WO2019120091A1 - 身份认证方法、系统及计算设备 - Google Patents

身份认证方法、系统及计算设备 Download PDF

Info

Publication number
WO2019120091A1
WO2019120091A1 PCT/CN2018/120073 CN2018120073W WO2019120091A1 WO 2019120091 A1 WO2019120091 A1 WO 2019120091A1 CN 2018120073 W CN2018120073 W CN 2018120073W WO 2019120091 A1 WO2019120091 A1 WO 2019120091A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
identity information
encrypted
identity
login account
Prior art date
Application number
PCT/CN2018/120073
Other languages
English (en)
French (fr)
Inventor
金海峰
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Priority to SG11202005708XA priority Critical patent/SG11202005708XA/en
Priority to EP18890601.0A priority patent/EP3731551A4/en
Publication of WO2019120091A1 publication Critical patent/WO2019120091A1/zh
Priority to US16/904,398 priority patent/US11509485B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present application relates to the field of Internet of Things, and in particular, to an identity authentication method, system, and computing device.
  • Edge computing is a technology developed on the basis of this. For the Internet of Things, edge computing implements many control of devices through local devices, greatly improving processing efficiency and reducing the processing load of the server.
  • the IoT edge computing there are many devices that cannot communicate with the server. Therefore, these devices cannot be operated through the server, and can only be operated by establishing a LAN environment. For example, through the installation of the client terminal and the device component LAN to operate the device, it is necessary to authenticate the various applications that can operate the device to ensure the security of the IoT device and the normal use of the function. After the user buys back an IoT device, he only needs to download the relevant client program to control the device. For example, after the user installs a camera for monitoring the home situation at home, the camera control application can be downloaded through the mobile phone. , you can see the situation at home.
  • the embodiment of the present invention provides an identity authentication method, system, and computing device, to at least solve the problem in the prior art, in the process of operating a networked device to a non-networked device, the non-networked device cannot connect to the authentication server, resulting in access
  • the networked device of the non-networked device cannot complete the technical problem of identity authentication.
  • an identity authentication method including: a first device establishes a communication connection with a second device, and obtains encrypted information through the Internet, where the first device is a device that allows access to the Internet, The second device is a device that does not allow access to the Internet; the first device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device; the first device receives the second device and returns The verification result, wherein the second device verifies the encrypted identity information based on the verification information.
  • an identity authentication method including: establishing, by a second device, a communication connection with the first device, and receiving identity information to be verified transmitted by the first device, where the first device For the device that allows access to the Internet, the second device is a device that does not allow access to the Internet; the second device verifies the identity information to be verified transmitted by the first device based on the verification information, and obtains a verification result; wherein the identity information to be verified is used Encrypted data encrypted data.
  • an identity authentication method including: receiving, by a second device, identity information to be verified transmitted from a first device, where the first device is a device that allows access to the Internet, The second device is a device that does not allow access to the Internet; the second device verifies the identity information to be verified according to the verification information, and obtains a verification result; and when the verification result is that the identity information is trusted, generates a shared key for encrypting and decrypting data, The shared key is used to ensure secure data transmission between the first device and the second device.
  • the identity information to be verified is data encrypted by using the encrypted information.
  • an identity authentication system including: a first device, configured to acquire encrypted information by using an Internet, and encrypt, by using the encrypted information, identity information of an account that is logged in to the second device, and Sending the encrypted identity information to the second device; the second device establishes a communication connection with the first device, and is configured to verify the encrypted identity information based on the verification information, obtain the verification result, and return the verification result to the first device.
  • the first device is a device that allows access to the Internet
  • the second device is a device that does not allow access to the Internet.
  • a computing device comprising: a communication device, establishing a communication connection with a control device, for receiving identity information to be verified transmitted from a control device, wherein the control device is allowed to access the Internet
  • the device is connected to the communication device, and is configured to verify, according to the verification information, the identity information to be verified transmitted by the control device, obtain the verification result, and generate the encryption and decryption if the verification result is that the identity information is trusted.
  • a shared key of data wherein the shared key is used to ensure secure data transmission between the communication device and the control device.
  • a storage medium comprising a stored program, wherein the device in which the storage medium is located controls the identity authentication method of any one of the above.
  • a computing terminal comprising: a processor, the processor is configured to run a program, wherein the program is executed to perform an identity authentication method of any one of the above.
  • an identity authentication system including: a processor; and a memory coupled to the processor for providing an instruction to the processor to process the following processing steps: the first device and the The second device establishes a communication connection and obtains encrypted information through the Internet, wherein the first device is a device that allows access to the Internet, and the second device is a device that does not allow access to the Internet; the first device uses the encrypted information to log in to the account of the second device.
  • the identity information is encrypted, and the encrypted identity information is sent to the second device; the first device receives the verification result returned by the second device, wherein the second device verifies the encrypted identity information based on the verification information.
  • a communication connection is established between the first device and the second device, and the encrypted information is obtained through the Internet, where the first device is a device that allows access to the Internet, and the second device is a device that does not allow access to the Internet;
  • the device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device;
  • the first device receives the verification result returned by the second device, where the second device is based on the verification
  • the information is used to verify the encrypted identity information, and the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby realizing the operation of the non-networked device through the client.
  • the technical effect of the non-networked device authenticating the client identity to improve the security of data transmission between the client and the non-networked device, thereby solving the prior art in the process of operating the networked device to the non-networked device , because the non-networked device cannot connect to the authentication server, resulting in access to the non-networked Preparation of networked devices can not be completed authentication of technical problems.
  • FIG. 1 is a schematic diagram of an optional identity authentication system according to Embodiment 1 of the present application.
  • FIG. 2 is a schematic diagram of interaction of an optional identity authentication system according to Embodiment 1 of the present application;
  • FIG. 3 is a flowchart of an identity authentication method according to Embodiment 2 of the present application.
  • FIG. 5 is a flowchart of an optional identity authentication method according to Embodiment 2 of the present application.
  • FIG. 6 is a flowchart of an optional identity authentication method according to Embodiment 2 of the present application.
  • FIG. 7 is a flowchart of an optional identity authentication method according to Embodiment 2 of the present application.
  • FIG. 9 is a flowchart of an identity authentication method according to Embodiment 4 of the present application.
  • FIG. 10 is a schematic diagram of a computing device according to Embodiment 5 of the present application.
  • FIG. 11 is a schematic diagram of an identity authentication apparatus according to Embodiment 6 of the present application.
  • FIG. 12 is a block diagram showing the hardware configuration of a computer terminal according to Embodiment 7 of the present application.
  • the Internet of Things refers to a huge network formed by combining various information needed to monitor, connect, and interact with objects or processes through various information sensing devices.
  • Edge computing refers to an open platform that uses network, computing, storage, and application core capabilities on one side of the object or data source to provide the most recent service. Its application is launched on the edge side, resulting in faster network service response, meeting the basic requirements of real-time business, application intelligence, security and privacy protection. IoT edge computing enables many of the control of IoT devices to be implemented through local devices, thereby reducing the processing load on the server and improving processing efficiency.
  • the first device which may be a device connected to the Internet, has access to the Internet, including but not limited to IoT edge computing, with devices installed for controlling or operating various IoT infrastructure devices.
  • the second device may be a non-networked device, that is, a device that is not connected to the Internet. As an optional embodiment, it may be various Internet of Things infrastructure devices that are not connected to the Internet in the Internet of Things edge computing.
  • an embodiment of an identity authentication system is provided, which can be applied to identity authentication of an operation object of any non-networked device.
  • the embodiment may be applied to a client or a web-based application for operating an Internet of Things edge device in an Internet of Things edge computing, wherein the client or the web-based application is installed on the networked device.
  • a client or a web-based application for operating an Internet of Things edge device in an Internet of Things edge computing, wherein the client or the web-based application is installed on the networked device.
  • networked devices can communicate with the server.
  • IoT edge computing many IoT infrastructure devices (for example, smart lights, smart air conditioners, etc.) are unable to communicate with the server, but through client applications installed on networked devices (eg, mobile phones) or Operate the IoT infrastructure with Web-based IoT applications.
  • networked devices e.g, mobile phones
  • the first way in the prior art is through these client applications or web-based applications.
  • Directly log in to operate the IoT infrastructure device The IoT infrastructure device does not authenticate the application that accesses or operates the IoT infrastructure device, and the transmitted data is transmitted in plain text with low security.
  • the second method is The IoT infrastructure device directly accesses the server, and the server sends a trusted list.
  • the client application or the web-based application is connected to the IoT infrastructure device, the device determines whether the current application is in the trusted list, and then determines Provide service or refuse service.
  • the inventors have found through research that if an identity authentication scheme can be provided and applied to a device that is not connected to the Internet (ie, cannot communicate with the server), the identity of the object that operates the device is authenticated. Authenticating applications that operate non-networked devices for increased security without increasing the processing load on the server.
  • FIG. 1 is a schematic diagram of an optional identity authentication system according to an embodiment of the present application.
  • the system includes: a first device 101 and a second device 103.
  • the first device is a device that allows access to the Internet
  • the second device is a device that does not allow access to the Internet. That is, the first device can communicate with the server, and the second device cannot communicate with the server.
  • the second device may not communicate with the server, including but not limited to the following two situations: (1) the second device itself has no networking function (for example, various Internet of Things infrastructure devices in the Internet of Things edge computing), Unable to communicate with the server; (2) The second device has networking capabilities, but does not have access to the server (for example, in order to prevent a large number of devices from accessing the server, the service processing load is too large, and some devices are not allowed to access the service. end).
  • the second device itself has no networking function (for example, various Internet of Things infrastructure devices in the Internet of Things edge computing), Unable to communicate with the server; (2) The second device has networking capabilities, but does not have access to the server (for example, in order to prevent a large number of devices from accessing the server, the service processing load is too large, and some devices are not allowed to access the service. end).
  • the first device 101 is configured to obtain the encrypted information by using the Internet, encrypt the identity information of the account that is used to log in to the second device by using the encrypted information, and send the encrypted identity information to the second device.
  • the first device may be any terminal device capable of accessing the Internet, including but not limited to a mobile phone, a notebook computer, a tablet computer, a computer, etc.; the second device may be a device capable of accessing the Internet, or may not be able to access the Internet device.
  • the identity authentication method provided by the embodiment of the present application is mainly applied to a second device that is not connected to the Internet or cannot communicate with the server, including but not limited to any type of Internet of Things edge device (or infrastructure device).
  • the encrypted information may be key information for encrypting identity information transmitted by the first device to the second device. It is easy to note that the encryption algorithm used is different and the acquired encryption information is different.
  • the encrypted information may be a key for encrypting the identity information, and the sender (first device 101) encrypts the identity information by using the encrypted information, and the recipient (second device 103)
  • the key information is used to decrypt the identity information.
  • the encrypted information may include: a private key that encrypts the identity information and a public key that decrypts the encrypted identity information, and the sender (first device 101) uses the private key pair.
  • the identity information is encrypted, and the recipient (second device 103) decrypts the identity information using the public key corresponding to the private key.
  • the applications installed on the first device include but are not limited to the following applications of any one of the following operating systems: Windows, iOS, Android, and the like.
  • the application installed on the first device may be a client application or some web-based application that needs to be accessed through a browser installed on the first device. The user can operate the second device through the applications installed by the first device.
  • the second device 103 establishes a communication connection with the first device, and is configured to verify the encrypted identity information based on the verification information, obtain a verification result, and return the verification result to the first device.
  • the second device since the second device is not connected to the Internet, or is unable to communicate with the corresponding server, in order to authenticate the identity of the object operating the second device, as an optional embodiment
  • some information for verifying the identity of the operation object may be built in, so that when the first device establishes a communication connection with the second device, the second device may operate the second through the built-in verification information. The identity information of the first device of the device is verified.
  • the verification information may be a root certificate of the server certificate visa platform, and the certificate visa platform may be a platform for the server to issue a digital certificate to the first device.
  • the first device 101 can establish a communication connection with the second device 103 by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • a transmission control protocol TCP a transmission control protocol
  • UDP user datagram protocol
  • Bluetooth a Wi-Fi Protected Access Protocol
  • Zigbee a Wi-Fi Protected Access Protocol
  • WiFi Wireless Fidelity
  • the system may further include: a server 105, in communication with the first device 101, the server 105 receives a login request initiated by the first device 101, and generates an encryption according to the login request.
  • Information wherein the encrypted information comprises at least one of: a key pair and a digital certificate.
  • the key pair includes: a private key and a public key, configured to asymmetrically encrypt the identity information transmitted by the first device to the second device, that is, the first device encrypts the identity information transmitted to the first device by using the private key.
  • the second device decrypts the received encrypted identity information by using a public key corresponding to the private key.
  • the above digital certificate may be used to transmit the public key.
  • FIG. 2 is a schematic diagram of an optional identity authentication system interaction according to an embodiment of the present application. As shown in FIG. 2, the interaction process between the first device 101, the second device 103, and the server 105 is as follows:
  • the first device 101 acquires a login account, and issues a login request to the server 105 via the login account.
  • the server 105 generates corresponding encrypted information according to the login request of the first device, wherein the encrypted information includes at least one of the following: a key pair and a digital certificate.
  • the server 105 may generate corresponding encryption information according to the login account of the first device in the login request. As an optional embodiment, the server 105 may further generate a login account according to the first device in the login request. The user account corresponding to the login account (also referred to as the account number, using the account of the second device as the first device), and the corresponding encrypted information. Optionally, the server 105 can also grant different usage rights for different user accounts.
  • the login account of the first device can be directly used as an account for operating or using the second device, or a special user account can be generated.
  • the application does not limit this, as long as it can be used to identify the identity information of the first device, which is within the scope of the protection of the present application.
  • the first device 101 After receiving the encrypted information returned by the server 105, the first device 101 generates the encrypted identity information according to the login account and the encrypted information.
  • the first device 101 may encrypt the login account and/or the random number by using the private key in the key pair to obtain an encryption result, and generate the encrypted identity information based on the login account and the information of at least one of the following: Encrypted results and digital certificates. Including but not limited to the following three implementations:
  • the first device 101 encrypts the login account by using the private key in the key pair returned by the server 105 to obtain an encryption result, and generates the encrypted identity information based on the encryption result and the digital certificate.
  • the digital certificate can be used to transmit the public key corresponding to the private key.
  • the first device 101 encrypts the login account and the random number (assumed to be the first random number) by using the private key in the key pair returned by the server 105 to obtain an encryption result, and based on the encryption result.
  • the digital certificate generates the encrypted identity information.
  • the digital certificate can be used to transmit the public key corresponding to the private key.
  • the first device 101 encrypts the random number (assumed to be the first random number) by using the private key in the key pair returned by the server 105, obtains the encryption result, and is based on the login of the first device.
  • the account number, encryption result, and digital certificate generate encrypted identity information.
  • the digital certificate can be used to transmit the public key corresponding to the private key.
  • the first device 101 transmits the encrypted identity information to the second device 103.
  • the generated encrypted identity information may be added to the digital signature of the first device, and the digital signature is added.
  • the subsequent identity information is sent to the second device 103.
  • the first device 101 After receiving the encrypted identity information sent by the first device 101, the first device 101 decrypts the encrypted identity information.
  • the first device 101 decrypts the encrypted identity information, first, based on the pre-installed root certificate, it may be determined whether the digital certificate included in the identity information to be verified is trusted, and the digital certificate is not trusted. Next, the result of the authentication failure returned to the first device 101.
  • the second device 103 extracts the public key included in the digital certificate, and verifies whether the received data has been tampered with by the digital signature, and in the case that the received data is tampered with, A device receives the result of the authentication failure returned by the second device.
  • the second device 103 decrypts the encryption result by using the public key extracted from the digital certificate to obtain a login account number and/or a random number (ie, the first random number). And determining whether the login account exists in the trusted list, wherein the trusted list includes at least one account that allows login to the second device, and if the login account does not exist in the trusted list, returning the authentication to the first device fails the result of.
  • the second device 103 determines whether the login account exists in the trusted list, whether the login account exists in the trusted list, and if the login account does not exist in the trusted list, the second device decrypts The obtained login account is used as an administrative account and added to the trusted list, wherein the management account is used to manage at least one login account in the trusted list.
  • the second device 103 in a case that the login account exists in the trusted list, the second device 103 generates a random number (ie, second random data), and generates a shared key according to the first random number and the second random number, and shares the secret.
  • the key is used to ensure secure data transmission between the first device and the second device.
  • the first device 101 generates, according to the first random number and the second random number returned by the server, a secure data transmission shared key between the subsequent first device and the second device.
  • an embodiment of the identity authentication method is also provided.
  • the embodiment may be applied to the identity authentication system in Embodiment 1, including but not limited to the scenario in Embodiment 1.
  • the steps illustrated in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and, although shown in the flowchart, The steps shown or described may be performed in an order different than that herein.
  • FIG. 3 is a flowchart of an identity authentication method according to an embodiment of the present application. As shown in FIG. 3, the method includes the following steps:
  • Step S302 The first device establishes a communication connection with the second device, and obtains the encrypted information through the Internet, where the first device is a device that allows access to the Internet, and the second device is a device that does not allow access to the Internet.
  • the foregoing encryption information may be key information used to encrypt identity information transmitted by the first device to the second device.
  • the first device may be any terminal device capable of accessing the Internet, including but not limited to a mobile phone, a notebook computer, a tablet computer, a computer, etc.; the second device may be a device capable of accessing the Internet, or may not be able to access the Internet device.
  • the identity authentication method provided by the embodiment of the present application is mainly applied to a second device that is not connected to the Internet or cannot communicate with the server, including but not limited to any one of the Internet of Things edge devices (or infrastructure devices).
  • the application installed on the first device includes, but is not limited to, an application of any one of the following operating systems: Windows, iOS, Android, and the like.
  • the application installed on the first device may be a client application or some web-based application that needs to be accessed through a browser installed on the first device. The user can operate the second device through the applications installed by the first device.
  • the first device can establish a communication connection with the second device by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • TCP transmission control protocol
  • UDP user datagram protocol
  • Bluetooth Bluetooth
  • Zigbee Zigbee
  • WiFi Wireless Fidelity
  • the encrypted information may be a key for encrypting identity information
  • the first device uses the encrypted information to encrypt the identity information
  • the second device utilizes the The key decrypts the identity information
  • the foregoing encrypted information may include: a private key that encrypts the identity information and a public key that decrypts the encrypted identity information, the first device The identity information is encrypted by using the private key, and the second device decrypts the identity information by using the public key corresponding to the private key.
  • Step S304 the first device encrypts the identity information of the account that is logged into the second device by using the encrypted information, and sends the encrypted identity information to the second device.
  • the first device establishes a communication connection with the second device, and obtains the corresponding encrypted information from the Internet, and the encrypted information is used to encrypt the identity information of the account that the first device logs in to the second device, where the encryption manner includes
  • the encryption manner includes
  • the first device encrypts the identity information of the first device by using the encrypted information, and obtains the encrypted identity information
  • the first device generates the identity information of the first device and the first device by using the encrypted information.
  • the random number is encrypted to obtain the encrypted identity information.
  • the first device is based on the identity information of the first device, and uses the encrypted information to encrypt the random number generated by the first device to obtain the encrypted identity information.
  • Step S306 the first device receives the verification result returned by the second device, where the second device verifies the encrypted identity information based on the verification information.
  • the second device since the second device is not connected to the Internet, or is unable to communicate with the corresponding server, in order to authenticate the identity of the object operating the second device, as an optional embodiment
