WO2019184736A1 - 接入认证方法、装置及服务器 - Google Patents

接入认证方法、装置及服务器 Download PDF

Info

Publication number
WO2019184736A1
WO2019184736A1 PCT/CN2019/078379 CN2019078379W WO2019184736A1 WO 2019184736 A1 WO2019184736 A1 WO 2019184736A1 CN 2019078379 W CN2019078379 W CN 2019078379W WO 2019184736 A1 WO2019184736 A1 WO 2019184736A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
server
information
key
verification
Prior art date
Application number
PCT/CN2019/078379
Other languages
English (en)
French (fr)
Inventor
欧锻灏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019184736A1 publication Critical patent/WO2019184736A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0872—Generation of secret information including derivation or calculation of cryptographic keys or passwords using geo-location information, e.g. location data, time, relative position or proximity to other entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present disclosure relates to the field of Internet of Things technologies, and in particular, to an access authentication method, apparatus, and server.
  • the Internet of Things is an Internet connected to objects. It can realize the interconnection between goods and objects, people and objects.
  • the terminal can exchange information with the server by accessing the Internet of Things.
  • the server needs to authenticate the terminal, and allows the terminal to access the Internet of Things when the authentication passes.
  • the terminal and the server pre-store a common pre-shared key (PSK).
  • PSK common pre-shared key
  • the terminal When the terminal needs to access the Internet of Things, the terminal generates a first verification information according to the PSK and its own device identifier, and sends the first verification information to the server.
  • An access request the access request carries the first verification information and the device identifier of the terminal, and the server generates second verification information according to the PSK and the device identifier of the terminal, and compares the second verification information with the first verification information. If the second verification information is consistent with the first verification information, the server may allow the terminal to access the Internet of Things. If the second verification information is inconsistent with the first verification information, the server may reject the terminal from accessing the Internet of Things.
  • the criminals can use the PSK to access the Internet of Things, resulting in the access authentication mechanism being compromised and the security being poor.
  • the embodiments of the present disclosure provide a method, an apparatus, and a server for access authentication, which can solve the technical problem of poor security of access authentication in the related art.
  • the technical solution is as follows:
  • an access authentication method comprising:
  • first verification information is consistent with the second verification information, acquiring first location information of the terminal and second location information stored by the server, where the first location information is used to indicate that the terminal is currently a location at which the second location information is used to indicate an installation location of the terminal;
  • the terminal is allowed to access the Internet of Things.
  • the method provided in this embodiment provides a multi-factor authentication mechanism, and combines the stored first key, the first random number generated by the server, and the current location of the terminal to authenticate the identity of the terminal. Even if a certain authentication factor is leaked, it is impossible to use the identity of the terminal to access the Internet of Things, which greatly improves the difficulty of breaking the access authentication mechanism and improves security.
  • the random number used in the authentication process is generated by the server, and the server has more powerful computing power than the terminal, and can ensure that a high-security random number is generated, and the verification information generated by the high-security random number is used for calibration.
  • the test improves the predictability of the verification information, thus improving security.
  • the terminal is allowed to access the Internet of Things, including:
  • the terminal If the first location information is consistent with the second location information, allowing the terminal to access the Internet of Things; or
  • the terminal is allowed to access the Internet of Things.
  • the security can be greatly improved by checking the position of the terminal.
  • the method After the second verification information is generated based on the first key stored by the server, the device identification information stored by the server, and the first random number generated by the server, the method also includes:
  • the terminal is allowed to access the Internet of Things.
  • the security can be greatly improved by checking the mobile behavior state of the terminal.
  • the mobile behavior status information meets a second preset condition, allowing the terminal to access the Internet of Things, including:
  • the preset mobile behavior state information is used to indicate the The mobile state of the terminal during normal operation; or,
  • the classification model Inputting the mobile behavior state information into a classification model, outputting a category of the mobile behavior state information, the classification model is configured to perform classification according to the mobile behavior state information; if the category is a preset category, allowing the terminal to be connected Into the Internet of Things.
  • the mobile behavior state information includes at least one of a moving trajectory of the terminal, a moving speed of the terminal, and a moving range of the terminal.
  • the method includes:
  • the first verification information is consistent with the second verification information, acquiring a device type of the terminal;
  • the device type belongs to a static terminal, performing the step of acquiring first location information of the terminal and second location information stored by the server; or
  • the device type belongs to the mobile terminal, performing the step of acquiring the current mobile behavior status information of the terminal.
  • the server can intelligently select a matching verification mode for the terminal currently accessing the authentication, thereby greatly improving flexibility.
  • the method further includes:
  • the first key is valid, performing the step of sending a first verification instruction to the terminal; or if the first key is invalid, generating an updated first key; sending the first to the terminal And a second verification instruction, where the second verification instruction is used to instruct the terminal to generate first verification information based on the updated first key, device identification information, and the first random number generated by the server.
  • the first key stored by the terminal and the server is periodically updated, and has high timeliness. Even if the criminal steals the first key from the terminal, the obtained first key is used for access authentication. Since the obtained first key fails, the access authentication fails, thereby greatly improving the security.
  • the first key between the terminal and the server does not need to be transmitted, and only the first random number and the second random number are transmitted, so that each time the terminal and the server update the first key, both sides are ensured.
  • the updated first key is consistent.
  • the criminal intercepts the information transmitted by the server to the terminal only the first random number and the second random number can be obtained, and the first random number and the second random number cannot perform the same authentication function as the first key.
  • the criminals use the first random number and the second random number for access authentication, which makes the access authentication fail, thereby avoiding the risk that the transmitted information is stolen and the authentication mechanism is broken, which greatly improves the security.
  • the terminal negotiates a new first key each time the terminal accesses, the processing load of the terminal is increased, and the power of the terminal is consumed.
  • the first key is designed to expire. The mechanism of time points and/or acquisition times, the new first key is renegotiated only when the first key fails. Since the authentication credential can be directly used when the first key is valid, the terminal can be prevented from frequently generating a new first key, thereby reducing the processing load of the terminal and saving the power consumed by the terminal.
  • the first verification instruction carries a first random number generated by the server and a valid identifier, where the valid identifier is used to identify that the first key stored by the terminal is valid.
  • the second verification instruction carries a first random number, a second random number, and a failure identifier generated by the server, and the second random number is used to generate the updated first password.
  • a key, the invalidation identifier is used to identify that the first key stored by the terminal is invalid.
  • the generating the updated first key comprises:
  • the method further includes:
  • the method further includes:
  • Receiving a configuration command setting an expiration time point of the first key or an acquisition number of the first key; or, if the number of failures of the access request of the terminal reaches a second time threshold, The expiration time point of the first key or the number of acquisitions of the first key is set;
  • the time difference between the set expiration time point and the current time point is not less than the first time difference threshold, and the set number of acquisitions is not less than the first time threshold.
  • the validity of the first key can be flexibly set: if the first key has been leaked or the first key is compromised, the server can make the expiration time and/or the number of acquisitions of the first key.
  • the setting is performed to achieve the effect that the first key stored in the terminal and the server is automatically invalidated, when the terminal performs access authentication, the terminal and the server need to renegotiate the updated first key when the first key has expired. , thereby greatly improving the security of access authentication.
  • the sending the first verification instruction to the terminal includes:
  • the first verification command is sent by means of short message, which improves the difficulty of the access authentication mechanism being broken, and improves the security compared to sending the verification instruction through the network address.
  • the method further includes:
  • the first random number is valid, performing the step of generating the second verification information by using the first key stored by the server, the device identification information, and the first random number generated by the server; or if The first random number is invalid, and the notification message is sent to the terminal, where the notification message is used to instruct the terminal to resend the access request.
  • the effect of the anti-replay attack can be achieved: even if the criminals steal the first random number, the identity of the terminal is fraudulently used by the first random number that is stolen.
  • the server sends the first verification information, and since the first random number is invalidated soon after being generated, or fails once received, when the server receives the first verification information of the criminal, the first random number has expired. Refused criminals to access the Internet of Things.
  • the method further includes:
  • the device identification information includes device fingerprint information, where the device fingerprint information is used to uniquely identify the terminal, and before the sending the first verification instruction to the terminal, the method further includes:
  • the device fingerprint information of the terminal is generated according to at least one of a device model, a device size, a device provider, and a device serial number.
  • the acquiring the first location information of the terminal includes:
  • the server obtains the current location of the terminal through the LBS node, and introduces the LBS node as a defense mechanism.
  • the attacker cannot intercept the information transmitted between the terminal and the server to obtain the location of the terminal, thereby preventing the attacker from tampering with the terminal.
  • the location information reported by the server causes the attack mechanism to be broken, which improves the difficulty for the attacker to break the access mechanism and improves the security.
  • an access authentication apparatus comprising a plurality of functional modules to implement the first aspect and the access authentication method of any of the possible aspects of the first aspect.
  • a server including a processor, a memory, and a communication interface, the memory storing at least one instruction loaded by the processor and executed to implement the first aspect described above An access authentication method in any of the possible aspects of the first aspect, the communication interface being for communicating with other devices.
  • a fourth aspect provides a computer readable storage medium having stored therein at least one instruction loaded by a processor and executed to implement the first aspect and any one of the possible aspects of the first aspect Access authentication method in .
  • a computer program product comprising at least one instruction loaded by a processor and executed to implement the first aspect and the connection of any of the possible aspects of the first aspect Enter the authentication method.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present disclosure
  • FIG. 2 is a schematic diagram of an implementation environment provided by an embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of an implementation environment provided by an embodiment of the present disclosure.
  • FIG. 4 is a schematic diagram of an implementation environment provided by an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a server according to an embodiment of the present disclosure.
  • FIG. 6 is a flowchart of an access authentication method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of an access authentication apparatus according to an embodiment of the present disclosure.
  • Terminal It can also be called an end-side device or an Internet of Things terminal. It can include devices belonging to users, devices placed on the user side by service providers, infrastructure devices, devices in public places, etc., such as manhole covers, fire hydrants, water meters, and electricity meters. , street lights, bicycles, cars, etc.
  • Device fingerprint information It is used to uniquely identify the corresponding terminal. It can hash at least one of the device model, device size, device vendor, and device serial number, and use the obtained hash value as the device fingerprint information.
  • LBS Location Based Service
  • GIS Geographical System
  • DTLS Datagram Transport Layer Security
  • TLS Transport Layer Security
  • UDP User Datagram Protocol
  • DTLS attempts to extend the existing TLS protocol architecture to support UDP, which is a version of TLS that supports datagram transmission.
  • DTLS 1.0 is based on TLS 1.1
  • DTLS 1.2 is based on TLS 1.2.
  • MFA Multiple factors authentication
  • the MFA authenticates the user by combining two or three separate credentials (as the user knows, what the user owns and what the user is). Multi-factor authentication is more secure than single-factor authentication (as the user knows).
  • PSK authentication method is efficient in authentication (compared with the asymmetric encryption-based authentication method), it is suitable for an access authentication scenario with limited end-end device resources, but the IoT scenario involving personal privacy is still not secure enough.
  • Replay attacks also known as replay attacks. Attackers send a packet that the destination host has received to achieve the purpose of spoofing the system. It is mainly used for the identity authentication process and destroys the correctness of the authentication. Replay attacks can be performed by enemies that intercept and resend data. The attacker uses network monitoring or other means to steal the authentication information generated by the authentication key, and then re-sends the authentication information to the server. Replay attacks can occur in various network communication processes, and are one of the common attack methods used by computer world hackers.
  • the terminal in the Internet of Things is limited by the cost of the device and the size of the device, resulting in limited hardware and software resources of the terminal. Therefore, it is difficult for the terminal to have strong security protection capabilities such as firewall, antivirus, hardware encryption, etc., and there is no condition to generate a sufficiently secure random number or key, and it is impossible to ensure the security of the key storage.
  • the manufacturers of the terminal focus on achieving more business functions and a good user experience on the terminal, so compromises will be made in security, making the resources of the vendors more secure.
  • the user security awareness of the terminal is weak, for example, the key of the terminal is not updated for a long time, and the default password is not modified.
  • the access security of the terminal cannot be guaranteed only by the capabilities of the end user, the device manufacturer, and the device itself.
  • the present invention devises a secure access method based on the Internet of Things device.
  • a pre-shared key (“I know")
  • SMS verification information ("I have it”
  • terminal fingerprint information (“Who am I””
  • other factors to jointly verify the legality of the device identity.
  • the first random number (randA) used for anti-replay and auxiliary authentication in the access authentication process is generated by a powerful computing server, and the server can transmit to the terminal through the short message channel after being generated;
  • pre-sharing The first key (authKey) generated by the key and the second random number (randB) has a certain validity period. After the expiration date expires, the updated first key may be renegotiated by using a short message.
  • the validity period of the first key may be manually set to be invalid.
  • the verification of the position information can be further introduced as an auxiliary means for access authentication.
  • verification of the mobile behavior status information may be further introduced as an auxiliary means for access authentication.
  • the location information of the terminal may not be transmitted to the server for authentication by the terminal, but may be directly obtained by the server according to the communication number of the terminal to the LBS node.
  • multi-factor authentication is introduced, and in addition to the PSK, an authentication factor such as short message verification, device fingerprint information, location information, and mobile behavior status information is introduced to help further verify the identity of the terminal to solve the authentication mechanism.
  • an authentication factor such as short message verification, device fingerprint information, location information, and mobile behavior status information is introduced to help further verify the identity of the terminal to solve the authentication mechanism.
  • Security alone depends on the PSK problem, which increases the difficulty of attackers spoofing end-device access.
  • the random number is not generated by the terminal, but is generated by a server with strong computing power, and then sent to the terminal through a short message to solve the risk that the random number is insecure due to limited terminal resources.
  • the present invention provides a mechanism for negotiating a new PSK online when the PSK is compromised or fails, without the need to terminate the service and recall the terminal or the near-end re-preset PSK.
  • the validity period of the first key in the present disclosure is configurable, and once the first key is discovered to be leaked or there is a risk of the first key leak, the first key may be immediately invalidated, and the next access is performed. The new first key needs to be renegotiated during authentication, thereby further enhancing the security of the access mechanism authentication.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present disclosure. As shown in FIG. 1, the implementation environment includes a terminal 101 and a server 102, and the terminal 101 and the server 102 can be connected through a network.
  • the terminal 101 may have a function of receiving and/or transmitting a short message, and is capable of receiving a first verification instruction and/or a second verification instruction sent by the server 102 in the form of a short message.
  • the terminal 101 can be configured with a short message unit, and the short message unit can be a physical entity unit or a logical virtual unit.
  • the short message unit is configured to receive and/or send a short message, and can physically identify the user identification (Subscriber Identification Module, SIM). ) card, or for other forms.
  • SIM Subscriber Identification Module
  • the terminal 101 may also have a function of positioning, and can send its own location to the LBS node.
  • the terminal 101 can configure a location location tracking unit, and the location location tracking unit can be a physical or logical unit, and the location location tracking unit is used to
  • the LBS node performs information interaction, and may be a physical physical unit or a logical virtual unit.
  • the physical form may be an integrated circuit with a Global Positioning System (GPS) function, or other forms.
  • GPS Global Positioning System
  • the server 102 may also be referred to as a platform-side server 102, an authentication server 102, and the like.
  • the server 102 performs access authentication on the terminal 101 to control the behavior of the terminal 101 accessing the Internet of Things. Improve security.
  • the server 102 may include an access authentication unit, a data storage unit, and a decryption unit.
  • the access authentication unit is configured to receive and process an access authentication request of the terminal 101, and obtain a ciphertext and device fingerprint information of the PSK from the data storage unit.
  • the ciphertext of the ciphertext and the second location information requesting the decryption unit to decrypt the ciphertext, transmitting the information to the terminal 101 through the short message service center, and acquiring the location information of the device from the LBS node.
  • the data storage unit is configured to store a PSK for authenticating the terminal 101, device fingerprint information and second location information, a ciphertext for providing a PSK to the access authentication unit, a ciphertext of the device fingerprint information, and a ciphertext of the second location information.
  • the decryption unit is configured to decrypt the ciphertext of the PSK, the ciphertext of the device fingerprint information, and the ciphertext of the device location information, and is also used to process the decryption request of the access authentication unit.
  • the server 102 may be provided as a server, and the access authentication unit, the data storage unit, and the decryption unit may be mapped to a unit inside the server, for example, a physical entity unit or a logical virtual unit, and a server.
  • 102 may also be provided as a distributed system composed of multiple servers, and the access authentication unit, the data storage unit, and the decryption unit may be mapped to different servers, for example, server A in the distributed system acts as an access authentication unit, and server B acts as a server.
  • the data storage unit, the server C acts as a decryption unit, and different servers perform the process of access authentication through information interaction.
  • the implementation environment may further include a short message service center, where the short message service center is used to forward the short message sent by the server 102 to the end device, and may be a server of an Internet Service Provider (ISP).
  • ISP Internet Service Provider
  • the server associated with the instant application communication program, such as the background server of the chat application, is not limited in this embodiment.
  • the implementation environment may further include an LBS node, where the LBS node is configured to acquire first location information of the terminal, and provide the server with first location information of the device.
  • the LBS node may be a server of the ISP or a server associated with the GPS satellite. This embodiment does not limit this.
  • FIG. 5 is a schematic structural diagram of a server according to an embodiment of the present disclosure.
  • the server 500 may have a large difference due to different configurations or performances, and may include one or more central processing units (CPUs) 501 and one. Or more than one memory 502 and communication interface 503.
  • CPUs central processing units
  • memory 502 or more than one memory 502 and communication interface 503.
  • the memory 502 stores at least one instruction, and the at least one instruction is loaded and executed by the processor 501 to implement the access authentication method provided by the embodiment of the present disclosure, and the communication interface 503 can communicate with other devices.
  • the server 500 may also have a wired or wireless network interface, an input and output interface, and the like for input and output.
  • the server 500 may also include other components for implementing the functions of the device, and details are not described herein.
