采用私钥对由网络监控设备返回的经过公钥加密后的随机串进行解密，并将得到的原始随机串作为第二算法的密钥。然后采用第二算法对用户输入的原始激活密码进行加密，得到激活密码，并将加密后的激活密码发送至网络监控设备。
(2)基于MAC地址
客户端接收多个网络监控设备上报的MAC地址，其中，MAC地址用于唯一标识设备身份。客户端采用第一算法生成公钥和私钥，并将公钥和MAC地址发送至网络监控设备。具体地，客户端向网络监控设备发送与其自身MAC地址相匹配的公钥。网络监控设备采用该公钥对自身生成的原始随机串进行加密，生成加密随机串。然后客户端接收网络监控设备发送的加密随机串。进一步，客户端接收网络监控设备发送的加密随机串，还包括：接收网络监控设备发送的MAC地址，该MAC地址用于唯一标识设备身份。
客户端采用私钥对该加密随机串进行解密，并将得到的原始随机串作为第二算法的密钥。采用第二算法对用户输入的原始激活密码进行加密，得到激活密码，将加密后的激活密码发送至网络监控设备。具体地，客户端向网络监控设备发送与其自身MAC地址相匹配的激活密码。
在本发明的一个实施例中，在上述基于IP地址的激活和基于MAC地址的激活中，第一算法为非对称加密RSA算法，第二算法为对称加密的高级加密标准AES算法。
步骤S53，将加密后的激活密码发送给网络监控设备。
由于加密密钥是网络监控设备自身生成的原始随机串，网络监控设备利用可以利用第二算法对该激活密码进行解密，得到用户输入的原始激活密码。
步骤S54，在网络监控设备根据加密后的激活密码激活成功后，接收返回的激活成功信息。
网络监控设备判断解密得到原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则启动激活，并向客户端返回激活成功信息，否则向客户端返回激活失败信息。由客户端向用户提示设备激活成功。
根据本发明实施方式的基于客户端的网络监控设备的加密方法，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
图6是根据本发明优选实施方式的客户端的结构图。
如图6所示，本发明实施方式的客户端包括：接口单元61和加解密单元62。
具体地，接口单元61用于接收用户输入的对网络监控设备的原始激活密码。
加解密单元62用于对原始激活密码进行加密。接口单元61进一步将加密后的激活密码发送给网络监控设备，网络监控设备判断原始激活密码是否符合预设的密码强度要求，如果是则启动激活，并将原始激活密码设置为管理员密码，向客户端返回设备激活成功信息。
其中，本发明的客户端在用于对网络监控设备进行激活时，根据网络交互方式的不同可以包括：基于IP地址的激活方式和基于MAC地址的激活方式两种，这两种激活方式的区别仅在于网络交互上，两者的加密方式是一致的。
(1)基于IP地址
加解密单元62采用第一算法生成公钥和私钥，并将公钥发送至网络监控设备，网络监控设备采用公钥对自身生成的原始随机串进行加密，生成加密随机串。接口单元 61接收网络监控设备发送的加密随机串，采用私钥对由网络监控设备返回的经过公钥加密后的随机串进行解密，并将得到的原始随机串作为第二算法的密钥。然后加解密单元62采用第二算法对用户输入的原始激活密码进行加密，得到激活密码，并将加密后的激活密码发送至网络监控设备。
(2)基于MAC地址
接口单元61接收多个网络监控设备上报的MAC地址，其中，MAC地址用于唯一标识设备身份。加解密单元62采用第一算法生成公钥和私钥，并将公钥和MAC地址发送至网络监控设备。具体地，接口单元61向网络监控设备发送与其自身MAC地址相匹配的公钥。网络监控设备采用该公钥对自身生成的原始随机串进行加密，生成加密随机串。然后接口单元61接收网络监控设备发送的加密随机串。进一步，接口单元61接收网络监控设备发送的加密随机串，还包括：接收网络监控设备发送的MAC地址，该MAC地址用于唯一标识设备身份。加解密单元62采用私钥对该加密随机串进行解密，得到激活密码，将得到的原始随机串作为第二算法的密钥。加解密单元62采用第二算法对用户输入的原始激活密码进行加密，并将加密后的激活密码发送至网络监控设备。具体地，接口单元61向网络监控设备发送与其自身MAC地址相匹配的激活密码。
在本发明的一个实施例中，在上述基于IP地址的激活和基于MAC地址的激活中，第一算法为非对称加密RSA算法，第二算法为对称加密的高级加密标准AES算法。