  • some information for verifying the identity of the operation object may be built in, so that when the first device establishes a communication connection with the second device, the second device receives the received information according to the built-in verification information.
  • the identity information sent by the first device is verified, and the verification result is returned to the first device.
  • the verification information may be a root certificate of the server certificate visa platform, and the certificate visa platform may be a platform for the server to issue a digital certificate to the first device.
  • the first device that allows access to the Internet obtains the encrypted information from the Internet, and uses the encrypted information to encrypt the identity information of the account that the first device logs into the second device, so that the second device
  • the received identity information may be verified by the verification information to communicate with the first device if it is determined that the identity information of the first device is authentic.
  • the verification information in the second device can verify the encrypted information acquired by the first device to determine whether the identity of the first device is trusted according to the verification result. Therefore, through the solution disclosed in the foregoing embodiment of the present application, the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby achieving non-operation through the client.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device.
  • the solution of the foregoing embodiment 2 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • the first device encrypts the identity information of the account that is logged into the second device by using the encrypted information, and sends the encrypted identity information to the second.
  • Equipment including:
  • Step S402 The first device acquires the login account, and receives the encrypted information returned by the authentication server, where the encrypted information includes at least one of the following: a key pair and a digital certificate.
  • the authentication server may be a server for authenticating an object that operates on the second device, for example, when the second device is an Internet of Things (eg, smart light, smart air conditioner, etc.), the authentication server may It is a server that provides an application service, and the first device can operate the second device by installing a corresponding application. Since the second device is unable to communicate with the authentication server, in order to verify whether the identity information of the first device operating the second device is authentic, the first device capable of communicating with the server (ie, the authentication server) may be based on the current registration or Registering an account of the application to log in to the authentication server, so that the authentication server generates corresponding encryption information, and the first device encrypts the identity information sent by the first device to the second device.
  • the authentication server may be based on the current registration or Registering an account of the application to log in to the authentication server, so that the authentication server generates corresponding encryption information, and the first device encrypts the identity information sent by the first device to the second device.
  • the key pair in the encrypted information includes: a private key and a public key, and is used for asymmetrically encrypting the identity information transmitted by the first device to the second device, that is, the first device uses the private key pair to transmit to the first
  • the identity information of a device is encrypted, and the second device decrypts the received encrypted identity information by using a public key corresponding to the private key.
  • the above digital certificate may be used to transmit the public key.
  • the login account is used to represent the identity information of the account that the first device logs in to the second device, and may be the account of the first device logging in to the authentication server, or may be the account of the authentication server logging in to the authentication server according to the first device.
  • a corresponding user account is generated (also called an account, and the account of the second device is used as the first device).
  • the login account of the first device can be directly used as the account for operating or using the second device, and a special user account can also be generated. As long as it can be used to identify the identity information of the first device, it is within the scope of the protection of the present application.
  • Step S404 the first device generates the encrypted identity information according to the login account and the encrypted information.
  • the encrypted identity information may be generated by using any one of the following manners: 1 the first device uses the encrypted information to perform the login account Encrypted to obtain the encrypted identity information; 2 the first device encrypts the login account and the random number generated by the first device by using the encrypted information to obtain the encrypted identity information; 3 the first device is based on the login account, and uses the encrypted information pair Encrypted with the random number generated by the first device to obtain the encrypted identity information.
  • step S404 may include: step S4041, first The device encrypts the login account and/or the random number by using the private key in the key pair to obtain an encryption result.
  • step S4043 the first device generates the encrypted identity information based on the login account and at least one of the following information: the encryption result. And digital certificates.
  • the first device encrypts the login account and/or the random number by using the private key in the key pair to obtain the encryption result, which may include the following steps: Step S4041a, the first device Acquiring the first random number; in step S4041b, the first device encrypts the login account and the first random number by using the private key in the key pair to obtain an encryption result.
  • a specific key pair and a digital certificate are obtained according to the login account of the first device, and the specific implementation may have no account, and the certificate of the key pair is obtained by using another medium, which belongs to the protection scope of the present application. .
  • Step S406 the first device sends the encrypted identity information to the second device.
  • the generated encrypted identity information may be added to the digital signature of the first device, and the digital signature is added.
  • the identity information is sent to the second device.
  • the method may further include: Step S303: The first device initiates a login request to the authentication server, where the authentication server generates the encrypted information according to the login request, where the encrypted information includes at least one of the following: a key pair and a digital certificate.
  • the key pair includes: a private key and a public key, configured to asymmetrically encrypt the identity information transmitted by the first device to the second device, that is, the first device encrypts the identity information transmitted to the first device by using the private key.
  • the second device decrypts the received encrypted identity information by using a public key corresponding to the private key.
  • the above digital certificate may be used to transmit the public key.
  • the first device may add the digital signature of the first device when the encrypted identity information is sent to the second device, and the The digitally signed identity information is sent to the second device. Therefore, as an optional embodiment, as shown in FIG. 5, the first device sends the encrypted identity information to the second device, which may include the following steps:
  • Step S502 the first device adds the encrypted identity information to the digital signature of the first device.
  • Step S504 the first device sends the digitally signed identity information to the second device.
  • the second device may be configured to verify whether the content has been tampered with according to the digital signature protocol after receiving the identity information sent by the first device.
  • the method may further include the following steps:
  • Step S602 The second device determines, according to the pre-installed root certificate, whether the digital certificate included in the identity information to be verified is trusted.
  • the root certificate in the second device may be a root certificate of the server certificate visa platform
  • the certificate visa platform may be a platform used by the server to issue a digital certificate to the first device.
  • the root certificate of the certificate visa platform can be used to verify whether the digital certificate returned by the certificate visa platform (ie, the authentication server) to the first device is trusted.
  • Step S604 If the digital certificate is not trusted, the first device receives a result of the identity verification failure returned by the second device.
  • the second device may return a result of the identity verification failure.
  • the foregoing method may further include the following steps:
  • Step S606 the second device extracts the public key included in the digital certificate, and verifies whether the received data is tampered with by a digital signature;
  • Step S608 in the case that the received data is tampered with, the first device receives the result of the identity verification failure returned by the second device.
  • the second device Since the second device receives the identity information to be verified sent by the first device, which is encrypted by using the medium private key of the key pair, determining, according to the root certificate installed in the second device, that the received digital certificate is trusted In the case that the identity information to be verified is decrypted by the public key included in the received digital certificate, in order to avoid unnecessary operations, the receiving may be first verified according to the digital signature of the first device included in the received data. Whether the data content has been tampered with, and in the case of tampering, returns the result of the authentication failure.
  • the foregoing method may further include the following steps:
  • Step S610 the second device decrypts the encryption result by using the public key to obtain a login account number and/or a first random number.
  • the identity information encrypted by the private key may be decrypted according to the public key extracted from the digital certificate.
  • the identity information of the first device eg, login account
  • the random number produced by the first device ie, the first random number
  • Step S612 the second device determines whether the login account exists in the trusted list, wherein the trusted list includes at least one account that allows login to the second device.
  • the above-mentioned trusted list stores identity information of at least one trusted account (for example, a login account, or a user account generated according to the login account).
  • the method may further include the following steps: Step S611a, the second device determines whether a login account exists in the trusted list; and step S611b does not in the trusted list.
  • the second device uses the decrypted login account as an administrative account and adds it to the trusted list, wherein the management account is used to manage at least one login account in the trusted list.
  • the first device transmits the identity information (for example, the login account, or the user account generated according to the login account) to the second device as an administrator account, and adds it to the list of trusted accounts.
  • the account corresponding to the administrator account may delete or add other accounts in the trusted list, thereby solving the problem that the second device needs to be connected to the server to obtain a trusted list, so that the server is overloaded.
  • Step S614 If the login account does not exist in the trusted list, the first device receives the result of the identity verification failure returned by the second device. If the decrypted login account is not in the trusted list, the login account is not trusted. Therefore, the result of the identity verification failure may be returned to the first device, and the operation of the first device to the second device is terminated.
  • the foregoing method may further include the following steps:
  • Step S616 the first device generates a shared key according to the first random number and the second random number returned by the authentication server, where the second random number is the second device, where the login account exists in the trusted list, and the second device a random number generated by the device; wherein, the second device generates a shared key according to the first random number and the second random number.
  • the second device determines that the identity of the first device is trusted, generating a shared key for transmitting data between the first device and the second device according to the generating the second random number and the first random number generated by the first device It can be used for subsequent secure data transmission between the first device and the second device.
  • FIG. 7 is a flowchart of an optional identity authentication method according to an embodiment of the present application. As shown in FIG. 7, the method includes the following steps:
  • the client that is, the first device mentioned above logs in to the account. That is, the user logs in through a client program installed by the client device or a web-based application.
  • the server returns the user account, key pair, and digital certificate corresponding to the login account.
  • the server generates a user account and a key pair according to the login account, and issues a digital certificate to the key through the authorization platform.
  • the server can save the information in the data, so that the next time the login account is logged in, it can be directly read.
  • the client establishes a communication connection with the non-networked device (ie, the second device described above).
  • the client connects to the non-networked device via TCP or UDP.
  • the client encrypts the user account and the random number (ie, the first random number) with the private key and sends it to the non-networked device, and the protocol includes the digital certificate and the digital signature.
  • the non-networked device verifies the digital certificate and signature according to the root certificate.
  • the non-networked device parses the digital certificate, and verifies whether the received digital certificate is trusted by the root certificate, and returns an authentication failure error if the digital certificate is not trusted. If the digital certificate is trusted, the public key is extracted from the digital certificate, and the content of the protocol is verified to have been tampered with by the digital signature protocol. If the content has been tampered with, an authentication failure error is returned.
  • the non-networked device decrypts the user account and the first random number through the public key, and determines whether the trusted list is empty. If the trusted list is empty, the user account is used as an administrator account, and generates The second random number, with the first random data of the client, generates a shared key for secure data transmission between the client and the non-networked device. The client generates a shared key for secure data transmission between the client and the non-networked device according to the first random number generated by the client and the second random number returned by the server.
  • the transmitted data is encrypted by the private key
  • the digital certificate transmits the public key
  • the non-networked device verifies that the digital certificate is trusted, and then passes the
  • the public key decrypted data extracted from the digital certificate obtains the identity information of the first device, thereby solving the problem that the non-networked device needs to connect to the server to add a trusted account, and the purpose of identity confirmation and shared key generation is completed in one communication. .
  • an embodiment of the identity authentication method is also provided.
  • the embodiment may be applied to the identity authentication system in Embodiment 1, including but not limited to the scenario in Embodiment 1.
  • the steps illustrated in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and, although shown in the flowchart, The steps shown or described may be performed in an order different than that herein.
  • FIG. 8 is a flowchart of an identity authentication method according to an embodiment of the present application. As shown in FIG. 8, the method includes the following steps:
  • Step S802 The second device establishes a communication connection with the first device, and receives the identity information to be verified transmitted by the first device, where the first device is a device that allows access to the Internet, and the second device is a device that is not allowed to access the Internet.
  • the foregoing second device may be a device capable of accessing the Internet, or may not be able to access the Internet device.
  • the identity authentication method provided by the embodiment of the present application is mainly applied to the second device that is not connected to the Internet or cannot communicate with the server. Including but not limited to any type of Internet of Things edge device (or infrastructure device); the identity information to be verified is data encrypted using encrypted information; the first device may be any terminal device capable of accessing the Internet, including Not limited to mobile phones, laptops, tablets, computers, etc.
  • the second device may establish a communication connection with the first device by using any one of the following communication methods: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • TCP transmission control protocol
  • UDP user datagram protocol
  • Bluetooth Bluetooth
  • Zigbee Zigbee
  • WiFi Wireless Fidelity
  • Step S804 the second device verifies the identity information to be verified transmitted by the first device based on the verification information, and obtains a verification result.
  • the verification information may be: when the second device is shipped from the factory, some information for verifying the identity of the operation object may be built in; because the second device is not connected to the Internet, or is unable to communicate with the corresponding server.
  • some information for verifying the identity of the operation object may be built in when the second device is shipped, so that when the first device establishes a communication connection with the second device, The second device verifies the received identity information sent by the first device according to the built-in verification information, and returns the verification result to the first device.
  • the verification information may be a root certificate of the server certificate visa platform, and the certificate visa platform may be a platform for the server to issue a digital certificate to the first device.
  • the second device that does not allow access to the Internet establishes a communication connection with the first device that allows access to the Internet, and receives the identity information to be verified sent by the first device, and the second device passes the verification.
  • the information comes to the identity information of the first device to communicate with the first device if it is determined that the identity information of the first device is authentic.
  • the identity information to be verified sent by the first device is the data encrypted by using the encrypted information
  • the verification information in the second device can verify the encrypted information acquired by the first device, according to the verification result. Determine if the identity of the first device is trustworthy. Therefore, through the solution disclosed in the foregoing embodiment of the present application, the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby achieving non-operation through the client.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device.
  • the solution of the foregoing embodiment 3 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • an embodiment of the identity authentication method is also provided.
  • the embodiment may be applied to the identity authentication system in Embodiment 1, including but not limited to the scenario in Embodiment 1.
  • the steps illustrated in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and, although shown in the flowchart, The steps shown or described may be performed in an order different than that herein.
  • FIG. 9 is a flowchart of an identity authentication method according to an embodiment of the present application. As shown in FIG. 9, the method includes the following steps:
  • Step S902 The second device receives the identity information to be verified transmitted from the first device, where the first device is a device that allows access to the Internet, and the second device is a device that does not allow access to the Internet.
  • the foregoing second device may be a device that can access the Internet or a device that is not capable of accessing the Internet.
  • the identity authentication method provided by the embodiment of the present application is mainly applied to the second device that is not connected to the Internet or cannot communicate with the server, including It is not limited to any type of Internet of Things edge device (or infrastructure device); the identity information to be verified is data encrypted by using encrypted information; the first device may be any terminal device capable of accessing the Internet, including but not limited to Mobile phones, laptops, tablets, computers, etc.
  • Step S904 the second device verifies the identity information to be verified according to the verification information, and obtains the verification result.
  • the verification information may be: when the second device is shipped from the factory, some information may be built in the verification of the identity of the operation object; in an optional embodiment, the verification information may be a root certificate of the server certificate visa platform.
  • the certificate visa platform may be a platform for the server to issue a digital certificate to the first device.
  • step S906 if the verification result is that the identity information is trusted, a shared key for encrypting and decrypting data is generated, wherein the shared key is used to ensure secure data transmission between the first device and the second device.
  • the shared key may be used for key information for subsequent secure data transmission by the first device and the second device.
  • the second device that does not allow access to the Internet establishes a communication connection with the first device that allows access to the Internet, and receives the identity information to be verified sent by the first device, and the second device passes the verification.
  • the information is whether the identity information of the first device is trusted, and in the case of determining that the identity information of the first device is trusted, generating a shared key for communication between the first device and the second device.
  • the identity information to be verified sent by the first device is the data encrypted by using the encrypted information
  • the verification information in the second device can verify the encrypted information acquired by the first device, according to the verification result. Determine if the identity of the first device is trustworthy. Therefore, with the solution disclosed in the foregoing embodiment of the present application, the identity information of the object for operating the non-networked device is verified according to the verification information built in the non-networked device, and in the case where the identity is trusted, the generation is performed.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device when the non-networked device is operated by the client.
  • the solution of the foregoing embodiment 4 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • the method before the second device receives the identity information to be verified transmitted by the first device, the method further includes: the first device acquiring the login account, and receiving the encrypted information returned by the authentication server, where The encrypted information includes at least one of the following: a key pair and a digital certificate; the first device generates the identity information to be verified according to the login account and the encrypted information; and the first device sends the identity information to be verified to the second device.
  • the second device receives the identity information to be verified sent by the first device by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • the method before the first device obtains the login account and receives the encrypted information returned by the authentication server returned by the server, the method further includes: the first device initiating a login request to the authentication server, where the authentication server Generate encrypted information based on the login request.
  • the first device generates the identity information to be verified according to the login account and the encrypted information, including: the first device encrypts the login account and/or the random number by using the private key in the key pair. And obtaining an encryption result; the first device generates the identity information to be verified based on the login account and the information of at least one of the following: an encryption result and a digital certificate.
  • the first device encrypts the login account and/or the random number by using the private key in the key pair to obtain an encryption result, including: the first device acquires the first random number; the first device The login account and the first random number are encrypted using the private key in the key pair to obtain an encryption result.
  • the sending, by the first device, the identity information to be verified to the second device may include: adding, by the first device, the identity information to be verified to the digital signature of the first device; the first device adds a number The signed identity information is sent to the second device.
  • the second device verifies the identity information to be verified transmitted by the first device, and obtains the verification result, which may include: determining, by the second device, the identity to be verified based on the pre-installed root certificate. Whether the digital certificate contained in the information is trusted; if the digital certificate is not trusted, the second device returns the result of the authentication failure to the first device.
  • the method further includes: when the digital certificate is trusted, the second device extracts the public key included in the digital certificate, and verifies whether the received data is verified by the digital signature. Tampering; in case the received data is tampered with, the second device returns the result of the authentication failure to the first device.
  • the method further includes: the second device decrypts the encryption result by using the public key to obtain a login account and/or a first random number; and the second device determines the login account. Whether it exists in the trusted list, wherein the trusted list includes at least one account that allows login to the second device; if the login account does not exist in the trusted list, the second device returns the result of the authentication failure to the first device .
  • the second device determines that the identity information transmitted by the first device is a trusted verification result.
  • the method further includes: acquiring, by the second device, the second random number, and Generating a shared key according to the first random number and the second random number; wherein the first device generates the shared key according to the first random number and the second random number returned by the authentication server.
  • the method further includes: determining, by the second device, whether the login exists in the trusted list. If the login account does not exist in the trusted list, the second device uses the decrypted login account as an administrative account and adds to the trusted list, wherein the management account is used to manage at least one of the trusted lists. Login account.
  • the identity authentication method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases The former is a better implementation.
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.
  • FIG. 10 is a schematic diagram of a computing device according to an embodiment of the present application. As shown in FIG. 10, the computing device 10 includes : communication device 1001 and processor 1003.
  • the communication device 1001 establishes a communication connection with the control device, and is configured to receive identity information to be verified transmitted from the control device, where the control device is a device that allows access to the Internet;