  • a computer readable storage medium storing a computer program, such as a memory storing a computer program, the computer program being executed when executed to implement access authentication as shown in the following embodiments method.
  • the computer readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), or a Compact Disc Read-Only Memory (CD-ROM). Tapes, floppy disks, and optical data storage devices.
  • the first key in the claims is called authKey
  • the first random number is called randA
  • the second random number is called randB
  • the first verification information is called verification information V
  • the second verification information is called verification information.
  • V' the first location information
  • Dlocation the second location information
  • FIG. 6 is a flowchart of an access authentication method according to an embodiment of the present disclosure.
  • the interaction entity of the method includes a terminal and a server, and the method includes the following steps:
  • the terminal sends an access request to the server.
  • an access request may be generated, and an access request is sent to the server to trigger the process of access authentication.
  • the access request may carry the device identification information of the terminal, where the device identification information is used to identify the identity of the terminal, and may include an identity (ID) of the terminal.
  • the terminal may obtain an Internet Protocol (IP) address of the server, and send an access request to the server based on the IP address of the server.
  • IP Internet Protocol
  • the terminal may send a short message to the server, where the short message carries an access request.
  • the server receives the access request of the terminal, and obtains the authKey corresponding to the device identification information according to the device identification information carried in the access request.
  • the server can resolve the access request, obtain the device identification information carried in the access request, and obtain the authKey corresponding to the device identification information in the access request according to the correspondence between the device identification information and the authKey.
  • the correspondence between the device identification information and the authKey includes multiple device identification information and corresponding multiple authKeys, and the correspondence between the device identification information and the authKey may be pre-stored in the server.
  • the server checks the authKey.
  • the authKey can be periodically expired and updated periodically. After the server obtains the authKey, the authKey can be verified. If the authKey is valid by the verification, the following step 604 is performed. If the authKey is invalidated by the verification, the following step 1 is performed. , update authKey to improve security.
  • the process of verifying the authKey may include the following manners one to two:
  • Method 1 Combine the validity period of authKey to verify the authKey.
  • the specific method may include the following steps 1 to 3:
  • Step 1 The server obtains the time difference between the expiration time point of the authKey and the current time point.
  • the expiration point of authKey used to indicate when the authKey expires.
  • the expiration point of authKey can be represented by T.
  • the server can preset the expiration time point of the authKey, corresponding to the expiration time point of the authKey and the authKey, when the server obtains the authKey, the expiration time point of the preset authKey can be obtained at the same time.
  • the server can determine the time point for generating the authKey when generating the authKey, and obtain the preset duration.
  • the preset time length is added to the time point of generating the authKey, and the obtained time point is used as the expiration time point of the authKey.
  • the preset duration may be determined according to experience or business requirements, for example, may be 5 ms.
  • Design 2 The server can receive the configuration instruction and obtain the time point indicated by the configuration instruction as the expiration time point of the authKey.
  • the configuration command is used to configure the expiration time point of the authKey, which can be triggered by the user input operation.
  • Step 2 If the time difference is less than the first time difference threshold, determine that authKey is valid.
  • the server may determine whether the time difference is less than the first time difference threshold. If the time difference is less than the first time difference threshold, determine that the authKey is valid. If the time difference is not less than the first time difference threshold, determine that the authKey is invalid.
  • the first time difference threshold may be set according to experience or business requirements, for example, may be 0.
  • Manner 2 Verify the authKey by combining the number of times the authKey is acquired.
  • the server can count the number of times the authKey is obtained. If the number of times the authKey is obtained is less than the first threshold, the authKey is valid. If the number of times the authKey is obtained is not less than the first threshold, the authKey is invalid.
  • the first threshold may be set according to experience or business requirements, for example, may be 5.
  • the server may accumulate the number of times the authKey is acquired each time an access request is received, thereby counting the number of times the authKey is acquired. For example, when the authKey is generated, the server counts the number of acquisitions of the authKey as 1. When the authKey is obtained based on the device identification information, the number of times the authKey is acquired is incremented by one, so that the number of times the authKey is acquired is obtained through an iterative process.
  • the validity of the authKey can be flexibly set: if the authKey has been compromised or the authKey is at risk of leaking, the server can set the expiration point and/or the number of acquisitions of the authKey so that the authKey is automatically If the authKey has expired, the terminal and the server need to renegotiate the updated authKey.
  • the server may set the expiration time point of the authKey, for example, setting the expiration time point to a preset time point, and setting the expiration time point and current
  • the time difference between the time points is not less than the first time difference threshold. Therefore, after the expiration time point is set, the server receives the access request and acquires the authKey at any time, due to the expiration time point of the authKey and the current time point. If the time difference is not less than the first time difference threshold, the authKey will always be invalidated. That is, the server sets the expiration time point of the authKey to achieve the effect that the authKey stored by the terminal and the server are automatically invalidated.
  • the server may set the number of times the authKey is acquired, for example, the number of acquisitions is set to a preset number of times, and the number of acquisitions after the setting is not less than the threshold of the first number, so the acquisition is performed.
  • the authKey will always be invalidated because the number of times the authKey is acquired is not less than the first threshold. That is, the server sets the number of times the authKey is acquired, and the authKey stored in the terminal and the server are automatically invalidated.
  • the timing of setting the authKey can include the following design one and design two:
  • the server can receive the configuration command and respond to the configuration command to set the expiration time point and/or the number of acquisitions of the authKey.
  • the configuration command may be triggered by a user input operation, and the configuration command may be used to indicate that the authKey is disabled.
  • the user views the surveillance video, finds that the safe in the home is stolen, can immediately perform an input operation for the safe, triggers the configuration command of the server, and the server receives the configuration command to expire the authKey of the safe.
  • the point and/or the number of acquisitions are set, so that the authKey of the safe is automatically disabled, so that the stolen safe cannot access the Internet of Things.
  • the server may count the number of failures of the access request of the terminal in the process of access authentication, for example, when the terminal is denied access to the Internet of Things, the number of failures of the access request is increased by one. In the statistics process, it can be determined whether the number of failures of the access request of the terminal reaches the second threshold. If the number of failures reaches the second threshold, indicating that a violent guessing attack may occur, the server may expire the authKey. Set the number of points and/or acquisitions. Optionally, if the number of failures reaches the second threshold, the server may also perform an alarm according to a preset alarm manner, thereby notifying the user to know the situation in time.
  • the server sends a first verification instruction to the terminal.
  • the server may generate a first verification instruction, and send a first verification instruction to the terminal, where the first verification instruction is used to instruct the terminal to generate the verification information V based on the authKey stored by the terminal, the device identification information, and the randA generated by the server. In order for the server to verify the verification information V generated by the terminal.
  • the server can generate randA, randA is used for the server to generate the verification information V' for the terminal to generate the verification information V, and the randA can also be used for the authentication process to defend against the replay attack.
  • the server may carry the randA generated by the server in the first verification instruction when the first verification instruction is generated, so that the terminal generates the verification information V by randA in the first verification instruction.
  • the first verification instruction may carry a valid identifier of the authKey, and the valid identifier is used to identify that the authKey stored by the terminal is valid, for example, may be 1, Y, or the like.
  • the server may generate the valid identifier, and carry the valid identifier in the first verification instruction, so that the terminal learns that the stored authKey is valid by using the valid identifier in the first verification instruction, and can directly generate the verification information V by using the stored authKey, and temporarily There is no need to update the stored authKey.
  • the server may send a short message to the terminal, and the short message carries the first verification instruction.
  • the server can send a short message to the short message service center. After receiving the short message, the short message service center can forward the short message to the terminal, thereby implementing the function of receiving the short message of the server by the terminal.
  • the short message service center can be the server of the operator, or the server of the instant messaging application.
  • the server can also be equipped with a function of sending a short message, and the server can directly send a short message to the terminal.
  • the server may send the first verification instruction to the terminal by using the IP address of the terminal.
  • the terminal receives the first verification instruction, generates verification information V based on the stored authKey, the device identification information, and the randA generated by the server, and sends the verification information V to the server.
  • the terminal can receive the first verification instruction, parse the first verification instruction, and obtain the valid identifier carried in the first verification instruction, so as to know that the stored authKey is currently valid, and can directly generate the verification information V by using the stored authKey, so the terminal can The stored authKey, the device identification information, and the randA generated by the server are generated, and the verification information V is generated based on the authKey, the device identification information, and the randA.
  • the terminal may perform a calculation on the authKey, the device identification information, and the randA by using a hash algorithm, and use the calculated hash value as the verification information V.
  • the hash algorithm may be a Hash-based Message Authentication Code (HMAC), a Secure Hash Algorithm (SHA), or a Password-Based Key Derivation Function (PBKDF) algorithm. Advanced Encryption Standard (AES) algorithm.
  • HMAC Hash-based Message Authentication Code
  • SHA Secure Hash Algorithm
  • PBKDF Password-Based Key Derivation Function
  • AES Advanced Encryption Standard
  • the device identification information in this embodiment may include an ID of the terminal and device fingerprint information of the terminal, and the terminal may obtain the stored authKey, ID, device fingerprint information, and randA, according to the authKey, the ID, the device fingerprint information, and the randA.
  • Generate verification information V The device fingerprint information is represented as FI, and the HMAC algorithm is used to generate the verification information V.
  • the terminal can generate the verification information V by executing the following statement:
  • V HMAC(authKey, ID
  • the device fingerprint information the terminal may obtain at least one of a device model, a device size, a device provider, and a device serial number in advance, according to at least one of the device model, the device size, the device vendor, and the device serial number. One, generating device fingerprint information, and storing device fingerprint information.
  • the terminal may use a hash algorithm to calculate at least one of the device model, the device size, the device provider, and the device serial number, and use the calculated hash value as the device fingerprint information. .
  • the device model is represented as DType
  • the device size is represented as size
  • the device vendor is represented as vendor
  • the device serial number is represented as SN
  • the device fingerprint information is represented as FI
  • the hash algorithm for generating device fingerprint information is SHA256 as an example.
  • the terminal can pass Generate the device fingerprint information by executing the following statement:
  • FI SHA256(Dtype
  • the terminal in the manner of transmitting the verification information V, can transmit the verification information V to the server based on the IP address of the server.
  • the terminal may send a short message to the server, where the short message carries the verification information V.
  • the second point is that the terminal may also send the device identification information while transmitting the verification information V, so that the server determines, according to the received device identification information, the terminal from which the verification information V comes.
  • the terminal may also send randA while transmitting the verification information V, so that the server can authenticate the randA according to the received randA.
  • the terminal may send the verification information V to the server in the following format: (V
  • steps 604 to 605 illustrate the interaction process between the terminal and the server when the authKey is valid, and if the authKey is invalid, the above steps 604 to 605 can be replaced by the following steps 1 to 4:
  • Step 1 If the authKey fails, the server generates an updated authKey.
  • randA is used to generate the updated authKey to update the invalid authKey.
  • the server can obtain the pre-shared key PSK, and generate an updated authKey according to randB and PSK.
  • the server may use a hash algorithm to calculate randB and PSK, and use the calculated hash value as the updated authKey.
  • the server can generate an updated authKey by executing the following statement:
  • authKey HMAC-SHA256(PSK, randB)
  • the server can store the ciphertext of the PSK. If the authKey is to be generated, the ciphertext of the PSK is obtained, and the ciphertext of the PSK is decrypted to obtain the PSK, thereby improving the PSK. Storage security.
  • the server may include a data storage module for storing the ciphertext of the PSK, a decryption module for decrypting the ciphertext of the PSK, and the server may read the ciphertext of the PSK from the data storage module.
  • the second point that needs to be explained is that the server can set an expiration time point for the updated authKey when the updated authKey is generated, and correspondingly store the updated authKey and the expiration time point, so that the terminal initiates the access request next time.
  • the expired time point is verified, it is verified whether the updated authKey is valid.
  • Step 2 The server sends a second verification instruction to the terminal.
  • the server may generate a second verification instruction, and send a second verification instruction to the terminal, where the second verification instruction is used to instruct the terminal to generate the verification information V based on the updated authKey, the device identification information, and the randA generated by the server, so that The server verifies the verification information V generated by the terminal.
  • the server may carry the randA and randB generated by the server in the second verification instruction, so that the terminal generates the verification information V through the randA in the second verification instruction, and generates the update after the randB in the second verification instruction. authKey.
  • the server may further generate a failure identifier of the authKey, and carry the failure identifier in the second verification instruction, so that the terminal determines that the stored authKey has expired by using the failure identifier in the second verification instruction, and updates the stored authKey.
  • the invalidation identifier is used to identify that the authKey stored in the terminal is invalid, for example, may be 0, N, or the like.
  • the server sends the second verification command
  • sending the second verification command through the IP channel may be insecure, and the server may use the short message mode.
  • the second verification command is sent, that is, the server can send a short message to the terminal, and the short message carries the second verification instruction, thereby avoiding the risk caused by the authKey leakage.
  • the server periodically updates the authKey, if the server actively updates the authKey of the terminal, the second verification command can still be sent to the terminal through the IP address of the terminal.
  • Step 3 The terminal receives the second verification instruction, and generates an updated authKey.
  • the terminal may receive the second verification instruction, parse the second verification instruction, and obtain the failure identifier carried in the second verification instruction, so as to know that the stored authKey is currently invalid. Therefore, the terminal updates the stored authKey and generates an updated authKey to generate the verification information V using the updated authKey. In addition, the terminal can store the generated updated authKey for use in the next access authentication.
  • the terminal may acquire the randB of the second verification command, acquire the pre-stored PSK, and generate the updated authKey according to randB and PSK.
  • the terminal may use a hash algorithm to calculate randB and PSK, and use the calculated hash value as the updated authKey.
  • Hash-SHA256 the terminal can generate an updated authKey by executing the following statement:
  • authKey HMAC-SHA256(PSK, randB)
  • the manner in which the terminal generates the updated authKey may be the same as the manner in which the server generates the updated authKey in step 1 above. For example, if the same hash algorithm is used, the terminal and the server generate the updated authKey in the same manner.
  • the same parameter is randB, which ensures that the updated authKey is consistent between the terminal and the server, and implements access authentication through the authKey.
  • the terminal and the server use the fixed PSK for access authentication, and once the illegal molecule steals the PSK stored in the terminal, the access authentication mechanism is broken.
  • the authKey stored by the terminal and the server is periodically updated, and has high timeliness. Even if the illicit key steals the authKey from the terminal, the obtained authKey is used for access authentication, and the obtained authKey is invalid. Access authentication failed, which greatly improved security.
  • the updated authKey is not required to be transmitted between the terminal and the server, and only the randA and randB are transmitted, so that the authKey updated on both sides is consistent when the terminal and the server update the authKey.
  • the criminals can only get randA and randB, randA and randB can not achieve the same authentication function as authKey, and the criminals use randA and randB for access authentication, making access authentication. Failure, thereby avoiding the risk of the transmitted information being stolen and causing the authentication mechanism to be compromised, greatly improves security.
  • the terminal negotiates a new authKey each time the terminal accesses, the processing load of the terminal is increased, and the power of the terminal is consumed.
  • the expiration time is designed for the authKey.
  • the mechanism of points and/or acquisition times, the new authKey is renegotiated only when the authKey fails. Since the authentication credential can be directly used when the authKey is valid, the terminal can be prevented from frequently generating a new authKey, thereby reducing the processing load of the terminal and saving the power consumed by the terminal.
  • the first verification instruction may not need to carry a valid identifier
  • the second verification instruction may not need to carry the invalid identifier
  • the first verification instruction and the second verification instruction may pass other
  • the mode indicates whether the authKey stored by the terminal is valid, and only needs to ensure that the first verification instruction and the second verification instruction are different.
  • the verification instruction carrying a random number is a first verification instruction indicating that the authKey is valid
  • the verification instruction carrying the two random numbers is a second verification instruction indicating that the authKey is invalid
  • the terminal can pass the number of random numbers. Differentiate the verification instructions of different functions to respond separately.
  • Step 4 The terminal generates verification information V based on the updated authKey, the device identification information, and the randA generated by the server, and sends the verification information V to the server.
  • This step is the same as the process of generating the verification information V and the verification information V in the above step 605, and details are not described herein.
  • the server receives the verification information of the terminal, and verifies the validity of the randA.
  • the server can directly verify the received randA.
  • the server may obtain the randA generated in step 604 or step 1 above, for example, when generating randA, storing randA and device identification information.
  • the randA corresponding to the device identification information, so as to verify the randA.
  • the method for verifying the validity of randA may include the following methods 1 and 2:
  • Method 1 Combine the validity period of randA to verify randA.
  • the process is the same as the method in the above step 603, that is, the server can obtain the time difference between the expiration time point of the randA and the current time point, and if the time difference is less than the second time difference threshold, it is determined that randA is valid.
  • the second time difference threshold is used to indicate the maximum time that randA is valid, and may be set according to experience or business requirements. For example, the second time difference may be 5 ms.
  • This process is the same as the second method in the above step 603, that is, the server can count the number of receptions of randA, and if the number of receptions of randA is less than the threshold of the third number, it is determined that randA is valid.
  • the third number of thresholds is used to indicate the maximum number of times randA is valid.
  • randA If randA is valid, the server generates verification information V' based on the authKey stored by the server, the device identification information, and the randA generated by the server.
  • the manner in which the server generates the verification information V' may be the same as the manner in which the terminal generates the verification information V in the above step 605. For example, if the same hash algorithm is used, the parameters used by the terminal and the server are the same, and the parameters used are authKey.
  • the device identification information and randA can ensure that the verification information V and the verification information V' are consistent.
  • the device identification information used by the server may include the ID of the terminal and the device fingerprint information of the terminal.
  • the server may pre-store the correspondence between the device ID and the device fingerprint information. Relationship, you can get the corresponding device fingerprint information according to the device ID.
  • the server may store the ciphertext of the device fingerprint information, decrypt the ciphertext of the device fingerprint information, and obtain the device fingerprint information.