接口单元61将加密后的激活密码发送给网络监控设备，由于加密密钥是网络监控设备自身生成的原始随机串，网络监控设备利用可以利用第二算法对该激活密码进行解密，得到用户输入的原始激活密码。
网络监控设备判断解密得到原始激活密码的复杂度是否符合预设密码强度要求，如果符合，则启动激活，并向接口单元61返回激活成功信息，否则向接口单元61返回激活失败信息。由客户端向用户提示设备激活成功。
根据本发明实施方式的客户端，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
图7是根据本发明优选实施方式的基于网络监控设备的远程激活系统的结构图。
具体地，本发明实施方式的基于网络监控设备的远程激活系统，包括：客户端1和网络监控设备2。
客户端1用于接收用户输入的对网络监控设备2的原始激活密码，并对原始激活密码进行加密。具体地，客户端1将采用第一算法生成的公钥发送给网络监控设备2。网络监控设备2采用公钥对自身生成的原始随机串进行加密，生成加密随机串。客户端1采用第一算法生成的私钥对网络监控设备2返回的2加密随机串进行解密，得到2原始随机串。客户端1将得到的原始随机串作为第二算法的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到加密后的激活密码，发送至网络监控设备2。
具体地，可以采用基于IP地址和基于MAC地址两种方式实现上述对原始激活密码的加密。
网络监控设备2用于接收来自客户端1的经过加密的激活密码，对加密后的激活密码进行解密，获取用户输入的原始激活密码，并判断原始激活密码是否符合预设的密码强度要求，如果符合，则启动激活，并将原始激活密码设置为管理员密码，向客户端1返回激活成功信息。客户端1在接收到激活成功信息后，向用户发出激活成功提示。
需要说明的是，根据网络交互方式的不同，本发明的基于网络监控设备的远程激活系统可以包括：基于IP地址的激活方式和基于MAC地址的激活方式两种，这两种激活方式的区别仅在于网络交互上，两者的加密方式是一致的。
(1)基于IP地址
客户端1将采用第一算法生成公钥发送给网络监控设备2，并对网络监控设备2返回的经过公钥加密随机串进行解密，以得到的原始随机串作为第二算法的密钥，采用第二算法对用户输入的原始激活密码进行加密，得到加密后的激活密码，发送至网络监控设备2。
(2)基于MAC地址
客户端接收多个网络监控设备上报的MAC地址，采用第一算法生成公钥和私钥，并将公钥和MAC地址发送至网络监控设备。然后采用私钥对由网络监控设备返回的经过公钥加密后的随机串进行解密，并将得到的原始随机串作为第二算法的密钥。采 用第二算法对用户输入的原始激活密码进行加密，并将加密后的激活密码发送至网络监控设备。
在本发明的一个实施例中，在上述基于IP地址的激活和基于MAC地址的激活中，第一算法为非对称加密RSA算法，第二算法为对称加密的高级加密标准AES算法。
图8是根据本发明优选实施方式的基于网络监控设备的远程激活系统的激活流程图。
步骤S81，用户通过客户端1向未激活的网络监控设备2发出开机指令，未激活设备2接收到该指令后完成开机动作。
步骤S82，用户进一步通过客户端1向未激活的网络监控设备2发出网络访问请求，由于该设备未被激活，因此访问失败，用户需要首先进行激活操作。
步骤S83，客户端1对用户输入的对网络监控设备2的原始激活密码进行加密，得到激活密码，并将加密后的激活密码发送给网络监控设备2。
步骤S84，网络监控设备2接收来自客户端1的经过加密的激活密码，对加密后的激活密码进行解密，获取用户输入的原始激活密码，并判断原始激活密码是否符合预设的密码强度要求，如果符合，则执行步骤S85。
步骤S85，该网络监控设备2启动激活，并将原始激活密码设置为管理员密码。
步骤S86，网络监控设备2向客户端1返回激活成功信息。
步骤S87，客户端1向已经激活的网络监控设备2发送具体的网络操作请求。
步骤S88，网络监控设备2根据上述网络操作请求，向客户端1返回网络操作应答。
根据本发明实施方式的基于网络监控设备的远程激活系统，出厂的网络监控设备不设置默认密码，需要用户激活设备之后才能正常使用，可以改变用户之前一直使用默认密码的陋习，并且对于用户输入的原始激活密码做强度校验，不允许使用过于简单的密码来激活设备，使得非法用户将无法再用默认密码或者因为密码过于简单而猜测到当前密码，从而远程控制监控设备，提升了密码的安全性。此外，本发明在对用户输入的原始激活密码进行加密的过程采用非对称加密RSA算法和对称加密AES算法两种方式组合使用，从网络上难以破解用户输入的激活密码，进一步增强激活过程中的安全性。