  • the processor 1003 is connected to the communication device, and is configured to verify, according to the verification information, the identity information to be verified transmitted by the control device, obtain a verification result, and generate an encryption and decryption data if the verification result is that the identity information is trusted.
  • a shared key wherein the shared key is used to ensure secure data transmission between the communication device and the control device.
  • the computing device may be an Internet of Things (such as a smart light, a smart air conditioner, etc.) in the Internet of Things edge computing, and the computing device cannot communicate with the server, but is connected through networking.
  • a client application installed on a device (for example, a mobile phone) or an Internet of Things infrastructure device is operated through a web-based IoT application.
  • the above control device may be a networked device for controlling or operating a computing device, the control device may communicate with the server, and the control device operates the above computing device through an installed client application or a web-based application, including but not limited to a mobile phone, a notebook Computers, tablets, computers, etc.
  • the computing device 10 communicates with the control device through the communication device 1001.
  • the communication protocol includes, but is not limited to, any one of the following: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • the first device that allows access to the Internet obtains the encrypted information from the Internet, and uses the encrypted information to encrypt the identity information of the account that the first device logs into the second device, so that the second device
  • the received identity information may be verified by the verification information to communicate with the first device if it is determined that the identity information of the first device is authentic.
  • the verification information in the second device can verify the encrypted information acquired by the first device to determine the identity of the first device according to the verification result. Therefore, through the solution disclosed in the foregoing embodiment of the present application, the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby achieving non-operation through the client.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device.
  • the solution of the foregoing embodiment 2 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • FIG. 11 is a schematic diagram of an identity authentication apparatus according to an embodiment of the present application. As shown in FIG. 11, the apparatus includes: acquiring The unit 111, the encryption unit 113, and the receiving unit 115.
  • the obtaining unit 111 is configured to establish a communication connection with the second device by using the first device, and obtain the encrypted information by using the Internet, where the first device is a device that allows access to the Internet, and the second device is a device that is not allowed to access the Internet;
  • the encryption unit 113 is configured to encrypt, by the first device, the identity information of the account that is logged in to the second device by using the encrypted information, and send the encrypted identity information to the second device;
  • the receiving unit 115 is configured to receive, by the first device, a verification result returned by the second device, where the second device verifies the encrypted identity information based on the verification information.
  • the foregoing obtaining unit 111, the encrypting unit 113, and the receiving unit 115 correspond to steps S302 to S306 in Embodiment 2, and the foregoing modules are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the above.
  • the content disclosed in Embodiment 2 is disclosed. It should be noted that the above modules may be implemented as part of a device in a computer system such as a set of computer executable instructions.
  • the first device that allows access to the Internet obtains the encrypted information from the Internet, and uses the encrypted information to encrypt the identity information of the account that the first device logs into the second device, so that the second device
  • the received identity information may be verified by the verification information to communicate with the first device if it is determined that the identity information of the first device is authentic.
  • the verification information in the second device can verify the encrypted information acquired by the first device to determine whether the identity of the first device is trusted according to the verification result. Therefore, through the solution disclosed in the foregoing embodiment of the present application, the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby achieving non-operation through the client.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device.
  • the solution of the foregoing embodiment 5 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • the encryption unit includes: an obtaining module, configured to acquire a login account by using the first device, and receive the encrypted information returned by the authentication server, where the encryption information includes at least one of the following: a key pair and a digital certificate; a generating module, configured to generate, by the first device, the encrypted identity information according to the login account and the encrypted information; and the sending module, configured to send the encrypted identity information to the second device by using the first device.
  • the generating module includes: a first encryption module, configured to encrypt the login account and/or the random number by using the private key in the key pair by the first device to obtain an encryption result; And an encryption module, configured to generate, by the first device, the encrypted identity information based on the login account and the information of at least one of the following: an encryption result and a digital certificate.
  • the first encryption module is further configured to acquire the first random number by using the first device, and encrypt the login account and the first random number by using the private key in the key pair by the first device. , get the encrypted result.
  • the foregoing apparatus further includes: a sending unit, configured to initiate a login request to the authentication server by using the first device, where the authentication server generates the encrypted information according to the login request, where the encrypted information includes at least the following One: key pair and digital certificate.
  • the first device establishes a communication connection with the second device by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • TCP transmission control protocol
  • UDP user datagram protocol
  • Bluetooth Bluetooth
  • Zigbee Zigbee
  • WiFi Wireless Fidelity
  • the sending module is further configured to add the encrypted identity information to the digital signature of the first device by using the first device, and send the digital signature-added identity information to the first device by using the first device. Two devices.
  • the foregoing apparatus further includes: a first determining unit, configured to determine, by the second device, whether the digital certificate included in the identity information to be verified is trusted according to the pre-installed root certificate;
  • the receiving unit is further configured to: when the digital certificate is not trusted, the first device receives a result of the identity verification failure returned by the second device.
  • the apparatus further includes: an extracting unit, configured to extract, by using the second device, the public key included in the digital certificate, if the digital certificate is trusted And determining, by the digital signature, whether the received data is tampered with; wherein the receiving unit is further configured to receive, by the first device, the result of the identity verification failure returned by the second device, if the received data is tampered with.
  • the device further includes: a decrypting unit, configured to decrypt the encryption result by using the public key by using the second device, to obtain the login account and/or Or a first random number; the second determining unit is configured to determine, by the second device, whether the login account exists in the trusted list, where the trusted list includes at least one account that allows login to the second device; wherein the receiving unit further uses In the case that the login account does not exist in the trusted list, the result of the identity verification failure returned by the second device is received by the first device.
  • a decrypting unit configured to decrypt the encryption result by using the public key by using the second device, to obtain the login account and/or Or a first random number
  • the second determining unit is configured to determine, by the second device, whether the login account exists in the trusted list, where the trusted list includes at least one account that allows login to the second device
  • the receiving unit further uses In the case that the login account does not exist in the trusted list, the result of the identity verification failure returned by the second device is received by the first device.
  • the foregoing apparatus further includes: a generating unit, configured, by the first device, according to the first random number and the second random number returned by the authentication server, Generating a shared key, where the second random number is a random number generated by the second device when the login account exists in the trusted list, where the second device is configured according to the first random number and the second random number , generate a shared key.
  • the foregoing apparatus includes: a third determining unit, configured to determine, by the second device, whether a login account exists in the trusted list; and a processing unit, configured to not have a login account in the trusted list
  • the second device uses the decrypted login account as an administrative account and adds it to the trusted list, where the management account is used to manage at least one login account in the trusted list.
  • Embodiments of the present application may provide a computer terminal, which may be any one of computer terminal groups.
  • the foregoing computer terminal may also be replaced with a terminal device such as a computer terminal.
  • the computer terminal may be located in at least one access device of the plurality of network devices of the computer network.
  • Fig. 12 is a block diagram showing the hardware configuration of a computer terminal.
  • computer terminal 12 may include one or more (only one shown) processor 122 (processor 122 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • processor 122 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA)
  • a memory 124 for storing data
  • a transmission device 126 for communication functions.
  • it can also include: display, input/output interface (I/O interface), universal serial bus (USB) port (which can be included as one of the ports of the I/O interface), network interface, power supply And / or camera.
  • I/O interface input/output interface
  • USB universal serial bus
  • FIG. 12 is merely illustrative and does not limit the structure of the above electronic device.
  • computer terminal 12 may also include more or fewer components than shown in FIG. 12, or have
  • processors 122 and/or other data processing circuits may be referred to herein generally as "data processing circuits.”
  • the data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination.
  • the data processing circuitry can be a single, separate processing module, or incorporated in whole or in part into any of the other components in computer terminal 12.
  • the data processing circuit is controlled as a processor (e.g., selection of a variable resistance terminal path connected to the interface).
  • the processor 122 may call the memory stored information and the application program by the transmission device to perform the following steps: generating a session interaction interface based on the user's operation on the order, and the session corresponding to the session interaction interface is created based on the order; in the session interaction interface, Realize instant messaging between users for orders.
  • the memory 124 can be used to store software programs and modules of the application software, such as the program instructions/data storage devices corresponding to the identity authentication method in the embodiment of the present application, and the processor 122 executes by executing the software programs and modules stored in the memory 124.
  • Various functional applications and data processing that is, an identity authentication method for implementing the above application.
  • Memory 124 may include high speed random access memory and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 124 may further include memory remotely located relative to processor 122, which may be coupled to computer terminal 12 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 126 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 12.
  • transmission device 126 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • NIC Network Interface Controller
  • the transmission device 126 can be a Radio Frequency (RF) module for communicating wirelessly with the Internet.
  • RF Radio Frequency
  • the display can be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of computer terminal 12.
  • LCD liquid crystal display
  • the computer terminal 12 shown in FIG. 12 above may include hardware components (including circuits), software components (including computer code stored on a computer readable medium), or A combination of both hardware and software components. It should be noted that FIG. 12 is only one example of a specific specific example, and is intended to show the types of components that may be present in the computer terminal 12 described above.
  • the computer terminal shown in FIG. 12 described above has a touch display (also referred to as a "touch screen” or a “touch display screen”).
  • the computer terminal shown in FIG. 12 has an image user interface (GUI), and the user can interact with the GUI by touching a finger contact and/or a gesture on the touch-sensitive surface, where the human-machine is
  • GUI image user interface
  • Interactive features include the following interactions: creating web pages, drawing, word processing, creating electronic documents, games, video conferencing, instant messaging, emailing, calling interfaces, playing digital video, playing digital music, and/or web browsing, etc.
  • the executable instructions for performing the human-computer interaction functions described above are configured/stored in one or more processor-executable computer program products or readable storage media.
  • the computer terminal 12 may execute the program code of the following steps in the identity authentication method of the application: the first device establishes a communication connection with the second device, and obtains the encrypted information through the Internet, wherein the first device is allowed a device accessing the Internet, the second device is a device that is not allowed to access the Internet; the first device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device; The device receives the verification result returned by the second device, wherein the second device verifies the encrypted identity information based on the verification information.
  • the foregoing processor may further execute the following program code: the first device establishes a communication connection with the second device, and obtains the encrypted information by using the Internet, where the first device is a device that allows access to the Internet, and the second device is The device that does not allow access to the Internet; the first device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device; the first device receives the verification result returned by the second device Wherein the second device verifies the encrypted identity information based on the verification information.
  • the foregoing processor may further execute the following program code: the first device obtains the login account, and receives the encrypted information returned by the authentication server, where the encrypted information includes at least one of the following: a key pair and a digital certificate; The device generates the encrypted identity information according to the login account and the encrypted information; the first device sends the encrypted identity information to the second device.
  • the foregoing processor may further execute the following program code: the first device encrypts the login account and/or the random number by using the private key in the key pair to obtain an encryption result; the first device is based on the login account, and The information of at least one of the following generates encrypted identity information: an encryption result and a digital certificate.
  • the foregoing processor may further execute the following program code: the first device acquires the first random number; and the first device encrypts the login account and the first random number by using the private key in the key pair to obtain an encryption result. .
  • the foregoing processor may further execute the following steps: the first device initiates a login request to the authentication server, where the authentication server generates the encrypted information according to the login request, where the encrypted information includes at least one of the following: a key pair And digital certificates.
  • the first device establishes a communication connection with the second device by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • TCP transmission control protocol
  • UDP user datagram protocol
  • Bluetooth Bluetooth
  • Zigbee Zigbee
  • WiFi Wireless Fidelity
  • the foregoing processor may further execute the following program code: the first device adds the encrypted identity information to the digital signature of the first device; and the first device sends the digitally signed identity information to the second device.
  • the foregoing processor may further execute the following program code: the second device determines, according to the pre-installed root certificate, whether the digital certificate included in the identity information to be verified is trusted; if the digital certificate is not trusted, The first device receives a result of the authentication failure returned by the second device.
  • the processor may further execute the following program code: when the digital certificate is trusted, the second device extracts the public key included in the digital certificate and digitally signs Verifying that the received data has been tampered with; in the event that the received data is tampered with, the first device receives the result of the authentication failure returned by the second device.
  • the processor may further execute the following program code: the second device decrypts the encryption result by using the public key to obtain a login account and/or a first random number.
  • the second device determines whether the login account exists in the trusted list, wherein the trusted list includes at least one account that allows login to the second device; and in the case that the login account does not exist in the trusted list, the first device receives the second The result of the authentication failure returned by the device.
  • the processor may further execute the following program code: the first device generates the shared key according to the first random number and the second random number returned by the authentication server.
  • the second random number is a random number generated by the second device when the login account exists in the trusted list, and the second device generates the shared secret according to the first random number and the second random number. key.
  • the foregoing processor may further execute the following program code: the second device determines whether a login account exists in the trusted list; and if the login account does not exist in the trusted list, the second device decrypts the login.
  • the account is used as an administrative account and added to the trusted list, wherein the management account is used to manage at least one login account in the trusted list.
  • FIG. 12 is merely illustrative, and the computer terminal can also be a smart phone (such as an Android mobile phone, an iOS mobile phone, etc.), a tablet computer, an applause computer, and a mobile Internet device (Mobile Internet Devices, MID). ), PAD and other terminal devices.
  • FIG. 12 does not limit the structure of the above electronic device.
  • computer terminal 12 may also include more or fewer components (such as a network interface, display device, etc.) than shown in FIG. 12, or have a different configuration than that shown in FIG.
  • Embodiments of the present application also provide a storage medium.
  • the foregoing storage medium may be used to save the program code executed by the identity authentication method provided by the foregoing embodiment, where the device where the storage medium is located is controlled to execute any one of the embodiments.
  • Optional or preferred order processing method may be used to save the program code executed by the identity authentication method provided by the foregoing embodiment, where the device where the storage medium is located is controlled to execute any one of the embodiments.
  • the foregoing storage medium may be located in any one of the mobile terminal groups in the computer network, or in any one of the mobile terminal groups.
  • the storage medium is configured to store program code for performing the following steps: the first device establishes a communication connection with the second device, and obtains encrypted information through the Internet, wherein the first device is allowed a device accessing the Internet, the second device is a device that is not allowed to access the Internet; the first device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device; The device receives the verification result returned by the second device, wherein the second device verifies the encrypted identity information based on the verification information.
  • the storage medium is configured to store program code for performing the following steps: the first device acquires the login account, and receives the encrypted information returned by the authentication server, where the encrypted information includes at least one of the following: The key pair and the digital certificate; the first device generates the encrypted identity information according to the login account and the encrypted information; the first device sends the encrypted identity information to the second device.
  • the storage medium is configured to store program code for performing the following steps: the first device encrypts the login account and/or the random number by using the private key in the key pair to obtain an encryption result.
  • the first device generates the encrypted identity information based on the login account and at least one of the following: the encryption result and the digital certificate.
  • the storage medium is configured to store program code for performing the following steps: the first device acquires the first random number; the first device uses the private key pair in the key pair to log in the account and the first A random number is encrypted to obtain an encrypted result.
  • the storage medium is configured to store program code for performing the following steps: the first device initiates a login request to the authentication server, wherein the authentication server generates the encrypted information according to the login request, wherein the encrypted information It includes at least one of the following: a key pair and a digital certificate.
  • the first device establishes a communication connection with the second device by using any one of the following communication modes: a transmission control protocol TCP, a user datagram protocol UDP, Bluetooth, Zigbee, and WiFi.
  • TCP transmission control protocol
  • UDP user datagram protocol
  • Bluetooth Bluetooth
  • Zigbee Zigbee
  • WiFi Wireless Fidelity
  • the storage medium is configured to store program code for performing the following steps: the first device adds the encrypted identity information to the digital signature of the first device; the first device adds the digital signature The identity information is sent to the second device.
  • the storage medium is configured to store program code for performing the following steps: the second device determines, according to the pre-installed root certificate, whether the digital certificate included in the identity information to be verified is trusted; In case the digital certificate is not trusted, the first device receives the result of the identity verification failure returned by the second device.
  • the storage medium is configured to store program code for performing the following steps: in case the digital certificate is trusted, the second device extracts the digital certificate. The public key is included, and the received data is verified to be tampered with by a digital signature; if the received data is tampered with, the first device receives the result of the identity verification failure returned by the second device.
  • the storage medium is configured to store program code for performing the following steps: the second device decrypts the encryption result by using the public key, Logging in to the account and/or the first random number; the second device determines whether the login account exists in the trusted list, wherein the trusted list includes at least one account that allows login to the second device; and the login account does not exist in the trusted list In the case, the first device receives the result of the authentication failure returned by the second device.
  • the storage medium is configured to store program code for performing the following steps: the first device returns according to the first random number and the authentication server a second random number, wherein the second random number is a random number generated by the second device, where the second device is in the trusted list, wherein the second device is configured according to the first random number And the second random number, generating a shared key.
  • the storage medium is configured to store program code for performing the following steps: the second device determines whether a login account exists in the trusted list; if the login account does not exist in the trusted list The second device uses the decrypted login account as an administrative account and adds to the trusted list, where the management account is used to manage at least one login account in the trusted list.
  • An embodiment of the present application further provides an identity authentication system, including: a processor; and a memory coupled to the processor for providing an instruction to the processor to process the following processing steps:
  • the first device establishes a communication connection with the second device, and obtains the encrypted information through the Internet, where the first device is a device that allows access to the Internet, and the second device is a device that does not allow access to the Internet;
  • the first device encrypts the identity information of the account that is logged in to the second device by using the encrypted information, and sends the encrypted identity information to the second device;
  • the first device receives the verification result returned by the second device, wherein the second device verifies the encrypted identity information based on the verification information.
  • the first device that allows access to the Internet obtains the encrypted information from the Internet, and uses the encrypted information to encrypt the identity information of the account that the first device logs into the second device, so that the second device
  • the received identity information may be verified by the verification information to communicate with the first device if it is determined that the identity information of the first device is authentic.
  • the verification information in the second device can verify the encrypted information acquired by the first device to determine whether the identity of the first device is trusted according to the verification result. Therefore, through the solution disclosed in the foregoing embodiment of the present application, the purpose of verifying the identity information of the object for operating the non-networked device according to the verification information built in the non-networked device is achieved, thereby achieving non-operation through the client.
  • the non-networked device authenticates the client identity to improve the security of data transmission between the client and the non-networked device.
  • the solution of the foregoing embodiment 9 provided by the present application solves the problem in the prior art that, when the networked device operates the non-networked device, the non-networked device cannot connect to the authentication server, thereby causing access to the non-networked device. Networking devices cannot complete the technical problem of identity authentication.
  • the disclosed technical contents may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Information Transfer Between Computers (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请公开了一种身份认证方法、系统及计算设备。其中，该方法包括：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。本申请解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。