  • step 607 is described by taking randA as an example. If the randA fails, the server may generate a notification message and send a notification message to the terminal, where the notification message is used to instruct the terminal to resend the access request. Then the terminal returns to step 601 to re-execute the process of sending an access request.
  • the effect of the anti-replay attack can be achieved: even if the illicit agent steals the randA, the randA is sneaked, and the verification information V is sent to the server by the identity of the terminal. Since randA will fail soon after it is generated, or it will fail once it is received, if the server receives the verification information V of the criminal, it will refuse the illegal entity to access the Internet of Things because randA has expired.
  • the server acquires the Dlocation' of the terminal and the Dlocation stored by the server, the Dlocation' is used to indicate the current location of the terminal, and the Dlocation is used to indicate the installation location of the terminal.
  • the server may compare the verification information V sent by the terminal with the verification information V′ generated by the terminal. If the verification information V is consistent with the verification information V′, the server may acquire the Dlocation and the Dlocation′ of the terminal, thereby further combining the location of the terminal. check.
  • the server can record the installation location of the terminal as the Dlocation, and store the correspondence between the Dlocation of the terminal and the device identification information. After the server receives the verification information V of the terminal, the server can The device identification information of the terminal is used to query the correspondence between the Dlocation and the device identification information to obtain the Dlocation of the pre-recorded terminal.
  • the server may encrypt the Dlocation of the terminal and store the ciphertext of the Dlocation. If the location information of the terminal is to be verified, the server may decrypt the ciphertext of the Dlocation to obtain Dlocation.
  • the server may include a data storage module and a decryption module.
  • the data storage module stores a correspondence between the device identification information of the terminal and the ciphertext of the Dlocation, and the server may read the Dlocation corresponding to the device identification information from the data storage module.
  • the ciphertext sends a decryption request to the decryption module, and the decryption module decrypts the ciphertext of the Dlocation to obtain Dlocation.
  • the server may send a location information request to the LBS node, where the location information request is used to request location information of the terminal, and the LBS node receives the location information request of the server, and the location information request is obtained in response to the location information request.
  • the current location of the terminal is Dlocation', and Dlocation' is sent to the server, and the server can receive the Dlocation' sent by the LBS node, thereby obtaining the Dlocation' of the terminal.
  • the LBS node may extract the current location of the terminal from the terminal, thereby obtaining Dlocation', or the terminal may also actively send the current location to the LBS node, the LBS node. Receive the current location of the terminal, and get Dlocation'.
  • the server obtains the current location of the terminal through the LBS node, and introduces the LBS node as a defense mechanism.
  • the attacker cannot intercept the information transmitted between the terminal and the server to obtain the location of the terminal, which can prevent the attacker from tampering with the location reported by the terminal to the server.
  • the information causes the attack mechanism to be broken, which increases the difficulty for the attacker to break the access mechanism and improves the security.
  • the server may also perform information interaction with the terminal to obtain the current location of the terminal.
  • the location for example, the server may send a location information request to the terminal, the terminal receives the location information request, and sends the current location to the server, and the server may receive the location sent by the terminal as Dlocation'.
  • the terminal can actively send the current location to the server, and the server can obtain the location of the terminal's latest transmission as Dlocation'.
  • the terminal may send the current location to the server in real time, or periodically send the current location to the server, or send the current location to the server when the current location of the terminal meets a certain condition. The embodiment does not limit this.
  • the server allows the terminal to access the Internet of Things.
  • the server When the server obtains Dlocation and Dlocation', it can determine whether Dlocation and Dlocation' meet the first preset condition. If Dlocation' and Dlocation meet the first preset condition, the terminal is allowed to access the Internet of Things, and if Dlocation' and Dlocation do not meet the requirements. A preset condition denies the terminal from accessing the Internet of Things.
  • the process of the server verifying Dlocation and Dlocation' may include the following manners 1 and 2:
  • the server can determine whether Dlocation' is consistent with Dlocation. If Dlocation' is consistent with Dlocation, the terminal is allowed to access the Internet of Things. If Dlocation' is inconsistent with Dlocation, the terminal is denied access to the Internet of Things.
  • the server may also be inconsistent with the Dlocation in the Dlocation and perform the alarm according to the preset alarm mode, so that the user can know in time that the current location of the terminal has migrated.
  • the server will find that the Dlocation of the manhole cover is inconsistent with Dlocation and will refuse.
  • the manhole cover is connected to the Internet of Things, and an alarm is also issued so that the user can know the situation in which the manhole cover is stolen.
  • the server can obtain the distance between Dlocation' and Dlocation, and can determine whether the distance between Dlocation' and Dlocation is less than a preset distance. If the distance between Dlocation' and Dlocation is less than a preset distance, the terminal is allowed to access the Internet of Things. The distance between Dlocation' and Dlocation is not less than the preset distance, and the terminal is denied access to the Internet of Things.
  • the preset distance can be determined according to experience or business needs, for example, 60m.
  • the server may also perform an alarm according to a preset alarm mode in which the Dlocation' and the Dlocation are not less than a preset distance, so that the user can know in time that the location of the terminal is greatly changed.
  • the terminal when a user's home is installed, the water meter is installed in the living room. If the user relocates the water meter from the living room to the kitchen, the current location of the water meter and the installation of the water meter. The distance between the locations is small, so the server still allows the water meter to access the Internet of Things. When the thief steals the water meter from the user's home, the distance between the current location of the water meter and the installation location of the water meter is large, so the server will refuse the water meter to access the Internet of Things, and an alarm will be issued so that the user can know in time. The situation in which the water meter was stolen.
  • step 608 to step 609 the access authentication is performed on the terminal in combination with the current location and the installation location of the terminal.
  • the foregoing step 608 to the step are performed. 609 can also be replaced by the following steps (1) to (2):
  • the server acquires the current mobile behavior status information of the terminal.
  • the mobile behavior state information is used to indicate the current mobile state of the terminal, and can be used to identify the behavior of the terminal, and can include at least one of a mobile trajectory of the terminal, a moving speed of the terminal, and a moving range of the terminal.
  • the server may send a mobile behavior status information request to the LBS node, where the mobile behavior status information request is used to request the mobile behavior status information of the terminal, and the LBS node receives the mobile behavior of the server.
  • the status information request in response to the mobile behavior status information request, obtains the current mobile behavior status information of the terminal, and sends the status information to the server, and the server may receive the mobile behavior status information, thereby obtaining the mobile behavior status information of the terminal.
  • the server can directly obtain information about the mobile behavior status of the terminal by performing information interaction with the terminal.
  • the LBS node can determine the location of the terminal in the latest period of time, obtain multiple locations, and record multiple locations according to the recording time.
  • the order of the connections is sequentially connected to obtain a moving track.
  • the most recent period of time may refer to a time period in which the current time point is the time end point and the duration is a preset time period.
  • the LBS node can acquire the GPS data of the terminal, parse the GPS data, and obtain the moving speed of the terminal.
  • the LBS node can determine the location of the terminal in the most recent period of time, obtain a plurality of locations, and obtain a union of the multiple locations, and the range of the boundary line of the union is taken as The range of movement of the terminal.
  • the server allows the terminal to access the Internet of Things.
  • the server When the server obtains the mobile behavior status information of the terminal, it can determine whether the mobile behavior status information of the terminal meets the second preset condition, and if the mobile behavior status information of the terminal meets the second preset condition, the terminal is allowed to access the Internet of Things, and if the terminal The mobile behavior status information does not meet the second preset condition, and the terminal is denied access to the Internet of Things.
  • the process of verifying the mobile behavior status information of the terminal by the server may include the following manners 1 and 2:
  • Manner 1 If the deviation between the mobile behavior state information and the preset mobile behavior state information of the terminal is less than a preset deviation threshold, the server allows the terminal to access the Internet of Things.
  • the preset mobile behavior state information is used to indicate the mobile state when the terminal is in normal operation, and can be determined by the mobile state during the terminal historical operation, and can be regarded as the mobile state of the terminal habit.
  • the preset movement information may include at least one of a preset movement trajectory of the terminal, a preset movement speed of the terminal, and a preset movement range of the terminal.
  • the server may pre-generate the preset mobile behavior state information of the terminal, and store the correspondence between the device identification information of the terminal and the preset mobile behavior state information, in the process of accessing the authentication. According to the device identification information of the terminal, the corresponding relationship between the device identification information of the terminal and the preset mobile behavior state information is obtained, and the preset mobile behavior state information is obtained, thereby performing access authentication.
  • the server may record the daily trajectory of the terminal in the historical time period in advance, according to the terminal in the historical time period. Moving the trajectory, obtaining a plurality of moving trajectories, and counting the plurality of moving trajectories to obtain the preset moving trajectory. For example, the server may obtain an average of the plurality of moving trajectories and use the average value as the moving trajectory.
  • the server may obtain a weighted average of the plurality of moving tracks, and use the weighted average as a preset moving track, wherein the weight of each moving track may be determined according to a corresponding recording time, for example, the new recording time of the moving track is Then the weight of the moving track is larger.
  • the manner of obtaining the preset moving speed and the preset moving range is the same as the manner of obtaining the preset moving track, and details are not described herein.
  • the server may obtain a deviation between the mobile behavior state information and the preset movement behavior state information, and determine whether the deviation is less than a preset.
  • the deviation threshold if the deviation is less than the preset deviation threshold, allows the terminal to access the Internet of Things, and if the deviation is not less than the preset deviation threshold, the terminal is denied access to the Internet of Things.
  • the server can obtain the deviation between the movement trajectory of the terminal and the preset movement trajectory, for example, selecting a plurality of time points, respectively acquiring the movement trajectory and the preset movement trajectory in the same
  • the position of the time point obtains a plurality of pairs of positions, calculates the distance between different positions of each pair of positions, obtains a plurality of distances, and averages the plurality of distances, and uses the average value as the movement track and the preset movement track. deviation.
  • the position of the movement trajectory at 6:00 and the position of the preset movement trajectory at 6:00 can be acquired, the distance 1 between the two positions is calculated, the position of the movement trajectory is obtained at 7:00, and the preset movement is obtained.
  • the trajectory is at the position of 7:00, the distance 2 between the two positions is calculated, and so on, and finally all the distances obtained are averaged to obtain a deviation.
  • the server can obtain the deviation between the moving speed of the terminal and the preset moving speed, for example, selecting multiple time points, and acquiring the moving speed and the preset moving speed at the same time.
  • the deviation between the points, so as to obtain different deviations corresponding to different time points, the average value of the plurality of deviations is taken as the deviation between the moving speed and the preset moving speed.
  • the moving speed of 6:00 and the preset moving speed can be obtained, the deviation 1 between the two speeds is calculated, and the moving speed of 7:00 is acquired with the preset moving speed, and the calculation between the two speeds is performed. Deviation 2, and finally the average of all the deviations obtained is taken as the final deviation.
  • the server can obtain the deviation between the movement range of the terminal and the preset movement range, for example, the area where the movement range of the terminal exceeds the preset movement range, and the area is taken as deviation.
  • the terminal as the bicycle and the mobile behavior state information as the moving trajectory as an example
  • a user usually rides to and from work, and the preset movement track of the bicycle is from home to the unit, and when the thief steals the bicycle After the trip, the current movement track of the bicycle will deviate greatly from the preset movement track, and the server will refuse the bicycle to access the Internet of Things, and an alarm will be issued so that the user can know the situation that the bicycle is stolen.
  • the server inputs the mobile behavior status information into the classification model, and outputs the category of the mobile behavior status information. If the category is the preset category, the server allows the terminal to access the Internet of Things.
  • Classification model used to classify according to the mobile behavior state information. After inputting the mobile behavior state information to the classification model, the classification model can output the category of the mobile behavior state information.
  • the preset state may be used to indicate that the moving state of the corresponding terminal is normal.
  • the server inputs the mobile behavior state information to the classification model, if the category output by the classification model is a preset category, it may be determined that the mobile state of the terminal is normal, so the server may Allow the terminal to access the Internet of Things. If the category output by the classification model is not the preset category, it can be determined that the mobile state of the terminal is abnormal, so the server will reject the terminal access to the Internet of Things.
  • a large number of sample movement behavior state information of the terminal may be collected in advance, and each sample movement behavior state information is tagged, that is, the category to which the sample movement behavior state information belongs is marked, wherein if the sample movement behavior state information corresponds to If the moving state is normal, the category to which the sample moving behavior state information belongs is a preset category. If the moving state corresponding to the sample moving behavior state information is abnormal, the category to which the sample moving behavior state information belongs is another category. After that, the machine learning method is used to train a large number of sampled mobile behavior state information, and a classification model is obtained.
  • the classification model can learn the habit of the mobile state of the terminal through a large number of sample movement behavior state information, and thus can be based on the current terminal.
  • the mobile behavior status information accurately predicts the category of the mobile behavior status information, thereby determining whether the current mobile state of the terminal is normal.
  • step 608 to step 609 and step (1) to step (2) can be provided as processing logics of different servers.
  • the server managing the static terminal performs the above steps 608 to 609 when performing the access authentication method provided by the present disclosure.
  • the server managing the mobile terminal performs the access provided by the present disclosure.
  • steps (1) to (2) are performed.
  • the static terminal refers to a terminal with a relatively fixed position, such as a manhole cover, a fire hydrant, a water meter, an electric meter, a street lamp, a television, an air conditioner, a cash machine, a surveillance camera, a printer, etc., and the position generally does not change when the static terminal is in normal operation. Or the degree of change is small.
  • a mobile terminal refers to a terminal that moves frequently, and may be, for example, a bicycle, a car, an in-vehicle terminal, a wearable device, or the like.
  • step 608 to step 609 and step (1) to step (2) can be integrated into one set of processing logic, which is executed by the same server, and the server can For the terminal that is currently accessing the authentication, intelligently selects the matching check mode from the two modes, thereby greatly improving the flexibility.
  • the server may acquire the device type of the terminal. If the device type of the terminal belongs to the static terminal, the server may perform step 608 to step 609. And if the device type of the terminal belongs to the mobile terminal, the server may perform the above steps (1) to (2).
  • the method for obtaining the device type may be: the server may query the correspondence between the device identification information and the device type according to the device identification information of the terminal, and obtain the device type of the terminal.
  • the server may record the device type of the terminal, and establish and store the correspondence between the device type and the device identification information of the terminal, so that the server can query the corresponding relationship when accessing the authentication. .
  • the server may not need to store the correspondence between the device type and the device identification information of the terminal, but the terminal actively sends its own device type.
  • the terminal and the server may pre-agreed, and the device type is used as one of the access requests.
  • the terminal when the terminal sends an access request, the terminal carries its own device type in the access request, so that the server can obtain the device type of the terminal when the server resolves the access request.
  • the server determines that the device type of the manhole cover belongs to the static terminal, and then performs verification through steps 608 to 609. If the bicycle performs access authentication, the server determines that the device type of the bicycle belongs to the mobile. The terminal is verified by steps (1) to (2).
  • the server can return the result of the authentication to the terminal. For example, if the server allows the terminal to access the Internet of Things, an access success message may be sent to the terminal. If the server refuses to access the Internet of Things, the terminal may send an access failure message to the terminal.
  • the method provided in this embodiment provides a multi-factor authentication mechanism, and combines the stored first key, the first random number generated by the server, and the current location of the terminal to authenticate the identity of the terminal. Even if a certain authentication factor is leaked, it is impossible to use the identity of the terminal to access the Internet of Things, which greatly improves the difficulty of breaking the access authentication mechanism and improves security. Further, the random number used in the authentication process is generated by the server, and the server has more powerful computing power than the terminal, and can ensure that a high-security random number is generated, and the verification information generated by the high-security random number is used for calibration. The test improves the predictability of the verification information, thus improving security.
  • FIG. 7 is a schematic structural diagram of an access authentication apparatus according to an embodiment of the present disclosure.
  • the apparatus is applied to a server, where the apparatus includes: a receiving module 701, a sending module 702, a generating module 703, an obtaining module 704, and an enabling module 705.
  • the receiving module 701 is configured to receive an access request of the terminal.
  • the sending module 702 is configured to send a first verification instruction to the terminal
  • the receiving module 701 is further configured to receive first verification information of the terminal
  • a generating module 703, configured to generate second verification information
  • the obtaining module 704 is configured to acquire first location information of the terminal and second location information stored by the server;
  • the module 705 is allowed to allow the terminal to access the Internet of Things.
  • the module 705 is allowed to perform the above step 609.
  • the obtaining module 704 is further configured to obtain current mobile behavior status information of the terminal.
  • the obtaining module 704 is further configured to acquire a device type of the terminal;
  • the obtaining module 704 is further configured to acquire the first key
  • the sending module 702 is further configured to perform step 1 to step 2 in step 604 or step 605.
  • the generating module 703 is configured to generate the updated first key.
  • the device further includes: a first key verification module, configured to perform step 603.
  • the receiving module 701 is further configured to receive a configuration instruction
  • the device further includes: a setting module, configured to set an expiration time point of the first key or a number of acquisitions of the first key;
  • the sending module 702 is configured to send a short message to the terminal.
  • the receiving module 701 is further configured to receive a first random number of the terminal;
  • the generating module 703 is further configured to generate second verification information if the first random number is valid;
  • the sending module 702 is further configured to send a notification message to the terminal if the first random number fails.
  • the apparatus further includes: a random number verification module, configured to perform step 606.
  • the generating module 703 is further configured to generate device fingerprint information of the terminal.
  • the acquisition module 704 includes:
  • a sending submodule configured to send a location information request to the location service LBS node
  • the receiving submodule is configured to receive first location information sent by the LBS node.
  • the embodiment of the present disclosure further provides a computer program product, where the computer program product includes one or more instructions, and when the instruction is loaded and executed on a server, the access authentication method described in the embodiment of the present disclosure may be implemented.
  • the server can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the instructions may be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the instructions may be wired or wirelessly from a website site, computer, server or data center. Ways to transfer to another website site, computer, server, or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (DVD), or a semiconductor medium (such as a solid state hard disk) or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提供了一种接入认证方法、装置及服务器，属于物联网技术领域。所述方法包括：接收终端的接入请求；向所述终端发送第一验证指令；接收所述终端的第一验证信息；基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息；如果所述第一验证信息与所述第二验证信息一致，获取所述终端的第一位置信息以及所述服务器存储的第二位置信息；如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网。本公开提高了物联网中接入认证的安全性。

