WO2022016435A1 - 接入认证方法、装置、设备及存储介质 - Google Patents

接入认证方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2022016435A1
WO2022016435A1 PCT/CN2020/103637 CN2020103637W WO2022016435A1 WO 2022016435 A1 WO2022016435 A1 WO 2022016435A1 CN 2020103637 W CN2020103637 W CN 2020103637W WO 2022016435 A1 WO2022016435 A1 WO 2022016435A1
Authority
WO
WIPO (PCT)
Prior art keywords
platform
random number
cloud
bluetooth mesh
mesh device
Prior art date
Application number
PCT/CN2020/103637
Other languages
English (en)
French (fr)
Inventor
茹昭
张军
罗朝明
Original Assignee
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Oppo广东移动通信有限公司 filed Critical Oppo广东移动通信有限公司
Priority to CN202080101163.2A priority Critical patent/CN115669209A/zh
Priority to PCT/CN2020/103637 priority patent/WO2022016435A1/zh
Publication of WO2022016435A1 publication Critical patent/WO2022016435A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Definitions

  • the present application relates to the field of network technologies, and in particular, to an access authentication method, apparatus, device, and storage medium.
  • Bluetooth wireless mesh (Mesh) technology is a key technology of many-to-many based on Bluetooth.
  • Bluetooth Mesh devices based on Bluetooth Mesh technology can perform access authentication across different platforms.
  • the authentication information (AuthValue) of the Bluetooth Mesh device belonging to the E company is stored in the B platform cloud, and the Bluetooth Mesh device is configured by the A platform gateway to access the network.
  • the A platform gateway and the A platform cloud corresponding to the A platform gateway need to help pass the provisioning confirmation value corresponding to the B platform cloud, so that the Bluetooth Mesh device can be authenticated through the B platform cloud.
  • the elliptic curve algorithm (Elliptic Curves Diffie-Hellman, ECDH) is calculated by the A platform gateway and the Bluetooth Mesh device, and the shared root key (ECDHSecret) is obtained by calculation.
  • ECDHSecret shared root key
  • the embodiments of the present application provide an access authentication method, apparatus, device, and storage medium, which avoids the risk of leakage of the Static OOB authentication information AuthValue of the Bluetooth Mesh device, and ensures the security of the Bluetooth Mesh device during the access process.
  • the technical solution is as follows.
  • an access authentication method is provided, which is applied in a first platform cloud, where the first platform cloud is a cloud server that stores authentication information of a Bluetooth Mesh device, and the method includes:
  • the authentication information of the network distribution device is generated, and the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device.
  • an access authentication method is provided, which is applied to a Bluetooth wireless mesh network Mesh device, and the method includes:
  • the first platform cloud is a cloud server that stores the authentication information of the Bluetooth Mesh device, the Bluetooth Mesh device is configured to access the network by the second platform gateway, and the shared root key is used to generate a device confirmation value deviceconfirmation, The device confirmation value is used for access authentication with the first platform cloud.
  • an access authentication method is provided, which is applied in a second platform gateway,
  • the second platform gateway is used to configure the Bluetooth wireless mesh network Mesh device into the network, the Bluetooth Mesh device is stored by the first platform cloud
  • the authentication information of the Bluetooth Mesh device, and the cloud server corresponding to the second platform gateway is:
  • the second platform cloud, the method includes:
  • the second platform cloud receive the authentication information of the network distribution device whose source address is the first platform cloud, and the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device;
  • the authentication information of the network distribution device is generated by the first platform cloud according to the shared root key ECDHSecret, and the shared root key is calculated by the elliptic curve algorithm ECDH calculation performed by the first platform cloud and the Bluetooth Mesh device get.
  • an access authentication method is provided, which is applied in a first platform cloud, where the first platform cloud is a cloud server that stores authentication information of a Bluetooth Mesh device, and the method includes:
  • the destination address of the authentication information is a second platform gateway, and the second platform gateway is used to configure the Bluetooth Mesh device into a network;
  • the authentication information is used for the second platform gateway to authenticate the Bluetooth Mesh device.
  • an access authentication method is provided, which is applied to a second platform gateway, where the second platform gateway is used to configure a Bluetooth wireless mesh network mesh device into the network, and the Bluetooth mesh device is configured by a second platform gateway.
  • a platform cloud saves the authentication information of the Bluetooth Mesh device, the cloud server corresponding to the second platform gateway is the second platform cloud, and the method includes:
  • the authentication information of the network distribution device is generated, and the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device.
  • an access authentication method is provided, which is applied to a Bluetooth Mesh device, where the Bluetooth Mesh device is configured to access the network by a second platform gateway, and the Bluetooth Mesh device is stored by the first platform cloud.
  • Authentication information of the Mesh device the method includes:
  • the authentication information AuthValue corresponding to this network configuration process is generated, and the authentication information is the same as the authentication information at the first platform cloud.
  • an access authentication device which is applied in a first platform cloud, where the first platform cloud is a cloud server that stores authentication information of a Bluetooth Mesh device, and the device includes: a generation module ;
  • the generation module is used to perform ECDH calculation with the Bluetooth Mesh device, and generate a shared root key ECDHSecret, and the Bluetooth Mesh device is configured to enter the network by the second platform gateway;
  • the generating module is configured to generate authentication information of the network distributor according to the shared root key, where the authentication information of the network distributor is used to perform access authentication with the Bluetooth Mesh device.
  • an access authentication apparatus which is applied to a Bluetooth Mesh device, and the apparatus includes: a generating module;
  • the generating module is used to perform ECDH calculation with the first platform cloud to generate a shared root key ECDHSecret;
  • the first platform cloud is a cloud server that stores the authentication information of the Bluetooth Mesh device, the Bluetooth Mesh device is configured to access the network by the second platform gateway, and the shared root key is used to generate a device confirmation value deviceconfirmation, The device confirmation value is used for access authentication with the first platform cloud.
  • an access authentication device which is applied to a second platform gateway, where the second platform gateway is used to configure a Bluetooth wireless mesh network mesh device into the network, and the Bluetooth mesh device is configured by a first platform gateway.
  • a platform cloud saves the authentication information of the Bluetooth Mesh device, the cloud server corresponding to the second platform gateway is the second platform cloud, and the device includes: a receiving module and a sending module;
  • the receiving module is configured to receive, through the second platform cloud, the authentication information of the network distributor whose source address is the first platform cloud, and the authentication information of the network distributor is used to access the Bluetooth Mesh device certification;
  • the sending module is configured to forward the authentication information of the network distributor to the Bluetooth Mesh device;
  • the authentication information of the network distribution device is generated by the first platform cloud according to the shared root key ECDHSecret, and the shared root key is calculated by the elliptic curve algorithm ECDH calculation performed by the first platform cloud and the Bluetooth Mesh device get.
  • an access authentication device which is applied in a first platform cloud, where the first platform cloud is a cloud server that stores authentication information of a Bluetooth Mesh device, and the device includes: a generation module and sending module;
  • the generation module is configured to generate authentication information AuthValue corresponding to this network distribution process in response to the Bluetooth Mesh device starting the network configuration process, where the authentication information is the same as the authentication information at the Bluetooth Mesh device;
  • the sending module is configured to send the authentication information, where the destination address of the authentication information is a second platform gateway, and the second platform gateway is used to configure the Bluetooth Mesh device into a network;
  • the authentication information is used for the second platform gateway to authenticate the Bluetooth Mesh device.
  • an access authentication device which is applied to a second platform gateway, where the second platform gateway is used to configure a Bluetooth wireless mesh network mesh device into the network, and the Bluetooth mesh device is configured by a first platform gateway.
  • a platform cloud saves the authentication information of the Bluetooth Mesh device, the cloud server corresponding to the second platform gateway is the second platform cloud, and the device includes: a receiving module and a generating module;
  • the receiving module is configured to receive, through the second platform cloud, the authentication information AuthValue sent by the first platform cloud;
  • the generating module is configured to generate authentication information of the network distributor according to the authentication information, and the authentication information of the network distributor is used to perform access authentication with the Bluetooth Mesh device.
  • an access authentication device which is applied to a Bluetooth Mesh device, where the Bluetooth Mesh device is configured to access the network by a second platform gateway, and the Bluetooth Mesh device is stored by the first platform cloud.
  • Authentication information of Mesh equipment the device includes: a generating module;
  • the generation module is configured to generate authentication information AuthValue corresponding to the current network distribution process in response to the Bluetooth Mesh device starting the network distribution process, where the authentication information is the same as the authentication information at the first platform cloud.
  • a first platform cloud includes: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor ; wherein the processor is configured to load and execute the executable instructions to implement the access authentication method described in the above aspects.
  • a second platform gateway comprising: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor ; wherein the processor is configured to load and execute the executable instructions to implement the access authentication method described in the above aspects.
  • a Bluetooth Mesh device comprising: a processor; a transceiver connected to the processor; a memory for storing executable instructions of the processor; wherein , the processor is configured to load and execute the executable instructions to implement the access authentication method described in the above aspects.
  • a computer-readable storage medium is provided, and executable instructions are stored in the readable storage medium, and the executable instructions are loaded and executed by a processor to implement the interface described in the above aspect. Enter the authentication method.
  • a computer program product or computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium, the processor of the computer device being readable from the computer
  • the storage medium reads the computer instruction, and the processor executes the computer instruction, so that the computer device executes the access authentication method described in the above aspects.
  • the shared root key is generated by the ECDH calculation performed by the first platform cloud and the Bluetooth Mesh device, which avoids that when the second platform gateway and the Bluetooth Mesh device perform the ECDH calculation, the confirmation value (such as the configuration end confirmation) is exchanged through the second platform gateway. value), and the second platform gateway stores the shared root key generated by ECDH calculation, which leads to the risk of leakage of the StaticOOB authentication information AuthValue of the Bluetooth Mesh device, which ensures the security of the Bluetooth Mesh device during the access process.
  • FIG. 1 is a block diagram of a cross-platform access authentication system for Bluetooth Mesh devices provided by an exemplary embodiment of the present application
  • FIG. 2 is a flowchart of a method for accessing and authenticating a device across different platforms provided by an exemplary embodiment of the related art
  • FIG. 3 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 4 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 5 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 6 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 7 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 8 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 9 is a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • FIG. 10 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 11 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 12 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 13 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 14 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 15 is a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a server provided by an exemplary embodiment of the present application.
  • Bluetooth low energy network topology for establishing many-to-many device communication. Allows the creation of large-scale networks based on multiple devices.
  • the network can contain dozens, hundreds or even thousands of Bluetooth Mesh devices, which can communicate with each other.
  • a device that is a member of a Bluetooth Mesh network is called a "node”, and a device that does not constitute a node is called a “device”.
  • provisioning a security process that adds the device to the Bluetooth Mesh network.
  • a device that is a member of a Bluetooth Mesh network is called a "node”
  • a device that does not constitute a node is called a “device”.
  • the process of starting the configuration will turn a common "Device” into a "Node”, making it an official member of the Bluetooth Mesh network.
  • the process of starting configuration mainly includes five stages: 1. Sending Beacon signal, 2. invitation, 3. Exchange of public key, 4. Authentication, 5. Start-up configuration data distribution.
  • Output Out-Of-Band For the authentication phase, there are three available verification methods: Output Out-Of-Band, Output OOB, Input OOB, and Static OOB (Static OOB) or No OOB (No OOB).
  • Static OOB Static OOB
  • No OOB No OOB
  • the verification method adopted by the device is StaticOOB.
  • FIG. 1 shows a block diagram of a cross-platform access authentication system for a Bluetooth Mesh device provided by an exemplary embodiment of the present application.
  • the system may include: a Bluetooth Mesh device 12, a second platform gateway 141, a second platform cloud 142, and a first Platform Cloud 16.
  • the Bluetooth Mesh device 12 is a device that supports Bluetooth technology and can be connected to a Bluetooth Mesh network.
  • the Bluetooth Mesh device includes various types of IoT devices, such as: light bulbs, speakers, mobile phones, etc., which are not limited in this embodiment of the present application.
  • the Bluetooth Mesh device 12 is configured into the network by the second platform gateway 141 , and the cloud server corresponding to the second platform gateway 141 is the second platform cloud 142 .
  • the second platform gateway 141 and the second platform cloud 142 are connected through a wired or wireless network.
  • the second platform cloud gateway 141 receives data from the Bluetooth Mesh device 12, performs computing processing on the data, and sends the data to the second platform cloud 142 for storage or further processing by the second platform cloud 142.
  • the Bluetooth Mesh device 12 is developed based on the first platform cloud 16 , and the authentication information of the Bluetooth Mesh device 12 is stored in the first platform cloud 16 .
  • the second platform cloud 142 sends the information required by the Bluetooth Mesh device 12 in the authentication process with the first platform cloud 16 to the first platform cloud 16; A platform cloud 16 information required in the authentication process.
  • the above-mentioned second platform cloud 142 and first platform cloud 16 are cloud computing resource pools in the field of cloud technology, and multiple types of virtual resources are deployed in the resource pools for external customers to choose and use.
  • the cloud computing resource pool mainly includes: computing devices (which are virtualized machines, including operating systems), storage devices, and network devices. It can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, intermediate Cloud servers for basic cloud computing services such as software services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.
  • CDN Content Delivery Network
  • FIG. 2 shows a flow chart of a method for accessing and authenticating devices across different platforms in a related art, and the method includes:
  • Step 21 the user activates and scans the gateway of platform A by using voice or APP.
  • Step 22 the device of E company (developed based on the B platform) broadcasts the Bluetooth Mesh unconfigured network broadcast packet according to the specification.
  • the broadcast packet contains the company identifier (Company Identifier, CID) of the B platform.
  • CID Company Identifier
  • Step 23 the A platform gateway queries the device type.
  • the gateway of platform A After obtaining the unconfigured network broadcast information broadcast by the equipment of E company, the gateway of platform A uploads the information to the cloud of platform A to query the type of the equipment.
  • Step 23.1 A platform cloud judges whether it is the device of this platform.
  • Step 23.2 A platform cloud queries the corresponding platform information of the device.
  • the cloud of platform A After receiving the device information reported by the gateway of platform A, the cloud of platform A determines through CID that the device of company E is not developed based on platform A, and requires authorization from other platforms.
  • Step 23.3 the platform cloud A obtains the platform information corresponding to the CID through the interconnection server.
  • the platform information includes information such as platform B authority management server (AuthServer).
  • AuthServer platform B authority management server
  • step 23.4 the A platform cloud queries the B platform cloud for the device type.
  • Step 23.5 the A platform cloud obtains the device type from the B platform cloud.
  • Step 24 the A platform cloud forwards the device type to the A platform gateway.
  • Step 25 the platform A gateway broadcasts the device and the device type to the user.
  • Step 26 user input: connect device.
  • Step 27 the gateway of platform A and the device of company E perform a connection and invitation process (Link&Invitation).
  • Step 27.1 the platform A gateway sends a provisioning start (Provisioning Start) to the device of company E.
  • Step 27.2 the platform A gateway sends the provisioning public key (Provisioning Public Key) to the device of the E company.
  • Provisioning Public Key Provisioning Public Key
  • step 27.3 the device of company E sends the device public key (Device Public Key) to the gateway of platform A.