Description

身份认证方法、系统及计算设备
本申请要求2017年12月18日递交的申请号为201711366337.4、发明名称为“身份认证方法、系统及计算设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及物联网领域，具体而言，涉及一种身份认证方法、系统及计算设备。
背景技术
随着信息技术的发展，物联网逐渐发展成集信息采集、传输、处理于一体的系统，被广泛运用于各行各业，可以缩短很多业务环节，减少机械劳动。在物联网系统中，由物联网边缘设备采集数据，发送给服务器进行运算处理分析，然后由服务器下发操作指令，由边缘设备执行。由于大量的原始数据，都需要传输到服务器进行分析和处理，对网络带宽和存储容量要求很高。同时给服务器带来了很大的处理负荷，容易出现延迟、网络不稳定的现象。因而，将所有的物联网设备都接入互联网与服务器进行通信，是不现实的。边缘计算是在此基础上发展起来的一项技术，对于物联网而言，边缘计算将许多对设备的控制通过本地设备来实现，大大提升了处理效率，减轻了服务器的处理负荷。
目前，在物联网边缘计算中，有很多设备是无法和服务端通信，因而，无法通过服务端来操作这些设备，只能通过建立局域网环境来操作。例如，通过安装的客户端终端与设备组件局域网来操作设备，这边需要对能操作设备的各个应用程序进行身份认证，才能保证物联网设备的安全以及功能的正常使用。当用户购买回某个物联网设备后，只需要下载相关的客户端程序，就控制该设备，例如，用户在家中安装用于监控家中情况的摄像头后，可以通过手机下载该摄像头的控制应用程序，即可看家中的情况。但是，这种方式，容易被非法者通过破解得到的IP地址连接上用户家中的摄像头，便可查看用户家中的情况。由此，为了保证物联网设备的安全，并不是每个能连上该设备的客户端都具有对该设备进行操作的权限的。而由于物联网边缘的设备，不具有联网条件，在没有上网能力的情况下，无法实现对用于操作该设备的客户端进行认证，存在安全隐患。
针对上述现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种身份认证方法、系统及计算设备，以至少解决现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
根据本发明实施例的一个方面，提供了一种身份认证方法，包括：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
根据本发明实施例的另一方面，还提供了一种身份认证方法，包括：第二设备与第一设备建立通信连接，并接收第一设备传输的待验证的身份信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第二设备基于验证信息来验证第一设备传输的待验证的身份信息，得到验证结果；其中，待验证的身份信息为使用加密信息加密后的数据。
根据本发明实施例的另一方面，还提供了一种身份认证方法，包括：第二设备接收来自第一设备传输的待验证的身份信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第二设备根据验证信息验证待验证的身份信息，得到验证结果；在验证结果为身份信息可信的情况下，生成用于加解密数据的共享密钥，其中，共享密钥用于保证第一设备和第二设备之间进行安全数据传输；其中，待验证的身份信息为使用加密信息加密后的数据。
根据本发明实施例的另一方面，还提供了一种身份认证系统，包括：第一设备，用于通过互联网获取加密信息，使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第二设备，与第一设备建立通信连接，用于基于验证信息来验证加密后的身份信息，得到验证结果，并将验证结果返回至第一设备；其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备。
根据本发明实施例的另一方面，还提供了计算设备，包括：通信装置，与控制设备建立通信连接，用于接收来自控制设备传输的待验证的身份信息，其中，控制设备为允许访问互联网的设备；处理器，与通信装置连接，用于根据验证信息，验证控制设备传输的待验证的身份信息，得到验证结果，并在验证结果为身份信息可信的情况下，生成 用于加解密数据的共享密钥，其中，共享密钥用于保证通信装置和控制设备之间进行安全数据传输。
根据本发明实施例的另一方面，还提供了一种存储介质，存储介质包括存储的程序，其中，在程序运行时控制存储介质所在设备执行上述任意一项的身份认证方法。
根据本发明实施例的另一方面，还提供了一种计算终端，包括：处理器，处理器用于运行程序，其中，程序运行时执行上述任意一项的身份认证方法。
根据本发明实施例的另一方面，还提供了一种身份认证系统，包括：处理器；以及存储器，与处理器连接，用于为处理器提供处理以下处理步骤的指令：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
在本发明实施例中，通过第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果，进而解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是根据本申请实施例1的一种可选的身份认证系统示意图；
图2是根据本申请实施例1的一种可选的身份认证系统交互示意图；
图3是根据本申请实施例2的一种身份认证方法流程图；
图4是根据本申请实施例2的一种可选的身份认证方法流程图；
图5是根据本申请实施例2的一种可选的身份认证方法流程图；
图6是根据本申请实施例2的一种可选的身份认证方法流程图；
图7是根据本申请实施例2的一种可选的身份认证方法流程图；
图8是根据本申请实施例3的一种身份认证方法流程图；
图9是根据本申请实施例4的一种身份认证方法流程图；
图10是根据本申请实施例5的一种计算设备示意图；
图11是根据本申请实施例6的一种身份认证装置示意图；以及
图12是根据本申请实施例7的一种计算机终端的硬件结构框图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
需要说明的是，本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
首先，在对本申请实施例进行描述的过程中出现的部分名词或术语适用于如下解释：
物联网，是指通过各种信息传感设备，实时采集任何需要监控、连接、互动的物体或过程等各种需要的信息，与互联网那个结合形成的一个巨大的网络。
边缘计算，是指在靠近物或数据源头的一侧，采用网络、计算、存储、应用核心能力为一体的开放平台，提供最近端服务。其应用程序在边缘侧发起，产生更快的网络服务响应，满足实时业务、应用智能、安全与隐私保护等方面的基本要求。物联网边缘计算实现了将许多对物联网设备的控制通过本地设备实现，从而减轻了服务端的处理负 荷、提升了处理效率。
第一设备，可以是与互联网连接的设备，可以访问互联网，包括但不限于物联网边缘计算中，安装有用于对各种物联网基础设备进行控制或操作的应用程序的设备。
第二设备，可以是非联网设备，即没有连接互联网的设备，作为一种可选的实施例，可以是物联网边缘计算中的没有连接互联网的各种物联网基础设备。
实施例1
根据本申请实施例，提供了一种身份认证系统实施例，可以应用于对任何一种非联网设备的操作对象的身份认证。
作为一种可选的实施例，本实施例可以应用于物联网边缘计算中对物联网边缘设备进行操作的客户端或基于Web的应用中，其中，客户端或基于Web的应用安装于联网设备(包括但不限于手机、笔记本电脑、平板电脑、计算机等)上，联网设备可以与服务端进行通信。
由于在物联网边缘计算中，很多物联网基础设备(例如，智能灯、智能空调等)是无法和服务端进行通信的，而是通过联网设备(例如，手机)上安装的客户端应用程序或者通过基于Web的物联网应用来对物联网基础设备进行操作。
在通过联网设备上安装的客户端应用或基于Web的应用访问物联网基础设备并对物联网基础设备进行操作的时候，现有技术中，第一种方式是通过这些客户应用或基于Web的应用直接登录来对物联网基础设备进行操作，物联网基础设备不对访问或操作该物联网基础设备的应用进行身份认证，且传输的数据为明文传输，安全性很低；第二种方式是由这些物联网基础设备直接访问服务端，由服务端下发可信任列表，当客户应用或基于Web的应用连接到物联网基础设设备上，由设备判断当前的应用是否在可信任列表中，进而确定提供服务还是拒绝服务。
由上可以看出，上述第一种方式，在不对应用进行身份认证的情况下，直接通过应用对物联网基础设备进行操作，存在安全隐患；上述第二种方式，由设备与服务端通信，大量的设备容易导致服务端处理负荷增大。
在上述背景下，发明人经研究发现，如果可以提供一种身份认证方案，应用于没有连接互联网(即无法与服务端通信)的设备，对操作该设备的对象的身份进行认证，不仅实现了对操作非联网设备的应用进行身份认证以提高安全性，而且还不会增加服务端的处理负荷。
作为一种可选的实施例，图1是根据本申请实施例的一种可选的身份认证系统示意 图，如图1所示，该系统包括：第一设备101和第二设备103。其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备。也就是说，第一设备可以与服务端通信，第二设备不可以与服务端通信。需要说明的是，第二设备不可以与服务端通信包括但不限于如下两种情形：(1)第二设备本身没有联网功能(例如，物联网边缘计算中的各种物联网基础设备)，无法与服务端通信；(2)第二设备具有联网功能，但是没有访问服务端的权限(例如，为了防止大量设备访问服务端造成服务处理负荷过大的问题，而限制某些设备不允许访问服务端)。
其中，第一设备101，用于通过互联网获取加密信息，使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备。
具体地，第一设备可以是任意一种能够访问互联网的终端设备，包括但不限于手机、笔记本电脑、平板电脑、计算机等；第二设备可以是能够上网的设备，也可以是不能够上网设备，本申请实施例提供的身份认证方法主要应用于没有与互联网连接或者无法与服务端通信第二设备，包括但不限于任意一种物联网边缘设备(或称基础设备)。加密信息可以是用于对第一设备向第二设备传输的身份信息进行加密的密钥信息。容易注意的是，采用的加密算法不同，获取到的加密信息也不同。
例如，在采用对称加密算法的情况下，上述加密信息可以是对身份信息进行加密的密钥，发送方(第一设备101)利用该加密信息对身份信息加密，接收方(第二设备103)利用该密钥对身份信息进行解密。在采用非对称加密算法的情况下，上述加密信息可以包括：对身份信息进行加密的私钥以及对加密后的身份信息进行解密的公钥，发送方(第一设备101)利用该私钥对身份信息加密，接收方(第二设备103)利用该私钥对应的公钥对身份信息进行解密。
需要说明的是，上述第一设备上安装的应用包括但不限于如下任意一种操作系统的上应用：Windows、iOS、Android等。第一设备上安装的应用可以是客户端应用程序，也可是需要通过第一设备上安装的浏览器来访问的一些基于Web的应用。用户可以通过第一设备安装的这些应用操作第二设备。
第二设备103，与第一设备建立通信连接，用于基于验证信息来验证加密后的身份信息，得到验证结果，并将验证结果返回至第一设备。
具体地，由于第二设备是没有连接互联网的，或者说是无法与对应的服务端进行通信的，为了实现对操作第二设备的对象的身份进行认证，因而，作为一种可选的实施例，可以在第二设备出厂时可以内置一些用于对操作对象的身份进行验证的信息，以便当第 一设备与第二设备建立通信连接后，第二设备可以通过内置的验证信息对操作第二设备的第一设备的身份信息进行验证。
一种可选的实施例中，上述验证信息可以是服务端证书签证平台的根证书，该证书签证平台可以是用于服务端向第一设备签发数字证书的平台。
可选地，第一设备101可以通过如下任意一种通信方式与第二设备103建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
作为一种可选的实施例，如图1所示，上述系统还可以包括：服务器105，与第一设备101通信，该服务器105接收第一设备101发起的登录请求，并根据登录请求生成加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。其中，密钥对包括：私钥和公钥，用于对第一设备向第二设备传输的身份信息进行非对称加密，即第一设备利用私钥对传输至第一设备的身份信息进行加密，第二设备利用与该私钥对应的公钥对接收到的加密后的身份信息进行解密。可选地，上述数字证书可以用于对公钥进行传输。
图2是根据本申请实施例的一种可选的身份认证系统交互示意图，如图2所示，第一设备101、第二设备103和服务器105之间的交互过程如下：
(1)第一设备101获取登录账号，通过该登录账号向服务器105发出登录请求。
(2)服务器105根据第一设备的登录请求生成对应的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。
需要说明的是，服务器105至少可以根据登录请求中第一设备的登录账号生成对应的加密信息，作为一种可选的实施例，服务器105还可以根据登录请求中第一设备的登录账号生成一个与该登录账号对应的使用者账号(也称使用账号，作为第一设备使用第二设备的账号)，以及对应的加密信息。可选地，服务器105还可以针对不同的使用者账号授予不同的使用权限。
容易注意的是，由于使用者账号与登录账号是一一对应的，因而，可以直接采用第一设备的登录账号作为操作或使用第二设备的账号，也可以生成一个专门的使用者账号，本申请对此不作限定，只要可以用于标识第一设备的身份信息，均属于本申请保护的范围。
(3)第一设备101接收到服务器105返回的加密信息后，根据登录账号和加密信息，生成加密后的身份信息。
具体地，第一设备101可以使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果，并基于登录账号，以及如下至少之一的信息生成加密后的身份信息：加 密结果和数字证书。包括但不限于如下三种实施方式：
第一种可选的实施方式，第一设备101使用服务器105返回的密钥对中的私钥对登录账号进行加密，得到加密结果，并基于加密结果和数字证书生成加密后的身份信息。其中，数字证书可以用于传输该私钥对应的公钥。
第二种可选的实施方式，第一设备101使用服务器105返回的密钥对中的私钥对登录账号和随机数(假设为第一随机数)进行加密，得到加密结果，并基于加密结果和数字证书生成加密后的身份信息。其中，数字证书可以用于传输该私钥对应的公钥。
第三种可选的实施方式，第一设备101使用服务器105返回的密钥对中的私钥对随机数(假设为第一随机数)进行加密，得到加密结果，并基于第一设备的登录账号、加密结果和数字证书生成加密后的身份信息。其中，数字证书可以用于传输该私钥对应的公钥。
(4)第一设备101将加密后的身份信息发送至第二设备103。
可选地，在通过(3)中任意一种可选的实施方式，生成加密后的身份信息后，还可以将生成的加密后的身份信息添加第一设备的数字签名，并将添加数字签名后的身份信息发送至第二设备103。
(5)第一设备101接收到来自第一设备101发送的加密后的身份信息后，对加密的身份信息进行解密。
具体地，在第一设备101对加密的身份信息进行解密的时候，首先可以基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信，并在数字证书不可信的情况下，向第一设备101返回的身份验证失败的结果。
进一步地，在数字证书可信的情况下，第二设备103提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改，在接收到的数据被篡改的情况下，第一设备接收第二设备返回的身份验证失败的结果。
进一步地，在接收到的数据未被篡改的情况下，第二设备103利用从数字证书中提取到的公钥对加密结果进行解密，得到登录账号和/或随机数(即第一随机数)，并判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户，在登录账号不存在于可信任列表的情况下，向第一设备返回身份验证失败的结果。
其中，在第二设备103判断登录账号是否存在于可信任列表中之前，还可以判断可信任列表中是否存在登录账号，并在可信任列表中不存在登录账号的情况下，第二设备 将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
可选地，在登录账号存在于可信任列表的情况下，第二设备103生成随机数(即第二随机数据)，并根据第一随机数和第二随机数，生成共享密钥，共享密钥用于保证后续第一设备和第二设备之间进行安全数据传输。
(6)第一设备101根据第一随机数和服务器返回的第二随机数，生成用于保证后续第一设备和第二设备之间进行安全数据传输共享密钥。
实施例2
根据本申请实施例，还提供了一种身份认证方法实施例，本实施例可以应用于实施例1中的身份认证系统中，包括但不限于实施例1中场景。需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
由于在通过客户终端对设备进行操作的过程中，在设备没有联网(即无法与服务端进行通信)的情况下，存在已经联网的客户终端无法在设备上完成身份认证的技术问题。
为了解决上述问题，本申请提供了一种身份认证方法实施例，图3是根据本申请实施例的一种身份认证方法流程图，如图3所示，包括如下步骤：
步骤S302，第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备。
具体地，上述加密信息可以是用于对第一设备向第二设备传输的身份信息进行加密的密钥信息。其中，第一设备可以是任意一种能够访问互联网的终端设备，包括但不限于手机、笔记本电脑、平板电脑、计算机等；第二设备可以是能够上网的设备，也可以是不能够上网设备，本申请实施例提供的身份认证方法主要应用于没有与互联网连接或者无法与服务端通信第二设备，包括但不限于任意一种物联网边缘设备(或称基础设备)。
可选地，上述第一设备上安装的应用包括但不限于如下任意一种操作系统的上应用：Windows、iOS、Android等。第一设备上安装的应用可以是客户端应用程序，也可是需要通过第一设备上安装的浏览器来访问的一些基于Web的应用。用户可以通过第一设备安装的这些应用操作第二设备。
一种可选的实施例中，第一设备可以通过如下任意一种通信方式与第二设备建立通 信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
容易注意的是，采用的加密算法不同，获取到的加密信息也不同。
作为第一种可选的实施方案，在采用对称加密算法的情况下，上述加密信息可以是对身份信息进行加密的密钥，第一设备利用该加密信息对身份信息加密，第二设备利用该密钥对身份信息进行解密。
作为第二种可选的实施方案，在采用非对称加密算法的情况下，上述加密信息可以包括：对身份信息进行加密的私钥以及对加密后的身份信息进行解密的公钥，第一设备利用该私钥对身份信息加密，第二设备利用该私钥对应的公钥对身份信息进行解密。
步骤S304，第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备。
具体地，在第一设备与第二设备建立通信连接，并从互联网上获取到对应的加密信息，可以使用该加密信息对第一设备登录第二设备的账户的身份信息进行加密，加密方式包括但不限于如下三种：①第一设备使用加密信息对第一设备的身份信息进行加密，得到加密后的身份信息；②第一设备使用加密信息对第一设备的身份信息和第一设备生成的随机数进行加密，得到加密后的身份信息；③第一设备基于第一设备的身份信息，并使用加密信息对和第一设备生成的随机数进行加密，得到加密后的身份信息。
步骤S306，第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
具体地，由于第二设备是没有连接互联网的，或者说是无法与对应的服务端进行通信的，为了实现对操作第二设备的对象的身份进行认证，因而，作为一种可选的实施例，可以在第二设备出厂时可以内置一些用于对操作对象的身份进行验证的信息，以便当第一设备与第二设备建立通信连接后，第二设备根据内置的验证信息对接收到的来自第一设备发送的身份信息进行验证，并将验证结果返回到第一设备。
作为一种可选的实施例，上述验证信息可以是服务端证书签证平台的根证书，该证书签证平台可以是用于服务端向第一设备签发数字证书的平台。
由上可知，在本申请上述实施例中，通过允许访问互联网的第一设备从互联网上获取加密信息，并使用该加密信息加密第一设备登录第二设备的账户的身份信息，以便第二设备可以通过验证信息，对接收到的身份信息进行验证，以便在确定第一设备的身份信息为可信的情况下，才与第一设备进行通信。