应当理解的是，本发明的上述具体实施方式仅仅用于示例性说明或解释本发明的原理，而不构成对本发明的限制。因此，在不偏离本发明的精神和范围的情况下所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。此外，本发明所附权利要求旨在涵盖落入所附权利要求范围和边界、或者这种范围和边界的等同形式内的全部变化和修改例。
本发明的实施例可以提供一种计算机终端，该计算机终端可以是计算机终端群中的任意一个计算机终端设备。可选地，在本实施例中，上述计算机终端也可以替换为移动终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个网络设备。
在本实施例中，上述计算机终端可以执行网络监控设备的远程激活方法中以下步骤的程序代码：接收用户通过客户端输入的经过加密后的激活密码；对加密后的激活密码进行解密，获取用户输入的原始激活密码；判断原始激活密码是否符合预设的密码强度要求，如果是，则启动激活，并将原始激活密码设置为管理员密码；向用户返回设备激活成功信息。
可选地，该计算机终端可以包括：一个或多个处理器、存储器、以及传输装置。
其中，存储器可用于存储软件程序以及模块，如本发明实施例中的网络监控设备的远程激活方法对应的程序指令/模块，处理器通过运行存储在存储器内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的网络监控设备的远程激活方法。存储器可包括高速随机存储器，还可以包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器可进一步包括相对于处理器远程设置的存储器，这些远程存储器可以通过网络连接至终端。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
上述的传输装置用于经由一个网络接收或者发送数据。上述的网络具体实例可包括有线网络及无线网络。在一个实例中，传输装置包括一个网络适配器(Network Interface Controller，NIC)，其可通过网线与其他网络设备与路由器相连从而可与互联网或局域网进行通讯。在一个实例中，传输装置为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
其中，具体地，存储器用于存储预设动作条件和预设权限用户的信息、以及应用程序。
处理器可以通过传输装置调用存储器存储的信息及应用程序，以执行上述方法实施例中的各个可选或优选实施例的方法步骤的程序代码。
本领域普通技术人员可以理解，计算机终端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌声电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以用于保存上述方法实施例和装置实施例所提供的网络监控设备的远程激活方法所执行的程序代码。
可选地，在本实施例中，上述存储介质可以位于计算机网络中计算机终端群中的任意一个计算机终端中，或者位于移动终端群中的任意一个移动终端中。
可选地，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：接收用户通过客户端输入的经过加密后的激活密码；对加密后的激活密码进行解密，获取用户输入的原始激活密码；判断原始激活密码是否符合预设的密码强度要求，如果是，则启动激活，并将原始激活密码设置为管理员密码；向用户返回设备激活成功信息。
可选地，在本实施例中，存储介质还可以被设置为存储用于执行网络监控设备的远程激活方法提供的各种优选地或可选的方法步骤的程序代码。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
在本发明的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，可以为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所 显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (36)