  • step 27.4 the device of company E and the gateway of platform A perform ECDH calculation to generate a confirmation key (ConfirmationKey).
  • Step 27.5 the A platform gateway reports the confirmation key generated in the device authentication process to the A platform cloud.
  • Step 27.6 A platform cloud reports the confirmation key to B platform cloud.
  • step 27.7 platform A obtains the provisioner confirmation value and provisioner random number required for authentication through platform B cloud.
  • step 27.8 the A platform cloud forwards the configuration end confirmation value and the configuration end random number to the A platform gateway.
  • step 27.9 the gateway of platform A sends the confirmation value of the configuration terminal to the device of company E.
  • step 27.10 the device of company E returns the device confirmation value (deviceconfirmation) of the device side.
  • step 27.11 the gateway of platform A sends the random number of the configuration terminal to the device of company E.
  • step 27.12 the equipment of company E verifies the confirmation value of the configuration terminal.
  • Step 27.13 if the verification is passed, the device of E company returns the device random number (devicerandom) on the device side.
  • step 27.14 the A platform gateway reports the device confirmation value and the device random number of the device to the A platform cloud.
  • Step 27.15 A platform cloud sends the device confirmation value and device random number to B platform cloud.
  • Step 27.16 the B platform cloud performs authentication verification.
  • Step 27.17 the B platform cloud returns the authentication result and device information.
  • the device information includes the control functions and control instructions supported by the device.
  • Step 27.18 A platform cloud storage device information.
  • Step 27.19 Platform A cloud forwards the authentication result to platform A gateway.
  • Step 28 the platform A gateway broadcasts the authentication result to the user.
  • the calculation methods of the confirmation key (ConfirmationKey), the provisioner confirmation value (provisioner confirmation), and the device confirmation value (deviceconfirmation) are as follows, which are derived from Bluetooth MeshProfilev1.0.1.
  • ConfirmationProvisioner AES-CMAC ConfirmationKey (RandomProvisioner
  • ECDHSecret P-256 (private key, peer public key).
  • the confirmation value of the configuration terminal generated by the cloud of platform B is related to the confirmation key and AuthValue
  • the confirmation key is stored at the gateway of platform A, and the confirmation value of the configuration terminal is received, the configuration terminal can be verified.
  • the confirmation value is decrypted, and the authentication information AuthValue of the device is deduced, resulting in the leakage of the authentication information of the device.
  • the StaticOOB information (ie AuthValue) is constant, for example, it is pre-generated and directly burned into the Bluetooth Mesh device when it leaves the factory.
  • the StaticOOB information (ie AuthValue) will be regenerated every time the network is configured.
  • FIG. 3 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • the method can be applied to the cross-platform access authentication system for Bluetooth Mesh devices as shown in Figure 1, and the method includes:
  • Step 310 the first platform cloud and the Bluetooth Mesh device perform ECDH calculation to generate a shared root key (ECDHSecret).
  • a Bluetooth Mesh device is a device that supports access to a Bluetooth Mesh network.
  • Bluetooth mesh devices include various types of household equipment (such as electric lights), industrial assets (such as examination equipment in hospitals), and more.
  • the platform corresponding to the first platform cloud is a platform for developing Bluetooth Mesh devices.
  • the first platform cloud stores the authentication information (AuthValue) of the Bluetooth Mesh device.
  • the second platform gateway is a node that supports adding Bluetooth Mesh devices to the Bluetooth Mesh network.
  • the Bluetooth Mesh devices are configured to enter the network by the second platform gateway, and the cloud server corresponding to the second platform gateway is the second platform cloud and the first platform cloud.
  • the first platform cloud and the second platform cloud are two different platform clouds and belong to different platforms.
  • the Bluetooth Mesh device performs a connection and invitation process (Link&Invitation) with the gateway of the second platform, and the second platform obtains information required by the Bluetooth Mesh device in the authentication process from the cloud of the first platform.
  • Link&Invitation connection and invitation process
  • ECDH is a DH (Diffie-Hellman) key exchange algorithm based on Elliptic Curve Cryptosystems (ECC). Exchange parties can negotiate a key without sharing any secrets. And the algorithm inherits the outstanding advantages of short ECC key length, fast calculation speed and good security performance.
  • the ECDH calculation is performed by the second platform gateway and the Bluetooth Mesh device.
  • the ECDH calculation process is transferred to the first platform cloud, and the first platform cloud and the Bluetooth Mesh The device performs ECDH calculation, and both the first platform cloud and the Bluetooth Mesh device generate a shared root key.
  • both the first platform cloud and the Bluetooth Mesh device support the FIPS P-256 elliptic curve algorithm, and can perform ECDH calculation to generate a shared root key.
  • a secure channel is created through asymmetric encryption based on this algorithm to complete the rest of the boot configuration process.
  • private key is the private key of both parties
  • peer public key is the public key of both parties.
  • the shared root key is used to derive other keys, such as: a device key (DevKey), a session key (SessionKey), and a session random number (SessionNonce).
  • a device key (DevKey)
  • SessionKey a session key
  • SessionNonce a session random number
  • Step 320 the first platform cloud generates authentication information of the network distributor according to the shared root key.
  • the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device.
  • the Bluetooth Mesh device and the first platform cloud need to verify the authentication information generated by the other party according to the shared device authentication information AuthValue. If the verification is passed, continue the next process.
  • the authentication information of the network distribution device is the authentication information of the configuration terminal corresponding to the first platform cloud.
  • the destination address of the authentication information of the network distributor is the Bluetooth Mesh device, and the Bluetooth Mesh device can check and verify the authentication information of the network distributor.
  • the Bluetooth Mesh device generates a device confirmation value according to the shared root key.
  • the device confirmation value is the device-side authentication information corresponding to the Bluetooth Mesh device.
  • the network distributor authentication information includes a configuration terminal confirmation value.
  • Step 310 includes: the first platform cloud generates a confirmation key according to the shared root key; generates a configuration-side random number, and the configuration-side random number and the authentication information of the Bluetooth Mesh device form a first plaintext; use the confirmation key to perform the first plaintext. Encrypted to generate configuration-side confirmation values.
  • ConfirmationProvisioner AES-CMACConfirmationKey(RandomProvisioner
  • AES-CMAC is an encryption algorithm.
  • the first platform cloud generates a confirmation key according to the shared root key, including: the first platform cloud obtains a confirmation input value (ConfirmationInputs); according to the confirmation input value, generating a confirmation salt value (ConfirmationSalt); according to the confirmation salt value , shared root key and the string "prck" to generate a confirmation key.
  • a confirmation input value ConfirmationInputs
  • ConfirmationSalt confirmation salt value
  • ConfirmationKey k1 (ECDHSecret, ConfirmationSalt, "prck”).
  • the first platform cloud obtains the confirmation input value including: the first platform cloud receives the configuration information whose source address is the second platform gateway; the receiving source address is the device public key of the Bluetooth Mesh device; generating the configuration terminal public key; Information, device public key and configuration terminal public key, generate confirmation input value; wherein, configuration information includes: configuration invitation protocol data unit value (ProvisioningInvitePDUValue), configuration capability protocol data unit value (ProvisioningCapabilitiesPDUValue), configuration start protocol data unit value (ProvisioningStartPDUValue) ) at least one of them.
  • configuration Information includes: configuration invitation protocol data unit value (ProvisioningInvitePDUValue), configuration capability protocol data unit value (ProvisioningCapabilitiesPDUValue), configuration start protocol data unit value (ProvisioningStartPDUValue) ) at least one of them.
  • ConfirmationInputs ProvisioningInvitePDUValue
  • the second platform includes a second platform gateway and a second platform cloud.
  • the process of sending the configuration information by the second platform includes: the second platform gateway sends the configuration information, and the destination address of the configuration information is the first platform cloud; and the second platform cloud forwards the configuration information to the first platform cloud.
  • the device public key of the Bluetooth Mesh device will also be forwarded through the second platform, including: receiving the device public key whose source address is the Bluetooth Mesh device through the second platform gateway; the second platform gateway forwarding the device to the second platform cloud public key; the second platform cloud forwards the device public key to the first platform cloud.
  • the network distributor and the Bluetooth Mesh device to be distributed need to exchange public keys.
  • the first platform cloud sends the configuration terminal generated by itself to the Bluetooth Mesh device. public key.
  • the first platform cloud sends the public key of the configuration terminal, and the destination address of the public key of the configuration terminal is a Bluetooth Mesh device.
  • the second platform includes a second platform gateway and a second platform cloud
  • the public key of the configuration terminal will reach the Bluetooth Mesh device through the forwarding of the second platform, including: through the second platform cloud, the receiving source address is the first platform cloud.
  • the second platform cloud forwards the configuration end public key to the second platform gateway; the second platform gateway forwards the configuration end public key to the Bluetooth Mesh device.
  • Step 330 the first platform cloud sends the authentication information of the network distributor to the second platform cloud.
  • the first platform cloud sends the network distribution device authentication information to the second platform cloud, and the second platform cloud correspondingly receives the network distribution device authentication information from the first platform cloud.
  • Step 340 the second platform cloud forwards the authentication information of the network distributor to the second platform gateway.
  • Step 350 the second platform gateway forwards the authentication information of the network distributor to the Bluetooth Mesh device.
  • the authentication information of the network distributor arrives at the destination address of the Bluetooth Mesh device from the source address of the first platform cloud.
  • the Bluetooth Mesh device verifies the authentication information of the network adapter, and if the verification passes, the network configuration process is continued, and if the verification fails, the network configuration process is terminated.
  • the first platform cloud also verifies the authentication information (such as the device confirmation value) from the device side of the Bluetooth Mesh device accordingly. After the verification, the verification result needs to be fed back.
  • the first platform cloud sends the device key, session key and session random number to the second platform.
  • the above three kinds of data are generated by the first platform cloud and sent to the second platform for the second platform to use the above three kinds of data subsequently.
  • the second platform includes a second platform gateway and a second platform cloud
  • the process of receiving the above three data by the second platform includes: receiving, through the second platform cloud, the device key whose source address is the first platform cloud, Session key and session random number; the second platform cloud forwards the device key, session key and session random number to the second platform gateway.
  • the shared root key is generated by performing ECDH calculation on the first platform cloud and the Bluetooth Mesh device.
  • the platform gateway exchanges the confirmation value (such as the confirmation value of the configuration terminal), and the second platform gateway stores the shared root key generated by ECDH calculation, which leads to the risk of leakage of the StaticOOB authentication information AuthValue of the Bluetooth Mesh device, which ensures that the Bluetooth Mesh device can Security during access.
  • FIG. 4 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • the method can be applied to the cross-platform access authentication system for Bluetooth Mesh devices as shown in Figure 1, and the method includes:
  • Step 41 the user activates the scanning of the second platform gateway using voice or APP.
  • Step 42 the Bluetooth Mesh device (developed based on the first platform) broadcasts the Bluetooth Mesh unconfigured broadcast packet according to the specification.
  • the broadcast packet includes the CID of the first platform.
  • Step 43 the second platform gateway queries the device type.
  • the second platform gateway After the second platform gateway obtains the unconfigured broadcast information broadcast by the Bluetooth Mesh device, it uploads the information to the second platform cloud to query the type of the device.
  • Step 43.1 the second platform cloud judges whether it is the device of this platform.
  • Step 43.2 the second platform cloud queries the CID corresponding to the device.
  • the second platform cloud After the second platform cloud receives the device information reported by the second platform gateway, it judges through the CID that the Bluetooth Mesh device is not a device developed based on the second platform, and requires authorization from other platforms.
  • Step 43.3 the second platform cloud obtains the platform information corresponding to the CID through the interconnection server.
  • the platform information includes information such as the rights management server of the first platform.
  • Step 43.4 the second platform cloud queries the first platform cloud for the device type.
  • Step 43.5 the second platform cloud obtains the device type from the first platform cloud.
  • Step 44 the second platform cloud forwards the device type to the second platform gateway.
  • Step 45 the second platform gateway broadcasts the device and the device type to the user.
  • Step 46 user input: connect device.
  • Step 47 the second platform gateway connects and invites the Bluetooth Mesh device.
  • Step 47.1 the second platform gateway reports the configuration invitation protocol data unit value, the configuration capability protocol data unit value, and the configuration start protocol data unit value to the second platform cloud.
  • Step 47.2 the second platform cloud reports the configuration invitation protocol data unit value, the configuration capability protocol data unit value, and the configuration start protocol data unit value to the first platform cloud.
  • Step 47.3 the first platform cloud generates and reports the public key of the configuration terminal to the second platform cloud.
  • Step 47.4 the second platform cloud sends the public key of the configuration terminal to the second platform gateway.
  • Step 47.5 the second platform gateway sends the configuration to the Bluetooth Mesh device to start.
  • Step 47.6 the second platform gateway sends the public key of the configuration terminal to the Bluetooth Mesh device.
  • Step 47.7 the Bluetooth Mesh device sends the device public key to the second platform gateway.
  • Step 47.8 the second platform gateway sends the device public key to the second platform cloud.
  • Step 47.9 the second platform cloud sends the device public key to the first platform cloud.
  • Step 47.10 the Bluetooth Mesh device and the first platform cloud perform ECDH calculation to generate a confirmation key.
  • Step 47.11 the second platform cloud obtains the configuration-side confirmation value and the configuration-side random number required for authentication through the first platform cloud.
  • Step 47.12 the second platform cloud forwards the configuration end confirmation value and the configuration end random number to the second platform gateway.
  • Step 47.13 the second platform gateway sends the confirmation value of the configuration terminal to the Bluetooth Mesh device.
  • Step 47.14 the Bluetooth Mesh device returns the device confirmation value on the device side.
  • Step 47.15 the second platform gateway sends the configuration terminal random number to the Bluetooth Mesh device.
  • Step 47.16 the Bluetooth Mesh device verifies the confirmation value of the configuration terminal.
  • Step 47.17 the verification is passed, and the Bluetooth Mesh device returns the device random number on the device side.
  • Step 47.18 the second platform gateway reports the device confirmation value of the device and the device random number to the second platform cloud.
  • Step 47.19 the second platform cloud sends the device confirmation value and the device random number to the first platform cloud.
  • Step 47.20 the first platform cloud performs authentication verification.
  • Step 47.21 the first platform cloud returns the authentication result, device information, device key, session key and session random number.
  • the device information includes the control functions and control instructions supported by the device.
  • Step 47.22 the second platform cloud storage device information.
  • Step 47.23 the second platform cloud forwards the authentication result, device information, device key, session key and session random number to the second platform gateway.
  • the second platform gateway stores the device key for subsequent configuration of the Bluetooth Mesh device, the second platform gateway encrypts and authenticates the configuration data using the session key and the session random number, and then sends the configuration data to the Bluetooth Mesh device.
  • Step 48 the second platform gateway broadcasts the authentication result to the user.
  • the method provided in this embodiment not only ensures the security of the Bluetooth Mesh device during the access process, but also supports the cross-platform authentication access of the existing Bluetooth Mesh device with constant StaticOOB information.
  • the public-private key pair on the Bluetooth Mesh device side adopts a fixed method, instead of being regenerated every time the network is configured, so that the shared root key remains unchanged, and the second platform gateway can Use the configuration end public key, configuration end confirmation value, configuration end random number, session key and session random number generated in the last and the same device network configuration process to replay the device, so that the Bluetooth Mesh device does not go through the first time.