容易注意的是，第二设备中验证信息可以对第一设备获取到的加密信息进行验证， 以根据验证结果，来确定第一设备的身份是否可信。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例2的方案解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
在一种可选的实施例中，如图4所示，上述步骤S304，第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备，包括：
步骤S402，第一设备获取登录账号，并接收认证服务器返回的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。
具体地，认证服务器可以是用于认证对第二设备进行操作的对象的服务器，例如，当第二设备为物联网基础设备(例如，智能灯、智能空调等)的情况下，该认证服务器可以是提供应用服务的服务器，第一设备可以通过安装对应的应用程序来操作第二设备。由于第二设备无法与认证服务器进行通信，为了验证操作第二设备的第一设备的身份信息是否为可信的，能够与服务端(即认证服务器)通信的第一设备可以根据当前注册或已注册该应用的一个账号登录认证服务器，以便认证服务器生成对应的加密信息，用于第一设备加密第一设备向第二设备发送的身份信息。
需要说明的是，加密信息中的密钥对包括：私钥和公钥，用于对第一设备向第二设备传输的身份信息进行非对称加密，即第一设备利用私钥对传输至第一设备的身份信息进行加密，第二设备利用与该私钥对应的公钥对接收到的加密后的身份信息进行解密。可选地，上述数字证书可以用于对公钥进行传输。
容易注意的是，上述登录账号用于表征第一设备登录第二设备的账户的身份信息，可以是第一设备登录认证服务器的账号，也可以是是认证服务器根据第一设备登录认证服务器的账号生成的一个对应的使用者账号(也称使用账号，作为第一设备使用第二设备的账号)。
由于使用者账号与登录账号是一一对应的，因而，可以直接采用第一设备的登录账号作为操作或使用第二设备的账号，也可以生成一个专门的使用者账号，本申请对此不作限定，只要可以用于标识第一设备的身份信息，均属于本申请保护的范围。
步骤S404，第一设备根据登录账号和加密信息，生成加密后的身份信息。
具体地，在第一设备根据登录账号和加密信息，生成加密后的身份信息的过程中，可以通过如下任意一种方式来生成加密后的身份信息：①第一设备使用加密信息对登录账号进行加密，得到加密后的身份信息；②第一设备使用加密信息对登录账号和第一设备生成的随机数进行加密，得到加密后的身份信息；③第一设备基于登录账号，并使用加密信息对和第一设备生成的随机数进行加密，得到加密后的身份信息。
作为一种可选的实施方案，在采用非对称加密算法对身份信息进行加密的情况下，获取到的密钥对的中私钥来进行加密，则上述步骤S404可以包括：步骤S4041，第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果；步骤S4043，第一设备基于登录账号，以及如下至少之一的信息生成加密后的身份信息：加密结果和数字证书。
以上述第二种方式为例，上述步骤S4041，第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果，可以包括如下步骤：步骤S4041a，第一设备获取第一随机数；步骤S4041b，第一设备使用密钥对中的私钥对登录账号和第一随机数进行加密，得到加密结果。
容易注意的是，本申请中根据第一设备的登录账号来获取特定的密钥对和数字证书，具体实施可以没有账号，以别的介质来获取密钥对的证书，均属于本申请保护范围。
步骤S406，第一设备发送加密后的身份信息至第二设备。
具体地，第一设备在根据获取到的据登录账号和加密信息，生成加密后的身份信息后，可以将生成的加密后的身份信息添加第一设备的数字签名，并将添加数字签名后的身份信息发送至第二设备。
通过上述步骤S402至S406公开的方案，实现对待验证的身份信息进行加密传输的目的。
在一种可选的实施例中，在第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备之前，上述方法还可以包括：步骤S303，第一设备向认证服务器发起登录请求，其中，认证服务器根据登录请求生成加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。其中，密钥对包括：私钥和公钥，用于对第一设备向第二设备传输的身份信息进行非对称加密，即第一设备利用私钥对传输至第一设备的身份信息进行加密，第二设备利用与该私钥对应的公钥对接收到的加密后的身份信息进行解密。可选地，上述数字证书可以用于对公钥进行传输。
需要说明的是，为了确保第二设备接收到来自第一设备的数据没有被篡改，第一设 备在向第二设备发送加密后的身份信息时，可以添加第一设备的数字签名，并将添加数字签名后的身份信息发送至第二设备。因而，作为一种可选的实施例，如图5所示，第一设备发送加密后的身份信息至第二设备，可以包括如下步骤：
步骤S502，第一设备将加密后的身份信息添加第一设备的数字签名；
步骤S504，第一设备将添加数字签名后的身份信息发送至第二设备。
通过上述步骤S502至S504公开的方案，可以使得第二设备在接收到第一设备发送的身份信息后，根据数字签名协议验证内容是否被篡改。
基于上述实施例，作为一种可选的实施方式，如图6所示，在第一设备将添加数字签名后的身份信息发送至第二设备之后，上述方法还可以包括如下步骤：
步骤S602，第二设备基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信。
具体地，第二设备中的根证书可以是服务端证书签证平台的根证书，该证书签证平台可以是用于服务端向第一设备签发数字证书的平台。通过证书签证平台的根证书可以验证该证书签证平台(即认证服务器)向第一设备返回的数字证书是否可信。
步骤S604，在数字证书不可信的情况下，第一设备接收第二设备返回的身份验证失败的结果。
具体地，在根据第二设备中预先安装的根证书，确定第一设备发送的待验证的身份信息不可信的情况下，第二设备可以返回身份验证失败的结果。
可选地，在数字证书可信的情况下，上述方法还可以包括如下步骤：
步骤S606，第二设备提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改；
步骤S608，在接收到的数据被篡改的情况下，第一设备接收第二设备返回的身份验证失败的结果。
由于第二设备接收到来自第一设备发送的待验证的身份信息是采用密钥对的中私钥进行加密的，因而，在根据第二设备中安装的根证书确定接收到的数字证书可信的情况下，可以通过接收到的数字证书中包含的公钥对待验证的身份信息进行解密，为了避免不必要的操作，可以首先根据接收到的数据中包含的第一设备的数字签名来验证接收到数据内容是否被篡改，在篡改的情况下，返回身份验证失败的结果。
可选地，在接收到的数据未被篡改的情况下，上述方法还可以包括如下步骤：
步骤S610，第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随机 数。
在根据接收到的数字签名根据数字签名协议验证第二设备接收到身份信息内容没有被篡改的情况下，可以根据从数字证书中提取到的公钥对采用私钥加密的身份信息进行解密，得到第一设备的身份信息(例如，登录账号)，以及第一设备生产的随机数(即第一随机数)。
步骤S612，第二设备判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户。
具体地，上述可信任列表中存储了至少一个可信的账户的身份信息(例如，登录账号，或者，根据登录账号生产的使用者账号)。
可选地，在判断登录账号是否存在于可信任列表中之前，上述方法还可以包括如下步骤：步骤S611a，第二设备判断可信任列表中是否存在登录账号；步骤S611b，在可信任列表中不存在登录账号的情况下，第二设备将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
通过上述步骤S611a和S611b，将第一设备首次传输到第二设备的身份信息(例如，登录账号，或者，根据登录账号生产的使用者账号)作为管理员账号，并添加到可信任账号列表中，其中，管理员账号对应的账户可以删除或增加可信任列表中的其他账号，从而解决了需要将第二设备连接到服务器来获取可信任列表，从而到至服务器处理负荷过高的问题。
步骤S614，在登录账号不存在于可信任列表的情况下，第一设备接收第二设备返回的身份验证失败的结果。如果解密得到的登录账号不在可信任列表中，说明该登录账号不可信，因而，可以向第一设备返回身份验证失败的结果，并终止第一设备向第二设备的操作。
可选地，在登录账号存在于可信任列表的情况下，上述方法还可以包括如下步骤：
步骤S616，第一设备根据第一随机数和认证服务器返回的第二随机数，生成共享密钥，其中，第二随机数为第二设备在登录账号存在于可信任列表的情况下，第二设备生成的随机数；其中，第二设备根据第一随机数和第二随机数，生成共享密钥。
在第二设备确定第一设备的身份为可信的情况下，根据生成第二随机数和第一设备生成的第一随机数，生成第一设备与第二设备之间传输数据的共享密钥，可以用于第一设备与第二设备后续进行安全数据传输。
作为一种可选的实施例，图7是根据本申请实施例的一种可选的身份认证方法流程 图，如图7所示，包括如下步骤：
(1)客户端(即上述第一设备)登录账号。即用户通过客户端设备安装的客户端程序或基于Web的应用登录。
(2)服务端返回登录账号对应的使用者账号、密钥对、数字证书。
具体地，服务端根据登录的账号生成使用者账号，密钥对，并对这个密钥通过授权平台签发一个数字证书。可选地，服务端可以将这些信息保存在数据中，以便下次该登录账号登录时，可以直接读取。
(3)客户端与非联网设备(即上述第二设备)建立通信连接。可选地，客户端通过TCP或UDP连接非联网设备。
(4)客户端将使用者账号、随机数(即第一随机数)利用私钥加密，发送给非联网设备，协议中包含数字证书和数字签名。
(5)非联网设备根据根证书验证数字证书和签名。
具体地，非联网设备在接收到客户端传输来的数据后，解析出数字证书，并通过根证书验证收到的数字证书是否可信，如果数字证书不可信，则返回认证失败错误。如果数字证书可信，则从数字证书中提取出公钥，通过数字签名协议验证协议内容是否被篡改过，如果内容被篡改过，则返回认证失败错误。
(6)生成共享密钥。
如果内容未被篡改，非联网设备通过公钥解密出使用者账号和第一随机数，判断可信任列表是否空，如果可信任列表为空，则将该使用者账号作为管理员账号，并生成第二随机数，与客户端的第一随机数据生成用于客户端与非联网设备之间安全数据传输的共享密钥。其中，客户端根据自己生成的第一随机数和服务端返回的第二随机数，生成用于客户端与非联网设备之间安全数据传输的共享密钥。
通过本申请上述实施例公开的方案，在第一设备与第二设备建立通信连接后，通过私钥加密传输的数据，数字证书传输公钥，非联网设备验证数字证书为可信后，通过从数字证书中提取到的公钥解密数据，得到第一设备的身份信息，从而解决了非联网设备需要连接服务端来添加可信任账号的问题，一次通信便完成身份确认和共享密钥生成的目的。
实施例3
根据本申请实施例，还提供了一种身份认证方法实施例，本实施例可以应用于实施例1中的身份认证系统中，包括但不限于实施例1中场景。需要说明的是，在附图的流 程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图8是根据本申请实施例的一种身份认证方法流程图，如图8所示，包括如下步骤：
步骤S802，第二设备与第一设备建立通信连接，并接收第一设备传输的待验证的身份信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备。
需要说明的是，上述第二设备可以是能够上网的设备，也可以是不能够上网设备，本申请实施例提供的身份认证方法主要应用于没有与互联网连接或者无法与服务端通信第二设备，包括但不限于任意一种物联网边缘设备(或称基础设备)；上述待验证的身份信息为使用加密信息加密后的数据；第一设备可以是任意一种能够访问互联网的终端设备，包括但不限于手机、笔记本电脑、平板电脑、计算机等。
第二设备可以通过如下任意一种通信方式与第一设备建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
步骤S804，第二设备基于验证信息来验证第一设备传输的待验证的身份信息，得到验证结果。
具体地，上述验证信息可以是在第二设备出厂时可以内置一些用于对操作对象的身份进行验证的信息；由于第二设备是没有连接互联网的，或者说是无法与对应的服务端进行通信的，为了实现对操作第二设备的对象的身份进行认证，在第二设备出厂时可以内置一些用于对操作对象的身份进行验证的信息，以便当第一设备与第二设备建立通信连接后，第二设备根据内置的验证信息对接收到的来自第一设备发送的身份信息进行验证，并将验证结果返回到第一设备。
一种可选的实施例中，上述验证信息可以是服务端证书签证平台的根证书，该证书签证平台可以是用于服务端向第一设备签发数字证书的平台。
由上可知，在本申请上述实施例中，不允许访问互联网的第二设备与允许访问互联网的第一设备建立通信连接，并接收第一设备发送的待验证的身份信息，第二设备通过验证信息来第一设备的身份信息，以便在确定第一设备的身份信息为可信的情况下，才与第一设备进行通信。
容易注意的是，第一设备发送的待验证的身份信息是使用加密信息加密后的数据，而第二设备中验证信息可以对第一设备获取到的加密信息进行验证，以根据验证结果， 来确定第一设备的身份是否可信。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例3的方案解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
实施例4
根据本申请实施例，还提供了一种身份认证方法实施例，本实施例可以应用于实施例1中的身份认证系统中，包括但不限于实施例1中场景。需要说明的是，在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行，并且，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图9是根据本申请实施例的一种身份认证方法流程图，如图9所示，包括如下步骤：
步骤S902，第二设备接收来自第一设备传输的待验证的身份信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备。
具体地，上述第二设备可以是能够上网的设备，也可以是不能够上网设备，本申请实施例提供的身份认证方法主要应用于没有与互联网连接或者无法与服务端通信第二设备，包括但不限于任意一种物联网边缘设备(或称基础设备)；上述待验证的身份信息为使用加密信息加密后的数据；第一设备可以是任意一种能够访问互联网的终端设备，包括但不限于手机、笔记本电脑、平板电脑、计算机等。
步骤S904，第二设备根据验证信息验证待验证的身份信息，得到验证结果。
其中，验证信息可以是在第二设备出厂时可以内置一些用于对操作对象的身份进行验证的信息；一种可选的实施例中，该验证信息可以是服务端证书签证平台的根证书，该证书签证平台可以是用于服务端向第一设备签发数字证书的平台。
步骤S906，在验证结果为身份信息可信的情况下，生成用于加解密数据的共享密钥，其中，共享密钥用于保证第一设备和第二设备之间进行安全数据传输。
具体地，共享密钥可以用于第一设备与第二设备后续进行安全数据传输的密钥信息。
由上可知，在本申请上述实施例中，不允许访问互联网的第二设备与允许访问互联 网的第一设备建立通信连接，并接收第一设备发送的待验证的身份信息，第二设备通过验证信息来第一设备的身份信息是否可信，并在确定第一设备的身份信息为可信的情况下，生成用于第一设备与第二设备之间进行通信的共享密钥。
容易注意的是，第一设备发送的待验证的身份信息是使用加密信息加密后的数据，而第二设备中验证信息可以对第一设备获取到的加密信息进行验证，以根据验证结果，来确定第一设备的身份是否可信。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证，并在身份可信的情况下，生成用于安全数据传输的共享密钥的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例4的方案解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
在一种可选的实施例中，在第二设备接收来自第一设备传输的待验证的身份信息之前，上述方法还包括：第一设备获取登录账号，并接收认证服务器返回的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书；第一设备根据登录账号和加密信息，生成待验证的身份信息；第一设备发送待验证的身份信息至第二设备。
在一种可选的实施例中，第二设备通过如下任意一种通信方式接收第一设备发送的待验证的身份信息：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
在一种可选的实施例中，在第一设备获取登录账号，并接收服务器返回的认证服务器返回的加密信息之前，上述方法还包括：第一设备向认证服务器发起登录请求，其中，认证服务器根据登录请求生成加密信息。
在一种可选的实施例中，第一设备根据登录账号和加密信息，生成待验证的身份信息，包括：第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果；第一设备基于登录账号，以及如下至少之一的信息生成待验证的身份信息：加密结果和数字证书。
在一种可选的实施例中，第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果，包括：第一设备获取第一随机数；第一设备使用密钥对中的私钥对登录账号和第一随机数进行加密，得到加密结果。
在一种可选的实施例中，第一设备发送待验证的身份信息至第二设备，可以包括： 第一设备将待验证的身份信息添加第一设备的数字签名；第一设备将添加数字签名后的身份信息发送至第二设备。
在一种可选的实施例中，第二设备根据验证信息验证第一设备传输的待验证的身份信息，得到验证结果，可以包括：第二设备基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信；在数字证书不可信的情况下，第二设备向第一设备返回身份验证失败的结果。
可选地，在数字证书可信的情况下，上述方法还包括：在数字证书可信的情况下，第二设备提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改；在接收到的数据被篡改的情况下，第二设备向第一设备返回身份验证失败的结果。
可选地，在接收到的数据未被篡改的情况下，上述方法还包括：第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随机数；第二设备判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户；在登录账号不存在于可信任列表的情况下，第二设备向第一设备返回身份验证失败的结果。
可选地，在登录账号存在于可信任列表的情况下，第二设备确定第一设备传输的身份信息为可信的验证结果。
可选地，在登录账号存在于可信任列表的情况下，第二设备确定第一设备传输的身份信息为可信的验证结果之后，上述方法还包括：第二设备获取第二随机数，并根据第一随机数和第二随机数生成共享密钥；其中，第一设备根据第一随机数和认证服务器返回的第二随机数，生成共享密钥。
作为一种可选的实施例，在第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随机数之后，上述方法还包括：第二设备判断可信任列表中是否存在登录账号；在可信任列表中不存在登录账号的情况下，第二设备将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例 的身份认证方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
实施例5
根据本申请实施例，还提供了一种用于实现上述身份认证方法的计算设备实施例，图10是根据本申请实施例的一种计算设备示意图，如图10所示，该计算设备10包括：通信装置1001和处理器1003。
其中，通信装置1001，与控制设备建立通信连接，用于接收来自控制设备传输的待验证的身份信息，其中，控制设备为允许访问互联网的设备；
处理器1003，与通信装置连接，用于根据验证信息，验证控制设备传输的待验证的身份信息，得到验证结果，并在验证结果为身份信息可信的情况下，生成用于加解密数据的共享密钥，其中，共享密钥用于保证通信装置和控制设备之间进行安全数据传输。
作为一种可选的实施例，上述计算设备可以是物联网边缘计算中的物联网基础设备(例如，智能灯、智能空调等)，该计算设备无法和服务端进行通信的，而是通过联网设备(例如，手机)上安装的客户端应用程序或者通过基于Web的物联网应用来对物联网基础设备进行操作。上述控制设备可以是用于控制或操作计算设备的联网设备，控制设备可以与服务端通信，并且控制设备通过安装的客户端应用或基于Web的应用操作上述计算设备，包括但不限于手机、笔记本电脑、平板电脑、计算机等。