Description

接入认证方法、装置及服务器
本申请要求于2018年3月31日提交中国国家知识产权局、申请号为201810278142.2、发明名称为“接入认证方法、装置及服务器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及物联网技术领域，特别涉及一种接入认证方法、装置及服务器。
背景技术
物联网(Internet of things，IoT)即为物物相连的互联网，能够实现物品与物品、人与物品之间的互连，终端可以通过接入物联网与服务器进行信息交互。为了保证安全性，当终端发起接入请求时，服务器需要对终端进行认证，当认证通过时才允许终端接入物联网。
目前，终端和服务器会预先存储共同的预共享密钥(Pre-shared key，PSK)，当终端需要接入物联网时，会根据PSK和自身的设备标识，生成第一验证信息，向服务器发送接入请求，该接入请求携带该第一验证信息和终端的设备标识，服务器会根据PSK和终端的设备标识，生成第二验证信息，对第二验证信息与第一验证信息进行比对，如果第二验证信息与第一验证信息一致，服务器会允许终端接入物联网，如果第二验证信息与第一验证信息不一致，服务器会拒绝终端接入物联网。
在实现本公开的过程中，发明人发现相关技术至少存在以下问题：
一旦终端存储的PSK泄露，不法分子冒用PSK即可接入物联网，导致接入认证机制被攻破，安全性很差。
发明内容
本公开实施例提供了一种接入认证方法、装置及服务器，能够解决相关技术中接入认证的安全性较差的技术问题。所述技术方案如下：
第一方面，提供了一种接入认证方法，所述方法包括：
接收终端的接入请求；
向所述终端发送第一验证指令，所述第一验证指令用于指示所述终端基于所述终端存储的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息；
接收所述终端的第一验证信息；
基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息；
如果所述第一验证信息与所述第二验证信息一致，获取所述终端的第一位置信息以及所述服务器存储的第二位置信息，所述第一位置信息用于指示所述终端当前所处的位置，所述第二位置信息用于指示所述终端的安装位置；
如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网。
本实施例提供的方法，提供了多因子认证的机制，结合存储的第一密钥、服务器生成的第一随机数以及终端当前所处的位置等多个认证因子，共同对终端的身份进行认证，即使某一认证因子泄露，也无法冒用终端的身份接入物联网，极大的提高了攻破接入认证机制的难度，提高了安全性。
进一步地，认证过程采用的随机数由服务器负责生成，与终端相比，服务器具有更强大的计算能力，能够确保生成安全性高的随机数，通过安全性高的随机数生成的验证信息进行校验，提高了验证信息的难预测性，因此提高了安全性。
在一种可能的设计中，所述如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网，包括：
如果所述第一位置信息与所述第二位置信息一致，允许所述终端接入物联网；或，
如果所述第一位置信息与所述第二位置信息之间的距离小于预设距离，允许所述终端接入物联网。
结合本设计，对于各种位置相对固定的终端来说，通过结合终端的位置进行校验，能够极大地提高安全性。
在一种可能的设计中，所述基于所述服务器存储的第一密钥、所述服务器存储的设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息之后，所述方法还包括：
如果所述第一验证信息与所述第二验证信息一致，获取所述终端当前的移动行为状态信息；
如果所述移动行为状态信息符合第二预设条件，允许所述终端接入物联网。
结合本设计，对于各种移动终端来说，通过结合终端的移动行为状态进行校验，能够极大地提高安全性。
在一种可能的设计中，所述如果所述移动行为状态信息符合第二预设条件时，允许所述终端接入物联网，包括：
如果所述移动行为状态信息与所述终端的预设移动行为状态信息之间的偏差小于预设偏差阈值，允许所述终端接入物联网，所述预设移动行为状态信息用于指示所述终端正常运行时的移动状态；或，
将所述移动行为状态信息输入到分类模型，输出所述移动行为状态信息的类别，所述分类模型用于根据移动行为状态信息进行分类；如果所述类别为预设类别，允许所述终端接入物联网。
在一种可能的设计中，所述移动行为状态信息包括所述终端的移动轨迹、所述终端的移动速度、所述终端的移动范围中的至少一项。
在一种可能的设计中，所述基于所述服务器存储的第一密钥、所述服务器存储的设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息之后，包括：
如果所述第一验证信息与所述第二验证信息一致，获取所述终端的设备类型；
如果所述设备类型属于静态终端，执行所述获取所述终端的第一位置信息以及所述服务器存储的第二位置信息的步骤；或，
如果所述设备类型属于移动终端，执行所述获取所述终端当前的移动行为状态信息的步骤。
结合本设计，服务器可以针对当前接入认证的终端，智能地选择匹配的校验方式，从而极大地提高了灵活性。
在一种可能的设计中，所述方法还包括：
根据所述接入请求携带的所述设备标识信息，获取所述设备标识信息对应的第一密钥；
如果所述第一密钥有效，执行所述向所述终端发送第一验证指令的步骤；或，如果所述第一密钥失效，生成更新后的第一密钥；向所述终端发送第二验证指令，所述第二验证指令用于指示所述终端基于所述更新后的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息。
结合本设计，终端和服务器存储的第一密钥是定期更新的，具有高时效性，即使不法分子从终端中窃取了第一密钥，采用得到的第一密钥进行接入认证，也会由于得到的第一密钥失效，使得接入认证失败，从而极大地提高了安全性。
进一步地，终端与服务器之间无需传输更新后的第一密钥，只需传输第一随机数和第二随机数，即可保证每当终端与服务器对第一密钥进行更新时，两侧更新的第一密钥一致。那么，即使不法分子截获了服务器向终端传输的信息，也只能得到第一随机数和第二随机数，第一随机数和第二随机数无法起到和第一密钥相同的认证功能，不法分子采用第一随机数和第二随机数进行接入认证，使得接入认证失败，从而避免传输的信息被窃取而导致认证机制被攻破的风险，极大地提高了安全性。
进一步地，考虑到如果终端每次接入时，都要协商新的第一密钥，会增加终端的处理负荷，消耗终端的电量，而本实施例中，通过为第一密钥设计到期时间点和/或获取次数的机制，只有在第一密钥失效的时候才重新协商新的第一密钥。由于在第一密钥有效的情况下可以直接使用认证凭据，避免终端频繁生成新的第一密钥的情况，因此减轻了终端的处理负荷，节约了终端消耗的电量。
在一种可能的设计中，所述第一验证指令携带所述服务器生成的第一随机数以及有效标识，所述有效标识用于标识所述终端存储的第一密钥有效。
在一种可能的设计中，所述第二验证指令携带所述服务器生成的第一随机数、第二随机数以及失效标识，所述第二随机数用于生成所述更新后的第一密钥，所述失效标识用于标识所述终端存储的第一密钥失效。
在一种可能的设计中，所述生成更新后的第一密钥，包括：
根据所述第二随机数以及预共享密钥PSK，生成所述更新后的第一密钥。
在一种可能的设计中，所述获取所述设备标识对应的第一密钥之后，所述方法还包括：
获取所述第一密钥的到期时间点与当前时间点之间的时间差；如果所述时间差小于第一时间差阈值，确定所述第一密钥有效；或，
统计所述第一密钥的获取次数；如果所述第一密钥的获取次数小于第一次数阈值，确定所述第一密钥有效。
在一种可能的设计中，所述方法还包括：
接收配置指令；对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；或，如果所述终端的接入请求的失败次数达到第二次数阈值，对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；
其中，置位后的到期时间点与当前时间点之间的时间差不小于所述第一时间差阈值，置位后的获取次数不小于所述第一次数阈值。
结合本设计，第一密钥的有效性可以进行灵活设置：如果第一密钥已泄露或者第一密钥存在泄露的风险，服务器可以对第一密钥的到期时间点和/或获取次数进行置位，达到终端以及服务器存储的第一密钥均自动失效的效果，则终端之后进行接入认证时，由于第一密钥已失效，终端和服务器需要重新协商更新后的第一密钥，从而极大地提高接入认证的安全性。
在一种可能的设计中，所述向所述终端发送第一验证指令，包括：
向所述终端发送短信，所述短信携带所述第一验证指令。
结合本设计，通过短信的方式发送第一验证指令，提高了接入认证机制被攻破的难度，相对于通过网络地址发送验证指令来说，能够提高安全性。
在一种可能的设计中，所述向所述终端发送第一验证指令之后，所述方法还包括：
接收所述终端的第一随机数；
如果所述第一随机数有效，执行所述基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息的步骤；或，如果所述第一随机数失效，向所述终端发送通知消息，所述通知消息用于指示所述终端重新发送接入请求。
结合本设计，通过对第一随机数的有效性进行验证，可以达到防重放攻击的效果：即使不法分子窃听到了第一随机数，通过窃听到的第一随机数，冒用终端的身份向服务器发送第一验证信息，而由于第一随机数生成后很快就会失效，或接收到一次就失效，则服务器接收到不法分子的第一验证信息时，会由于第一随机数已经失效，拒绝不法分子接入物联网。
在一种可能的设计中，所述向所述终端发送第一验证指令之后，所述方法还包括：
获取所述第一随机数的到期时间点与当前时间点之间的时间差；如果所述时间差小于第二时间差阈值，确定所述第一随机数有效；或，
统计所述第一随机数的接收次数；如果所述第一随机数的接收次数小于第三次数阈值，确定所述第一随机数有效。
在一种可能的设计中，所述设备标识信息包括设备指纹信息，所述设备指纹信息用于唯一标识所述终端，所述向所述终端发送第一验证指令之前，所述方法还包括：
根据设备型号、设备尺寸、设备供应商、设备序列号中的至少一项，生成所述终端的设备指纹信息。
结合本设计，通过结合唯一标识终端的设备指纹信息进行校验，能够极大地提高安全性。
在一种可能的设计中，所述获取所述终端的第一位置信息，包括：
向位置服务LBS节点发送位置信息请求，所述位置信息请求用于请求所述终端当前所处的位置；
接收所述LBS节点发送的所述终端的第一位置信息。
结合本设计，服务器通过LBS节点获取终端当前所处的位置，引入LBS节点作为抵御的机制，攻击者无法通过截获终端与服务器之间传输的信息，得到终端的位置，能够避免攻击者篡改终端向服务器上报的位置信息而导致攻破接入机制的情况，提高了攻击者攻破接入机制的难度，提高了安全性。
第二方面，提供了一种接入认证装置，所述装置包括多个功能模块，以实现上述第一方 面以及第一方面的任一种可能设计中的接入认证方法。
第三方面，提供了一种服务器，所述服务器包括处理器、存储器和通信接口，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现上述第一方面以及第一方面的任一种可能设计中的接入认证方法，所述通信接口用于与其他设备进行通信。
第四方面，提供了一种计算机可读存储介质，所述存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现上述第一方面以及第一方面的任一种可能设计中的接入认证方法。
第五方面，提供了一种计算机程序产品，所述计算机程序产品包括至少一条指令，所述指令由处理器加载并执行以实现上述第一方面以及第一方面的任一种可能设计中的接入认证方法。
附图说明
图1是本公开实施例提供的一种实施环境的示意图；
图2是本公开实施例提供的一种实施环境的示意图；
图3是本公开实施例提供的一种实施环境的示意图；
图4是本公开实施例提供的一种实施环境的示意图；
图5是本公开实施例提供的一种服务器的结构示意图；
图6是本公开实施例提供的一种接入认证方法的流程图；
图7是本公开实施例提供的一种接入认证装置的结构示意图。
具体实施方式
为使本公开的目的、技术方案和优点更加清楚，下面将结合附图对本公开实施方式作进一步地详细描述。
下面对本公开实施例涉及的一些技术术语进行解释：
终端：也可称为端侧设备或物联网终端，可以包括属于用户的设备、服务提供商放置在用户侧的设备、基础设施设备、公共场所的设备等，例如为井盖、消火栓、水表、电表、路灯、自行车、汽车等。
设备指纹信息：用于唯一标识对应的终端，可以对设备型号、设备尺寸、设备供应商、设备序列号中的至少一项进行哈希运算，将得到的哈希值作为设备指纹信息。
基于位置的服务(Location Based Service，LBS)节点：用于通过电信移动运营商的通讯网络(如3G网络、4G网络)或外部定位方式(如GPS)，提供终端的位置信息，还可以在地理信息系统(Geographic Information System，GIS)平台进行连接，通过GIS平台得到终端的位置信息。
数据包传输层安全性协议(Datagram Transport Layer Security，DTLS)：安全传输层协议(Transport Layer Security，TLS)不能用来保证用户数据报协议(User Datagram Protocol，UDP)上传输的数据的安全，因此DTLS试图在现存的TLS协议架构上提出扩展，使之支持UDP，即成为TLS的一个支持数据报传输的版本。DTLS 1.0基于TLS 1.1,DTLS 1.2基于TLS 1.2。
多因子认证(Multiple factors authentication，MFA)是一种安全系统，目的是建立一个多层次的防御，使未经授权的人或机器访问计算机系统或网络更加困难。MFA通过结合两个或三个独立的凭证(用户所知道，用户所有拥有的，用户是什么)对用户进行认证。与单因子身份验证(用户所知道)相比，多因子身份认证更加安全。虽然PSK认证方法由于认证效率高效(与基于非对称加密的认证方法比)，适合于端侧设备资源有限的接入认证场景，但是在涉及个人隐私的IoT场景还是不够安全。
||：连接符，例如“1||2”表示“12”。
重放攻击(Replay Attacks)：又称重播攻击、回放攻击，是指攻击者发送一个目的主机已接收过的包，来达到欺骗系统的目的，主要用于身份认证过程，破坏认证的正确性。重放攻击可以由拦截并重发数据的敌方进行。攻击者利用网络监听或者其他方式盗取通过认证密钥生成的认证信息，之后再把认证信息重新发给服务器。重放攻击在各种网络通信过程中都可能发生，是计算机世界黑客常用的攻击方式之一。
物联网中的终端由于设备价格成本和设备大小等限制，导致终端的软硬件资源受限。因此，终端难以做到像服务器一样有防火墙、杀毒、硬件加密等强大的安全防护能力，也没有条件生成足够安全的随机数或密钥，更无法确保密钥的存储安全。终端的厂商着力于在终端上实现更多的业务功能和良好的用户体验，因此在安全上会做出妥协，使得厂商在安全上的资源投入更加有限。另外，终端的用户安全意识薄弱，例如长时间不更新终端的密钥、默认密码不修改等。综上，终端的接入安全不能仅依赖于端侧用户、设备厂商和设备自身能力来保障。
而本发明设计了一种基于物联网端设备的安全接入方法，(1)为了增加攻击难度，结合预共享密钥(“我所知道的”)、短信验证信息(“我所拥有的”)、终端指纹信息(“我是谁”)等多个因子来共同认证设备身份的合法性。(2)在接入认证过程用于防重放和辅助认证身份的第一随机数(randA)由计算能力强大的服务器负责生成，服务器生成后可以通过短信通道传输给终端；(3)预共享密钥和第二随机数(randB)共同生成的第一密钥(authKey)具有一定的有效期，在有效期失效后，可通过短信重新协商更新后的第一密钥。另外，如果发生第一密钥泄露或发现终端行为异常，可手工将第一密钥的有效期设置为失效。(4)针对位置固定的静态终端(例如消火栓、水电表、路灯、井盖等)，还可以进一步引入对位置信息的校验来作为接入认证的辅助手段。针对移动终端(例如自行车、汽车等)，还可以进一步引入对移动行为状态信息的校验来作为接入认证的辅助手段。其中，终端的位置信息可以不通过终端传输给服务器进行认证，而是由服务器根据终端的通信号码向LBS节点直接获取。
对于采用PSK进行接入认证的方案来说，第一，由于认证机制完全依赖于PSK，而由于终端的资源有限，不足以很好的保护存储的PSK，因此存在“一旦PSK泄露即导致认证机制被攻破”的问题。第二，由于端侧设备资源有限，终端不具备产生安全的随机数的条件，很难保证产生足够安全的随机数用于防重放，因此导致认证机制中存在重放攻击的风险。第三，如果发现PSK泄露，服务器只能终止服务，召回设备或近端重新预置PSK。
而本公开实施例中，第一，引入多因子认证，除了PSK外还引入短信验证、设备指纹信息、位置信息、移动行为状态信息等认证因子来帮助进一步验证终端的身份，以解决认证机 制的安全性单独依赖于PSK的问题，增加攻击者仿冒端侧设备接入的难度。第二，在本发明中，随机数不由终端生成，而是由计算能力强大的服务器生成，然后通过短信下发给终端，解决因终端资源有限导致的随机数不安全的风险。第三，本发明在PSK泄露或者失效时，提供在线协商新的PSK的机制，而不需要终止服务并召回终端或近端重新预置PSK。进一步地，本公开中第一密钥的有效期是可配置的，一旦发现第一密钥已泄露或者存在第一密钥泄露的风险，可立刻将第一密钥置为失效，下次接入认证时需要重新协商新的第一密钥，从而进一步增强接入机制认证的安全性。
图1是本公开实施例提供的一种实施环境的示意图，如图1所示，该实施环境包括终端101和服务器102，终端101和服务器102可以通过网络连接。
终端101可以具有接收和/或发送短信的功能，能够接收服务器102通过短信的形式发送的第一验证指令和/或第二验证指令。例如终端101可以配置短信单元，短信单元可以为物理上的实体单元或逻辑上的虚拟单元，短信单元用于接收和/或发送短信，在物理形态上可以为用户身份识别(Subscriber Identification Module，SIM)卡，或者为其他形态。另外，终端101还可以具有定位的功能，能够向LBS节点发送自身的位置，例如终端101可以配置位置定位追踪单元，位置定位跟踪单元可以为物理或逻辑上的单元，位置定位跟踪单元用于与LBS节点进行信息交互，可以为物理上的实体单元或逻辑上的虚拟单元，在物理形态上可以为具有全球定位系统(Global Positioning System，GPS)功能的集成电路，或者为其他形态。
服务器102也可称为平台侧服务器102、认证服务器102等，当终端101要接入物联网时，服务器102会对终端101进行接入认证，以便对终端101接入物联网的行为进行控制，提高安全性。
参见图2，服务器102可以包括接入认证单元、数据存储单元，解密单元，接入认证单元用于接收和处理终端101的接入认证请求，从数据存储单元获取PSK的密文、设备指纹信息的密文和第二位置信息的密文，向解密单元请求对密文进行解密，通过短信服务中心向终端101发送信息，从LBS节点获取设备的位置信息。数据存储单元用于存储用于认证终端101的PSK、设备指纹信息和第二位置信息、向接入认证单元提供PSK的密文、设备指纹信息的密文和第二位置信息的密文。解密单元用于对PSK的密文、设备指纹信息的密文和设备位置信息的密文进行解密，还用于处理接入认证单元的解密请求。
需要说明的是，服务器102可以被提供为一台服务器，接入认证单元、数据存储单元和解密单元可以映射为该服务器内部的单元，例如为物理上的实体单元或逻辑上的虚拟单元，服务器102也可以被提供为多台服务器组成的分布式系统，接入认证单元、数据存储单元和解密单元可以映射为不同的服务器，例如分布式系统中的服务器A充当接入认证单元，服务器B充当数据存储单元，服务器C充当解密单元，不同服务器之间通过信息交互执行接入认证的流程。
可选地，参见图3，该实施环境还可以包括短信服务中心，短信服务中心用于转发服务器102发送给端侧设备的短信，可以为互联网服务提供商(Internet Service Provider，ISP)的服务器，也可以为即时应用通信程序关联的服务器，例如聊天应用的后台服务器，本实施 例对此不做限定。