  • the network can also be successfully configured, which affects the security of the Bluetooth Mesh device during the network configuration process.
  • the Bluetooth Mesh device receives the public key of the configuration terminal whose source address is the cloud of the first platform; checks the public key of the configuration terminal; if the public key of the configuration terminal is stored in the local record, the configuration terminal is terminated. network process; if the public key of the configuration terminal is not in the local record, the public key of the device is fed back.
  • the Bluetooth Mesh device corresponds to a local record
  • the local record records the historical configuration terminal public key received by the Bluetooth Mesh device during the historical network configuration process.
  • this embodiment of the present application does not limit the number of historical configuration terminal public keys recorded in the local record.
  • the public key of the configuration terminal received by the Bluetooth Mesh device is stored in the local record and belongs to the public key of the historical configuration terminal, it means that the public key of the configuration terminal received by the Bluetooth Mesh device may be used by the second platform.
  • the gateway is used for replay attacks, and the Bluetooth Mesh device terminates the network configuration process; if the public key of the configuration side received by the Bluetooth Mesh device is not in the local record and does not belong to the public key of the historical configuration side, it means that the Bluetooth Mesh device receives the public key of the configuration side.
  • the public key of the configuration terminal may be regenerated by the first platform cloud, and the Bluetooth Mesh device continues the network configuration process and starts to feed back the public key of the device.
  • FIG. 5 adds step 57.7 on the basis of FIG. 4 : the Bluetooth Mesh device checks the public key of the configuration terminal.
  • the Bluetooth Mesh device can also check one or more of the configuration end public key, configuration end confirmation value, configuration end random number, session key, and session random number to ensure the accuracy of the inspection result.
  • the local record records the historical configuration terminal confirmation value received by the Bluetooth Mesh device during the historical network configuration process.
  • the Bluetooth Mesh device determines whether to terminate the network configuration process according to whether the received configuration terminal confirmation value is stored in the local record.
  • the local record records the historical configuration terminal public key and historical configuration terminal random number received by the Bluetooth Mesh device during the historical network configuration process. After the Bluetooth Mesh device receives the public key of the configuration end, it is determined that the public key of the configuration end belongs to the public key of the historical configuration end, then the Bluetooth Mesh device continues the network configuration process first, and the random number of the configuration end received subsequently also belongs to the random number of the historical configuration end In the case of , the network distribution process is terminated.
  • the first platform cloud receives the first random number whose source address is the Bluetooth Mesh device; and generates the confirmation input value according to the first random number, configuration information, the public key of the device and the public key of the configuration terminal.
  • the Bluetooth Mesh device sends a first random number, and the destination address of the first random number is the first platform cloud; wherein, the first random number is used for the first platform cloud to generate a confirmation input value.
  • the second platform includes: a second platform gateway and a second platform cloud.
  • the process of the second platform sending the first random number includes: receiving the first random number whose source address is a Bluetooth Mesh device through the second platform gateway; the second platform gateway forwarding the first random number to the second platform cloud; the second platform cloud The first random number is forwarded to the first platform cloud, where the first random number is used for the first platform cloud to generate a confirmation input value.
  • the Bluetooth Mesh device At the beginning of each network distribution process, the Bluetooth Mesh device generates a first random number, and the confirmation input value generated by the first platform cloud is related to the first random number. Since the configuration end confirmation value generated by the first platform cloud is related to the confirmation input value, it can be ensured that the configuration end confirmation value is different each time, and the second platform gateway cannot use the historical configuration end confirmation value of the historical record to complete the connection with Bluetooth Mesh.
  • the authentication process of the device is to say, at the beginning of each network distribution process, the Bluetooth Mesh device generates a first random number, and the confirmation input value generated by the first platform cloud is related to the confirmation input value. Since the configuration end confirmation value generated by the first platform cloud is related to the confirmation input value, it can be ensured that the configuration end confirmation value is different each time, and the second platform gateway cannot use the historical configuration end confirmation value of the historical record to complete the connection with Bluetooth Mesh.
  • the authentication process of the device is to say, at the beginning of each network distribution process, the Bluetooth Mesh device generates a first
  • ConfirmationInputs ProvisioningInvitePDUValue
  • the first random number is contained in a Universally Unique Identifier (UUID).
  • UUID Universally Unique Identifier
  • the Bluetooth Mesh device generates a first random number and fills it in the UUID every time it enters the state to be connected to the network.
  • FIG. 6 modifies the following steps:
  • Step 62 the Bluetooth Mesh device broadcasts a Bluetooth Mesh unconfigured broadcast packet according to the specification, and the broadcast packet carries the first random number.
  • Step 63 the second platform gateway queries the device type, which carries the first random number.
  • Step 63.4 the second platform cloud queries the first platform cloud for the device type, carrying the first random number.
  • step 63.5 the first platform cloud saves the first random number for calculating the confirmation input value.
  • the Bluetooth Mesh device sends a second random number, and the destination address of the second random number is the first platform cloud; wherein, the second random number is used for the first platform cloud to generate the first verification information (VerifyValue). Calculate the second proofreading information according to the second random number; forward it through the second platform, and receive the first proofreading information whose source address is the first platform cloud; when the first proofreading information and the second proofreading information are different, terminate the distribution network Process.
  • the first platform cloud receives the second random number whose source address is the Bluetooth Mesh device; uses the authentication information of the Bluetooth Mesh device to encrypt the second random number to generate the first proofreading information; sends the first proofreading information, the first proofreading The destination address of the information is the Bluetooth Mesh device; wherein, the first proofreading information is used for the Bluetooth Mesh device to determine whether to terminate the network distribution process.
  • the second platform includes: a second platform gateway and a second platform cloud.
  • the process of the second platform forwarding the second random number and the first proofreading information includes: receiving, through the second platform gateway, the second random number whose source address is a Bluetooth Mesh device; the second platform gateway forwarding the second random number to the second platform cloud The second platform cloud forwards the second random number to the first platform cloud, and the second random number is used for the first platform cloud to generate the first proofreading information; through the second platform cloud, the receiving source address is the first platform cloud. proofreading information; the second platform cloud forwards the first proofreading information to the second platform gateway; the second platform gateway sends the first proofreading information to the Bluetooth Mesh device.
  • the Bluetooth Mesh device At the beginning of each network configuration process, the Bluetooth Mesh device generates a second random number and informs the first platform cloud of the second random number.
  • the first platform cloud and the Bluetooth Mesh device use the same authentication information and second random number of the Bluetooth Mesh device to calculate the proofreading information according to the same formula. If the second proofreading information calculated by the Bluetooth Mesh device is the same as the received first proofreading information, continue the subsequent process to ensure that the first platform cloud participates in the access authentication.
  • the second random number is contained in the UUID.
  • the Bluetooth Mesh device generates a second random number and fills it in the UUID every time it enters the state to be connected to the network.
  • FIG. 7 modifies the following steps:
  • Step 72 the Bluetooth Mesh device broadcasts the Bluetooth Mesh unconfigured broadcast packet according to the specification, and the broadcast packet carries the second random number.
  • Step 73 the second platform gateway queries the device type, which carries the second random number.
  • Step 73.4 the second platform cloud queries the first platform cloud for the device type, carrying the second random number.
  • Step 73.6 the second platform cloud obtains the device type and the first proofreading information from the first platform cloud.
  • Step 74 the second platform cloud forwards the device type and the first proofreading information to the second platform gateway.
  • step 73.5 the first platform cloud uses the second random number to calculate the first proofreading information.
  • the Bluetooth Mesh device checks the first proofreading information.
  • the second platform cloud forwards the second random number generated by the Bluetooth Mesh device to the first platform cloud, and the first platform cloud uses the above calculation formula to calculate the first proofreading information and the device type and sends it to the second platform together Cloud, the second platform cloud sends the first proofreading information and device type to the second platform gateway, and the second platform gateway sends the first proofreading information to the Bluetooth Mesh device in the Link&Invatition process with the Bluetooth Mesh device, and the Bluetooth Mesh device uses The same calculation formula above calculates the second proofreading information, and compares the first proofreading information sent by the second platform gateway, if the same, the subsequent process continues, otherwise the connection is disconnected to terminate the network distribution process.
  • the method provided in this embodiment provides three different solutions to avoid the situation where the second platform gateway uses the information saved in the historical network configuration process to carry out replay attacks to successfully configure the network, and enhances the Bluetooth Mesh The security and reliability of the equipment distribution process.
  • FIG. 8 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • the method can be applied to the cross-platform access authentication system for Bluetooth Mesh devices as shown in Figure 1, and the method includes:
  • Step 810 in response to the Bluetooth Mesh device starting the network configuration process, the first platform cloud generates authentication information corresponding to the current network configuration process, and the authentication information is the same as the authentication information at the Bluetooth Mesh device.
  • a Bluetooth Mesh device is a device that supports access to a Bluetooth Mesh network.
  • Bluetooth mesh devices include various types of household equipment (such as electric lights), industrial assets (such as examination equipment in hospitals), and more.
  • the platform corresponding to the first platform cloud is a platform for developing Bluetooth Mesh devices.
  • the first platform cloud stores the authentication information (AuthValue) of the Bluetooth Mesh device.
  • the Bluetooth Mesh device regenerates the authentication information for the current network configuration process with the first platform cloud. That is to say, the authentication information is only valid in a single network distribution process.
  • the Bluetooth Mesh device in response to the Bluetooth Mesh device starting the network configuration process, the Bluetooth Mesh device also generates authentication information corresponding to this network configuration process. Because the same parameters and the same formula are used to generate the authentication information, the authentication information at the Bluetooth Mesh device is the same as the authentication information at the first platform cloud.
  • the embodiment of the present application does not limit the specific implementation manner of the first platform cloud and the Bluetooth Mesh device to generate the authentication information corresponding to this network distribution process.
  • Step 820 the first platform cloud sends authentication information to the second platform.
  • the second platform gateway is a node that supports adding Bluetooth Mesh devices to the Bluetooth Mesh network.
  • the Bluetooth Mesh devices are configured to enter the network by the second platform gateway, and the cloud server corresponding to the second platform gateway is the second platform cloud and the first platform cloud.
  • the first platform cloud and the second platform cloud are two different platform clouds and belong to different platforms.
  • the first platform cloud sends the dynamically generated authentication information to the second platform for the second platform gateway to use the authentication information to complete the authentication of the Bluetooth Mesh device.
  • the first platform cloud receives the third random number whose source address is the Bluetooth Mesh device; if the third random number is not in the local record, the authentication information is sent, The destination address of the authentication information is the second platform gateway.
  • the Bluetooth Mesh device sends a third random number, and the destination address of the third random number is the first platform cloud.
  • the second platform includes: a second platform gateway and a second platform cloud.
  • the process of the second platform forwarding the third random number includes: receiving the third random number whose source address is a Bluetooth Mesh device through the second platform gateway; the second platform gateway forwarding the third random number to the second platform cloud; the second platform cloud The third random number is forwarded to the first platform cloud; wherein, the third random number is used for the first platform cloud to determine whether to send authentication information to the second platform.
  • the first platform cloud corresponds to a local record
  • the local record records the historical third random number received by the first platform cloud during the historical network distribution process.
  • this embodiment of the present application does not limit the number of historical third random numbers recorded in the local record.
  • the third random number received by the first platform cloud is not in the local record and does not belong to the historical third random number, it means that the Bluetooth Mesh device has restarted a new round of network distribution process. Then the first platform cloud uses the third random number to generate authentication information corresponding to this network distribution process.
  • the third random number is contained in the UUID.
  • the Bluetooth Mesh device generates a third random number and fills it in the UUID every time it enters the state to be connected to the network.
  • Step 830 Receive the authentication information sent by the first platform cloud through the second platform cloud.
  • Step 840 the second platform cloud forwards the authentication information to the second platform gateway.
  • Step 850 the second platform gateway generates authentication information of the network distributor according to the authentication information.
  • the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device.
  • the destination address of the authentication information of the network adapter is a Bluetooth Mesh device, and the Bluetooth Mesh device can check and verify the authentication information of the network adapter.
  • the authentication information of the network distributor includes the confirmation value of the configuration side.
  • the second platform includes: a second platform gateway and a second platform cloud.
  • the second platform gateway After step 850: the second platform gateway generates an authentication result; the second platform gateway sends the authentication result to the second platform cloud. Since the second platform gateway stores the authentication information corresponding to this network distribution process, the second platform gateway generates an authentication result after checking the device confirmation value, and sends the confirmation result to the second platform cloud for storage.
  • the authentication information AuthValue of the Bluetooth Mesh device is dynamically generated during each network configuration, and is only valid in a single network configuration cycle, thereby avoiding the existence of the StaticOOB authentication information AuthValue of the Bluetooth Mesh device.
  • the problem of leakage risk ensures the security of Bluetooth Mesh devices during the access process.
  • FIG. 9 shows a flowchart of an access authentication method provided by an exemplary embodiment of the present application.
  • the method can be applied to the cross-platform access authentication system for Bluetooth Mesh devices as shown in Figure 1, and the method includes:
  • Step 91 the user activates the scanning of the second platform gateway using voice or APP.
  • Step 92 the Bluetooth Mesh device (developed based on the first platform) broadcasts the Bluetooth Mesh unconfigured broadcast packet according to the specification, and the broadcast packet carries a third random number.
  • the broadcast packet includes the CID corresponding to the first platform.
  • the Bluetooth Mesh device In each network distribution process, the Bluetooth Mesh device generates a third random number corresponding to this network distribution process, which is carried by the broadcast packet and sent.
  • Step 93 the second platform gateway queries the device type, which carries the third random number.
  • the second platform gateway After the second platform gateway acquires the unconfigured network broadcast information broadcast by the Bluetooth Mesh device, it uploads the information to the second platform cloud to query the type of the device, and at the same time, uploads the third random number to the second platform cloud.
  • Step 93.1 the second platform cloud judges whether it is the device of this platform.
  • Step 93.2 the second platform cloud queries the CID corresponding to the device.
  • the second platform cloud After the second platform cloud receives the device information reported by the second platform gateway, it judges through the CID that the Bluetooth Mesh device is not a device developed based on the second platform, and requires authorization from other platforms.
  • Step 93.3 the second platform cloud obtains the first platform information corresponding to the CID through the interconnection server.
  • the first platform information includes information such as a first platform rights management server.
  • Step 93.4 the second platform cloud queries the first platform cloud for the device type, carrying the third random number.
  • Step 93.5 the first platform cloud checks whether the third random number has been used, and generates authentication information.
  • the first platform cloud checks the legitimacy of the third random number and calculates the authentication information of this distribution network.
  • Step 93.6 the A platform cloud obtains the device type and authentication information from the first platform cloud.
  • Step 94 the second platform cloud forwards the device type and authentication information to the second platform gateway.
  • Step 95 the second platform gateway broadcasts the device and the device type to the user.
  • Step 96 the user inputs: connect the device.
  • Step 97 the second platform gateway and the Bluetooth Mesh device perform a connection and invitation process.
  • Step 97.1 the second platform gateway sends the configuration to the Bluetooth Mesh device to start.