计算设备10通过通信装置1001与控制设备通信，其通讯协议包括但不限于如下任意一种：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
由上可知，在本申请上述实施例中，通过允许访问互联网的第一设备从互联网上获取加密信息，并使用该加密信息加密第一设备登录第二设备的账户的身份信息，以便第二设备可以通过验证信息，对接收到的身份信息进行验证，以便在确定第一设备的身份信息为可信的情况下，才与第一设备进行通信。
容易注意的是，第二设备中验证信息可以对第一设备获取到的加密信息进行验证，以根据验证结果，来确定第一设备的身份。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息 进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例2的方案解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
实施例6
根据本申请实施例，还提供了一种用于实现上述身份认证方法的装置实施例，图11是根据本申请实施例的一种身份认证装置示意图，如图11所示，该装置包括：获取单元111、加密单元113和接收单元115。
其中，获取单元111，用于通过第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；
加密单元113，用于第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；
接收单元115，用于第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
此处需要说明的是，上述获取单元111、加密单元113和接收单元115对应于实施例2中的步骤S302至S306，上述模块与对应的步骤所实现的示例和应用场景相同，但不限于上述实施例2所公开的内容。需要说明的是，上述模块作为装置的一部分可以在诸如一组计算机可执行指令的计算机系统中执行。
由上可知，在本申请上述实施例中，通过允许访问互联网的第一设备从互联网上获取加密信息，并使用该加密信息加密第一设备登录第二设备的账户的身份信息，以便第二设备可以通过验证信息，对接收到的身份信息进行验证，以便在确定第一设备的身份信息为可信的情况下，才与第一设备进行通信。
容易注意的是，第二设备中验证信息可以对第一设备获取到的加密信息进行验证，以根据验证结果，来确定第一设备的身份是否可信。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例5的方案解决了现有技术中，在联网设备对非联网 设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
在一种可选的实施例中，加密单元包括：获取模块，用于通过第一设备获取登录账号，并接收认证服务器返回的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书；生成模块，用于通过第一设备根据登录账号和加密信息，生成加密后的身份信息；发送模块，用于通过第一设备发送加密后的身份信息至第二设备。
在一种可选的实施例中，生成模块包括：第一加密模块，用于通过第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果；第二加密模块，用于通过第一设备基于登录账号，以及如下至少之一的信息生成加密后的身份信息：加密结果和数字证书。
在一种可选的实施例中，第一加密模块还用于通过第一设备获取第一随机数，并通过第一设备使用密钥对中的私钥对登录账号和第一随机数进行加密，得到加密结果。
在一种可选的实施例中，上述装置还包括：发送单元，用于通过第一设备向认证服务器发起登录请求，其中，认证服务器根据登录请求生成加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。
在一种可选的实施例中，上述第一设备通过如下任意一种通信方式与第二设备建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
在一种可选的实施例中，上述发送模块还用于通过第一设备将加密后的身份信息添加第一设备的数字签名，并通过第一设备将添加数字签名后的身份信息发送至第二设备。
在一种可选的实施例中，上述装置还包括：第一判断单元，用于通过第二设备基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信；其中，接收单元还用于在数字证书不可信的情况下，第一设备接收第二设备返回的身份验证失败的结果。
在一种可选的实施例中，在数字证书可信的情况下，上述装置还包括：提取单元，用于在数字证书可信的情况下，通过第二设备提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改；其中，接收单元还用于在接收到的数据被篡改的情况下，通过第一设备接收第二设备返回的身份验证失败的结果。
在一种可选的实施例中，在接收到的数据未被篡改的情况下，上述装置还包括：解密单元，用于通过第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随 机数；第二判断单元，用于通过第二设备判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户；其中，接收单元还用于在登录账号不存在于可信任列表的情况下，通过第一设备接收第二设备返回的身份验证失败的结果。
在一种可选的实施例中，在登录账号存在于可信任列表的情况下，上述装置还包括：生成单元，用于第一设备根据第一随机数和认证服务器返回的第二随机数，生成共享密钥，其中，第二随机数为第二设备在登录账号存在于可信任列表的情况下，第二设备生成的随机数；其中，第二设备根据第一随机数和第二随机数，生成共享密钥。
在一种可选的实施例中，上述装置包括：第三判断单元，用于通过第二设备判断可信任列表中是否存在登录账号；处理单元，用于在可信任列表中不存在登录账号的情况下，第二设备将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
实施例7
本申请的实施例可以提供一种计算机终端，该计算机终端可以是计算机终端群中的任意一个计算机终端。可选地，在本实施例中，上述计算机终端也可以替换为计算机终端等终端设备。
可选地，在本实施例中，上述计算机终端可以位于计算机网络的多个网络设备中的至少一个访问设备。
图12示出了一种计算机终端的硬件结构框图。如图12所示，计算机终端12可以包括一个或多个(图中仅示出一个)处理器122(处理器122可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器124、以及用于通信功能的传输装置126。除此以外，还可以包括：显示器、输入/输出接口(I/O接口)、通用串行总线(USB)端口(可以作为I/O接口的端口中的一个端口被包括)、网络接口、电源和/或相机。本领域普通技术人员可以理解，图12所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端12还可包括比图12中所示更多或者更少的组件，或者具有与图12所示不同的配置。
应当注意到的是上述一个或多个处理器122和/或其他数据处理电路在本文中通常可以被称为“数据处理电路”。该数据处理电路可以全部或部分的体现为软件、硬件、固件或其他任意组合。此外，数据处理电路可为单个独立的处理模块，或全部或部分的结合到计算机终端12中的其他元件中的任意一个内。如本申请实施例中所涉及到的， 该数据处理电路作为一种处理器控制(例如与接口连接的可变电阻终端路径的选择)。
处理器122可以通过传输装置调用存储器存储的信息及应用程序，以执行下述步骤：基于用户对订单的操作，生成会话交互界面，会话交互界面对应的会话是基于订单创建；在会话交互界面，实现针对订单的用户间即时通讯功能。
存储器124可用于存储应用软件的软件程序以及模块，如本申请实施例中的身份认证方法对应的程序指令/数据存储装置，处理器122通过运行存储在存储器124内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的应用程序的身份认证方法。存储器124可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器124可进一步包括相对于处理器122远程设置的存储器，这些远程存储器可以通过网络连接至计算机终端12。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置126用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端12的通信供应商提供的无线网络。在一个实例中，传输装置126包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置126可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
显示器可以例如触摸屏式的液晶显示器(LCD)，该液晶显示器可使得用户能够与计算机终端12的用户界面进行交互。
此处需要说明的是，在一些可选实施例中，上述图12所示的计算机终端12可以包括硬件元件(包括电路)、软件元件(包括存储在计算机可读介质上的计算机代码)、或硬件元件和软件元件两者的结合。应当指出的是，图12仅为特定具体实例的一个实例，并且旨在示出可存在于上述计算机终端12中的部件的类型。
此处需要说明的是，在一些实施例中，上述图12所示的计算机终端具有触摸显示器(也被称为“触摸屏”或“触摸显示屏”)。在一些实施例中，上述图12所示的计算机终端具有图像用户界面(GUI)，用户可以通过触摸触敏表面上的手指接触和/或手势来与GUI进行人机交互，此处的人机交互功能可选的包括如下交互：创建网页、绘图、文字处理、制作电子文档、游戏、视频会议、即时通信、收发电子邮件、通话界面、播放数字视频、播放数字音乐和/或网络浏览等、用于执行上述人机交互功能的可执行指令被配置/存储在一个或多个处理器可执行的计算机程序产品或可读存储介质中。
在本实施例中，上述计算机终端12可以执行应用程序的身份认证方法中以下步骤的程序代码：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备获取登录账号，并接收认证服务器返回的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书；第一设备根据登录账号和加密信息，生成加密后的身份信息；第一设备发送加密后的身份信息至第二设备。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果；第一设备基于登录账号，以及如下至少之一的信息生成加密后的身份信息：加密结果和数字证书。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备获取第一随机数；第一设备使用密钥对中的私钥对登录账号和第一随机数进行加密，得到加密结果。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备向认证服务器发起登录请求，其中，认证服务器根据登录请求生成加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。
可选的，第一设备通过如下任意一种通信方式与第二设备建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
可选的，上述处理器还可以执行如下步骤的程序代码：第一设备将加密后的身份信息添加第一设备的数字签名；第一设备将添加数字签名后的身份信息发送至第二设备。
可选的，上述处理器还可以执行如下步骤的程序代码：第二设备基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信；在数字证书不可信的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在数字证书可信的情况下，上述处理器还可以执行如下步骤的程序代码：在数字证书可信的情况下，第二设备提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改；在接收到的数据被篡改的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在接收到的数据未被篡改的情况下，上述处理器还可以执行如下步骤的程序代码：第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随机数；第二设备判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户；在登录账号不存在于可信任列表的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在登录账号存在于可信任列表的情况下，上述处理器还可以执行如下步骤的程序代码：第一设备根据第一随机数和认证服务器返回的第二随机数，生成共享密钥，其中，第二随机数为第二设备在登录账号存在于可信任列表的情况下，第二设备生成的随机数；其中，第二设备根据第一随机数和第二随机数，生成共享密钥。
可选的，上述处理器还可以执行如下步骤的程序代码：第二设备判断可信任列表中是否存在登录账号；在可信任列表中不存在登录账号的情况下，第二设备将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
本领域普通技术人员可以理解，图12所示的结构仅为示意，计算机终端也可以是智能手机(如Android手机、iOS手机等)、平板电脑、掌声电脑以及移动互联网设备(Mobile Internet Devices，MID)、PAD等终端设备。图12其并不对上述电子装置的结构造成限定。例如，计算机终端12还可包括比图12中所示更多或者更少的组件(如网络接口、显示装置等)，或者具有与图12所示不同的配置。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令终端设备相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(Read-Only Memory，ROM)、随机存取器(Random Access Memory，RAM)、磁盘或光盘等。
实施例8
本申请的实施例还提供了一种存储介质。可选的，在本实施例中，上述存储介质可以用于保存上述实施例所提供的身份认证方法所执行的程序代码，其中，在程序运行时控制存储介质所在设备执行实施例中任意一项的可选的或优选的订单处理方法。
可选的，在本实施例中，上述存储介质可以位于计算机网络中移动终端群中的任意一个移动终端中，或者位于移动终端群中的任意一个移动终端中。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备获取登录账号，并接收认证服务器返回的加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书；第一设备根据登录账号和加密信息，生成加密后的身份信息；第一设备发送加密后的身份信息至第二设备。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备使用密钥对中的私钥对登录账号和/或随机数进行加密，得到加密结果；第一设备基于登录账号，以及如下至少之一的信息生成加密后的身份信息：加密结果和数字证书。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备获取第一随机数；第一设备使用密钥对中的私钥对登录账号和第一随机数进行加密，得到加密结果。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备向认证服务器发起登录请求，其中，认证服务器根据登录请求生成加密信息，其中，加密信息包括如下至少之一：密钥对和数字证书。
可选的，第一设备通过如下任意一种通信方式与第二设备建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备将加密后的身份信息添加第一设备的数字签名；第一设备将添加数字签名后的身份信息发送至第二设备。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第二设备基于预先安装的根证书，判断待验证的身份信息中包含的数字证书是否可信；在数字证书不可信的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在本实施例中，在数字证书可信的情况下，存储介质被设置为存储用于执行以下步骤的程序代码：在数字证书可信的情况下，第二设备提取数字证书中包含的公钥，并通过数字签名验证接收到的数据是否被篡改；在接收到的数据被篡改的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在本实施例中，在接收到的数据未被篡改的情况下，存储介质被设置为存储用于执行以下步骤的程序代码：第二设备利用公钥对加密结果进行解密，得到登录账号和/或第一随机数；第二设备判断登录账号是否存在于可信任列表中，其中，可信任列表包含允许登录第二设备的至少一个账户；在登录账号不存在于可信任列表的情况下，第一设备接收第二设备返回的身份验证失败的结果。
可选的，在本实施例中，在登录账号存在于可信任列表的情况下，存储介质被设置为存储用于执行以下步骤的程序代码：第一设备根据第一随机数和认证服务器返回的第二随机数，生成共享密钥，其中，第二随机数为第二设备在登录账号存在于可信任列表的情况下，第二设备生成的随机数；其中，第二设备根据第一随机数和第二随机数，生成共享密钥。
可选的，在本实施例中，存储介质被设置为存储用于执行以下步骤的程序代码：第二设备判断可信任列表中是否存在登录账号；在可信任列表中不存在登录账号的情况下，第二设备将解密得到的登录账号作为管理账号，并添加到可信任列表中，其中，管理账号用于管理可信任列表中的至少一个登录账号。
实施例9
本申请的实施例还提供了一种身份认证系统，包括：处理器；以及存储器，与处理器连接，用于为处理器提供处理以下处理步骤的指令：
第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，第一设备为允许访问互联网的设备，第二设备为不允许访问互联网的设备；
第一设备使用加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至第二设备；
第一设备接收第二设备返回的验证结果，其中，第二设备基于验证信息来验证加密后的身份信息。
由上可知，在本申请上述实施例中，通过允许访问互联网的第一设备从互联网上获取加密信息，并使用该加密信息加密第一设备登录第二设备的账户的身份信息，以便第二设备可以通过验证信息，对接收到的身份信息进行验证，以便在确定第一设备的身份 信息为可信的情况下，才与第一设备进行通信。
容易注意的是，第二设备中验证信息可以对第一设备获取到的加密信息进行验证，以根据验证结果，来确定第一设备的身份是否可信。因而，通过本申请上述实施例公开的方案，达到了根据非联网设备中内置的验证信息对用于操作该非联网设备的对象的身份信息进行验证的目的，从而实现了在通过客户端操作非联网设备的时候，非联网设备对客户端身份进行认证以提高客户端与非联网设备之间数据传输的安全性的技术效果。
由此，本申请提供的上述实施例9的方案解决了现有技术中，在联网设备对非联网设备进行操作的过程中，由于非联网设备无法连接认证服务器，导致接入该非联网设备的联网设备无法完成身份认证的技术问题。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
在本申请的上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的技术内容，可通过其它的方式实现。其中，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，单元或模块的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法 的全部或部分步骤。而前述的存储介质包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述仅是本申请的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本申请的保护范围。