  1. 一种网络监控设备的远程激活方法，其特征在于，包括：
    接收用户通过客户端输入的经过加密后的激活密码；
    对所述加密后的激活密码进行解密，获取用户输入的原始激活密码；
    判断所述原始激活密码是否符合预设的密码强度要求，如果是，则
    启动激活，并将所述原始激活密码设置为管理员密码；
    向所述用户返回设备激活成功信息。
  2. 根据权利要求1所述的网络监控设备的远程激活方法，其中，
    所述接收用户通过客户端输入的经过加密后的激活密码，包括：
    接收所述客户端发送的采用第一算法生成的公钥，采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，向所述客户端返回所述加密随机串，由所述客户端采用第一算法的私钥对加密随机串进行解密，得到所述原始随机串；
    接收所述客户端发送的采用第二算法加密的激活密码，其中，所述激活密码由所述客户端采用所述第二算法对用户输入的所述原始激活密码加密生成，所述第二算法的密钥为所述原始随机串。
  3. 根据权利要求1所述的监控设备的远程激活方法，其中，
    所述对所述加密后的激活密码进行解密，获取用户输入的原始激活密码，包括：
    采用第二算法对所述激活密码进行解密，获得所述用户输入的原始激活密码。
  4. 根据权利要求2所述的网络监控设备的远程激活方法，在接收所述客户端发送的采用第一算法生成的公钥之前，还包括：
    向所述客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
  5. 根据权利要求4所述的网络监控设备的远程激活方法，所述接收所述客 户端发送的采用第一算法生成的公钥，具体为：
    接收和自身MAC地址相匹配的公钥。
  6. 根据权利要求2所述的网络监控设备的远程激活方法，所述向所述客户端返回所述加密随机串，还包括：
    向所述客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
  7. 根据权利要求2所述的网络监控设备的远程激活方法，所述接收所述客户端发送的采用第二算法加密的激活密码，具体为：
    接收和自身MAC地址相匹配的激活密码。
  8. 根据权利要求2所述的网络监控设备的远程激活方法，其中，所述第一算法为非对称加密RSA算法。
  9. 根据权利要求3所述的网络监控设备的远程激活方法，其中，所述第二算法为对称加密的高级加密标准AES算法。
  10. 一种网络监控设备，其特征在于，包括：
    接口单元，用于接收用户通过客户端输入的经过加密后的激活密码；
    加解密单元，用于对所述加密后的激活密码进行解密，获取用户输入的原始激活密码；
    判断单元，用于判断所述原始激活密码是否符合预设的密码强度要求；
    激活单元，用于在所述原始激活密码符合预设的密码强度要求时，启动激活网络监控设备，并将所述原始激活密码设置为管理员密码；
    所述接口单元还用于向所述用户返回设备激活成功信息。
  11. 根据权利要求10所述的网络监控设备，其中，
    所述接口单元用于接收所述客户端发送的采用第一算法生成的公钥，向所述客户端返回所述加密随机串，所述加密随机串为所述加解密单元采用所述公钥对自身生成的原始随机串加密得到，所述客户端采用第一算法的私钥对所述加密随机串进行解密，得到所述原始随机串，
    并且，所述接口单元还用于接收所述客户端发送的采用第二算法加 密的激活密码，其中，所述激活密码由所述客户端采用第二算法对用户输入的所述原始激活密码加密生成，所述第二算法的密钥为所述原始随机串。
  12. 根据权利要求10所述的网络监控设备，其中，
    所述解密单元用于采用第二算法对所述激活密码进行解密，获得所述用户输入的所述原始激活密码。
  13. 根据权利要求11所述的网络监控设备，其中，所述接口单元在接收所述客户端发送的采用第一算法生成的公钥之前，向所述客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
  14. 根据权利要求13所述的网络监控设备，其中，所述接口单元接收所述客户端发送的采用第一算法生成的公钥，具体为：
    所述接口单元接收和自身MAC地址相匹配的公钥。