  • Step 97.2 the second platform gateway sends the public key of the configuration terminal to the Bluetooth Mesh device.
  • Step 97.3 the Bluetooth Mesh device sends the device public key to the second platform gateway.
  • Step 97.4 the Bluetooth Mesh device and the second platform gateway perform ECDH calculation.
  • Step 97.5 the second platform gateway sends the confirmation value of the configuration terminal to the Bluetooth Mesh device.
  • the second platform gateway Since the second platform gateway obtains the authentication information, the second platform can calculate and generate the configuration end confirmation value.
  • Step 97.6 the Bluetooth Mesh device sends the device confirmation value to the second platform gateway.
  • Step 97.7 the second platform gateway sends the configuration random number to the Bluetooth Mesh device.
  • the configuration side validation value is generated by the second platform gateway.
  • Step 97.8 the Bluetooth Mesh device verifies the confirmation value of the configuration terminal.
  • Step 97.9 the verification is passed, and the Bluetooth Mesh device returns the device random number on the device side.
  • Step 97.10 the second platform gateway performs authentication verification.
  • Step 97.11 the second platform gateway returns the authentication result.
  • Step 97.12 the second platform cloud storage device information.
  • Step 98 the second platform gateway broadcasts the authentication result to the user.
  • the method provided in this embodiment ensures the security of the Bluetooth Mesh device during the access process, and at the same time generates the configuration-side confirmation value and the configuration-side random number by the second platform gateway. It simplifies the process and improves the efficiency of access authentication.
  • the steps performed by the first platform cloud can be independently implemented as an access authentication method on the side of the first platform cloud
  • the steps performed by the Bluetooth Mesh device can be independently implemented as an access on the side of the Bluetooth Mesh device
  • the steps performed by the second platform gateway can be implemented independently as an access authentication method on the side of the second platform gateway.
  • FIG. 10 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a first platform cloud, or may be implemented as a part of the first platform cloud, and the first platform cloud is a storage
  • a cloud server with authentication information of a Bluetooth Mesh device, the device includes: a generating module 1001;
  • the generation module 1001 is used to perform ECDH calculation with the Bluetooth Mesh device, and generate a shared root key, and the Bluetooth Mesh device is configured to enter the network by the second platform gateway;
  • the generating module 1001 is configured to generate authentication information of the network distributor according to the shared root key, and the authentication information of the network distributor is used to perform access authentication with the Bluetooth Mesh device.
  • the apparatus further includes: a receiving module 1002 and a sending module 1003 .
  • the authentication information of the network distributor includes a configuration end confirmation value; the generation module 1001 is used to generate a confirmation key according to the shared root key; the generation module 1001 is used to generate a configuration end random number, configure The terminal random number and the authentication information AuthValue of the Bluetooth Mesh device form a first plaintext; the generating module 1001 is used for encrypting the first plaintext using a confirmation key to generate a configuration terminal confirmation value.
  • the generation module 1001 is used to obtain the confirmation input value; the generation module 1001 is used to generate the confirmation salt value according to the confirmation input value; the generation module 1001 is used to generate the confirmation salt value according to the confirmation salt value and the shared root secret. key and the string "prck" to generate a confirmation key.
  • the receiving module 1002 is configured to receive configuration information whose source address is the gateway of the second platform; the receiving module 1002 is configured to receive the device public key whose source address is a Bluetooth Mesh device; the generating module 1001 is configured to use is used to generate the configuration terminal public key; according to the configuration information, the device public key and the configuration terminal public key, the confirmation input value is generated; wherein, the configuration information includes: configuration invitation protocol data unit value, configuration capability protocol data unit value, configuration start protocol data unit at least one of the values.
  • the receiving module 1002 is configured to receive a first random number whose source address is a Bluetooth Mesh device; the generating module 1001 is configured to receive the first random number, configuration information, device public key and configuration terminal public key according to the first random number key to generate a confirmation input value.
  • the first random number is contained in the UUID.
  • the sending module 1003 is configured to send the public key of the configuration end, and the destination address of the public key of the configuration end is a Bluetooth Mesh device.
  • the sending module 1003 is configured to send the device key, the session key and the session random number, and the destination address of the device key, the session key and the session random number is the second platform gateway.
  • the receiving module 1002 is configured to receive a second random number whose source address is a Bluetooth Mesh device; the generating module 1001 is configured to encrypt the second random number using the authentication information of the Bluetooth Mesh device, and generate The first proofreading information; the sending module 1003 is used for sending the first proofreading information, and the destination address of the first proofreading information is a Bluetooth Mesh device; wherein, the first proofreading information is used for the Bluetooth Mesh device to judge whether to terminate the network distribution process.
  • the second random number is contained in the UUID.
  • the apparatus may be implemented as a Bluetooth Mesh device, or may be implemented as a part of a Bluetooth Mesh device, and the apparatus includes: a generating module 1101;
  • a generation module 1101 is used to perform ECDH calculation with the first platform cloud to generate a shared root key
  • the first platform cloud is a cloud server that stores the authentication information of the Bluetooth Mesh device
  • the Bluetooth Mesh device is configured to enter the network by the second platform gateway
  • the shared root key is used to generate the device confirmation value
  • the device confirmation value is used to communicate with the first platform. Cloud access authentication.
  • the apparatus further includes: a receiving module 1102 , a process terminating module 1103 , a sending module 1104 and a computing module 1105 .
  • the receiving module 1102 is configured to receive, through the second platform gateway, the configuration end public key whose source address is the first platform cloud; the process termination module 1103 is configured to store the configuration end public key in the local In the case of the record, terminate the network distribution process; the sending module 1104 is used for feeding back the device public key in the case that the public key of the configuration terminal is not in the local record.
  • the sending module 1104 is configured to send a first random number, and the destination address of the first random number is the first platform cloud; wherein, the first random number is used for the first platform cloud to generate a confirmation input value.
  • the first random number is contained in the universally unique identifier UUID.
  • the sending module 1104 is configured to send a second random number, where the destination address of the second random number is the first platform cloud; wherein the second random number is used for the first platform cloud to generate the first random number Proofreading information.
  • the calculating module 1105 is configured to calculate the second proofreading information according to the second random number; the receiving module 1102 is configured to receive the first platform cloud whose source address is the first platform cloud through the second platform gateway. Proofreading information; the process terminating module 1103 is configured to terminate the network distribution process when the first proofreading information and the second proofreading information are different.
  • the second random number is contained in the UUID.
  • FIG. 12 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a second platform gateway, or may be implemented as a part of the second platform gateway, and the second platform is a Bluetooth
  • the Mesh device is configured with a network access platform, the Bluetooth Mesh device is stored in the first platform cloud by the authentication information of the Bluetooth Mesh device, the cloud server corresponding to the second platform gateway is the second platform cloud, and the device includes: a receiving module 1201 and a sending module 1202;
  • the receiving module 1201 is used to receive the authentication information of the network distributor whose source address is the first platform cloud through the second platform cloud, and the authentication information of the network distributor is used to perform access authentication with the Bluetooth Mesh device;
  • the sending module 1202 is used to forward the authentication information of the network distributor to the Bluetooth Mesh device;
  • the authentication information of the network distribution device is generated by the first platform cloud according to the shared root key, and the shared root key is obtained by performing ECDH calculation on the first platform cloud and the Bluetooth Mesh device.
  • the sending module 1202 is used to send configuration information to the first platform through the second platform cloud; the receiving module 1201 is used to receive a device whose source address is a Bluetooth Mesh device The public key Device Public Key; the sending module 1202 is used to send the device public key to the first platform cloud through the second platform cloud; wherein, the configuration information and the device public key are used for the first platform cloud to generate a confirmation input value, and the configuration information It includes at least one of a configuration invitation protocol data unit value, a configuration capability protocol data unit value, and a configuration start protocol data unit value.
  • the receiving module 1201 is configured to receive the first random number whose source address is a Bluetooth Mesh device; the sending module 1202 is configured to send the first random number to the first platform cloud through the second platform cloud , and the first random number is used for the first platform cloud to generate a confirmation input value.
  • the first random number is contained in the UUID.
  • the receiving module 1201 is configured to receive, through the second platform cloud, the Provisioning Public Key of the configuration terminal whose source address is the first platform cloud; the sending module 1202 is configured to forward the configuration to the Bluetooth Mesh device end public key.
  • the receiving module 1201 is configured to receive, through the second platform cloud, the device key DevKey, the session key SessionKey and the session random number SessionNonce whose source address is the first platform cloud.
  • the receiving module 1201 is configured to receive the second random number whose source address is a Bluetooth Mesh device; the sending module 1202 is configured to send the second random number to the first platform cloud through the forwarding of the second platform cloud Random number, the second random number is used for the first platform cloud to generate the first proofreading information VerifyValue; the receiving module 1201 is used to receive the first proofreading information whose source address is the first platform cloud through the second platform cloud; the sending module 1202 , which is used to send the first proofreading information to the Bluetooth Mesh device.
  • the second random number is contained in the UUID.
  • FIG. 13 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a first platform cloud, or may be implemented as a part of the first platform cloud, and the first platform cloud is a storage
  • a cloud server with authentication information of the Bluetooth Mesh device, the device includes: a generating module 1301 and a sending module 1302;
  • the generating module 1301 is used to generate authentication information corresponding to this network distribution process in response to the Bluetooth Mesh device starting the network configuration process, and the authentication information is the same as the authentication information at the Bluetooth Mesh device;
  • the sending module 1302 is used for sending authentication information, the destination address of the authentication information is the second platform gateway, and the second platform gateway is used to configure the Bluetooth Mesh device into the network;
  • the authentication information is used for the second platform gateway to authenticate the Bluetooth Mesh device.
  • the apparatus further includes: a receiving module 1303 .
  • the receiving module 1303 is configured to receive a third random number whose source address is a Bluetooth Mesh device; the sending module 1302 is configured to send authentication information when the third random number is not in the local record .
  • the third random number is contained in the UUID.
  • FIG. 14 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a second platform gateway, or may be implemented as a part of the second platform gateway, and the second platform gateway is used for
  • the Bluetooth wireless mesh network Mesh device is configured to be connected to the network, the Bluetooth Mesh device is stored in the first platform cloud with the authentication information of the Bluetooth Mesh device, the cloud server corresponding to the second platform gateway is the second platform cloud, and the device includes: a receiving module 1401 and a generating module 1402;
  • a receiving module 1401, configured to receive the authentication information AuthValue sent by the first platform cloud through the second platform cloud;
  • the generating module 1402 is configured to generate authentication information of the network distribution device according to the authentication information, and the authentication information of the network distribution device is used to perform access authentication with the Bluetooth Mesh device.
  • the apparatus further includes: a sending module 1403; a receiving module 1401, for receiving a third random number whose source address is a Bluetooth Mesh device; A platform cloud sends a third random number; wherein, the third random number is used for the first platform cloud to determine whether to send authentication information to the second platform gateway.
  • the third random number is contained in the UUID.
  • the apparatus further includes: a sending module 1403; a generating module 1402, configured to generate an authentication result; and a sending module 1403, configured to send the authentication result to the second platform cloud.
  • Fig. 15 shows a structural block diagram of an access authentication apparatus provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a Bluetooth Mesh device, or may be implemented as a part of a Bluetooth Mesh device.
  • the Bluetooth Mesh device is configured by a second platform gateway Configured to enter the network, the Bluetooth Mesh device saves the authentication information of the Bluetooth Mesh device by the first platform cloud, and the device includes: a generating module 1501;
  • the generating module 1501 is configured to start the network distribution process in response to the Bluetooth Mesh device, and the authentication information corresponding to the current network distribution process, where the authentication information is the same as the authentication information in the first platform cloud.
  • FIG. 16 shows a structural block diagram of a server provided by an exemplary embodiment of the present application.
  • the server can be used to implement the access authentication method provided in the above embodiment. Specifically:
  • the server 1600 includes a central processing unit (Central Processing Unit, CPU) 1601, a system memory 1604 including a random access memory (Random Access Memory, RAM) 1602 and a read-only memory (Read-Only Memory, ROM) 1603, and a connection System memory 1604 and system bus 1605 of central processing unit 1601.
  • the server 1600 also includes a basic input/output system (Input/Output system, I/O system) 1606 that helps to transfer information between various devices in the server, and is used to store the operating system 1613, application programs 1614 and other program modules 1615 mass storage device 1607.
  • I/O system Basic input/output system
  • the basic input/output system 1606 includes a display 1608 for displaying information and input devices 1609 such as a mouse, keyboard, etc., for user input of information.
  • the display 1608 and the input device 1609 are both connected to the central processing unit 1601 through the input and output controller 1610 connected to the system bus 1605.
  • the basic input/output system 1606 may also include an input output controller 1610 for receiving and processing input from a number of other devices such as a keyboard, mouse, or electronic stylus.
  • input output controller 1610 also provides output to a display screen, printer, or other type of output device.
  • the mass storage device 1607 is connected to the central processing unit 1601 through a mass storage controller (not shown) connected to the system bus 1605 .
  • the mass storage device 1607 and its associated computer-readable storage media provide non-volatile storage for the server 1600. That is, the mass storage device 1607 may include a computer-readable storage medium (not shown) such as a hard disk or a Compact Disc Read-Only Memory (CD-ROM) drive.
  • a computer-readable storage medium such as a hard disk or a Compact Disc Read-Only Memory (CD-ROM) drive.
  • the computer-readable storage medium can include both computer storage medium and communication medium.
  • Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable storage instructions, data structures, program modules or other data.
  • Computer storage media include RAM, ROM, Erasable Programmable Read Only Memory (EPROM), Electronically Erasable Programmable Read Only Memory (EEPROM), flash memory or Other solid-state storage technologies, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices.
  • RAM random access memory
  • ROM Erasable Programmable Read Only Memory
  • EEPROM Electronically Erasable Programmable Read Only Memory
  • flash memory or Other solid-state storage technologies
  • CD-ROM Compact Disc
  • DVD Digital Versatile Disc
  • the memory stores one or more programs, the one or more programs are configured to be executed by the one or more central processing units 1601, the one or more programs contain instructions for implementing the above method embodiments, and the central processing unit 1601 executes the One or more programs implement the methods provided by the above-mentioned respective method embodiments.
  • the server 1600 may also be operated by connecting to a remote server on the network through a network such as the Internet. That is, the server 1600 can be connected to the network 1612 through the network interface unit 1611 connected to the system bus 1605, or the network interface unit 1611 can also be used to connect to other types of networks or remote server systems (not shown) .
  • the memory further includes one or more programs, the one or more programs are stored in the memory, and the one or more programs include the one or more programs used for performing the method provided by the embodiments of the present application by the first platform cloud or the third program. The steps performed by the second platform cloud.
  • a computer-readable storage medium stores at least one instruction, at least one piece of program, code set or instruction set, the at least one instruction, the At least one piece of program, the code set or the instruction set is loaded and executed by the processor to implement the access authentication method executed by the device provided by the above-mentioned various method embodiments.