Claims (32)

  1. 一种身份认证系统，其特征在于，包括：
    第一设备，用于通过互联网获取加密信息，使用所述加密信息对登录第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至所述第二设备；
    所述第二设备，与所述第一设备建立通信连接，用于基于验证信息来验证所述加密后的身份信息，得到验证结果，并将验证结果返回至所述第一设备；
    其中，所述第一设备为允许访问互联网的设备，所述第二设备为不允许访问互联网的设备。
  2. 根据权利要求1所述的系统，其特征在于，所述系统还包括：
    服务器，与所述第一设备通信，用于接收所述第一设备发起的登录请求，并根据所述登录请求生成所述加密信息，其中，所述加密信息包括如下至少之一：密钥对和数字证书。
  3. 一种身份认证方法，其特征在于，包括：
    第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，所述第二设备为不允许访问互联网的设备；
    所述第一设备使用所述加密信息对登录所述第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至所述第二设备；
    所述第一设备接收所述第二设备返回的验证结果，其中，所述第二设备基于验证信息来验证所述加密后的身份信息。
  4. 根据权利要求3所述的方法，其特征在于，所述第一设备使用所述加密信息对登录所述第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至所述第二设备，包括：
    所述第一设备获取登录账号，并接收认证服务器返回的所述加密信息，其中，所述加密信息包括如下至少之一：密钥对和数字证书；
    所述第一设备根据所述登录账号和所述加密信息，生成所述加密后的身份信息；
    所述第一设备发送所述加密后的身份信息至所述第二设备。
  5. 根据权利要求4所述的方法，其特征在于，所述第一设备根据所述登录账号和所述加密信息，生成所述加密后的身份信息包括：
    所述第一设备使用所述密钥对中的私钥对所述登录账号和/或随机数进行加密，得到加密结果；
    所述第一设备基于所述登录账号，以及如下至少之一的信息生成所述加密后的身份信息：所述加密结果和所述数字证书。
  6. 根据权利要求5所述的方法，其特征在于，所述第一设备使用所述密钥对中的私钥对所述登录账号和/或随机数进行加密，得到加密结果，包括：
    所述第一设备获取第一随机数；
    所述第一设备使用所述密钥对中的私钥对所述登录账号和所述第一随机数进行加密，得到加密结果。
  7. 根据权利要求3所述的方法，其特征在于，在所述第一设备使用所述加密信息对登录所述第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至所述第二设备之前，所述方法还包括：
    所述第一设备向认证服务器发起登录请求，其中，所述认证服务器根据所述登录请求生成所述加密信息，其中，所述加密信息包括如下至少之一：密钥对和数字证书。
  8. 根据权利要求3所述的方法，其特征在于，所述第一设备通过如下任意一种通信方式与第二设备建立通信连接：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
  9. 根据权利要求6所述的方法，其特征在于，所述第一设备发送所述加密后的身份信息至所述第二设备，包括：
    所述第一设备将所述加密后的身份信息添加所述第一设备的数字签名；
    所述第一设备将添加数字签名后的身份信息发送至所述第二设备。
  10. 根据权利要求9所述的方法，其特征在于，在所述第一设备将添加数字签名后的身份信息发送至所述第二设备之后，所述方法还包括：
    所述第二设备基于预先安装的根证书，判断所述添加数字签名后的身份信息中包含的数字证书是否可信；
    在所述数字证书不可信的情况下，所述第一设备接收所述第二设备返回的身份验证失败的结果。
  11. 根据权利要求10所述的方法，其特征在于，在所述数字证书可信的情况下，所述方法还包括：
    在所述数字证书可信的情况下，所述第二设备提取所述数字证书中包含的公钥，并通过所述数字签名验证接收到的数据是否被篡改；
    在所述接收到的数据被篡改的情况下，所述第一设备接收所述第二设备返回的身份 验证失败的结果。
  12. 根据权利要求11所述的方法，其特征在于，在所述接收到的数据未被篡改的情况下，所述方法还包括：
    所述第二设备利用所述公钥对所述加密结果进行解密，得到所述登录账号和/或所述第一随机数；
    所述第二设备判断所述登录账号是否存在于可信任列表中，其中，所述可信任列表包含允许登录所述第二设备的至少一个账户；
    在所述登录账号不存在于所述可信任列表的情况下，所述第一设备接收所述第二设备返回的身份验证失败的结果。
  13. 根据权利要求12所述的方法，其特征在于，在所述登录账号存在于所述可信任列表的情况下，所述方法还包括：
    所述第一设备根据所述第一随机数和所述认证服务器返回的第二随机数，生成共享密钥，其中，所述第二随机数为所述第二设备在所述登录账号存在于所述可信任列表的情况下，所述第二设备生成的随机数；
    其中，所述第二设备根据所述第一随机数和所述第二随机数，生成所述共享密钥。
  14. 根据权利要求12所述的方法，其特征在于，所述方法包括：
    所述第二设备判断所述可信任列表中是否存在登录账号；
    在所述可信任列表中不存在登录账号的情况下，所述第二设备将解密得到的所述登录账号作为管理账号，并添加到所述可信任列表中，其中，所述管理账号用于管理所述可信任列表中的至少一个登录账号。
  15. 一种身份认证方法，其特征在于，包括：
    第二设备与第一设备建立通信连接，并接收所述第一设备传输的待验证的身份信息，其中，所述第一设备为允许访问互联网的设备，所述第二设备为不允许访问互联网的设备；
    所述第二设备基于验证信息来验证所述第一设备传输的待验证的身份信息，得到验证结果；
    其中，所述待验证的身份信息为使用加密信息加密后的数据。
  16. 一种身份认证方法，其特征在于，包括：
    第二设备接收来自第一设备传输的待验证的身份信息，其中，所述第一设备为允许访问互联网的设备，所述第二设备为不允许访问互联网的设备；
    所述第二设备根据验证信息验证所述待验证的身份信息，得到验证结果；
    在所述验证结果为所述身份信息可信的情况下，生成用于加解密数据的共享密钥，其中，所述共享密钥用于保证所述第二设备和所述第一设备之间进行安全数据传输；
    其中，所述待验证的身份信息为使用加密信息加密后的数据。
  17. 根据权利要求16所述的方法，其特征在于，在第二设备接收来自第一设备传输的待验证的身份信息之前，所述方法还包括：
    所述第一设备获取登录账号，并接收认证服务器返回的所述加密信息，其中，所述加密信息包括如下至少之一：密钥对和数字证书；
    所述第一设备根据所述登录账号和所述加密信息，生成所述待验证的身份信息；
    所述第一设备发送所述待验证的身份信息至所述第二设备。
  18. 根据权利要求17所述的方法，其特征在于，所述第二设备通过如下任意一种通信方式接收所述第一设备发送的所述待验证的身份信息：传输控制协议TCP、用户数据报协议UDP、蓝牙、Zigbee、WiFi。
  19. 根据权利要求17所述的方法，其特征在于，在所述第一设备获取登录账号，并接收服务器返回的认证服务器返回的所述加密信息之前，所述方法还包括：
    所述第一设备向所述认证服务器发起登录请求，其中，所述认证服务器根据所述登录请求生成所述加密信息。
  20. 根据权利要求17所述的方法，其特征在于，所述第一设备根据所述登录账号和所述加密信息，生成所述待验证的身份信息，包括：
    所述第一设备使用所述密钥对中的私钥对所述登录账号和/或随机数进行加密，得到加密结果；
    所述第一设备基于所述登录账号，以及如下至少之一的信息生成所述待验证的身份信息：所述加密结果和所述数字证书。
  21. 根据权利要求20所述的方法，其特征在于，所述第一设备使用所述密钥对中的私钥对所述登录账号和/或随机数进行加密，得到加密结果，包括：
    所述第一设备获取第一随机数；
    所述第一设备使用所述密钥对中的私钥对所述登录账号和所述第一随机数进行加密，得到加密结果。
  22. 根据权利要求21所述的方法，其特征在于，所述第一设备发送所述待验证的身份信息至所述第二设备，包括：
    所述第一设备将所述待验证的身份信息添加所述第一设备的数字签名；
    所述第一设备将添加数字签名后的身份信息发送至所述第二设备。
  23. 根据权利要求22所述的方法，其特征在于，所述第二设备根据验证信息验证所述第一设备传输的待验证的身份信息，得到验证结果，包括：
    所述第二设备基于预先安装的根证书，判断所述待验证的身份信息中包含的数字证书是否可信；
    在所述数字证书不可信的情况下，所述第二设备向所述第一设备返回身份验证失败的结果。
  24. 根据权利要求23所述的方法，其特征在于，在所述数字证书可信的情况下，所述方法还包括：
    在所述数字证书可信的情况下，所述第二设备提取所述数字证书中包含的公钥，并通过所述数字签名验证接收到的数据是否被篡改；
    在所述接收到的数据被篡改的情况下，所述第二设备向所述第一设备返回身份验证失败的结果。
  25. 根据权利要求24所述的方法，其特征在于，在所述接收到的数据未被篡改的情况下，所述方法还包括：
    所述第二设备利用所述公钥对所述加密结果进行解密，得到所述登录账号和/或所述第一随机数；
    所述第二设备判断所述登录账号是否存在于可信任列表中，其中，所述可信任列表包含允许登录所述第二设备的至少一个账户；
    在所述登录账号不存在于所述可信任列表的情况下，所述第二设备向所述第一设备返回身份验证失败的结果。
  26. 根据权利要求25所述的方法，其特征在于，在所述登录账号存在于所述可信任列表的情况下，所述第二设备确定所述第一设备传输的身份信息为可信的验证结果。
  27. 根据权利要求26所述的方法，其特征在于，在所述登录账号存在于所述可信任列表的情况下，所述第二设备确定所述第一设备传输的身份信息为可信的验证结果之后，所述方法还包括：
    所述第二设备获取第二随机数，并根据所述第一随机数和所述第二随机数生成所述共享密钥；
    其中，所述第一设备根据所述第一随机数和所述认证服务器返回的所述第二随机 数，生成所述共享密钥。
  28. 根据权利要求25所述的方法，其特征在于，在所述第二设备利用所述公钥对所述加密结果进行解密，得到所述登录账号和/或所述第一随机数之后，所述方法包括：
    所述第二设备判断所述可信任列表中是否存在登录账号；
    在所述可信任列表中不存在登录账号的情况下，所述第二设备将解密得到的所述登录账号作为管理账号，并添加到所述可信任列表中，其中，所述管理账号用于管理所述可信任列表中的至少一个登录账号。
  29. 一种计算设备，其特征在于，包括：
    通信装置，与控制设备建立通信连接，用于接收来自控制设备传输的待验证的身份信息，其中，所述控制设备为允许访问互联网的设备；
    处理器，与所述通信装置连接，用于根据验证信息，验证所述控制设备传输的待验证的身份信息，得到验证结果，并在所述验证结果为所述身份信息可信的情况下，生成用于加解密数据的共享密钥，其中，所述共享密钥用于保证所述通信装置和所述控制设备之间进行安全数据传输。
  30. 一种存储介质，其特征在于，所述存储介质包括存储的程序，其中，在所述程序运行时控制所述存储介质所在设备执行权利要求3至14中任意一项所述的身份认证方法。
  31. 一种计算终端，其特征在于，包括：处理器，所述处理器用于运行程序，其中，所述程序运行时执行权利要求3至14中任意一项所述的身份认证方法。
  32. 一种身份认证系统，其特征在于，包括：
    处理器；以及
    存储器，与所述处理器连接，用于为所述处理器提供处理以下处理步骤的指令：
    第一设备与第二设备建立通信连接，并通过互联网获取加密信息，其中，所述第一设备为允许访问互联网的设备，所述第二设备为不允许访问互联网的设备；
    所述第一设备使用所述加密信息对登录所述第二设备的账户的身份信息进行加密，并将加密后的身份信息发送至所述第二设备；
    所述第一设备接收所述第二设备返回的验证结果，其中，所述第二设备基于验证信息来验证所述加密后的身份信息。
PCT/CN2018/120073 2017-12-18 2018-12-10 身份认证方法、系统及计算设备 WO2019120091A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
SG11202005708XA SG11202005708XA (en) 2017-12-18 2018-12-10 Identity authentication method and system, and computing device
EP18890601.0A EP3731551A4 (en) 2017-12-18 2018-12-10 IDENTITY AUTHENTICATION PROCESS AND SYSTEM AND COMPUTER DEVICE
US16/904,398 US11509485B2 (en) 2017-12-18 2020-06-17 Identity authentication method and system, and computing device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711366337.4 2017-12-18
CN201711366337.4A CN109936547A (zh) 2017-12-18 2017-12-18 身份认证方法、系统及计算设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/904,398 Continuation US11509485B2 (en) 2017-12-18 2020-06-17 Identity authentication method and system, and computing device