可选地，参见图4，该实施环境还可以包括LBS节点，LBS节点用于获取终端的第一位置信息，向服务器提供设备的第一位置信息。LBS节点可以为ISP的服务器，也可以为GPS卫星关联的服务器，本实施例对此不做限定。
图5是本公开实施例提供的一种服务器的结构示意图，该服务器500可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)501和一个或一个以上的存储器502以及通信接口503。
其中，该存储器502中存储有至少一条指令，该至少一条指令由该处理器501加载并执行以实现本公开实施例提供的接入认证方法，通信接口503可以与其他设备进行通信。
当然，该服务器500还可以具有有线或无线网络接口、输入输出接口等部件，以便进行输入输出，该服务器500还可以包括其他用于实现设备功能的部件，在此不做赘述。
在示例性实施例中，还提供了一种存储有计算机程序的计算机可读存储介质，例如存储有计算机程序的存储器，上述计算机程序被处理执行时实现下述实施例中所示的接入认证方法。例如，上述计算机可读存储介质可以是只读内存(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory，RAM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)、磁带、软盘和光数据存储设备等。
以下，以权利要求书中的第一密钥称为authKey，第一随机数称为randA，第二随机数称为randB，第一验证信息称为验证信息V，第二验证信息称为验证信息V’，第一位置信息称为Dlocation’，第二位置信息称为Dlocation，对本公开实施例提供的技术方案进行详细阐述，需要说明的是，上述各种信息的命名可以根据实际需求进行设计，本实施例对此不做限定。
图6是本公开实施例提供的一种接入认证方法的流程图，该方法的交互主体包括终端和服务器，该方法包括以下步骤：
601、终端向服务器发送接入请求。
当终端要接入物联网时，可以生成接入请求，向服务器发送接入请求，以便触发接入认证的流程。其中，接入请求可以携带终端的设备标识信息，该设备标识信息用于标识终端的身份，可以包括终端的身份标识(Identification,ID)。
关于终端向服务器发送接入请求的方式，终端可以获取服务器的网络互连协议(Internet Protocol,IP)地址，基于服务器的IP地址向服务器发送接入请求。或者，终端可以向服务器发送短信，该短信中携带接入请求。
602、服务器接收终端的接入请求，根据接入请求携带的设备标识信息，获取设备标识信息对应的authKey。
服务器可以解析接入请求，得到接入请求携带的设备标识信息，根据设备标识信息与authKey之间的对应关系，获取接入请求中的设备标识信息对应的authKey。其中，设备标识信息与authKey之间的对应关系包括多个设备标识信息以及对应的多个authKey，设备标 识信息与authKey之间的对应关系可以在服务器中预先存储。
603、服务器对authKey进行校验。
本实施例中，authKey可以定期失效并定期更新，服务器得到authKey后，可以对authKey进行校验，如果通过校验确定authKey有效，执行以下步骤604，如果通过校验确定authKey失效，执行以下步骤①，更新authKey，从而提高安全性。
示例性地，对authKey进行校验的过程可以包括以下方式一至方式二：
方式一、结合authKey的有效期对authKey进行校验。
本方式一具体可以包括以下步骤一至步骤三：
步骤一、服务器获取authKey的到期时间点与当前时间点之间的时间差。
authKey的到期时间点：用于指示authKey何时到期。在当前时间点到达到期时间点时，即authKey已到期时，服务器认为authKey失效，无法作为接入认证的有效凭据。authKey的到期时间点可以用T表示。服务器可以预先设置authKey的到期时间点，对应存储authKey的到期时间点与authKey，则服务器在获取authKey时，可以同时得到预先设置的authKey的到期时间点。
针对设置authKey的到期时间点的具体实现方式，在此示例性地提供以下两种设计：
设计一、服务器可以在生成authKey时，确定生成authKey的时间点，并获取预设时长，在生成authKey的时间点的基础上加上预设时长，将得到的时间点作为authKey的到期时间点。其中，该预设时长可以根据经验或业务需求确定，例如可以为5ms。
设计二、服务器可以接收配置指令，获取配置指令指示的时间点，作为authKey的到期时间点。其中，配置指令用于配置authKey的到期时间点，可以通过用户的输入操作触发。
步骤二、如果时间差小于第一时间差阈值，确定authKey有效。
服务器可以判断时间差是否小于第一时间差阈值，如果时间差小于第一时间差阈值，确定authKey有效，如果时间差不小于第一时间差阈值，确定authKey失效。其中，第一时间差阈值可以根据经验或业务需求设置，例如可以为0。
方式二、结合authKey的获取次数对authKey进行校验。
服务器可以统计authKey的获取次数，如果authKey的获取次数小于第一次数阈值，确定authKey有效，如果authKey的获取次数不小于第一次数阈值，确定authKey失效。其中，第一次数阈值可以根据经验或业务需求设置，例如可以为5。
针对统计authKey的获取次数的方式，服务器可以每当接收到接入请求时，累加authKey的获取次数，从而统计authKey的获取次数。例如，服务器可以在生成authKey时，将authKey的获取次数计为1，每当根据设备标识信息获取一次authKey时，向authKey的获取次数加一，从而通过迭代过程，得到authKey的获取次数。
在一种可能的设计中，authKey的有效性可以进行灵活设置：如果authKey已泄露或者authKey存在泄露的风险，服务器可以对authKey的到期时间点和/或获取次数进行置位，以使authKey自动失效，则终端之后进行接入认证时，由于authKey已失效，终端和服务器需要重新协商更新后的authKey。
关于置位的具体方式，结合上述方式一，服务器可以对authKey的到期时间点进行置位，例如将到期时间点置为某一预设时间点，置位后的到期时间点与当前时间点之间的时间差不 小于第一时间差阈值，因此对到期时间点置位后，服务器在任意时刻接收到接入请求并获取authKey时，由于authKey的到期时间点与当前时间点之间的时间差不小于第一时间差阈值，则始终会判定authKey失效。也即是，服务器通过对authKey的到期时间点进行置位，达到终端以及服务器存储的authKey均自动失效的效果。
同理地，结合上述方式二，服务器可以对authKey的获取次数进行置位，例如将获取次数置为某一预设次数，置位后的获取次数会不小于第一次数阈值，因此对获取次数置位后，服务器在任意时刻接收到接入请求并获取authKey时，由于authKey的获取次数不小于第一次数阈值，则始终会判定authKey失效。也即是，服务器通过对authKey的获取次数进行置位，达到终端以及服务器存储的authKey均自动失效的效果。
关于对authKey进行置位的时机，可以包括以下设计一和设计二：
设计一、服务器可以接收配置指令，响应配置指令，对authKey的到期时间点和/或获取次数进行置位。其中，该配置指令可以由用户的输入操作触发，配置指令可以用于指示对authKey置为失效。
在一个示例性场景中，用户查看监控录像，发现家中的保险箱被偷走，可以立刻为保险箱执行输入操作，触发服务器的配置指令，则服务器会接收到配置指令，将保险箱的authKey的到期时间点和/或获取次数进行置位，从而令保险箱的authKey自动失效，使得失窃的保险箱无法接入物联网。
设计二、服务器可以在接入认证的过程中，统计终端的接入请求的失败次数，例如每当拒绝终端接入物联网时，向接入请求的失败次数加一。在统计过程中，可以判断终端的接入请求的失败次数是否达到第二次数阈值，如果失败次数达到第二次数阈值，表明可能发生了暴力猜测攻击的情况，则服务器可以对authKey的到期时间点和/或获取次数进行置位。可选地，如果失败次数达到第二次数阈值，服务器还可以按照预设告警方式进行告警，从而通知用户及时了解这一情况。
604、如果authKey有效，服务器向终端发送第一验证指令。
如果确定authKey有效，服务器可以生成第一验证指令，向终端发送第一验证指令，该第一验证指令用于指示终端基于终端存储的authKey、设备标识信息以及服务器生成的randA，生成验证信息V，以便服务器对终端生成的验证信息V进行校验。
其中，关于第一验证指令所指示的randA：服务器可以生成randA，randA用于供服务器生成验证信息V’，供终端生成验证信息V，另外randA还能用于认证过程抵御重放攻击。服务器可以在生成第一验证指令时，在第一验证指令中携带服务器生成的randA，以便终端通过第一验证指令中的randA生成验证信息V。
可选地，第一验证指令可以携带authKey的有效标识，有效标识用于标识终端存储的authKey有效，例如可以为1、Y等。服务器可以生成该有效标识，在第一验证指令中携带该有效标识，以便终端通过第一验证指令中的有效标识，得知存储的authKey有效，可以直接采用存储的authKey生成验证信息V，而暂时无需对存储的authKey进行更新。
针对服务器发送第一验证指令的方式，在此示例性地提供以下两种方式：
方式一、服务器可以向终端发送短信，短信携带第一验证指令。
服务器可以向短信服务中心发送短信，短信服务中心接收到短信后，可以向终端转发短 信，从而实现终端接收服务器的短信的功能。其中，短信服务中心可以为运营商的服务器，或即时通信应用的服务器。另外，服务器也可以搭载发送短信的功能，可以由服务器直接向终端发送短信。
方式二、服务器可以通过终端的IP地址，向终端发送第一验证指令。
605、终端接收第一验证指令，基于存储的authKey、设备标识信息以及服务器生成的randA，生成验证信息V，向服务器发送验证信息V。
终端可以接收第一验证指令，对第一验证指令进行解析，得到第一验证指令中携带的有效标识，从而获知存储的authKey当前有效，可以直接采用存储的authKey生成验证信息V，因此，终端可以获取存储的authKey、设备标识信息以及服务器生成的randA，基于authKey、设备标识信息以及randA，生成验证信息V。
针对生成验证信息V的实现方式，终端可以采用哈希算法，对authKey、设备标识信息以及randA进行计算，将计算得到的哈希值作为验证信息V。其中，哈希算法可以为哈希消息认证码(Hash-based Message Authentication Code，HMAC)、安全散列算法(Secure Hash Algorithm，SHA)、密钥导出函数(Password-Based Key Derivation Function，PBKDF)算法、高级加密标准(Advanced Encryption Standard，AES)算法等。
可选地，本实施例中的设备标识信息可以包括终端的ID以及终端的设备指纹信息，终端可以获取存储的authKey、ID、设备指纹信息以及randA，根据authKey、ID、设备指纹信息以及randA，生成验证信息V。以设备指纹信息表示为FI，采用HMAC算法生成验证信息V为例，终端可以通过执行以下语句，生成验证信息V：
V＝HMAC(authKey,ID||randA||FI)。
其中，关于设备指纹信息：终端可以预先获取自身的设备型号、设备尺寸、设备供应商、设备序列号中的至少一项，根据该设备型号、设备尺寸、设备供应商、设备序列号中的至少一项，生成设备指纹信息，存储设备指纹信息。其中，关于生成设备指纹信息的方式，终端可以采用哈希算法，对设备型号、设备尺寸、设备供应商、设备序列号中的至少一项进行计算，将计算得到的哈希值作为设备指纹信息。
以设备型号表示为DType、设备尺寸表示为size，设备供应商表示为vendor，设备序列号表示为SN，设备指纹信息表示为FI，生成设备指纹信息的哈希算法为SHA256为例，终端可以通过执行以下语句，生成设备指纹信息：
FI＝SHA256(Dtype||size||vendor||SN)。
需要说明的第一点是，针对发送验证信息V的方式，终端可以基于服务器的IP地址向服务器发送验证信息V。或者，终端可以向服务器发送短信，该短信中携带验证信息V。
需要说明的第二点是，终端还可以在发送验证信息V的同时，还发送设备标识信息，以便服务器根据接收到的设备标识信息，确定验证信息V来自的终端。另外，终端还可以在发送验证信息V的同时，还发送randA，以便服务器根据接收到的randA，对randA是否有效进行认证。
示例性地，终端可以按照以下格式，向服务器发送验证信息V：(V||ID||randA)。
上述步骤604至步骤605阐述了authKey有效时终端和服务器的交互流程，而如果authKey无效时，上述步骤604至步骤605可以替代为以下步骤①至步骤④：
步骤①、如果authKey失效，服务器生成更新后的authKey。
如果服务器确定authKey失效，服务器可以生成randA和randB，randA的作用请参见上述步骤604，randB用于生成更新后的authKey，从而对失效的authKey进行更新。
针对通过randB生成更新后的authKey的实现方式，服务器可以获取预共享密钥PSK，根据randB以及PSK，生成更新后的authKey。具体地，服务器可以采用哈希算法，对randB以及PSK进行计算，将计算得到的哈希值作为更新后的authKey。以哈希算法为HMAC-SHA256为例，示例性地，服务器可以通过执行以下语句，生成更新后的authKey：
authKey＝HMAC-SHA256(PSK,randB)
需要说明的第一点是，针对获取PSK的方式，服务器可以存储PSK的密文，如果要生成更新后的authKey，获取PSK的密文，对PSK的密文进行解密以得到PSK,从而提高PSK的存储安全性。示例性地，服务器可以包括数据存储模块和解密模块，数据存储模块用于存储PSK的密文，解密模块用于对PSK的密文进行解密，服务器可以从数据存储模块读取PSK的密文，将PSK的密文发送给解密模块，向解密模块发送解密请求，解密模块响应该解密请求，对PSK的密文进行解密后，可以得到PSK。
需要说明的第二点是，服务器可以在生成更新后的authKey时，为更新后的authKey设置到期时间点，对应存储更新后的authKey以及到期时间点，以便当终端下一次发起接入请求时，通过到期时间点验证更新后的authKey是否有效。其中，设置到期时间点的具体过程详见上述步骤603中的设计一，在此不做赘述。
步骤②、服务器向终端发送第二验证指令。
如果确定authKey失效，服务器可以生成第二验证指令，向终端发送第二验证指令，第二验证指令用于指示终端基于更新后的authKey、设备标识信息以及服务器生成的randA，生成验证信息V，以便服务器对终端生成的验证信息V进行校验。
针对第二验证指令的内容，服务器可以在第二验证指令中携带服务器生成的randA和randB，以便终端通过第二验证指令中的randA生成验证信息V，通过第二验证指令中的randB生成更新后的authKey。可选地，服务器还可以生成authKey的失效标识，在第二验证指令中携带失效标识，以便终端通过第二验证指令中的失效标识，确定存储的authKey已经失效，要对存储的authKey进行更新。其中，失效标识用于标识终端存储的authKey失效，例如可以为0、N等。
针对服务器发送第二验证指令的方式，如果确定authKey失效，考虑到可能出现了authKey被猜测攻击的情况，通过IP通道的方式发送第二验证指令可能已经不安全了，则服务器可以通过短信的方式发送第二验证指令，即，服务器可以向终端发送短信，短信携带第二验证指令，从而避免authKey泄露带来的风险。当然，在服务器定期更新authKey的情况中，如果服务器要主动更新终端的authKey，仍可以通过终端的IP地址，向终端发送第二验证指令。
步骤③、终端接收第二验证指令，生成更新后的authKey。
终端可以接收第二验证指令，对第二验证指令进行解析，得到第二验证指令中携带的失效标识，从而获知存储的authKey当前已失效。因此，终端会对存储的authKey进行更新，生成更新后的authKey，以便采用更新后的authKey生成验证信息V。另外，终端可以存储生 成的更新后的authKey，以备下一次接入认证时使用。
关于终端生成更新后的authKey的方式，终端可以获取第二验证指令的randB，并获取预先存储的PSK，根据randB以及PSK，生成更新后的authKey。其中，终端可以采用哈希算法，对randB以及PSK进行计算，将计算得到的哈希值作为更新后的authKey。以哈希算法为HMAC-SHA256为例，终端可以通过执行以下语句，生成更新后的authKey：
authKey＝HMAC-SHA256(PSK,randB)
其中，终端生成更新后的authKey的方式可以与上述步骤①中服务器生成更新后的authKey的方式相同，例如采用相同的哈希算法，那么由于终端和服务器生成更新后的authKey的方式相同，采用的参数同为randB，可以保证终端和服务器生成更新后的authKey具有一致性，实现通过authKey进行接入认证的功能。
以下，对定期更新的authKey进行接入认证的技术效果进行阐述：
第一，相关技术中，终端和服务器采用固定不变的PSK进行接入认证，一旦不法分子窃取终端存储的PSK，就会导致接入认证机制被攻破。而本实施例中，终端和服务器存储的authKey是定期更新的，具有高时效性，即使不法分子从终端中窃取了authKey，采用得到的authKey进行接入认证，也会由于得到的authKey失效，使得接入认证失败，从而极大地提高了安全性。
第二，本实施例中，终端与服务器之间无需传输更新后的authKey，只需传输randA和randB，即可保证每当终端与服务器对authKey进行更新时，两侧更新的authKey一致。那么，即使不法分子截获了服务器向终端传输的信息，也只能得到randA和randB，randA和randB无法起到和authKey相同的认证功能，不法分子采用randA和randB进行接入认证，使得接入认证失败，从而避免传输的信息被窃取而导致认证机制被攻破的风险，极大地提高了安全性。
第三，本实施例中，考虑到如果终端每次接入时，都要协商新的authKey，会增加终端的处理负荷，消耗终端的电量，而本实施例中，通过为authKey设计到期时间点和/或获取次数的机制，只有在authKey失效的时候才重新协商新的authKey。由于在authKey有效的情况下可以直接使用认证凭据，避免终端频繁生成新的authKey的情况，因此减轻了终端的处理负荷，节约了终端消耗的电量。
需要说明的是，本实施例仅是以第一验证指令携带有效标识，第二验证指令携带失效标识，以便终端根据有效标识以及失效标识区分不同的验证指令，从而按照不同的方式生成验证信息V为例进行描述，而在另一种可能的实现方式中，第一验证指令可以无需携带有效标识，第二验证指令也可以无需携带失效标识，而第一验证指令和第二验证指令可以通过其他方式指示终端存储的authKey是否有效，只需保证第一验证指令和第二验证指令有所区别即可。
例如，可以预先约定：携带一个随机数的验证指令为指示authKey有效的第一验证指令，携带两个随机数的验证指令为指示authKey失效的第二验证指令，则终端可以通过随机数的数量，区分不同功能的验证指令，从而分别进行响应。
步骤④、终端基于更新后的authKey、设备标识信息以及服务器生成的randA，生成验证信息V，向服务器发送验证信息V。
本步骤与上述步骤605中生成验证信息V以及发送验证信息V的过程同理，在此不做赘述。
606、服务器接收终端的验证信息，对randA的有效性进行验证。
针对获取randA的方式，在上述步骤605或步骤④中，如果终端在发送验证信息的同时，还发送了randA，则服务器可以直接对接收到的randA进行验证。而在上述步骤605或步骤④中，如果终端在发送验证信息时未发送randA，服务器可以获取上述步骤604或步骤①中生成的randA，例如可以在生成randA时，存储randA与设备标识信息之间的对应关系，可以根据终端的设备标识信息，得到设备标识信息对应的randA，以便对randA进行验证。