  • a computer program product or computer program comprising computer instructions stored in a computer readable storage medium from which a processor of a computer device can
  • the computer instruction is read by reading the storage medium, and the processor executes the computer instruction, so that the computer device executes the access authentication method described in the above aspects.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请公开了一种接入认证方法、装置、设备及存储介质，涉及网络技术领域。该方法应用于第一平台云中，所述第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，所述方法包括：和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算，生成共享根密钥ECDHSecret，所述蓝牙Mesh设备由第二平台网关配置入网；根据所述共享根密钥，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。

Description

接入认证方法、装置、设备及存储介质 技术领域
本申请涉及网络技术领域，特别涉及一种接入认证方法、装置、设备及存储介质。
背景技术
蓝牙无线网格(Mesh)技术是一种基于蓝牙的多对多关键技术，基于蓝牙Mesh技术的蓝牙Mesh设备可以跨域不同的平台进行接入认证。
示例性的，属于E公司的蓝牙Mesh设备的认证信息(AuthValue)存放在B平台云，蓝牙Mesh设备由A平台网关配置入网。为了进行跨平台接入认证，A平台网关和A平台网关对应的A平台云需要帮助传递B平台云对应的配置端确认值(provisioning confirmation)，实现蓝牙Mesh设备通过B平台云进行接入认证。
相关技术中，由A平台网关和蓝牙Mesh设备进行椭圆曲线算法(Elliptic Curves Diffie-Hellman，ECDH)计算，计算得到共享根密钥(ECDHSecret)，在这种情况下，存在A平台网关反解出AuthValue的可能性，影响蓝牙Mesh设备的认证信息的安全性。
发明内容
本申请实施例提供了一种接入认证方法、装置、设备及存储介质，避免蓝牙Mesh设备的Static OOB认证信息AuthValue存在泄露风险的问题，保障了蓝牙Mesh设备进行接入过程中的安全性。所述技术方案如下。
根据本申请的一个方面，提供了一种接入认证方法，应用于第一平台云中，所述第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，所述方法包括：
和所述蓝牙Mesh设备进行ECDH计算，生成共享根密钥ECDHSecret，所述蓝牙Mesh设备由第二平台网关配置入网；
根据所述共享根密钥，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
根据本申请的一个方面，提供了一种接入认证方法，应用于蓝牙无线网格网络Mesh设备中，所述方法包括：
和第一平台云进行ECDH计算，生成共享根密钥ECDHSecret；
其中，所述第一平台云是保存有所述蓝牙Mesh设备的认证信息的云端服务器，所述蓝牙Mesh设备由第二平台网关配置入网，所述共享根密钥用于生成设备确认值deviceconfirmation，所述设备确认值用于与所述第一平台云进行接入认证。
根据本申请的一个方面，提供了一种接入认证方法，应用于第二平台网关中，
所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述方法包括：
通过所述第二平台云，接收源地址为所述第一平台云的配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证；
向所述蓝牙Mesh设备转发所述配网器认证信息；
其中，所述配网器认证信息是所述第一平台云根据共享根密钥ECDHSecret生成的，所述共享根密钥由所述第一平台云和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算得到。
根据本申请的一个方面，提供了一种接入认证方法，应用于第一平台云中，所述第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，所述方法包括：
响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述蓝牙Mesh设备处的认证信息相同；
发送所述认证信息，所述认证信息的目的地址为第二平台网关，所述第二平台网关用于将所述蓝牙Mesh设备配置入网；
其中，所述认证信息用于供所述第二平台网关对所述蓝牙Mesh设备进行认证。
根据本申请的一个方面，提供了一种接入认证方法，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述方法包括：
通过所述第二平台云，接收所述第一平台云发送的认证信息AuthValue；
根据所述认证信息，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
根据本申请的一个方面，提供了一种接入认证方法，应用于蓝牙Mesh设备中，所述蓝牙Mesh设备由第二平台网关配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述方法包括：
响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述第一平台云处的认证信息相同。
根据本申请的一个方面，提供了一种接入认证装置，应用于第一平台云中，所述第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，所述装置包括：生成模块；
所述生成模块，用于和所述蓝牙Mesh设备进行ECDH计算，生成共享根密钥ECDHSecret，所述蓝牙Mesh设备由第二平台网关配置入网；
所述生成模块，用于根据所述共享根密钥，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
根据本申请的一个方面，提供了一种接入认证装置，应用于蓝牙Mesh设备中，所述装置包括：生成模块；
所述生成模块，用于和第一平台云进行ECDH计算，生成共享根密钥ECDHSecret；
其中，所述第一平台云是保存有所述蓝牙Mesh设备的认证信息的云端服务器，所述蓝牙Mesh设备由第二平台网关配置入网，所述共享根密钥用于生成设备确认值deviceconfirmation，所述设备确认值用于与所述第一平台云进行接入认证。
根据本申请的一个方面，提供了一种接入认证装置，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述装置包括：接收模块和发送模块；
所述接收模块，用于通过所述第二平台云，接收源地址为所述第一平台云的配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证；
所述发送模块，用于向所述蓝牙Mesh设备转发所述配网器认证信息；
其中，所述配网器认证信息是所述第一平台云根据共享根密钥ECDHSecret生成的，所述共享根密钥由所述第一平台云和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算得到。
根据本申请的一个方面，提供了一种接入认证装置，应用于第一平台云中，所述第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，所述装置包括：生成模块和发送模块；
所述生成模块，用于响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述蓝牙Mesh设备处的认证信息相同；
所述发送模块，用于发送所述认证信息，所述认证信息的目的地址为第二平台网关，所述第二平台网关用于将所述蓝牙Mesh设备配置入网；
其中，所述认证信息用于供所述第二平台网关对所述蓝牙Mesh设备进行认证。
根据本申请的一个方面，提供了一种接入认证装置，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述装置包括：接收模块和生成模块；
所述接收模块，用于通过所述第二平台云，接收所述第一平台云发送的认证信息AuthValue；
所述生成模块，用于根据所述认证信息，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
根据本申请的一个方面，提供了一种接入认证装置，应用于蓝牙Mesh设备中，所述蓝牙Mesh设备由第二平台网关配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述装置包括：生成模块；
所述生成模块，用于响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述第一平台云处的认证信息相同。
根据本申请的一个方面，提供了一种第一平台云，所述第一平台云包括：处理器；与所述处理器相连的收发器；用于存储所述处理器的可执行指令的存储器；其中，所述处理器被配置为加载并执行所述可执行指令以实现如上述方面所述的接入认证方法。
根据本申请的一个方面，提供了一种第二平台网关，所述第二平台网关包括：处理器；与所述处理器相连的收发器；用于存储所述处理器的可执行指令的存储器；其中，所述处理器被配置为加载并执行所述可执行指令以实现如上述方面所述的接入认证方法。
根据本申请的一个方面，提供了一种蓝牙Mesh设备，所述蓝牙Mesh设备包括：处理器；与所述处 理器相连的收发器；用于存储所述处理器的可执行指令的存储器；其中，所述处理器被配置为加载并执行所述可执行指令以实现如上述方面所述的接入认证方法。
根据本申请的一个方面，提供了一种计算机可读存储介质，所述可读存储介质中存储有可执行指令，所述可执行指令由处理器加载并执行以实现如上述方面所述的接入认证方法。
根据本申请的一个方面，提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中，计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述方面所述的接入认证方法。
本申请实施例提供的技术方案至少包括如下有益效果：
通过由第一平台云和蓝牙Mesh设备进行ECDH计算生成共享根密钥，避免了在由第二平台网关和蓝牙Mesh设备进行ECDH计算时，由于通过第二平台网关交换确认值(如配置端确认值)，且第二平台网关保存有ECDH计算生成的共享根密钥，导致蓝牙Mesh设备的StaticOOB认证信息AuthValue存在泄露风险的问题，保障了蓝牙Mesh设备进行接入过程中的安全性。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一个示例性实施例提供的蓝牙Mesh设备跨平台接入认证系统的框图；
图2是相关技术中一个示例性实施例提供的设备跨越不同平台进行接入和认证的方法流程图；
图3是本申请一个示例性实施例提供的接入认证方法的流程图；
图4是本申请一个示例性实施例提供的接入认证方法的流程图；
图5是本申请一个示例性实施例提供的接入认证方法的流程图；
图6是本申请一个示例性实施例提供的接入认证方法的流程图；
图7是本申请一个示例性实施例提供的接入认证方法的流程图；
图8是本申请一个示例性实施例提供的接入认证方法的流程图；
图9是本申请一个示例性实施例提供的接入认证方法的流程图；
图10是本申请一个示例性实施例提供的接入认证装置的结构框图；
图11是本申请一个示例性实施例提供的接入认证装置的结构框图；
图12是本申请一个示例性实施例提供的接入认证装置的结构框图；
图13是本申请一个示例性实施例提供的接入认证装置的结构框图；
图14是本申请一个示例性实施例提供的接入认证装置的结构框图；
图15是本申请一个示例性实施例提供的接入认证装置的结构框图；
图16是本申请一个示例性实施例提供的服务器的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
首先，对本申请实施例中涉及的名词进行简单介绍：
蓝牙Mesh网络：
是用于建立多对多设备通信的低功耗蓝牙的网络拓扑。允许创建基于多个设备的大型网络，网络可以包含数十台，数百甚至数千台蓝牙Mesh设备，这些设备之间可以相互进行信息的传递。
一个设备要想成为蓝牙Mesh网络的成员，则需要经过一个称为“启动配置(provisioning)”的安全流程，将设备添加到蓝牙Mesh网络中。作为蓝牙Mesh网络成员的设备称为“节点”，而不构成节点的设备就称为“设备”。启动配置的流程会将普通的“设备(Device)”成为“节点(Node)”，使其正式成为蓝牙Mesh网络的成员。
启动配置的流程主要包括五个阶段：1发送Beacon信号、2邀请、3交换公共密钥、4认证、5启动配置数据分发。
对于认证阶段，有三种可用的验证方法：输出带外数据OOB(Output Out-Of-Band，Output OOB)、输入OOB(Input OOB)、以及静态OOB(Static OOB)或无OOB(No OOB)。
在实际产品形态中，出于设备成本以及配网便捷性的考虑，鲜有设备采用Output/Input OOB的方式(需要设备具有输入或输出的能力且过程中需要人工参与)，而NoOOB的方式安全性不佳，绝大多数设备都是 采用的StaticOOB的验证方法。本申请实施例中，设备采用的验证方法为StaticOOB。
图1示出了本申请一个示例性实施例提供的蓝牙Mesh设备跨平台接入认证系统的框图，该系统可以包括：蓝牙Mesh设备12、第二平台网关141、第二平台云142和第一平台云16。
蓝牙Mesh设备12是支持蓝牙技术，可以接入蓝牙Mesh网络的设备。蓝牙Mesh设备包括各种类型的物联网设备，如：灯泡、音箱、手机等，本申请实施例对此不进行限定。
蓝牙Mesh设备12由第二平台网关141配置入网，第二平台网关141对应的云端服务器是第二平台云142。第二平台网关141与第二平台云142之间通过有线或无线网络相连。可选地，第二平台云网关141从蓝牙Mesh设备12接收数据，对数据进行计算处理，将数据发送至第二平台云142处，由第二平台云142进行保存或进行进一步处理。
蓝牙Mesh设备12基于第一平台云16开发，蓝牙Mesh设备12的认证信息存储在第一平台云16。
第二平台云142和第一平台云16之间存在通信链路。可选地，第二平台云142向第一平台云16发送蓝牙Mesh设备12在与第一平台云16认证流程中所需的信息；或，向第二平台网关141转发蓝牙Mesh设备12在第一平台云16认证流程中所需的信息。
其中，上述第二平台云142和第一平台云16是云技术领域中的云计算资源池，在资源池中部署多种类型的虚拟资源，供外部客户选择使用。云计算资源池中主要包括：计算设备(为虚拟化机器，包含操作系统)、存储设备、网络设备。其可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。
图2示出了一个相关技术中设备跨越不同平台进行接入和认证的方法流程图，该方法包括：
步骤21，用户使用语音或APP激活扫描A平台网关。
步骤22，E公司设备(基于B平台开发)按规范广播蓝牙Mesh未配网广播包。
其中，广播包中包含B平台的公司标识符(Company Identifier，CID)。
步骤23，A平台网关查询设备类型。
A平台网关获取E公司设备广播的未配网广播信息后，将该信息上传至A平台云，查询该设备的类型。
步骤23.1，A平台云判断是否是本平台设备。
步骤23.2，A平台云查询设备对应平台信息。
A平台云在收到A平台网关上报的设备信息后，通过CID判断E公司设备不是基于A平台开发的设备，需要其它平台进行授权。
步骤23.3，A平台云通过互联互通服务器获取CID对应的平台信息。
可选地，平台信息包含B平台权限管理服务器(AuthServer)等信息。
步骤23.4，A平台云向B平台云查询设备类型。