  15. 根据权利要求11所述的网络监控设备，其中，所述接口单元向所述客户端返回所述加密随机串，还包括：向所述客户端上报MAC地址，所述MAC地址用于唯一标识设备身份。
  16. 根据权利要求11所述的网络监控设备，其中，所述接口单元接收所述客户端发送的采用第二算法加密的激活密码，具体为：
    所述接口单元接收和自身MAC地址相匹配的激活密码。
  17. 根据权利要求11所述的网络监控设备，其中，所述第一算法为非对称加密RSA算法。
  18. 根据权利要求12所述的网络监控设备，其中，所述第二算法为对称加密的高级加密标准AES算法。
  19. 一种基于客户端的网络监控设备的加密方法，其特征在于，包括：
    接收用户输入的对网络监控设备的原始激活密码；
    对所述原始激活密码进行加密；
    将加密后的激活密码发送给所述网络监控设备；
    在所述网络监控设备根据所述加密后的激活密码激活成功后，接收返回的激活成功信息。
  20. 根据权利要求19所述的基于客户端的网络监控设备的加密方法，其中，所述将加密后的激活密码发送给所述网络监控设备，包括：
    采用第一算法生成公钥和私钥，并将所述公钥发送至所述网络监控设备，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串；
    接收所述网络监控设备发送的所述加密随机串，采用所述私钥对所述加密随机串进行解密，得到所述原始随机串，将得到的原始随机串作为第二算法的密钥；
    采用所述第二算法对用户输入的原始激活密码进行加密，将加密后的激活密码发送至所述网络监控设备。
  21. 根据权利要求20所述的基于客户端的网络监控设备的加密方法，其中，在将所述公钥发送至所述网络监控设备之前，还包括：
    接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
  22. 根据权利要求21所述的基于客户端的网络监控设备的加密方法，所述将所述公钥发送至所述网络监控设备，具体为：
    向所述网络监控设备发送与其自身MAC地址相匹配的公钥。
  23. 根据权利要求20所述的基于客户端的网络监控设备的加密方法，其中，所述接收所述网络监控设备发送的加密随机串，还包括：
    接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
  24. 根据权利要求20所述的基于客户端的网络监控设备的加密方法，其中，所述将加密后的激活密码发送至所述网络监控设备，具体为：
    向所述网络监控设备发送与其自身MAC地址相匹配的激活密码。
  25. 根据权利要求20所述的基于客户端的网络监控设备的加密方法，其中，所述第一算法为非对称加密RSA算法；所述第二算法为对称加密的高级加密标准AES算法。
  26. 一种客户端，其特征在于，包括：
    接口单元，用于接收用户输入的对网络监控设备的原始激活密码；
    加解密单元，用于对所述原始激活密码进行加密；
    所述接口单元还用于将加密后的激活密码发送给所述网络监控设备，并在所述网络监控设备根据所述加密后的激活密码激活成功后，接收返回的激活成功信息。
  27. 根据权利要求26所述的客户端，其中，
    所述加解密单元用于采用第一算法生成公钥和私钥，并由所述接口单元向所述网络监控设备发送所述公钥，其中，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，所述接口单元接收所述网络监控设备发送的所述加密随机串，并采用私钥对所述加密随机串进行解密，将得到的原始随机串作为第二算法的密钥，
    并且，所述加解密单元用于采用所述第二算法对用户输入的原始激活密码进行加密，由所述接口单元将加密后的激活密码发送至所述网络监控设备。
  28. 根据权利要求27所述的客户端，其中，所述接口单元在将所述公钥发送至所述网络监控设备之前，接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
  29. 根据权利要求28所述的客户端，其中，所述接口单元将将所述公钥发送至所述网络监控设备，具体为：
    所述接口单元向所述网络监控设备发送与其自身MAC地址相匹配的公钥。