Publications (1)

Publication Number Publication Date
WO2019120091A1 true WO2019120091A1 (zh) 2019-06-27

Family

ID=66982722

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/120073 WO2019120091A1 (zh) 2017-12-18 2018-12-10 身份认证方法、系统及计算设备

Country Status (6)

Country Link
US (1) US11509485B2 (zh)
EP (1) EP3731551A4 (zh)
CN (1) CN109936547A (zh)
SG (1) SG11202005708XA (zh)
TW (1) TW201929482A (zh)
WO (1) WO2019120091A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112218279A (zh) * 2020-10-14 2021-01-12 福建小飞科技有限公司 一种多协议的手持终端对展示终端的控制方法及设备
CN112311533A (zh) * 2019-07-29 2021-02-02 中国电信股份有限公司 终端身份认证方法、系统以及存储介质
WO2021115270A1 (zh) * 2019-12-10 2021-06-17 华为技术有限公司 一种边缘应用的管理方法及装置
CN113572717A (zh) * 2020-04-29 2021-10-29 青岛海尔滚筒洗衣机有限公司 通信连接的建立方法、洗护设备及服务器
CN114024766A (zh) * 2021-11-23 2022-02-08 重庆邮电大学 一种面向边缘计算节点的零信任身份认证方法

Families Citing this family (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110932858B (zh) * 2018-09-19 2023-05-02 阿里巴巴集团控股有限公司 认证方法和系统
US11164178B2 (en) * 2019-04-04 2021-11-02 Comenity Llc Adding a credit account to a mobile wallet to make a transaction when the physical card associated with the credit account is unavailable
CN112291182B (zh) * 2019-07-23 2022-06-21 腾讯科技（深圳）有限公司 保持用户账户登录态的方法、装置、电子设备及存储介质
CN110401539B (zh) * 2019-07-24 2021-01-08 创新先进技术有限公司 一种身份验证数据处理方法、服务器、终端及系统
US10944578B2 (en) 2019-07-24 2021-03-09 Advanced New Technologies Co., Ltd. Identity verification
CN110392058B (zh) * 2019-08-01 2021-09-03 中数智创科技有限公司 业务保护方法、系统及终端设备
CN110519764B (zh) * 2019-09-19 2023-06-23 京东方科技集团股份有限公司 一种通信设备的安全验证方法、系统、计算机设备和介质
DE102019130067B4 (de) * 2019-11-07 2022-06-02 Krohne Messtechnik Gmbh Verfahren zur Durchführung einer erlaubnisabhängigen Kommunikation zwischen wenigstens einem Feldgerät der Automatisierungstechnik und einem Bediengerät
CN111049799B (zh) 2019-11-13 2022-01-21 华为终端有限公司 控制方法、装置和系统
CN113099443B (zh) * 2019-12-23 2024-05-17 阿里巴巴集团控股有限公司 设备认证方法、装置、设备和系统
CN111064752B (zh) * 2019-12-31 2021-12-17 郑州信大捷安信息技术股份有限公司 一种基于公网的预置密钥共享系统及方法
CN113472521A (zh) * 2020-03-30 2021-10-01 山东浪潮质量链科技有限公司 基于区块链的实名数字身份管理方法、签名设备和验证设备
CN113765950B (zh) 2020-06-02 2023-11-14 富泰华工业（深圳）有限公司 物联网设备、服务器及软件更新方法
TWI754950B (zh) * 2020-06-02 2022-02-11 鴻海精密工業股份有限公司 物聯網設備、伺服器及軟體更新方法
WO2022000155A1 (en) * 2020-06-29 2022-01-06 Nokia Shanghai Bell Co., Ltd. Access control of service based management framework
CN114079666A (zh) * 2020-08-06 2022-02-22 阿里巴巴集团控股有限公司 设备控制系统、方法及装置
CN112637128B (zh) * 2020-11-25 2022-07-08 四川新网银行股份有限公司 一种数据中心主机的身份互信方法及系统
CN112672333B (zh) * 2020-12-15 2023-08-25 三维通信股份有限公司 设备连接方法及装置
CN115442061A (zh) * 2021-06-04 2022-12-06 华为技术有限公司 安全认证方法、可读介质和电子设备
CN113806723B (zh) * 2021-09-27 2024-08-23 三星电子（中国）研发中心 双因子认证方法和装置
CN114499938A (zh) * 2021-12-21 2022-05-13 广东纬德信息科技股份有限公司 一种基于移动终端的统一身份认证方法及装置
CN114553432B (zh) * 2022-01-28 2023-08-18 中国银联股份有限公司 身份认证方法、装置、设备及计算机可读存储介质
CN115086041A (zh) * 2022-06-16 2022-09-20 北京天融信网络安全技术有限公司 账号管理方法、装置、电子设备和计算机可读存储介质
CN115250207B (zh) * 2022-09-26 2022-12-20 国网浙江省电力有限公司宁海县供电公司 用于能源互联网的安全交易方法、电子设备及存储介质
CN115834077B (zh) * 2022-11-11 2023-08-01 北京深盾科技股份有限公司 控制方法、控制系统、电子设备及存储介质
CN117040825B (zh) * 2023-08-03 2024-09-17 华润智算科技(广东)有限公司 物联网设备的认证方法和存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105100052A (zh) * 2015-05-29 2015-11-25 北京奇虎科技有限公司 服务器、手机终端及其帐号与设备绑定执行、控制方法
CN106211154A (zh) * 2016-06-29 2016-12-07 海尔优家智能科技（北京）有限公司 一种身份信息的验证方法及智能家电
US20170085379A1 (en) * 2014-05-25 2017-03-23 Fujitsu Limited Learning parity with noise-based relational encryption for proximity relations

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0411560D0 (en) 2004-05-24 2004-06-23 Protx Group Ltd A method of encrypting and transferring data between a sender and a receiver using a network
US8112066B2 (en) 2009-06-22 2012-02-07 Mourad Ben Ayed System for NFC authentication based on BLUETOOTH proximity
US8260262B2 (en) 2009-06-22 2012-09-04 Mourad Ben Ayed Systems for three factor authentication challenge
CN104202744A (zh) * 2014-08-14 2014-12-10 腾讯科技（深圳）有限公司 一种智能终端的操作认证方法、终端及系统
KR102457809B1 (ko) 2014-09-24 2022-10-24 삼성전자주식회사 데이터 통신 보안을 위한 방법, 장치 및 시스템
US10083291B2 (en) * 2015-02-25 2018-09-25 Verisign, Inc. Automating internet of things security provisioning
CN110365484B (zh) * 2015-03-17 2023-01-20 创新先进技术有限公司 一种设备认证的数据处理方法、装置及系统
US20160323283A1 (en) * 2015-04-30 2016-11-03 Samsung Electronics Co., Ltd. Semiconductor device for controlling access right to resource based on pairing technique and method thereof
US9717012B2 (en) 2015-06-01 2017-07-25 Afero, Inc. Internet of things (IOT) automotive device, system, and method
CN111367187B (zh) 2015-08-27 2023-10-24 江森自控泰科知识产权控股有限责任公司 用于改进对分布式网络中的传感器流数据的处理的方法
KR102576417B1 (ko) * 2015-11-19 2023-09-08 로베르트 보쉬 게엠베하 네트워크화된 컴퓨터를 통한 임베디드 디바이스에 대한 보안 액세스 제어
US10275962B2 (en) * 2015-12-14 2019-04-30 Afero, Inc. Apparatus and method for internet of things (IOT) security lock and notification device
CN105450659A (zh) * 2015-12-23 2016-03-30 北京握奇智能科技有限公司 一种物联网安全认证系统及认证方法
US10044674B2 (en) 2016-01-04 2018-08-07 Afero, Inc. System and method for automatic wireless network authentication in an internet of things (IOT) system
US9866637B2 (en) 2016-01-11 2018-01-09 Equinix, Inc. Distributed edge processing of internet of things device data in co-location facilities
US10348699B2 (en) * 2016-02-11 2019-07-09 Evident ID, Inc. Identity binding systems and methods in a personal data store in an online trust system
US10097948B2 (en) * 2016-03-31 2018-10-09 Intel Corporation Point-and-connect bluetooth pairing
CN105974802B (zh) * 2016-04-27 2017-09-29 腾讯科技（深圳）有限公司 一种控制智能设备的方法、装置和系统
US9860677B1 (en) 2016-09-30 2018-01-02 Intel Corporation Internet-of-things gateway coordination
CN106850540A (zh) * 2016-12-09 2017-06-13 深圳市金立通信设备有限公司 一种终端控制方法、终端及系统
EP3934203A1 (en) 2016-12-30 2022-01-05 INTEL Corporation Decentralized data storage and processing for iot devices

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170085379A1 (en) * 2014-05-25 2017-03-23 Fujitsu Limited Learning parity with noise-based relational encryption for proximity relations
CN105100052A (zh) * 2015-05-29 2015-11-25 北京奇虎科技有限公司 服务器、手机终端及其帐号与设备绑定执行、控制方法
CN106211154A (zh) * 2016-06-29 2016-12-07 海尔优家智能科技（北京）有限公司 一种身份信息的验证方法及智能家电

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3731551A4

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112311533A (zh) * 2019-07-29 2021-02-02 中国电信股份有限公司 终端身份认证方法、系统以及存储介质
WO2021115270A1 (zh) * 2019-12-10 2021-06-17 华为技术有限公司 一种边缘应用的管理方法及装置
CN113572717A (zh) * 2020-04-29 2021-10-29 青岛海尔滚筒洗衣机有限公司 通信连接的建立方法、洗护设备及服务器
CN113572717B (zh) * 2020-04-29 2024-02-20 青岛海尔洗涤电器有限公司 通信连接的建立方法、洗护设备及服务器
CN112218279A (zh) * 2020-10-14 2021-01-12 福建小飞科技有限公司 一种多协议的手持终端对展示终端的控制方法及设备
CN114024766A (zh) * 2021-11-23 2022-02-08 重庆邮电大学 一种面向边缘计算节点的零信任身份认证方法
CN114024766B (zh) * 2021-11-23 2023-06-20 重庆邮电大学 一种面向边缘计算节点的零信任身份认证方法

Also Published As

Publication number Publication date
US11509485B2 (en) 2022-11-22
SG11202005708XA (en) 2020-07-29
TW201929482A (zh) 2019-07-16
EP3731551A4 (en) 2021-09-08
US20200322170A1 (en) 2020-10-08
EP3731551A1 (en) 2020-10-28
CN109936547A (zh) 2019-06-25

Similar Documents

Publication Publication Date Title
WO2019120091A1 (zh) 身份认证方法、系统及计算设备
WO2022206349A1 (zh) 一种信息验证的方法、相关装置、设备以及存储介质
CN110636062B (zh) 设备的安全交互控制方法、装置、电子设备及存储介质
CN111193695B (zh) 一种第三方账号登录的加密方法、装置及存储介质
TWI780047B (zh) 身份認證方法、裝置和系統
JP6687641B2 (ja) サーバまたは他の装置からのエントロピーに基づくクライアント装置の認証
WO2018214777A1 (zh) 一种数据通信方法、装置、设备和存储介质
US20200259667A1 (en) Distributed management system for remote devices and methods thereof
US11736304B2 (en) Secure authentication of remote equipment
US10601590B1 (en) Secure secrets in hardware security module for use by protected function in trusted execution environment
CN105027107A (zh) 安全虚拟机迁移
CN112765684B (zh) 区块链节点终端管理方法、装置、设备及存储介质
EP2978192B1 (en) Peer to peer remote control method between one or more mobile devices
CN111343613A (zh) 在过程控制系统中建立安全的低能量无线通信的方法和装置
RU2685975C2 (ru) Обеспечение безопасности связи с расширенными мультимедийными платформами
JP2023552421A (ja) ハードウェア・セキュリティ・モジュールのリモート管理
TWI827906B (zh) 訊息傳輸系統以及應用其中之使用者裝置與資訊安全硬體模組
CN115001841A (zh) 一种身份认证方法、装置及存储介质
WO2024139616A1 (zh) 签名认证方法和装置
Zhang et al. TEO: Ephemeral ownership for iot devices to provide granular data control
KR101836211B1 (ko) 전자 기기 인증 매니저 장치
WO2023226778A1 (zh) 身份认证方法、装置、电子设备及计算机可读存储介质
CN115801252B (zh) 一种结合量子加密技术的安全云桌面系统
CN116961973A (zh) 数据传输方法、装置、电子设备及计算机可读存储介质
CN113472737B (zh) 边缘设备的数据处理方法、装置及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18890601

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018890601

Country of ref document: EP

Effective date: 20200720