步骤23.5，A平台云从B平台云获取设备类型。
步骤24，A平台云向A平台网关转发设备类型。
步骤25，A平台网关向用户播报设备、设备类型。
步骤26，用户输入：连接设备。
步骤27，A平台网关和E公司设备进行连接和邀请流程(Link&Invitation)。
步骤27.1，A平台网关向E公司设备发送配置开始(Provisioning Start)。
步骤27.2，A平台网关向E公司设备发送配置端公钥(Provisoning Public Key)。
步骤27.3，E公司设备向A平台网关发送设备公钥(Device Public Key)。
步骤27.4，E公司设备和A平台网关进行ECDH计算，生成确认密钥(ConfirmationKey)。
步骤27.5，A平台网关上报设备认证过程中产生的确认密钥至A平台云。
步骤27.6，A平台云上报确认密钥给B平台云。
步骤27.7，A平台云通过B平台云获取认证需要的配置端确认值(provisioner confirmation)及配置端随机数(provisioner random)。
步骤27.8，A平台云向A平台网关转发配置端确认值及配置端随机数。
步骤27.9，A平台网关将配置端确认值发送给E公司设备。
步骤27.10，E公司设备返回设备端的设备确认值(deviceconfirmation)。
步骤27.11，A平台网关将配置端随机数发送给E公司设备。
步骤27.12，E公司设备对配置端确认值进行校验。
步骤27.13，校验通过，E公司设备返回设备端的设备随机数(devicerandom)。
步骤27.14，A平台网关上报设备的设备确认值及设备随机数至A平台云。
步骤27.15，A平台云将设备确认值及设备随机数发送给B平台云。
步骤27.16，B平台云进行认证校验。
步骤27.17，B平台云返回认证结果以及设备信息。
其中，设备信息包含设备支持的控制功能和控制指令。
步骤27.18，A平台云存储设备信息。
步骤27.19，A平台云向A平台网关转发认证结果。
步骤28，A平台网关向用户播报认证结果。
可选地，上述步骤中，确认密钥(ConfirmationKey)和配置端确认值(provisioner confirmation)、设备确认值(deviceconfirmation)计算方式如下，来源自蓝牙MeshProfilev1.0.1。
ConfirmationProvisioner＝AES-CMAC ConfirmationKey(RandomProvisioner||AuthValue)；
ConfirmationDevice＝AES-CMAC ConfirmationKey(RandomDevice||AuthValue)；
ConfirmationKey＝k1(ECDHSecret,ConfirmationSalt,“prck”)；
ConfirmationSalt＝s1(ConfirmationInputs)；
ConfirmationInputs＝ProvisioningInvitePDUValue||ProvisioningCapabilitiesPDUValue||ProvisioningStartPDUValue||PublicKeyProvisioner||PublicKeyDevice；
ECDHSecret＝P-256(private key,peer public key)。
由上述计算方式可知，由于B平台云生成的配置端确认值跟确认密钥和AuthValue相关，在A平台网关处保存有确认密钥，又接收到配置端确认值的情况下，可以对配置端确认值进行解密，推导出设备的认证信息AuthValue，导致设备的认证信息泄露。
针对上述问题，本申请实施例提供了两种不同的技术方案：
1)由B平台云和蓝牙Mesh设备进行ECDH计算。
2)每次配网时，动态生成Static OOB信息(即AuthValue)。
可以理解的是，技术方案1)中，StaticOOB信息(即AuthValue)是恒定的，如：出厂时预生成直接烧录到蓝牙Mesh设备中。而技术方案2)中，StaticOOB信息(即AuthValue)在每次配网时都会重新生成。
下面，针对上述两种技术方案，进行示例性的说明。
技术方案1)
图3示出了本申请一个示例性实施例提供的接入认证方法的流程图。该方法可以应用于如图1示出的蓝牙Mesh设备跨平台接入认证系统中，该方法包括：
步骤310，第一平台云和蓝牙Mesh设备进行ECDH计算，生成共享根密钥(ECDHSecret)。
蓝牙Mesh设备是支持接入蓝牙Mesh网络的设备。蓝牙Mesh设备包括各种类型的家居设备(如电灯)、工业资产(如医院中的检查设备)等。
其中，第一平台云对应的平台是对蓝牙Mesh设备进行开发的平台。第一平台云保存有蓝牙Mesh设备的认证信息(AuthValue)。
第二平台网关是支持将蓝牙Mesh设备添加到蓝牙Mesh网络的节点，蓝牙Mesh设备由第二平台网关配置入网，第二平台网关对应的云端服务器为第二平台云第一平台云。第一平台云和第二平台云是不同的两个平台云，属于不同的平台。可选地，蓝牙Mesh设备与第二平台网关进行连接和邀请流程(Link&Invitation)，第二平台从第一平台云处获取蓝牙Mesh设备在认证流程所需的信息。
ECDH是基于椭圆曲线密码体制(Elliptic Curve Cryptosystems，ECC)的DH(Diffie-Hellman)密钥交换算法。交换双方可以在不共享任何秘密的情况下协商出一个密钥。且该算法继承了ECC密钥长度短、计算速度快和安全性能好等突出优点。
与相关技术中，由第二平台网关与蓝牙Mesh设备进行ECDH计算不同的是，图3所示的实施例中，将ECDH计算的流程转移到第一平台云，由第一平台云和蓝牙Mesh设备进行ECDH计算，第一平台云和蓝牙Mesh设备处均生成共享根密钥。
可选地，第一平台云和蓝牙Mesh设备都支持FIPS P-256椭圆曲线算法，可以进行ECDH计算，生成共享根密钥。通过基于该算法的非对称加密来创建安全通道，以完成剩余的启动配置流程。示例性的，共享根密钥的计算公式为：ECDHSecret＝P-256(private key,peer public key)。其中，private key为双方各自的私钥，peer public key为双方各自的公钥。
可选地，共享根密钥用于派生其他密钥，如：设备密钥(DevKey)、会话密钥(SessionKey)和会话随机数(SessionNonce)。
步骤320，第一平台云根据共享根密钥，生成配网器认证信息。
其中，配网器认证信息用于与蓝牙Mesh设备进行接入认证。
在蓝牙Mesh设备接入认证的过程中，需要由蓝牙Mesh设备和第一平台云根据共有的设备的认证信息AuthValue，对对方生成的认证信息进行校验。若校验通过，则继续接下来的流程。配网器认证信息是第一平台云对应的配置端认证信息。配网器认证信息的目的地址为蓝牙Mesh设备，蓝牙Mesh设备可以对配网器认证信息进行检查验证。
可选地，蓝牙Mesh设备根据共享根密钥，生成设备确认值。设备确认值是蓝牙Mesh设备对应的设备端认证信息。
可选地，配网器认证信息包括配置端确认值。步骤310包括：第一平台云根据共享根密钥，生成确认密钥；生成配置端随机数，配置端随机数与蓝牙Mesh设备的认证信息形成第一明文；使用确认密钥对第一明文进行加密，生成配置端确认值。
示例性的，配置端确认值的计算公式为：ConfirmationProvisioner＝AES-CMACConfirmationKey(RandomProvisioner||AuthValue)。其中，AES-CMAC为一种加密算法。
可选地，第一平台云根据共享根密钥，生成确认密钥，包括：第一平台云获取确认输入值(ConfirmationInputs)；根据确认输入值，生成确认盐值(ConfirmationSalt)；根据确认盐值、共享根密钥和字符串“prck”，生成确认密钥。
示例性的，确认密钥的计算公式为：ConfirmationKey＝k1(ECDHSecret,ConfirmationSalt,“prck”)。
可选地，第一平台云获取确认输入值包括：第一平台云接收源地址为第二平台网关的配置信息；接收源地址为蓝牙Mesh设备的设备公钥；生成配置端公钥；根据配置信息、设备公钥和配置端公钥，生成确认输入值；其中，配置信息包括：配置邀请协议数据单元值(ProvisioningInvitePDUValue)、配置能力协议数据单元值(ProvisioningCapabilitiesPDUValue)、配置开始协议数据单元值(ProvisioningStartPDUValue)中的至少一种。
示例性的，确认输入值的计算公式为：ConfirmationInputs＝ProvisioningInvitePDUValue||ProvisioningCapabilitiesPDUValue||ProvisioningStartPDUValue||PublicKeyProvisioner||PublicKeyDevice。
可选地，第二平台包括第二平台网关和第二平台云。第二平台发送配置信息的过程，包括：第二平台网关发送配置信息，配置信息的目的地址为第一平台云；第二平台云向第一平台云转发配置信息。
同样地，蓝牙Mesh设备的设备公钥也会经由第二平台的转发，包括：通过第二平台网关，接收源地址为蓝牙Mesh设备的设备公钥；第二平台网关向第二平台云转发设备公钥；第二平台云向第一平台云转发设备公钥。
配网器与待配网的蓝牙Mesh设备需要进行公钥的交换，在由第一平台云与蓝牙Mesh设备进行ECDH计算的情况下，由第一平台云向蓝牙Mesh设备发送自身生成的配置端公钥。可选地，在步骤310之前，第一平台云发送上述配置端公钥，配置端公钥的目的地址为蓝牙Mesh设备。
可选地，第二平台包括第二平台网关和第二平台云，配置端公钥会经由第二平台的转发到达蓝牙Mesh设备，包括：通过第二平台云，接收源地址为第一平台云的配置端公钥；第二平台云向第二平台网关转发配置端公钥；第二平台网关向蓝牙Mesh设备转发配置端公钥。
步骤330，第一平台云向第二平台云发送配网器认证信息。
第一平台云向第二平台云发送配网器认证信息，第二平台云相应地接收来自第一平台云的配网器认证信息。
步骤340，第二平台云向第二平台网关转发配网器认证信息。
步骤350，第二平台网关向蓝牙Mesh设备转发配网器认证信息。
通过第二平台云和第二平台网关的转发，配网器认证信息从源地址第一平台云，到达目的地址蓝牙Mesh设备。
可选地，蓝牙Mesh设备对配网器认证信息进行验证，验证通过则继续配网流程，验证失败则终止配网流程。
可选地，第一平台云也会相应地对来自蓝牙Mesh设备的设备端的认证信息(如设备确认值)进行验证。在验证结束后，需要反馈认证结果。在反馈认证结果时，第一平台云向第二平台发送设备密钥、会话密钥和会话随机数。在由第一平台云与蓝牙Mesh设备进行ECDH计算的情况下，由第一平台云生成上述3种数据，并向第二平台发送，供第二平台后续使用上述3种数据。
可选地，第二平台包括第二平台网关和第二平台云，则第二平台接收上述3个数据的过程包括：通过第二平台云，接收源地址为第一平台云的设备密钥、会话密钥和会话随机数；第二平台云向第二平台网关转发设备密钥、会话密钥和会话随机数。
综上，本实施例提供的方法，通过由第一平台云和蓝牙Mesh设备进行ECDH计算生成共享根密钥，避免了在由第二平台网关和蓝牙Mesh设备进行ECDH计算时，由于通过第二平台网关交换确认值(如配 置端确认值)，且第二平台网关保存有ECDH计算生成的共享根密钥，导致蓝牙Mesh设备的StaticOOB认证信息AuthValue存在泄露风险的问题，保障了蓝牙Mesh设备进行接入过程中的安全性。
在基于图3的可选实施例中，图4示出了本申请一个示例性实施例提供的接入认证方法的流程图。该方法可以应用于如图1示出的蓝牙Mesh设备跨平台接入认证系统中，该方法包括：
步骤41，用户使用语音或APP激活扫描第二平台网关。
步骤42，蓝牙Mesh设备(基于第一平台开发)按规范广播蓝牙Mesh未配网广播包。
其中，广播包中包含第一平台的CID。
步骤43，第二平台网关查询设备类型。
第二平台网关获取蓝牙Mesh设备广播的未配网广播信息后，将该信息上传至第二平台云，查询该设备的类型。
步骤43.1，第二平台云判断是否是本平台设备。
步骤43.2，第二平台云查询设备对应CID。
第二平台云在收到第二平台网关上报的设备信息后，通过CID判断蓝牙Mesh设备不是基于第二平台开发的设备，需要其它平台进行授权。
步骤43.3，第二平台云通过互联互通服务器获取CID对应的平台信息。
可选地，平台信息包含第一平台权限管理服务器等信息。
步骤43.4，第二平台云向第一平台云查询设备类型。
步骤43.5，第二平台云从第一平台云获取设备类型。
步骤44，第二平台云向第二平台网关转发设备类型。
步骤45，第二平台网关向用户播报设备、设备类型。
步骤46，用户输入：连接设备。
步骤47，第二平台网关和蓝牙Mesh设备进行连接和邀请。
步骤47.1，第二平台网关将配置邀请协议数据单元值、配置能力协议数据单元值和配置开始协议数据单元值上报给第二平台云。
步骤47.2，第二平台云上报配置邀请协议数据单元值、配置能力协议数据单元值和配置开始协议数据单元值给第一平台云。
步骤47.3，第一平台云生成配置端公钥上报给第二平台云。
步骤47.4，第二平台云将配置端公钥发送给第二平台网关。
步骤47.5，第二平台网关向蓝牙Mesh设备发送配置开始。
步骤47.6，第二平台网关向蓝牙Mesh设备发送配置端公钥。
步骤47.7，蓝牙Mesh设备向第二平台网关发送设备公钥。
步骤47.8，第二平台网关向第二平台云发送设备公钥。
步骤47.9，第二平台云向第一平台云发送设备公钥。
步骤47.10，蓝牙Mesh设备和第一平台云进行ECDH计算，生成确认密钥。
步骤47.11，第二平台云通过第一平台云获取认证需要的配置端确认值及配置端随机数。
步骤47.12，第二平台云向第二平台网关转发配置端确认值及配置端随机数。
步骤47.13，第二平台网关将配置端确认值发送给蓝牙Mesh设备。
步骤47.14，蓝牙Mesh设备返回设备端的设备确认值。
步骤47.15，第二平台网关将配置端随机数发送给蓝牙Mesh设备。
步骤47.16，蓝牙Mesh设备对配置端确认值进行校验。
步骤47.17，校验通过，蓝牙Mesh设备返回设备端的设备随机数。
步骤47.18，第二平台网关上报设备的设备确认值及设备随机数至第二平台云。
步骤47.19，第二平台云将设备确认值及设备随机数发送给第一平台云。
步骤47.20，第一平台云进行认证校验。
步骤47.21，第一平台云返回认证结果、设备信息、设备密钥、会话密钥和会话随机数。
其中，设备信息包含设备支持的控制功能和控制指令。
步骤47.22，第二平台云存储设备信息。
步骤47.23，第二平台云向第二平台网关转发认证结果、设备信息、设备密钥、会话密钥和会话随机数。
其中，第二平台网关存储设备密钥用于后续对蓝牙Mesh设备进行配置，第二平台网关使用会话密钥和会话随机数加密认证配置数据，再将配置数据发送给蓝牙Mesh设备。
步骤48，第二平台网关向用户播报认证结果。
综上所述，本实施例提供的方法，在保障蓝牙Mesh设备进行接入过程中的安全性的同时，也支持既有的恒定StaticOOB信息的蓝牙Mesh设备的跨平台认证接入。
可能性的，在进行ECDH计算时，蓝牙Mesh设备端的秘钥对(public-private key pair)采用固定方式，不是每次配网都重新生成，导致共享根密钥不变，第二平台网关可以使用上次和该相同设备配网过程中产生的配置端公钥、配置端确认值、配置端随机数、会话密钥和会话随机数对设备进行重放攻击，使得在蓝牙Mesh设备没有经过第一平台云认证的情况下，同样能配网成功，影响蓝牙Mesh设备配网过程中的安全性。
针对上述问题，在基于图3的可选实施例中，提出以下几种可能性的方案。
1)蓝牙Mesh设备通过第二平台的转发，接收源地址为第一平台云的配置端公钥；对配置端公钥进行检查；在配置端公钥保存在本地记录中的情况下，终止配网流程；在配置端公钥不在本地记录中的情况下，反馈设备公钥。
其中，蓝牙Mesh设备对应有本地记录，本地记录中记录有历史配网过程中蓝牙Mesh设备接收到的历史配置端公钥。可选地，本申请实施例对本地记录中记录的历史配置端公钥的个数不进行限制。
在本次配网过程中，若蓝牙Mesh设备接收到的配置端公钥保存在本地记录中，属于历史配置端公钥，则意味着蓝牙Mesh设备接收到的配置端公钥可能被第二平台网关用于进行重放攻击，则蓝牙Mesh设备终止配网流程；若蓝牙Mesh设备接收到的配置端公钥不在本地记录中，不属于历史配置端公钥，则意味着蓝牙Mesh设备接收到的配置端公钥可能是由第一平台云重新生成的，则蓝牙Mesh设备继续配网流程，开始反馈设备公钥。