  30. 根据权利要求27所述的客户端，其中，所述接口单元接收所述网络监控设备发送的加密随机串，还包括：所述接口单元接收所述网络监控设备发送的MAC地址，所述MAC地址用于唯一标识设备身份。
  31. 根据权利要求27所述的客户端，其中，所述接口单元将加密后的激活密码发送至所述网络监控设备，具体为：
    所述接口单元向所述网络监控设备发送与其自身MAC地址相匹配的激活密码。
  32. 根据权利要求27所述的客户端，其中，所述第一算法为非对称加密RSA算法；所述第二算法为对称加密的高级加密标准AES算法。
  33. 一种基于网络监控设备的远程激活系统，其特征在于，包括：
    客户端，用于接收用户输入的对网络监控设备的原始激活密码，并
    对所述原始激活密码进行加密；
    网络监控设备，用于接收来自所述客户端的经过加密的激活密码，对所述加密后的激活密码进行解密，获取用户输入的原始激活密码，并判断所述原始激活密码是否符合预设的密码强度要求，如果符合，则启动激活，并将所述原始激活密码设置为管理员密码，向所述客户端返回激活成功信息；
    所述客户端还用于在接收到所述激活成功信息后，向用户发出激活成功提示。
  34. 根据权利要求33所述的基于网络监控设备的远程激活系统，其中，所述客户端接收用户输入的对网络监控设备的原始激活密码，并对所述原始激活密码进行加密，包括：
    所述客户端将采用第一算法生成的公钥发送给所述网络监控设备，所述网络监控设备采用所述公钥对自身生成的原始随机串进行加密，生成加密随机串，
    所述客户端采用第一算法生成的私钥对所述网络监控设备返回的所述加密随机串进行解密，得到所述原始随机串，将得到的所述原始随机串作为第二算法的密钥，采用所述第二算法对用户输入的原始激活密码进行加密，得到加密后的激活密码，发送至所述网络监控设备。
  35. 一种计算机终端，用于执行所述权利要求1所述的网络监控设备的远程激活方法提供的步骤的程序代码。
  36. 一种存储介质，用于保存所述权利要求1所述的网络监控设备的远程激活方法所执行的程序代码。
PCT/CN2015/095447 2015-06-11 2015-11-24 网络监控设备及其远程加密、远程激活方法、装置及系统 WO2016197555A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
EP15894810.9A EP3309997B1 (en) 2015-06-11 2015-11-24 Network monitoring apparatus, and remote encryption and remote activation method, device and system therefor
ES15894810T ES2914087T3 (es) 2015-06-11 2015-11-24 Aparato de monitoreo de red y procedimiento de cifrado remoto y activación remota, dispositivo y sistema para el mismo
US15/735,340 US11019041B2 (en) 2015-06-11 2015-11-24 Network monitoring apparatus, and remote encryption and remote activation method, device and system thereof
PL15894810T PL3309997T3 (pl) 2015-06-11 2015-11-24 Urządzenie monitorujące sieć oraz sposób zdalnego szyfrowania i zdalnej aktywacji, urządzenie i system do tego celu
US17/238,031 US11456999B2 (en) 2015-06-11 2021-04-22 Network monitoring apparatus, and remote encryption and remote activation method, device and system thereof