对randA的有效性进行验证的方式可以包括以下方式一和方式二：
方式一、结合randA的有效期对randA进行校验。
本过程与上述步骤603中的方式一同理，即，服务器可以获取randA的到期时间点与当前时间点之间的时间差，如果时间差小于第二时间差阈值，确定randA有效。其中，第二时间差阈值用于指示randA有效的最长时间，可以根据经验或业务需求设置，例如第二时间差可以为5ms。
方式二、结合authKey的接收次数对authKey进行校验。
本过程与上述步骤603中的方式二同理，即，服务器可以统计randA的接收次数，如果randA的接收次数小于第三次数阈值，确定randA有效。其中，第三次数阈值用于指示randA有效的最大次数。
607、如果randA有效，服务器基于服务器存储的authKey、设备标识信息以及服务器生成的randA，生成验证信息V’。
服务器生成验证信息V’的方式可以与上述步骤605中终端生成验证信息V的方式相同，例如采用相同的哈希算法，那么由于终端和服务器生成验证信息的方式相同，采用的参数同为authKey、设备标识信息以及randA，可以保证验证信息V和验证信息V’具有一致性。
例如，如果终端在上述步骤605中通过执行语句：V＝HMAC(authKey,ID||randA||FI)来生成验证信息V，服务器可以通过执行语句：V’＝hMAC(authKey,ID||randA||FI’)来生成验证信息V’。
需要说明的第一点是，服务器采用的设备标识信息可以包括终端的ID以及终端的设备指纹信息，针对获取终端的设备指纹信息的方式，服务器可以预先存储设备ID和设备指纹信息之间的对应关系，可以根据设备ID得到对应的设备指纹信息。可选地，服务器可以存储设备指纹信息的密文，对设备指纹信息的密文进行解密，得到设备指纹信息。
需要说明的第二点是，本步骤607是以randA有效为例进行描述，而如果randA失效，服务器可以生成通知消息，向终端发送通知消息，通知消息用于指示终端重新发送接入请求。则终端会返回到步骤601，重新执行发送接入请求的过程。
本实施例中，通过对randA的有效性进行校验，可以达到防重放攻击的效果：即使不法分子窃听到了randA，通过窃听到的randA，冒用终端的身份向服务器发送验证信息V，而由于randA生成后很快就会失效，或接收到一次就失效，则服务器接收到不法分子的验证信息V时，会由于randA已经失效，拒绝不法分子接入物联网。
608、如果验证信息V与验证信息V’一致，服务器获取终端的Dlocation’以及服务器 存储的Dlocation，Dlocation’用于指示终端当前所处的位置，Dlocation用于指示终端的安装位置。
服务器可以对终端发送的验证信息V与自身生成的验证信息V’进行比对，如果验证信息V与验证信息V’一致时，服务器可以获取终端的Dlocation以及Dlocation’，从而结合终端的位置进行进一步校验。
针对获取Dlocation的方式，在安装终端时，服务器可以记录终端的安装位置，作为Dlocation，并存储终端的Dlocation与设备标识信息之间的对应关系，那么服务器接收到终端的验证信息V后，可以根据终端的设备标识信息，查询Dlocation与设备标识信息之间的对应关系，得到预先记录的终端的Dlocation。
可选地，服务器可以对终端的Dlocation进行加密，存储Dlocation的密文，如果要验证终端的位置信息，服务器可以对Dlocation的密文进行解密，得到Dlocation。示例性地，服务器可以包括数据存储模块和解密模块，数据存储模块存储终端的设备标识信息与Dlocation的密文之间的对应关系，服务器可以从数据存储模块中读取设备标识信息对应的Dlocation的密文，向解密模块发送解密请求，解密模块会对Dlocation的密文进行解密，得到Dlocation。
针对获取Dlocation’的方式，可选地，服务器可以向LBS节点发送位置信息请求，该位置信息请求用于请求终端的位置信息，LBS节点接收服务器的位置信息请求，响应该位置信息请求，会获取终端当前所处的位置，得到Dlocation’，向服务器发送Dlocation’，服务器可以接收该LBS节点发送的Dlocation’，从而得到终端的Dlocation’。
其中，针对LBS节点获取终端的Dlocation’的方式，LBS节点可以从终端中拉取终端当前所处的位置，从而得到Dlocation’，或者终端也可以向LBS节点主动发送当前所处的位置，LBS节点接收终端当前所处的位置，从而得到Dlocation’。
服务器通过LBS节点获取终端当前所处的位置，引入LBS节点作为抵御的机制，攻击者无法通过截获终端与服务器之间传输的信息，得到终端的位置，能够避免攻击者篡改终端向服务器上报的位置信息而导致攻破接入机制的情况，提高了攻击者攻破接入机制的难度，提高了安全性。
需要说明的是，上述过程仅是以通过LBS节点获取终端当前所处的位置为例进行说明，在一种可能的实现方式中，服务器也可以通过与终端进行信息交互，得到终端当前所处的位置，例如，服务器可以向终端发送位置信息请求，终端接收该位置信息请求，向服务器发送当前所处的位置，服务器可以接收终端发送的位置，作为Dlocation’。又如，终端可以主动向服务器发送当前所处的位置，服务器可以获取终端最新一次发送的位置，作为Dlocation’。其中，终端可以实时向服务器发送当前所处的位置，或周期性地向服务器发送当前所处的位置，或在终端当前所处的位置满足某一条件时向服务器发送当前所处的位置，本实施例对此不做限定。
609、如果Dlocation’和Dlocation符合第一预设条件，服务器允许终端接入物联网。
服务器得到Dlocation与Dlocation’时，可以判断Dlocation与Dlocation’是否符合第一预设条件，如果Dlocation’和Dlocation符合第一预设条件，允许终端接入物联网，而如果Dlocation’和Dlocation不符合第一预设条件，拒绝终端接入物联网。
具体来说，服务器验证Dlocation与Dlocation’的过程可以包括以下方式一和方式二：
方式一、如果Dlocation’与Dlocation一致，允许终端接入物联网。
服务器可以判断Dlocation’与Dlocation是否一致，如果Dlocation’与Dlocation一致，允许终端接入物联网，如果Dlocation’与Dlocation不一致，拒绝终端接入物联网。可选地，服务器还可以在Dlocation’与Dlocation不一致，按照预设告警方式进行告警，以便用户及时获知终端当前所处的位置发生了迁移。
在一个示例性场景中，以终端为井盖为例，一旦小偷将井盖偷走，井盖当前所处的位置即会与井盖的安装位置不一致，那么服务器会发现井盖的Dlocation’与Dlocation不一致，会拒绝井盖接入物联网，同时还会进行告警，以便用户及时了解井盖被偷走的情况。
方式二、如果Dlocation’与Dlocation之间的距离小于预设距离，允许终端接入物联网。
服务器可以获取Dlocation’与Dlocation之间的距离，可以判断Dlocation’与Dlocation之间的距离是否小于预设距离，如果Dlocation’与Dlocation之间的距离小于预设距离，允许终端接入物联网，如果Dlocation’与Dlocation之间的距离不小于预设距离，拒绝终端接入物联网。其中，预设距离可以根据经验或业务需求确定，例如为60m。可选地，服务器还可以在Dlocation’与Dlocation不小于预设距离，按照预设告警方式进行告警，以便用户及时获知终端当前所处的位置发生了较大改变。
在一个示例性场景中，以终端为水表为例，某用户的家在装修时水表安装在了客厅，如果用户将水表从客厅改搬到自家的厨房，水表当前所处的位置与水表的安装位置之间的距离较小，因此服务器仍允许水表接入物联网。而当小偷将水表从用户的家中偷走，水表当前所处的位置与水表的安装位置之间的距离较大，因此服务器会拒绝水表接入物联网，同时还会进行告警，以便用户及时了解水表被偷走的情况。
需要说明的是，上述步骤608至步骤609仅是以结合终端当前所处的位置以及安装位置，对终端进行接入认证为例进行描述，在一种可能的实现方式中，上述步骤608至步骤609还可以替换为以下步骤(1)至步骤(2)：
(1)如果验证信息V与验证信息V’一致，服务器获取终端当前的移动行为状态信息。
移动行为状态信息用于指示终端当前的移动状态，能够用来识别终端的行为，可以包括终端的移动轨迹、终端的移动速度、终端的移动范围中的至少一项。
针对获取终端的移动行为状态信息的方式，可选地，服务器可以向LBS节点发送移动行为状态信息请求，该移动行为状态信息请求用于请求终端的移动行为状态信息，LBS节点接收服务器的移动行为状态信息请求，响应该移动行为状态信息请求，会获取终端当前的移动行为状态信息，发送给服务器，服务器可以接收该移动行为状态信息，从而得到终端的移动行为状态信息。另外，服务器也可以直接通过与终端进行信息交互，得到终端的移动行为状态信息。
以LBS节点获取终端的移动行为状态信息为例，假设移动行为状态信息为终端的移动轨迹，LBS节点可以确定最近一段时间内终端所处的位置，得到多个位置，将多个位置按照记录时间的先后顺序依次连接，得到移动轨迹。其中，最近一段时间可以指以当前时间点为时间结束点，时长为预设时长的时间段。假设移动行为状态信息为终端的移动速度，LBS节点 可以获取终端的GPS数据，解析该GPS数据，得到终端的移动速度。假设移动行为状态信息为终端的移动范围，LBS节点可以确定最近一段时间内终端所处的位置，得到多个位置，求取多个位置的并集，将该并集的边界线组成的范围作为终端的移动范围。
(2)如果移动行为状态信息符合第二预设条件，服务器允许终端接入物联网。
服务器得到终端的移动行为状态信息时，可以判断终端的移动行为状态信息是否符合第二预设条件，如果终端的移动行为状态信息符合第二预设条件，允许终端接入物联网，而如果终端的移动行为状态信息不符合第二预设条件，拒绝终端接入物联网。
具体来说，服务器对终端的移动行为状态信息进行校验的过程可以包括以下方式一和方式二：
方式一、如果移动行为状态信息与终端的预设移动行为状态信息之间的偏差小于预设偏差阈值，服务器允许终端接入物联网。
预设移动行为状态信息：预设移动信息用于指示终端正常运行时的移动状态，可以通过终端历史运行时的移动状态确定，可以看作终端习惯的移动状态。预设移动信息可以包括终端的预设移动轨迹、终端的预设移动速度、终端的预设移动范围中的至少一项。
针对获取预设移动行为状态信息的方式，服务器可以预先生成终端的预设移动行为状态信息，并存储终端的设备标识信息与预设移动行为状态信息之间的对应关系，在接入认证的过程中，可以根据终端的设备标识信息，查询终端的设备标识信息与预设移动行为状态信息之间的对应关系，得到预设移动行为状态信息，从而进行接入认证。
针对生成预设移动行为状态信息的方式，以预设移动行为状态信息为预设移动轨迹为例，服务器可以预先在历史时间周期内记录终端每天的移动轨迹，根据终端在历史时间周期内每天的移动轨迹，得到多个移动轨迹，对该多个移动轨迹进行统计，得到该预设移动轨迹。例如，服务器可以获取该多个移动轨迹的平均值，将平均值作为移动轨迹。又如，服务器可以获取该多个移动轨迹的加权平均值，将加权平均值作为预设移动轨迹，其中每个移动轨迹的权重可以根据对应的记录时间确定，例如移动轨迹的记录时间越新，则移动轨迹的权重越大。
另外，获取预设移动速度以及预设移动范围的方式与获取预设移动轨迹的方式同理，在此不做赘述。
关于对移动行为状态信息与预设移动行为状态信息之间的偏差进行校验的具体过程，服务器可以获取移动行为状态信息与预设移动行为状态信息之间的偏差，判断该偏差是否小于预设偏差阈值，如果偏差小于预设偏差阈值，允许终端接入物联网，如果偏差不小于预设偏差阈值，拒绝终端接入物联网。
以预设移动信息为终端的预设移动轨迹为例，服务器可以获取终端的移动轨迹与预设移动轨迹之间的偏差，例如选取多个时间点，分别获取移动轨迹和预设移动轨迹在同一时间点的位置，得到多对位置，计算每对位置之间不同位置的距离，得到多个距离，对多个距离求取平均值，将该平均值作为移动轨迹与预设移动轨迹之间的偏差。
示例性地，可以获取移动轨迹在6:00的位置以及预设移动轨迹在6:00的位置，计算这两个位置之间的距离1，获取移动轨迹在7:00的位置以及预设移动轨迹在7:00的位置，计算这两个位置之间的距离2，依次类推，最终对得到的所有距离求取平均值，得到偏差。
以预设移动信息为终端的预设移动速度为例，服务器可以获取终端的移动速度与预设移 动速度之间的偏差，例如选取多个时间点，获取移动速度与预设移动速度在同一时间点之间的偏差，从而得到不同时间点对应的不同偏差，对多个偏差求取平均值，将该平均值作为移动速度与预设移动速度之间的偏差。
示例性地，可以获取6:00的移动速度与预设移动速度，计算这两个速度之间的偏差1，获取7:00的移动速度与预设移动速度，计算这两个速度之间的偏差2，最终对得到的所有偏差求取平均值，作为最终的偏差。
以预设移动信息为终端的预设移动范围为例，服务器可以获取终端的移动范围与预设移动范围之间的偏差，例如获取终端的移动范围超出预设移动范围的面积，将该面积作为偏差。
在一个示例性场景中，以终端为自行车、移动行为状态信息为移动轨迹为例，某用户平时一直骑车上下班，则自行车的预设移动轨迹为从家到单位，而当小偷将自行车偷走后，自行车当前的移动轨迹会与预设移动轨迹偏差较大，则服务器会拒绝自行车接入物联网，同时还会进行告警，以便用户及时了解自行车被偷走的情况。
方式二、服务器将移动行为状态信息输入到分类模型，输出移动行为状态信息的类别，如果类别为预设类别，服务器允许终端接入物联网。
分类模型：用于根据移动行为状态信息进行分类，将移动行为状态信息输入至分类模型后，分类模型可以输出移动行为状态信息的类别。其中，可以采用预设类别指示对应的终端的移动状态正常，服务器将移动行为状态信息输入至分类模型后，如果分类模型输出的类别为预设类别，可以确定终端的移动状态正常，因此服务器会允许终端接入物联网。而如果分类模型输出的类别不为预设类别，可以确定终端的移动状态不正常，因此服务器会拒绝终端接入物联网。
针对得到分类模型的方式，可以预先收集终端的大量样本移动行为状态信息，为每个样本移动行为状态信息打上标签，即标注样本移动行为状态信息所属的类别，其中如果样本移动行为状态信息对应的移动状态正常，则标注样本移动行为状态信息所属的类别为预设类别，如果样本移动行为状态信息对应的移动状态不正常，则标注样本移动行为状态信息所属的类别为其他类别。之后，采用机器学习方式，对已标注的大量样本移动行为状态信息进行训练，得到分类模型，该分类模型通过大量样本移动行为状态信息，可以学习到终端的移动状态的习惯，因此能够根据终端当前的移动行为状态信息，准确地预测出移动行为状态信息的类别，从而判决终端当前的移动状态是否正常。
需要说明的第一点是，在一种可能的设计中，可以将上述步骤608至步骤609、步骤(1)至步骤(2)这两种校验的方式提供为不同服务器的处理逻辑，对于管理静态终端的服务器来说，该服务器在执行本公开提供的接入认证方法时，会执行上述步骤608至步骤609，对于管理移动终端的服务器来说，该服务器在执行本公开提供的接入认证方法时，会执行步骤(1)至步骤(2)。
其中，静态终端是指位置较为固定的终端，例如可以为井盖、消火栓、水表、电表、路灯、电视、空调、取款机、监控摄像头、打印机等，静态终端正常运行时，位置一般不会发生改变或改变的程度较小。移动终端是指位置经常移动的终端，例如可以为自行车、汽车、车载终端、可穿戴设备等。
而在另一种可能的设计中，可以将上述步骤608至步骤609、步骤(1)至步骤(2)这 两种校验的方式集成为一套处理逻辑，由同一服务器执行，而服务器可以针对当前接入认证的终端，智能地从两种方式中选择匹配的校验方式，从而极大地提高了灵活性
针对选择校验方式的具体实现方式，示例性地，如果验证信息V与验证信息V’一致，服务器可以获取终端的设备类型，如果终端的设备类型属于静态终端，服务器可以执行步骤608至步骤609，而如果终端的设备类型属于移动终端，服务器可以执行以上步骤(1)至步骤(2)。
其中，关于获取设备类型的方式，可选地，服务器可以根据终端的设备标识信息，查询设备标识信息与设备类型之间的对应关系，得到终端的设备类型。其中，服务器可以在将每个终端的信息存储入库时，记录终端的设备类型，建立并存储终端的设备类型与设备标识信息之间的对应关系，以便在接入认证时可以查询该对应关系。当然，服务器也可以无需存储终端的设备类型与设备标识信息之间的对应关系，而是由终端主动发送自身的设备类型，例如终端和服务器可以预先约定，将设备类型作为接入请求中的某一字段，终端在发送接入请求时，会在接入请求中携带自身的设备类型，以便服务器解析接入请求时，可以得到终端的设备类型。
在一个示例性场景中，如果井盖进行接入认证，服务器确定井盖的设备类型属于静态终端，则通过步骤608至步骤609进行校验，如果自行车进行接入认证，服务器确定自行车的设备类型属于移动终端，则通过步骤(1)至步骤(2)进行校验。
需要说明的第二点是，服务器可以向终端返回认证的结果。例如，如果服务器允许终端接入物联网，可以向终端发送接入成功消息，如果服务器拒绝终端接入物联网，可以向终端发送接入失败消息。
本实施例提供的方法，提供了多因子认证的机制，结合存储的第一密钥、服务器生成的第一随机数以及终端当前所处的位置等多个认证因子，共同对终端的身份进行认证，即使某一认证因子泄露，也无法冒用终端的身份接入物联网，极大的提高了攻破接入认证机制的难度，提高了安全性。进一步地，认证过程采用的随机数由服务器负责生成，与终端相比，服务器具有更强大的计算能力，能够确保生成安全性高的随机数，通过安全性高的随机数生成的验证信息进行校验，提高了验证信息的难预测性，因此提高了安全性。
图7是本公开实施例示出的一种接入认证装置的结构示意图，应用于服务器中，装置包括：接收模块701、发送模块702、生成模块703、获取模块704和允许模块705。
接收模块701，用于接收终端的接入请求；
发送模块702，用于向终端发送第一验证指令；
该接收模块701，还用于接收终端的第一验证信息；
生成模块703，用于生成第二验证信息；
获取模块704，用于获取终端的第一位置信息以及服务器存储的第二位置信息；
允许模块705，用于允许终端接入物联网。
在一种可能的设计中，允许模块705，用于执行上述步骤609。
在一种可能的设计中，获取模块704，还用于获取终端当前的移动行为状态信息；
在一种可能的设计中，获取模块704，还用于获取终端的设备类型；
在一种可能的设计中，获取模块704，还用于获取第一密钥；
发送模块702，还用于执行步骤604或步骤605中的步骤①至步骤②。
在一种可能的设计中，生成模块703，用于生成更新后的第一密钥。
在一种可能的设计中，装置还包括：第一密钥验证模块，用于执行步骤603。
在一种可能的设计中，该接收模块701，还用于接收配置指令；
该装置还包括：置位模块，用于对第一密钥的到期时间点或第一密钥的获取次数进行置位；
在一种可能的设计中，发送模块702，用于向终端发送短信。
在一种可能的设计中，该接收模块701，还用于接收所述终端的第一随机数；
在一种可能的设计中，生成模块703，还用于如果第一随机数有效，生成第二验证信息；
在一种可能的设计中，发送模块702，还用于如果第一随机数失效，向终端发送通知消息。
在一种可能的设计中，该装置还包括：随机数校验模块，用于执行步骤606。
在一种可能的设计中，生成模块703，还用于生成终端的设备指纹信息。
在一种可能的设计中，获取模块704，包括：
发送子模块，用于向位置服务LBS节点发送位置信息请求；
接收子模块，用于接收LBS节点发送的第一位置信息。
本公开实施例还提供了一种计算机程序产品，该计算机程序产品包括一个或多个指令，在服务器上加载和执行所述指令时，可以实现本公开实施例所述的接入认证方法。该服务器可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。该指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
以上所述仅为本公开的可选实施例，并不用以限制本公开，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。