示例性的，结合参考图5，图5在图4的基础上，增加了步骤57.7：蓝牙Mesh设备检查配置端公钥。
可选地，蓝牙Mesh设备也可以对配置端公钥、配置端确认值、配置端随机数、会话密钥和会话随机数中的一种或多种进行检查，保证检查结果的准确性。
示例性的，本地记录中记录有历史配网过程中蓝牙Mesh设备接收到的历史配置端确认值。蓝牙Mesh设备根据接收到的配置端确认值，是否保存在本地记录中，确定是否终止配网流程。
示例性的，本地记录中记录有历史配网过程中蓝牙Mesh设备接收到的历史配置端公钥和历史配置端随机数。蓝牙Mesh设备接收到的配置端公钥后，确定配置端公钥属于历史配置端公钥，则蓝牙Mesh设备先继续配网流程，在后续接收到的配置端随机数也属于历史配置端随机数的情况下，则终止配网流程。
2)第一平台云接收源地址为蓝牙Mesh设备的第一随机数；根据第一随机数、配置信息、设备公钥和配置端公钥，生成确认输入值。
相应地，蓝牙Mesh设备发送第一随机数，第一随机数的目的地址为第一平台云；其中，第一随机数用于供第一平台云生成确认输入值。
相应地，第二平台包括：第二平台网关和第二平台云。第二平台发送第一随机数的过程包括：通过第二平台网关，接收源地址为蓝牙Mesh设备的第一随机数；第二平台网关向第二平台云转发第一随机数；第二平台云向第一平台云转发第一随机数，第一随机数用于供第一平台云生成确认输入值。
也就是说，在每次配网过程开始时，蓝牙Mesh设备生成一个第一随机数，第一平台云生成的确认输入值与第一随机数相关。由于第一平台云生成的配置端确认值又与确认输入值相关，则可以保证每次的配置端确认值不同，进而第二平台网关无法使用历史记录的历史配置端确认值，完成与蓝牙Mesh设备的认证过程。
示例性的，确认输入值的计算方式修改为：ConfirmationInputs＝ProvisioningInvitePDUValue||ProvisioningCapabilitiesPDUValue||ProvisioningStartPDUValue||PublicKeyProvisioner||PublicKeyDevice||Random。
可选地，第一随机数包含在通用唯一标识符(Universally Unique Identifier，UUID)中。蓝牙Mesh设备在每次进入待配网状态时生成第一随机数填充到UUID中。
示例性的，结合参考图6，图6在图4的基础上，修改了如下步骤：
步骤62，蓝牙Mesh设备按规范广播蓝牙Mesh未配网广播包，广播包携带第一随机数。
步骤63，第二平台网关查询设备类型，携带第一随机数。
步骤63.4，第二平台云向第一平台云查询设备类型，携带第一随机数。
同时，增加了步骤63.5：第一平台云保存第一随机数，用于计算确认输入值。
3)蓝牙Mesh设备发送第二随机数，第二随机数的目的地址为第一平台云；其中，第二随机数用于供第一平台云生成第一校对信息(VerifyValue)。根据第二随机数，计算第二校对信息；通过第二平台转发，接收源地址为第一平台云的第一校对信息；在第一校对信息和第二校对信息不同的情况下，终止配网流程。
相应地，第一平台云接收源地址为蓝牙Mesh设备的第二随机数；使用蓝牙Mesh设备的认证信息对第二随机数进行加密，生成第一校对信息；发送第一校对信息，第一校对信息的目的地址为蓝牙Mesh设备；其中，第一校对信息用于供蓝牙Mesh设备判断是否终止配网流程。
相应地，第二平台包括：第二平台网关和第二平台云。第二平台转发第二随机数和第一校对信息的过程包括：通过第二平台网关，接收源地址为蓝牙Mesh设备的第二随机数；第二平台网关向第二平台云转发第二随机数；第二平台云向第一平台云转发第二随机数，第二随机数用于供第一平台云生成第一校对信息；通过第二平台云，接收源地址为第一平台云的第一校对信息；第二平台云向第二平台网关转发第一校对信息；第二平台网关向蓝牙Mesh设备发送第一校对信息。
也就是说，在每次配网过程开始时，蓝牙Mesh设备生成一个第二随机数，并将第二随机数告知第一平台云。第一平台云和蓝牙Mesh设备使用相同的蓝牙Mesh设备的认证信息和第二随机数，根据同样的公式计算校对信息。若蓝牙Mesh设备计算的第二校对信息与接收到的第一校对信息相同，则继续后续流程，确保第一平台云参与到此次接入认证。
示例性的，校对信息的计算公式为：VerifyValue＝AES-CMACstaticoob(Random)。
可选地，第二随机数包含在UUID中。蓝牙Mesh设备在每次进入待配网状态时生成第二随机数填充到UUID中。
示例性的，结合参考图7，图7在图4的基础上，修改了如下步骤：
步骤72，蓝牙Mesh设备按规范广播蓝牙Mesh未配网广播包，广播包携带第二随机数。
步骤73，第二平台网关查询设备类型，携带第二随机数。
步骤73.4，第二平台云向第一平台云查询设备类型，携带第二随机数。
步骤73.6，第二平台云从第一平台云获取设备类型和第一校对信息。
步骤74，第二平台云向第二平台网关转发设备类型和第一校对信息。
同时，增加了步骤73.5：第一平台云使用第二随机数计算第一校对信息。
增加了步骤77.1，蓝牙Mesh设备检查第一校对信息。
如图7所示，第二平台云将蓝牙Mesh设备生成的第二随机数转发给第一平台云，第一平台云使用上述计算公式计算第一校对信息和设备类型一同下发给第二平台云，第二平台云将第一校对信息和设备类型下发至第二平台网关，第二平台网关在和蓝牙Mesh设备的Link&Invatition流程中将第一校对信息发给蓝牙Mesh设备，蓝牙Mesh设备使用上述相同计算公式计算第二校对信息，对第二平台网关发送过来的第一校对信息进行比较，相同则继续后续流程，否则断开连接终止配网流程。
综上所述，本实施例提供的方法，提供了3种不同的方案，避免第二平台网关使用历史配网过程中保存的信息，进行重放攻击从而配网成功的情况，增强了蓝牙Mesh设备配网过程的安全性和可靠性。
技术方案2)
图8示出了本申请一个示例性实施例提供的接入认证方法的流程图。该方法可以应用于如图1示出的蓝牙Mesh设备跨平台接入认证系统中，该方法包括：
步骤810，响应于蓝牙Mesh设备开始进行配网流程，第一平台云生成对应于本次配网流程的认证信息，认证信息与蓝牙Mesh设备处的认证信息相同。
蓝牙Mesh设备是支持接入蓝牙Mesh网络的设备。蓝牙Mesh设备包括各种类型的家居设备(如电灯)、工业资产(如医院中的检查设备)等。
其中，第一平台云对应的平台是对蓝牙Mesh设备进行开发的平台。第一平台云保存有蓝牙Mesh设备的认证信息(AuthValue)。
在每次蓝牙Mesh设备配网时，蓝牙Mesh设备重新与第一平台云生成针对于本次配网流程的认证信息。也就是说，认证信息只在单次配网流程中有效。
可选地，响应于蓝牙Mesh设备开始进行配网流程，蓝牙Mesh设备也生成对应于本次配网流程的认证信息。由于使用同样的参数和同样的公式计算生成认证信息，蓝牙Mesh设备处的认证信息与第一平台云处的认证信息相同。
可以理解的是，本申请实施例对第一平台云与蓝牙Mesh设备生成对应于本次配网流程的认证信息的具体实现方式不进行限定。
步骤820，第一平台云向第二平台发送认证信息。
第二平台网关是支持将蓝牙Mesh设备添加到蓝牙Mesh网络的节点，蓝牙Mesh设备由第二平台网关配置入网，第二平台网关对应的云端服务器为第二平台云第一平台云。第一平台云和第二平台云是不同的两个平台云，属于不同的平台。
在每次配网流程中，第一平台云将动态生成的认证信息发送给第二平台，供第二平台网关使用认证信息，完成对蓝牙Mesh设备的认证。
可选地，为了生成本次配网流程对应的认证信息，第一平台云接收源地址为蓝牙Mesh设备的第三随机数；在第三随机数不在本地记录中的情况下，发送认证信息，认证信息的目的地址是第二平台网关。
相应地，蓝牙Mesh设备发送第三随机数，第三随机数的目的地址为第一平台云。
相应地，第二平台包括：第二平台网关和第二平台云。第二平台转发第三随机数的过程包括：通过第二平台网关，接收源地址为蓝牙Mesh设备的第三随机数；第二平台网关向第二平台云转发第三随机数；第二平台云向第一平台云转发第三随机数；其中，第三随机数用于供第一平台云确定是否向第二平台发送认证信息。
也就是说，第一平台云对应有本地记录，本地记录中记录有历史配网过程中第一平台云接收到的历史第三随机数。可选地，本申请实施例对本地记录中记录的历史第三随机数的个数不进行限制。在本次配网过程中，若第一平台云接收到的第三随机数不在本地记录中，不属于历史第三随机数，则意味着蓝牙Mesh设备重新开始了新一轮的配网流程，则第一平台云使用第三随机数，生成对应于本次配网流程的认证信息。
可选地，第三随机数包含在UUID中。蓝牙Mesh设备在每次进入待配网状态时生成第三随机数填充到UUID中。
步骤830，通过第二平台云，接收第一平台云发送的认证信息。
步骤840，第二平台云向第二平台网关转发认证信息。
步骤850，第二平台网关根据认证信息，生成配网器认证信息。
其中，配网器认证信息用于与蓝牙Mesh设备进行接入认证。
可选地，配网器认证信息的目的地址为蓝牙Mesh设备，蓝牙Mesh设备可以对配网器认证信息进行检查验证。配网器认证信息包括配置端确认值。
可选地，第二平台包括：第二平台网关和第二平台云。在步骤850之后：第二平台网关生成认证结果；第二平台网关向第二平台云发送认证结果。由于第二平台网关保存有本次配网流程对应的认证信息，则由第二平台网关在检查完设备确认值后，生成认证结果，并将确认结果发送至第二平台云进行保存。
综上所述，本实施例提供的方法，蓝牙Mesh设备的认证信息AuthValue在每次配网时动态生成，只在单次配网周期内有效，从而避免了蓝牙Mesh设备的StaticOOB认证信息AuthValue存在泄露风险的问题，保障了蓝牙Mesh设备进行接入过程中的安全性。
在基于图8的可选实施例中，图9示出了本申请一个示例性实施例提供的接入认证方法的流程图。该方法可以应用于如图1示出的蓝牙Mesh设备跨平台接入认证系统中，该方法包括：
步骤91，用户使用语音或APP激活扫描第二平台网关。
步骤92，蓝牙Mesh设备(基于第一平台开发)按规范广播蓝牙Mesh未配网广播包，广播包中携带第三随机数。
其中，广播包中包含第一平台对应的CID。
每次配网流程中，蓝牙Mesh设备生成一个对应于本次配网流程的第三随机数，由广播包携带发送。
步骤93，第二平台网关查询设备类型，携带第三随机数。
第二平台网关获取蓝牙Mesh设备广播的未配网广播信息后，将该信息上传至第二平台云，查询该设备的类型，同时，上传第三随机数至第二平台云。
步骤93.1，第二平台云判断是否是本平台设备。
步骤93.2，第二平台云查询设备对应CID。
第二平台云在收到第二平台网关上报的设备信息后，通过CID判断蓝牙Mesh设备不是基于第二平台开发的设备，需要其它平台进行授权。
步骤93.3，第二平台云通过互联互通服务器获取CID对应的第一平台信息。
可选地，第一平台信息包含第一平台权限管理服务器等信息。
步骤93.4，第二平台云向第一平台云查询设备类型，携带第三随机数。
步骤93.5，第一平台云检查第三随机数是否使用过，生成认证信息。
第一平台云检验第三随机数的合法性，并计算本次配网的认证信息。
步骤93.6，A平台云从第一平台云获取设备类型以及认证信息。
步骤94，第二平台云向第二平台网关转发设备类型以及认证信息。
步骤95，第二平台网关向用户播报设备、设备类型。
步骤96，用户输入：连接设备。
步骤97，第二平台网关和蓝牙Mesh设备进行连接和邀请流程。
步骤97.1，第二平台网关向蓝牙Mesh设备发送配置开始。
步骤97.2，第二平台网关向蓝牙Mesh设备发送配置端公钥。
步骤97.3，蓝牙Mesh设备向第二平台网关发送设备公钥。
步骤97.4，蓝牙Mesh设备和第二平台网关进行ECDH计算。
步骤97.5，第二平台网关将配置端确认值发送给蓝牙Mesh设备。
由于第二平台网关获取了认证信息，则可以由第二平台计算生成配置端确认值。
步骤97.6，蓝牙Mesh设备向第二平台网关发送设备确认值。
步骤97.7，第二平台网关向蓝牙Mesh设备发送配置端随机数。
配置端确认值由第二平台网关生成。
步骤97.8，蓝牙Mesh设备对配置端确认值进行校验。
步骤97.9，校验通过，蓝牙Mesh设备返回设备端的设备随机数。
步骤97.10，第二平台网关进行认证校验。
步骤97.11，第二平台网关返回认证结果。
步骤97.12，第二平台云存储设备信息。
步骤98，第二平台网关向用户播报认证结果。
综上所述，本实施例提供的方法，在保障蓝牙Mesh设备进行接入过程中的安全性的同时，由第二平台网关生成配置端确认值和配置端随机数，无需从第一平台云处获取，简化了流程，提高了接入认证的效率。
需要说明的是，上述方法实施例可以分别单独实施，也可以组合实施，本申请对此不进行限制。
在上述各个实施例中，由第一平台云执行的步骤可以单独实现成为第一平台云一侧的接入认证方法，由蓝牙Mesh设备执行的步骤可以单独实现成为蓝牙Mesh设备一侧的接入认证方法，由第二平台网关执行的步骤可以单独实现成为第二平台网关一侧的接入认证方法。
图10示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为第一平台云，或者，实现成为第一平台云中的一部分，第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，该装置包括：生成模块1001；
生成模块1001，用于和蓝牙Mesh设备进行ECDH计算，生成共享根密钥，蓝牙Mesh设备由第二平台网关配置入网；
生成模块1001，用于根据共享根密钥，生成配网器认证信息，配网器认证信息用于与蓝牙Mesh设备进行接入认证。
可选地，该装置还包括：接收模块1002和发送模块1003。
在一个可选的实施例中，配网器认证信息包括配置端确认值；生成模块1001，用于根据共享根密钥，生成确认密钥；生成模块1001，用于生成配置端随机数，配置端随机数与蓝牙Mesh设备的认证信息AuthValue形成第一明文；生成模块1001，用于使用确认密钥对第一明文进行加密，生成配置端确认值。
在一个可选的实施例中，生成模块1001，用于获取确认输入值；生成模块1001，用于根据确认输入值，生成确认盐值；生成模块1001，用于根据确认盐值、共享根密钥和字符串“prck”，生成确认密钥。
在一个可选的实施例中，接收模块1002，用于接收源地址为第二平台网关的配置信息；接收模块1002，用于接收源地址为蓝牙Mesh设备的设备公钥；生成模块1001，用于生成配置端公钥；根据配置信息、设备公钥和配置端公钥，生成确认输入值；其中，配置信息包括：配置邀请协议数据单元值、配置能力协议数据单元值、配置开始协议数据单元值中的至少一种。
在一个可选的实施例中，接收模块1002，用于接收源地址为蓝牙Mesh设备的第一随机数；生成模块1001，用于根据第一随机数、配置信息、设备公钥和配置端公钥，生成确认输入值。
在一个可选的实施例中，第一随机数包含在UUID中。
在一个可选的实施例中，发送模块1003，用于发送配置端公钥，配置端公钥的目的地址为蓝牙Mesh设备。
在一个可选的实施例中，发送模块1003，用于发送设备密钥、会话密钥和会话随机数，设备密钥、会话密钥和会话随机数的目的地址为第二平台网关。
在一个可选的实施例中，接收模块1002，用于接收源地址为蓝牙Mesh设备的第二随机数；生成模块1001，用于使用蓝牙Mesh设备的认证信息对第二随机数进行加密，生成第一校对信息；发送模块1003，用于发送第一校对信息，第一校对信息的目的地址为蓝牙Mesh设备；其中，第一校对信息用于供蓝牙Mesh设备判断是否终止配网流程。
在一个可选的实施例中，第二随机数包含在UUID中。
图11示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为蓝牙Mesh设备，或者，实现成为蓝牙Mesh设备中的一部分，该装置包括：生成模块1101；
生成模块1101，用于和第一平台云进行ECDH计算，生成共享根密钥；
其中，第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，蓝牙Mesh设备由第二平台网关配置入网，共享根密钥用于生成设备确认值，设备确认值用于与第一平台云进行接入认证。
可选地，该装置还包括：接收模块1102、流程终止模块1103、发送模块1104和计算模块1105。
在一个可选的实施例中，接收模块1102，用于通过第二平台网关，接收源地址为第一平台云的配置端公钥；流程终止模块1103，用于在配置端公钥保存在本地记录中的情况下，终止配网流程；发送模块1104，用于在配置端公钥不在本地记录中的情况下，反馈设备公钥。