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510320504.6A CN106302369A (zh) 2015-06-11 2015-06-11 一种网络监控设备的远程激活方法、装置及远程激活系统
CN201510320504.6 2015-06-11

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US15/735,340 A-371-Of-International US11019041B2 (en) 2015-06-11 2015-11-24 Network monitoring apparatus, and remote encryption and remote activation method, device and system thereof
US17/238,031 Continuation US11456999B2 (en) 2015-06-11 2021-04-22 Network monitoring apparatus, and remote encryption and remote activation method, device and system thereof

Publications (1)

Publication Number Publication Date
WO2016197555A1 true WO2016197555A1 (zh) 2016-12-15

Family

ID=57503053

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095447 WO2016197555A1 (zh) 2015-06-11 2015-11-24 网络监控设备及其远程加密、远程激活方法、装置及系统

Country Status (6)

Country Link
US (2) US11019041B2 (zh)
EP (1) EP3309997B1 (zh)
CN (1) CN106302369A (zh)
ES (1) ES2914087T3 (zh)
PL (1) PL3309997T3 (zh)
WO (1) WO2016197555A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112486500A (zh) * 2020-11-03 2021-03-12 杭州云嘉云计算有限公司 一种系统授权部署方法

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10333903B1 (en) 2015-06-16 2019-06-25 Amazon Technologies, Inc. Provisioning network keys to devices to allow them to provide their identity
CN112669952A (zh) * 2019-10-14 2021-04-16 上海西门子医疗器械有限公司 医疗成像系统、无线网络接入方法和加密标识的生成方法
US11556630B2 (en) * 2019-10-22 2023-01-17 Microsoft Technology Licensing, Llc Private password constraint validation
US11625477B2 (en) * 2020-08-13 2023-04-11 Capital One Services, Llc Automated password generation
CN112311771B (zh) * 2020-09-30 2022-05-24 新华三大数据技术有限公司 一种管理用户接入设备的方法、管理设备和网络设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101051904A (zh) * 2007-05-17 2007-10-10 成都金山互动娱乐科技有限公司 一种保护网络应用程序使用账号密码进行登录的方法
EP1850261A1 (en) * 2005-02-10 2007-10-31 Matsushita Electric Industrial Co., Ltd. Program conversion device and program execution device
CN101453325A (zh) * 2007-11-30 2009-06-10 环达电脑(上海)有限公司 远程修改登录密码的方法

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6175926B1 (en) * 1998-05-08 2001-01-16 Hewlett-Packard Company Password protection for computer docking station
US7367053B2 (en) * 2002-10-11 2008-04-29 Yamatake Corporation Password strength checking method and apparatus and program and recording medium thereof, password creation assisting method and program thereof, and password creating method and program thereof
JP4000111B2 (ja) * 2003-12-19 2007-10-31 株式会社東芝 通信装置および通信方法
WO2005122733A2 (en) * 2004-06-09 2005-12-29 James Bergin Systems and methods for management of contact information
US20060123133A1 (en) * 2004-10-19 2006-06-08 Hrastar Scott E Detecting unauthorized wireless devices on a wired network
CN1885226A (zh) * 2005-06-24 2006-12-27 网际威信控股公司 资料加解密方法及执行该方法的储存媒体及加解密模块
CN1850261A (zh) 2006-02-27 2006-10-25 杨文龙 治疗中风、中经络的药物组合物及其制备方法
US7482929B2 (en) * 2006-05-01 2009-01-27 International Business Machines Corporation Point-of-sale activation of consumer electronics
US8125986B2 (en) * 2007-01-19 2012-02-28 International Business Machines Corporation Method for enabling secure usage of computers using a mechanism lockdown
CN102254380A (zh) * 2010-05-31 2011-11-23 北京汇冠金财科技有限公司 基于混合加密机制的手机安全支付方法及系统
CN101980508B (zh) * 2010-11-01 2013-05-15 深圳市鼎盛威电子有限公司 网络监控系统上的网络自适应运行模式
US20160005032A1 (en) * 2012-11-28 2016-01-07 Hoverkey Ltd. Method and system of providing authentication of user access to a computer resource via a mobile device using multiple separate security factors
US8930700B2 (en) * 2012-12-12 2015-01-06 Richard J. Wielopolski Remote device secure data file storage system and method
EP2936369B1 (en) * 2012-12-21 2020-04-15 Advanced Biometric Controls, LLC Verification of password using a keyboard with a secure password entry mode
US9323944B2 (en) 2013-08-28 2016-04-26 Lenovo (Singapore) Pte. Ltd. Conforming passwords to a password policy
KR101711021B1 (ko) * 2013-09-09 2017-03-13 한국전자통신연구원 모바일 신뢰 모듈 기반의 전자 서명을 제공하기 위한 시스템 및 그 방법
CN103595718B (zh) * 2013-11-15 2016-08-10 拉卡拉支付有限公司 一种pos终端激活方法、系统、服务平台及pos终端
HK1193940A2 (zh) * 2014-05-29 2014-10-03 Color I Holdings Ltd 種啟動 卡並即時獲取餘額的方法
CN104168567A (zh) * 2014-08-22 2014-11-26 北京金山安全软件有限公司 一种无线路由器的安全检测方法、检测设备及移动终端
CN104410641B (zh) * 2014-12-10 2017-12-08 福建联迪商用设备有限公司 一种pos终端安全受控的联网激活方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1850261A1 (en) * 2005-02-10 2007-10-31 Matsushita Electric Industrial Co., Ltd. Program conversion device and program execution device
CN101051904A (zh) * 2007-05-17 2007-10-10 成都金山互动娱乐科技有限公司 一种保护网络应用程序使用账号密码进行登录的方法
CN101453325A (zh) * 2007-11-30 2009-06-10 环达电脑(上海)有限公司 远程修改登录密码的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3309997A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112486500A (zh) * 2020-11-03 2021-03-12 杭州云嘉云计算有限公司 一种系统授权部署方法
CN112486500B (zh) * 2020-11-03 2022-10-21 杭州云嘉云计算有限公司 一种系统授权部署方法