Claims (36)

  1. 一种接入认证方法，其特征在于，应用于服务器中，所述方法包括：
    接收终端的接入请求；
    向所述终端发送第一验证指令，所述第一验证指令用于指示所述终端基于所述终端存储的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息；
    接收所述终端的第一验证信息；
    基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息；
    如果所述第一验证信息与所述第二验证信息一致，获取所述终端的第一位置信息以及所述服务器存储的第二位置信息，所述第一位置信息用于指示所述终端当前所处的位置，所述第二位置信息用于指示所述终端的安装位置；
    如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网。
  2. 根据权利要求1所述的方法，其特征在于，所述如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网，包括：
    如果所述第一位置信息与所述第二位置信息一致，允许所述终端接入物联网；或，
    如果所述第一位置信息与所述第二位置信息之间的距离小于预设距离，允许所述终端接入物联网。
  3. 根据权利要求1所述的方法，其特征在于，所述基于所述服务器存储的第一密钥、所述服务器存储的设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息之后，所述方法还包括：
    如果所述第一验证信息与所述第二验证信息一致，获取所述终端当前的移动行为状态信息；
    如果所述移动行为状态信息符合第二预设条件，允许所述终端接入物联网。
  4. 根据权利要求3所述的方法，其特征在于，所述如果所述移动行为状态信息符合第二预设条件，允许所述终端接入物联网，包括：
    如果所述移动行为状态信息与所述终端的预设移动行为状态信息之间的偏差小于预设偏差阈值，允许所述终端接入物联网，所述预设移动行为状态信息用于指示所述终端正常运行时的移动状态；或，
    将所述移动行为状态信息输入到分类模型，输出所述移动行为状态信息的类别，所述分类模型用于根据移动行为状态信息进行分类；如果所述类别为预设类别，允许所述终端接入物联网。
  5. 根据权利要求3或4所述的方法，其特征在于，所述移动行为状态信息包括所述终端的移动轨迹、所述终端的移动速度、所述终端的移动范围中的至少一项。
  6. 根据权利要求3所述的方法，其特征在于，所述基于所述服务器存储的第一密钥、所述服务器存储的设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息之后，所述方法还包括：
    如果所述第一验证信息与所述第二验证信息一致，获取所述终端的设备类型；
    如果所述设备类型属于静态终端，执行所述获取所述终端的第一位置信息以及所述服务 器存储的第二位置信息的步骤；或，
    如果所述设备类型属于移动终端，执行所述获取所述终端当前的移动行为状态信息的步骤。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    根据所述接入请求携带的所述设备标识信息，获取所述设备标识信息对应的第一密钥；
    如果所述第一密钥有效时，执行所述向所述终端发送第一验证指令的步骤；或，如果所述第一密钥失效时，生成更新后的第一密钥；向所述终端发送第二验证指令，所述第二验证指令用于指示所述终端基于所述更新后的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息。
  8. 根据权利要求7所述的方法，其特征在于，所述第一验证指令携带所述服务器生成的第一随机数以及有效标识，所述有效标识用于标识所述终端存储的第一密钥有效。
  9. 根据权利要求7所述的方法，其特征在于，所述第二验证指令携带所述服务器生成的第一随机数、第二随机数以及失效标识，所述第二随机数用于生成所述更新后的第一密钥，所述失效标识用于标识所述终端存储的第一密钥失效。
  10. 根据权利要求9所述的方法，其特征在于，所述生成更新后的第一密钥，包括：
    根据所述第二随机数以及预共享密钥PSK，生成所述更新后的第一密钥。
  11. 根据权利要求7所述的方法，其特征在于，所述获取所述设备标识对应的第一密钥之后，所述方法还包括：
    获取所述第一密钥的到期时间点与当前时间点之间的时间差；如果所述时间差小于第一时间差阈值，确定所述第一密钥有效；或，
    统计所述第一密钥的获取次数；如果所述第一密钥的获取次数小于第一次数阈值，确定所述第一密钥有效。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    接收配置指令；对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；或，
    如果所述终端的接入请求的失败次数达到第二次数阈值，对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；
    其中，置位后的到期时间点与当前时间点之间的时间差不小于所述第一时间差阈值，置位后的获取次数不小于所述第一次数阈值。
  13. 根据权利要求1所述的方法，其特征在于，所述向所述终端发送第一验证指令，包括：
    向所述终端发送短信，所述短信携带所述第一验证指令。
  14. 根据权利要求1所述的方法，其特征在于，所述向所述终端发送第一验证指令之后，所述方法还包括：
    接收所述终端的第一随机数；
    如果所述第一随机数有效，执行所述基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息的步骤；或，如果所述第一随机数失效，向所述终端发送通知消息，所述通知消息用于指示所述终端重新发送接入请求。
  15. 根据权利要求14所述的方法，其特征在于，所述向所述终端发送第一验证指令之后，所述方法还包括：
    获取所述第一随机数的到期时间点与当前时间点之间的时间差；如果所述时间差小于第 二时间差阈值，确定所述第一随机数有效；或，
    统计所述第一随机数的接收次数；如果所述第一随机数的接收次数小于第三次数阈值，确定所述第一随机数有效。
  16. 根据权利要求1所述的方法，其特征在于，所述设备标识信息包括设备指纹信息，所述设备指纹信息用于唯一标识所述终端，所述向所述终端发送第一验证指令之前，所述方法还包括：
    根据设备型号、设备尺寸、设备供应商、设备序列号中的至少一项，生成所述终端的设备指纹信息。
  17. 根据权利要求1所述的方法，其特征在于，所述获取所述终端的第一位置信息，包括：
    向位置服务LBS节点发送位置信息请求，所述位置信息请求用于请求所述终端当前所处的位置；
    接收所述LBS节点发送的所述终端的第一位置信息。
  18. 一种接入认证装置，其特征在于，应用于服务器中，所述装置包括：
    接收模块，用于接收终端的接入请求；
    发送模块，用于向所述终端发送第一验证指令，所述第一验证指令用于指示所述终端基于所述终端存储的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息；
    所述接收模块，还用于接收终端的第一验证信息；
    生成模块，用于基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息；
    获取模块，用于如果所述第一验证信息与所述第二验证信息一致，获取所述终端的第一位置信息以及所述服务器存储的第二位置信息，所述第一位置信息用于指示所述终端当前所处的位置，所述第二位置信息用于指示所述终端的安装位置；
    允许模块，用于如果所述第一位置信息和所述第二位置信息符合第一预设条件，允许所述终端接入物联网。
  19. 根据权利要求18所述的装置，其特征在于，所述允许模块，用于如果所述第一位置信息与所述第二位置信息一致，允许所述终端接入物联网；或，如果所述第一位置信息与所述第二位置信息之间的距离小于预设距离，允许所述终端接入物联网。
  20. 根据权利要求18所述的装置，其特征在于，所述获取模块，还用于如果所述第一验证信息与所述第二验证信息一致，获取所述终端当前的移动行为状态信息；
    所述允许模块，还用于如果所述移动行为状态信息符合第二预设条件，允许所述终端接入物联网。
  21. 根据权利要求20所述的装置，其特征在于，所述允许模块，用于如果所述移动行为状态信息与所述终端的预设移动行为状态信息之间的偏差小于预设偏差阈值，允许所述终端接入物联网，所述预设移动行为状态信息用于指示所述终端正常运行时的移动状态；或，将所述移动行为状态信息输入到分类模型，输出所述移动行为状态信息的类别，所述分类模型用于根据移动行为状态信息进行分类；如果所述类别为预设类别，允许所述终端接入物联网。
  22. 根据权利要求20或21所述的装置，其特征在于，所述移动行为状态信息包括所述终端的移动轨迹、所述终端的移动速度、所述终端的移动范围中的至少一项。
  23. 根据权利要求20所述的装置，其特征在于，所述获取模块，还用于：
    如果所述第一验证信息与所述第二验证信息一致，获取所述终端的设备类型；
    如果所述设备类型属于静态终端，执行所述获取所述终端的第一位置信息以及所述服务器存储的第二位置信息的步骤；或，
    如果所述设备类型属于移动终端，执行所述获取所述终端当前的移动行为状态信息的步骤。
  24. 根据权利要求18所述的装置，其特征在于，所述获取模块，还用于：根据所述接入请求携带的所述设备标识信息，获取所述设备标识信息对应的第一密钥；
    所述发送模块，还用于如果所述第一密钥有效，执行所述向所述终端发送第一验证指令的步骤；或，如果所述第一密钥失效，生成更新后的第一密钥；向所述终端发送第二验证指令，所述第二验证指令用于指示所述终端基于所述更新后的第一密钥、设备标识信息以及所述服务器生成的第一随机数，生成第一验证信息。
  25. 根据权利要求24所述的装置，其特征在于，所述第一验证指令携带所述服务器生成的第一随机数以及有效标识，所述有效标识用于标识所述终端存储的第一密钥有效。
  26. 根据权利要求24所述的装置，其特征在于，所述第二验证指令携带所述服务器生成的第一随机数、第二随机数以及失效标识，所述第二随机数用于生成所述更新后的第一密钥，所述失效标识用于标识所述终端存储的第一密钥失效。
  27. 根据权利要求26所述的装置，其特征在于，所述生成模块，用于根据所述第二随机数以及预共享密钥PSK，生成所述更新后的第一密钥。
  28. 根据权利要求24所述的装置，其特征在于，所述装置还包括：
    第一密钥验证模块，用于获取所述第一密钥的到期时间点与当前时间点之间的时间差；如果所述时间差小于第一时间差阈值，确定所述第一密钥有效；或，统计所述第一密钥的获取次数；如果所述第一密钥的获取次数小于第一次数阈值，确定所述第一密钥有效。
  29. 根据权利要求18所述的装置，其特征在于，
    所述接收模块，还用于接收配置指令；
    所述装置还包括：置位模块，用于对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；或，如果所述终端的接入请求的失败次数达到第二次数阈值，对所述第一密钥的到期时间点或所述第一密钥的获取次数进行置位；
    其中，置位后的到期时间点与当前时间点之间的时间差不小于所述第一时间差阈值，置位后的获取次数不小于所述第一次数阈值。
  30. 根据权利要求18所述的装置，其特征在于，所述发送模块，用于向所述终端发送短信，所述短信携带所述第一验证指令。
  31. 根据权利要求18所述的装置，其特征在于，
    所述接收模块，还用于接收所述终端的第一随机数；
    所述生成模块，还用于如果所述第一随机数有效，执行所述基于所述服务器存储的第一密钥、所述设备标识信息以及所述服务器生成的第一随机数，生成第二验证信息的步骤；或，
    所述发送模块，还用于如果所述第一随机数失效，向所述终端发送通知消息，所述通知消息用于指示所述终端重新发送接入请求。
  32. 根据权利要求31所述的装置，其特征在于，所述装置还包括：
    随机数校验模块，用于获取所述第一随机数的到期时间点与当前时间点之间的时间差；如果所述时间差小于第二时间差阈值，确定所述第一随机数有效；或，统计所述第一随机数的接收次数；如果所述第一随机数的接收次数小于第三次数阈值，确定所述第一随机数有效。
  33. 根据权利要求18所述的装置，其特征在于，所述生成模块，还用于根据设备型号、设备尺寸、设备供应商、设备序列号中的至少一项，生成所述终端的设备指纹信息。
  34. 根据权利要求18所述的装置，其特征在于，所述获取模块，包括：
    发送子模块，用于向位置服务LBS节点发送位置信息请求，所述位置信息请求用于请求所述终端当前所处的位置；
    接收子模块，用于接收所述LBS节点发送的所述终端的第一位置信息。
  35. 一种服务器，其特征在于，所述服务器包括处理器、存储器和通信接口，所述存储器中存储有至少一条指令，所述指令由所述处理器加载并执行以实现如权利要求1至权利要求17任一项所述的接入认证方法所执行的操作，所述通信接口用于与其他设备进行通信。
  36. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器加载并执行以实现如权利要求1至权利要求17任一项所述的接入认证方法所执行的操作。
PCT/CN2019/078379 2018-03-31 2019-03-15 接入认证方法、装置及服务器 WO2019184736A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810278142.2 2018-03-31
CN201810278142.2A CN110324287B (zh) 2018-03-31 2018-03-31 接入认证方法、装置及服务器