Also Published As

Publication number Publication date
EP3309997B1 (en) 2022-04-20
US20210314304A1 (en) 2021-10-07
US11019041B2 (en) 2021-05-25
US11456999B2 (en) 2022-09-27
US20180176188A1 (en) 2018-06-21
EP3309997A4 (en) 2018-11-14
CN106302369A (zh) 2017-01-04
PL3309997T3 (pl) 2022-06-20
ES2914087T3 (es) 2022-06-07
EP3309997A1 (en) 2018-04-18

Similar Documents

Publication Publication Date Title
WO2016197555A1 (zh) 网络监控设备及其远程加密、远程激活方法、装置及系统
TWI756439B (zh) 入網認證方法、裝置及系統
TWI705349B (zh) 終端的認證處理、認證方法及裝置、系統
EP3358805B1 (en) Systems and methods for provisioning a camera with a dynamic qr code and a ble connection
JP5474969B2 (ja) 携帯機器の関連付け
WO2016086584A1 (zh) 一种解锁管理权限的方法和认证设备
JP5431479B2 (ja) 機器とステーションの関連付けのためのプロトコル
US10831879B2 (en) Network monitoring device, method, apparatus and system for resetting password thereof, and server
US20180091487A1 (en) Electronic device, server and communication system for securely transmitting information
US8811609B2 (en) Information protection system and method
WO2018014760A1 (zh) 图形码信息提供、获取方法、装置及终端
CN104661219B (zh) 一种无线设备的通讯方法、无线设备和服务器
US20180041507A1 (en) System and methods for provisioning devices
CA2929173A1 (en) Key configuration method, system, and apparatus
JP6807153B2 (ja) セキュアな聴覚装置の通信のための装置および関係する方法
WO2014180198A1 (zh) 终端接入方法、系统、设备和计算机存储介质
WO2019047375A1 (zh) 防止被刷的验证方法、装置、服务器及存储介质
CN104967590A (zh) 一种传输通信消息的方法、装置和系统
CN108306793B (zh) 智能设备、智能家居网关、建立连接的方法及系统
US20140237627A1 (en) Protecting data in a mobile environment
EP4037250A1 (en) Message transmitting system with hardware security module
WO2018099407A1 (zh) 账户认证登录方法及装置
CN106537962B (zh) 无线网络配置、接入和访问方法、装置及设备
WO2016003310A1 (en) Bootstrapping a device to a wireless network
CN104468540B (zh) 一种工作模式切换方法及pe设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15894810

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15735340

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2015894810

Country of ref document: EP