Publications (1)

Publication Number Publication Date
WO2019184736A1 true WO2019184736A1 (zh) 2019-10-03

Family

ID=68059264

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/078379 WO2019184736A1 (zh) 2018-03-31 2019-03-15 接入认证方法、装置及服务器

Country Status (2)

Country Link
CN (2) CN112260995B (zh)
WO (1) WO2019184736A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111769952A (zh) * 2020-06-29 2020-10-13 福建福链科技有限公司 一种区块链传感器的数据处理系统
CN112016079A (zh) * 2020-08-27 2020-12-01 深圳市亲邻科技有限公司 设备终端验证方法、装置及存储介质
CN116055220A (zh) * 2023-03-20 2023-05-02 睿至科技集团有限公司 一种物联网终端安全防护管控方法及系统

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113206817B (zh) * 2020-02-03 2022-07-12 中移物联网有限公司 一种设备连接确认方法和区块链网络
WO2021176713A1 (ja) * 2020-03-06 2021-09-10 三菱電機株式会社 通信端末、通信装置、通信管理装置、通信システム、ネットワーク参入方法およびネットワーク参入プログラム
CN111431717A (zh) * 2020-03-31 2020-07-17 兴唐通信科技有限公司 一种卫星移动通信系统的加密方法
CN112218294B (zh) * 2020-09-08 2021-08-27 深圳市燃气集团股份有限公司 基于5g的物联网设备的接入方法、系统及存储介质
CN112135297B (zh) * 2020-09-22 2024-05-07 平安科技（深圳）有限公司 物联网的通信方法、中心服务器、设备及介质
CN112153599B (zh) * 2020-09-22 2023-03-24 中信科智联科技有限公司 一种消息的传输方法、装置、车联网设备及管理节点
CN112469034B (zh) * 2020-11-25 2022-07-15 中国科学技术大学 能安全认证物理感知设备的物联网网关装置及其接入方法
CN112583584B (zh) * 2020-11-30 2022-03-25 郑州信大捷安信息技术股份有限公司 一种基于随机数的服务监控系统及方法
WO2022116209A1 (zh) * 2020-12-04 2022-06-09 Oppo广东移动通信有限公司 物联网设备接入认证方法、装置、设备及存储介质
CN113015165A (zh) * 2021-03-11 2021-06-22 青岛海信智能商用系统股份有限公司 物联网平台设备接入方法、设备及系统
US20220311616A1 (en) * 2021-03-27 2022-09-29 International Business Machines Corporation Connection resilient multi-factor authentication
FR3121561A1 (fr) * 2021-04-01 2022-10-07 Electricite De France Procédé de gestion de sécurité dans un système de communication de données, et système pour la mise en œuvre du procédé
CN114124160B (zh) * 2021-10-29 2023-03-28 宁波三星智能电气有限公司 适用于plc载波安全的一表一psk适配方法
CN114095221A (zh) * 2021-11-11 2022-02-25 合肥移瑞通信技术有限公司 安全验证方法、装置、设备及存储介质
CN113890768A (zh) * 2021-11-22 2022-01-04 京东方科技集团股份有限公司 设备认证方法和系统、物联网设备和认证服务器
CN114553592B (zh) * 2022-03-23 2024-03-22 深圳市美科星通信技术有限公司 一种设备身份验证的方法、设备及存储介质
CN115914316B (zh) * 2023-03-14 2023-06-06 深圳中集智能科技有限公司 区块链的物流数据传输方法及可信物联网系统
CN116094852B (zh) * 2023-04-13 2023-08-01 深圳开鸿数字产业发展有限公司 设备的管理方法、管理装置、计算机设备及存储介质
CN116305066B (zh) * 2023-05-17 2023-08-22 山东青鸟工业互联网有限公司 一种基于主动标识载体的设备认证方法、系统及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130117400A1 (en) * 2010-07-08 2013-05-09 National It Industry Promotion Agency Electronic document distribution system and electronic document distribution method
CN104219626A (zh) * 2014-08-25 2014-12-17 北京乐富科技有限责任公司 一种身份认证的方法和装置
CN105188055A (zh) * 2015-08-14 2015-12-23 中国联合网络通信集团有限公司 无线网络接入方法、无线接入点以及服务器
CN105262773A (zh) * 2015-11-09 2016-01-20 北京世纪龙脉科技有限公司 一种物联网系统的验证方法及装置

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453394B (zh) * 2007-12-03 2011-06-01 华为技术有限公司 一种接入控制方法、系统和设备
CN104243406A (zh) * 2013-06-09 2014-12-24 中国移动通信集团公司 一种物联网系统中终端接入认证的方法及装置
CN103778516B (zh) * 2014-02-21 2017-11-17 北京购阿购技术服务有限公司 全方位安全定位交易信息集成方法
US9754097B2 (en) * 2014-02-21 2017-09-05 Liveensure, Inc. Method for peer to peer mobile context authentication
CN105007579B (zh) * 2014-04-24 2019-03-15 中国移动通信集团广东有限公司 一种无线局域网接入认证方法及终端
CN104852911B (zh) * 2015-04-27 2019-02-22 北京小米支付技术有限公司 安全验证方法、装置及系统
US10063374B2 (en) * 2015-05-31 2018-08-28 Massachusetts Institute Of Technology System and method for continuous authentication in internet of things
US10643245B2 (en) * 2016-07-15 2020-05-05 NXT-ID, Inc. Preference-driven advertising systems and methods
CN106713222B (zh) * 2015-07-30 2020-10-09 华为技术有限公司 一种无线局域网络的接入认证方法、服务器和认证系统
CN105827583A (zh) * 2015-09-30 2016-08-03 维沃移动通信有限公司 一种接入移动数据网络的方法和装置
CN106485631A (zh) * 2016-09-12 2017-03-08 福建北斗星河通信有限公司 基于物联网技术的城市公共安全和应急救助方法及系统
CN106656995B (zh) * 2016-10-28 2020-03-03 美的智慧家居科技有限公司 设备控制方法和装置
CN107563521A (zh) * 2017-07-27 2018-01-09 深圳市盛路物联通讯技术有限公司 一种安全管理方法及终端设备
CN107579991B (zh) * 2017-09-28 2021-03-02 奇安信科技集团股份有限公司 一种对客户端进行云端防护认证的方法、服务器和客户端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130117400A1 (en) * 2010-07-08 2013-05-09 National It Industry Promotion Agency Electronic document distribution system and electronic document distribution method
CN104219626A (zh) * 2014-08-25 2014-12-17 北京乐富科技有限责任公司 一种身份认证的方法和装置
CN105188055A (zh) * 2015-08-14 2015-12-23 中国联合网络通信集团有限公司 无线网络接入方法、无线接入点以及服务器
CN105262773A (zh) * 2015-11-09 2016-01-20 北京世纪龙脉科技有限公司 一种物联网系统的验证方法及装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111769952A (zh) * 2020-06-29 2020-10-13 福建福链科技有限公司 一种区块链传感器的数据处理系统
CN111769952B (zh) * 2020-06-29 2024-04-02 福建福链科技有限公司 一种区块链传感器的数据处理系统
CN112016079A (zh) * 2020-08-27 2020-12-01 深圳市亲邻科技有限公司 设备终端验证方法、装置及存储介质
CN116055220A (zh) * 2023-03-20 2023-05-02 睿至科技集团有限公司 一种物联网终端安全防护管控方法及系统
CN116055220B (zh) * 2023-03-20 2023-08-01 睿至科技集团有限公司 一种物联网终端安全防护管控方法及系统

Also Published As

Publication number Publication date
CN112260995B (zh) 2022-05-24
CN112260995A (zh) 2021-01-22
CN110324287B (zh) 2020-10-23
CN110324287A (zh) 2019-10-11

Similar Documents

Publication Publication Date Title
WO2019184736A1 (zh) 接入认证方法、装置及服务器
Mallik Man-in-the-middle-attack: Understanding in simple words
US9935954B2 (en) System and method for securing machine-to-machine communications
JP5390619B2 (ja) Ｈｏｍｅｎｏｄｅ−ｂ装置およびセキュリティプロトコル
JP5688087B2 (ja) 信頼できる認証およびログオンのための方法および装置
JP6757845B2 (ja) 秘密識別子を使用するユーザ機器に関連した動作
US10470102B2 (en) MAC address-bound WLAN password
US9258278B2 (en) Unidirectional deep packet inspection
CN108880813B (zh) 一种附着流程的实现方法及装置
Islam et al. An analysis of cybersecurity attacks against internet of things and security solutions
US20170238236A1 (en) Mac address-bound wlan password
CN108712364B (zh) 一种sdn网络的安全防御系统及方法
KR20150053912A (ko) 서버에 클라이언트를 등록하기 위한 방법 및 디바이스들
US9106572B2 (en) Immobilization module for security on a communication system
Khandare et al. Analysis on privacy protection in cloudlet and edge technology
CN114301967B (zh) 窄带物联网控制方法、装置及设备
CN106878989B (zh) 一种接入控制方法及装置
KR102558821B1 (ko) 사용자 및 디바이스 통합 인증 시스템 및 그 방법
WO2018172776A1 (en) Secure transfer of data between internet of things devices
US11316890B2 (en) Network denial of service defense method and system
JP2017139026A (ja) 信頼できる認証およびログオンのための方法および装置
Lee et al. Man-in-the-middle Attacks Detection Scheme on Smartphone using 3G network
JP2015111440A (ja) 信頼できる認証およびログオンのための方法および装置
GB2560895A (en) Secure transfer of data between internet of things devices
Maheshwary et al. Safeguarding the Connected Future: Security in Internet of Things (IoT)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19774842

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 19774842

Country of ref document: EP

Kind code of ref document: A1