在一个可选的实施例中，发送模块1104，用于发送第一随机数，第一随机数的目的地址为第一平台云；其中，第一随机数用于供第一平台云生成确认输入值。
在一个可选的实施例中，第一随机数包含在通用唯一标识符UUID中。
在一个可选的实施例中，发送模块1104，用于发送第二随机数，第二随机数的目的地址为第一平台云；其中，第二随机数用于供第一平台云生成第一校对信息。
在一个可选的实施例中，计算模块1105，用于根据第二随机数，计算第二校对信息；接收模块1102，用于通过第二平台网关，接收源地址为第一平台云的第一校对信息；流程终止模块1103，用于在第一校对信息和第二校对信息不同的情况下，终止配网流程。
在一个可选的实施例中，第二随机数包含在UUID中。
图12示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为第二平台网关，或者，实现成为第二平台网关中的一部分，第二平台是将蓝牙Mesh设备配置入网的平台，蓝牙Mesh设备由第一平台云保存蓝牙Mesh设备的认证信息，第二平台网关对应的云端服务器为第二平台云，该装置包括：接收模块1201和发送模块1202；
接收模块1201，用于通过第二平台云，接收源地址为第一平台云的配网器认证信息，配网器认证信息用于与蓝牙Mesh设备进行接入认证；
发送模块1202，用于向蓝牙Mesh设备转发配网器认证信息；
其中，配网器认证信息是第一平台云根据共享根密钥生成的，共享根密钥由第一平台云和蓝牙Mesh设备进行ECDH计算得到。
接收模块1201发送模块1202在一个可选的实施例中，发送模块1202，用于通过第二平台云，向第一平台发送配置信息；接收模块1201，用于接收源地址为蓝牙Mesh设备的设备公钥Device Public Key；发送模块1202，用于通过第二平台云，向第一平台云发送设备公钥；其中，配置信息和设备公钥用于供第一平台云生成确认输入值，配置信息包括：配置邀请协议数据单元值、配置能力协议数据单元值、配置开始协议数据单元值中的至少一种。
在一个可选的实施例中，接收模块1201，用于接收源地址为蓝牙Mesh设备的第一随机数；发送模块1202，用于通过第二平台云，向第一平台云发送第一随机数，第一随机数用于供第一平台云生成确认输入值。
在一个可选的实施例中，第一随机数包含在UUID中。
在一个可选的实施例中，接收模块1201，用于通过第二平台云，接收源地址为第一平台云的配置端公钥Provisoning Public Key；发送模块1202，用于向蓝牙Mesh设备转发配置端公钥。
在一个可选的实施例中，接收模块1201，用于通过第二平台云，接收源地址为第一平台云的设备密钥DevKey、会话密钥SessionKey和会话随机数SessionNonce。
在一个可选的实施例中，接收模块1201，用于接收源地址为蓝牙Mesh设备的第二随机数；发送模块1202，用于通过第二平台云的转发，向第一平台云发送第二随机数，第二随机数用于供第一平台云生成第一校对信息VerifyValue；接收模块1201，用于通过第二平台云，接收源地址为第一平台云的第一校对信息；发送模块1202，用于向蓝牙Mesh设备发送第一校对信息。
在一个可选的实施例中，第二随机数包含在UUID中。
图13示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为第一平台云，或者，实现成为第一平台云中的一部分，第一平台云是保存有蓝牙Mesh设备的认证信息的云端服务器，该装置包括：生成模块1301和发送模块1302；
生成模块1301，用于响应于蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息，认证信息与蓝牙Mesh设备处的认证信息相同；
发送模块1302，用于发送认证信息，认证信息的目的地址为第二平台网关，第二平台网关用于将蓝牙Mesh设备配置入网；
其中，认证信息用于供第二平台网关对蓝牙Mesh设备进行认证。
可选地，该装置还包括：接收模块1303。
在一个可选的实施例中，接收模块1303，用于接收源地址为蓝牙Mesh设备的第三随机数；发送模块1302，用于在第三随机数不在本地记录中的情况下，发送认证信息。
在一个可选的实施例中，第三随机数包含在UUID中。
图14示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为第二平台网关，或者，实现成为第二平台网关中的一部分，第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，蓝牙Mesh设备由第一平台云保存蓝牙Mesh设备的认证信息，第二平台网关对应的云端服务器为第二平台云，装置包括：接收模块1401和生成模块1402；
接收模块1401，用于通过第二平台云，接收第一平台云发送的认证信息AuthValue；
生成模块1402，用于根据认证信息，生成配网器认证信息，配网器认证信息用于与蓝牙Mesh设备进行接入认证。
在一个可选的实施例中，装置还包括：发送模块1403；接收模块1401，用于接收源地址为蓝牙Mesh设备的第三随机数；发送模块1403，用于通过第二平台云，向第一平台云发送第三随机数；其中，第三随机数用于供第一平台云确定是否向第二平台网关发送认证信息。
在一个可选的实施例中，第三随机数包含在UUID中。
在一个可选的实施例中，装置还包括：发送模块1403；生成模块1402，用于生成认证结果；发送模块1403，用于向第二平台云发送认证结果。
图15示出了本申请一个示例性实施例提供的接入认证装置的结构框图，该装置可以实现成为蓝牙Mesh设备，或者，实现成为蓝牙Mesh设备中的一部分，蓝牙Mesh设备由第二平台网关配置入网，蓝牙Mesh设备由第一平台云保存蓝牙Mesh设备的认证信息，该装置包括：生成模块1501；
生成模块1501，用于响应于蓝牙Mesh设备开始进行配网流程，对应于本次配网流程的认证信息，认证信息与第一平台云处的认证信息相同。
请参考图16，其示出了本申请一个示例性实施例提供的服务器的结构框图。该服务器可用于实施上述实施例中提供的接入认证方法。具体来讲：
所述服务器1600包括中央处理单元(Central Processing Unit，CPU)1601、包括随机存取存储器(Random Access Memory，RAM)1602和只读存储器(Read-Only Memory，ROM)1603的系统存储器1604，以及连接系统存储器1604和中央处理单元1601的系统总线1605。所述服务器1600还包括帮助服务器内的各个器件之间传输信息的基本输入/输出系统(Input/Output系统，I/O系统)1606，和用于存储操作系统1613、应用程序1614和其他程序模块1615的大容量存储设备1607。
所述基本输入/输出系统1606包括有用于显示信息的显示器1608和用于用户输入信息的诸如鼠标、键盘之类的输入设备1609。其中所述显示器1608和输入设备1609都通过连接到系统总线1605的输入输出控制器1610连接到中央处理单元1601。所述基本输入/输出系统1606还可以包括输入输出控制器1610以用于接收和处理来自键盘、鼠标、或电子触控笔等多个其他设备的输入。类似地，输入输出控制器1610还提供输出到显示屏、打印机或其他类型的输出设备。
所述大容量存储设备1607通过连接到系统总线1605的大容量存储控制器(未示出)连接到中央处理单元1601。所述大容量存储设备1607及其相关联的计算机可读存储介质为服务器1600提供非易失性存储。也就是说，所述大容量存储设备1607可以包括诸如硬盘或者只读光盘(Compact Disc Read-Only Memory，CD-ROM)驱动器之类的计算机可读存储介质(未示出)。
不失一般性，所述计算机可读存储介质可以包括计算机存储介质和通信介质。计算机存储介质包括以用于存储诸如计算机可读存储指令、数据结构、程序模块或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。计算机存储介质包括RAM、ROM、可擦除可编程只读寄存器(Erasable Programmable Read Only Memory，EPROM)、电子抹除式可复写只读存储器(Electrically-Erasable Programmable Read-Only Memory，EEPROM)、闪存或其他固态存储其技术，CD-ROM、数字多功能光盘(Digital Versatile Disc，DVD)或其他光学存储、磁带盒、磁带、磁盘存储或其他磁性存储设备。当然，本领域技术人员可知所述计算机存储介质不局限于上述几种。上述的系统存储器1604和大容量存储设备1607可以统称为存储器。
存储器存储有一个或多个程序，一个或多个程序被配置成由一个或多个中央处理单元1601执行，一个或多个程序包含用于实现上述方法实施例的指令，中央处理单元1601执行该一个或多个程序实现上述各个方法实施例提供的方法。
根据本申请的各种实施例，所述服务器1600还可以通过诸如因特网等网络连接到网络上的远程服务器运行。也即服务器1600可以通过连接在所述系统总线1605上的网络接口单元1611连接到网络1612，或者说，也可以使用网络接口单元1611来连接到其他类型的网络或远程服务器系统(未示出)。
所述存储器还包括一个或者一个以上的程序，所述一个或者一个以上程序存储于存储器中，所述一个或者一个以上程序包含用于进行本申请实施例提供的方法中由第一平台云或第二平台云所执行的步骤。
在示例性实施例中，还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现上述各个方法实施例提供的由设备执行的接入认证方法。
在示例性实施例中，还提供了一种计算机程序产品或计算机程序，该计算机程序产品或计算机程序包括计算机指令，该计算机指令存储在计算机可读存储介质中，计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述方面所述的接入认证方法。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (70)

  1. 一种接入认证方法，其特征在于，应用于第一平台云中，所述第一平台云是保存有蓝牙无线网格网络Mesh设备的认证信息的云端服务器，所述方法包括：
    和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算，生成共享根密钥ECDHSecret，所述蓝牙Mesh设备由第二平台网关配置入网；
    根据所述共享根密钥，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
  2. 根据权利要求1所述的方法，其特征在于，所述配网器认证信息包括配置端确认值provisioner confirmation；
    所述根据所述共享根密钥，生成配网器认证信息，包括：
    根据所述共享根密钥，生成确认密钥ConfirmationKey；
    生成配置端随机数provisioner random，所述配置端随机数与所述蓝牙Mesh设备的认证信息AuthValue形成第一明文；
    使用所述确认密钥对所述第一明文进行加密，生成所述配置端确认值。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述共享根密钥，生成确认密钥ConfirmationKey，包括：
    获取确认输入值ConfirmationInputs；
    根据所述确认输入值，生成确认盐值ConfirmationSalt；
    根据所述确认盐值、所述共享根密钥和字符串“prck”，生成所述确认密钥。
  4. 根据权利要求3所述的方法，其特征在于，所述获取确认输入值ConfirmationInputs，包括：
    接收源地址为所述第二平台网关的配置信息；
    接收源地址为所述蓝牙Mesh设备的设备公钥Device Public Key；
    生成配置端公钥Provisoning Public Key；
    根据所述配置信息、所述设备公钥和所述配置端公钥，生成所述确认输入值；
    其中，所述配置信息包括：配置邀请协议数据单元值ProvisioningInvitePDUValue、配置能力协议数据单元值ProvisioningCapabilitiesPDUValue、配置开始协议数据单元值ProvisioningStartPDUValue中的至少一种。
  5. 根据权利要求4所述的方法，其特征在于，根据所述配置信息、所述设备公钥和所述配置端公钥，生成所述确认输入值，包括：
    接收源地址为所述蓝牙Mesh设备的第一随机数；
    根据所述第一随机数、所述配置信息、所述设备公钥和所述配置端公钥，生成所述确认输入值。
  6. 根据权利要求5所述的方法，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  7. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    发送所述配置端公钥，所述配置端公钥的目的地址为所述蓝牙Mesh设备。
  8. 根据权利要求1至7任一所述的方法，其特征在于，所述方法还包括：
    发送设备密钥DevKey、会话密钥SessionKey和会话随机数SessionNonce，所述设备密钥、所述会话密钥和所述会话随机数的目的地址为所述第二平台网关。
  9. 根据权利要求1至7任一所述的方法，其特征在于，所述方法还包括：
    接收源地址为所述蓝牙Mesh设备的第二随机数；
    使用所述蓝牙Mesh设备的认证信息对所述第二随机数进行加密，生成第一校对信息VerifyValue；
    发送所述第一校对信息，所述第一校对信息的目的地址为所述蓝牙Mesh设备；
    其中，所述第一校对信息用于供所述蓝牙Mesh设备判断是否终止配网流程。
  10. 根据权利要求9所述的方法，其特征在于，
    所述第二随机数包含在UUID中。
  11. 一种接入认证方法，其特征在于，应用于蓝牙无线网格网络Mesh设备中，所述方法包括：
    和第一平台云进行椭圆曲线算法ECDH计算，生成共享根密钥ECDHSecret；
    其中，所述第一平台云是保存有所述蓝牙Mesh设备的认证信息的云端服务器，所述蓝牙Mesh设备由第二平台网关配置入网，所述共享根密钥用于生成设备确认值deviceconfirmation，所述设备确认值用于与所述第一平台云进行接入认证。
  12. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    通过所述第二平台网关，接收源地址为所述第一平台云的配置端公钥Provisoning Public Key；
    在所述配置端公钥保存在本地记录中的情况下，终止配网流程；
    在所述配置端公钥不在本地记录中的情况下，反馈设备公钥Device Public Key。
  13. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    发送第一随机数，所述第一随机数的目的地址为所述第一平台云；
    其中，所述第一随机数用于供所述第一平台云生成确认输入值ConfirmationInputs。
  14. 根据权利要求13所述的方法，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  15. 根据权利要求11所述的方法，其特征在于，所述方法还包括：
    发送第二随机数，所述第二随机数的目的地址为所述第一平台云；
    其中，所述第二随机数用于供所述第一平台云生成第一校对信息VerifyValue。
  16. 根据权利要求15所述的方法，其特征在于，所述方法还包括：
    根据所述第二随机数，计算第二校对信息；
    通过所述第二平台网关，接收源地址为所述第一平台云的所述第一校对信息；
    在所述第一校对信息和所述第二校对信息不同的情况下，终止配网流程。
  17. 根据权利要求15所述的方法，其特征在于，
    所述第二随机数包含在UUID中。
  18. 一种接入认证方法，其特征在于，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述方法包括：
    通过所述第二平台云，接收源地址为所述第一平台云的配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证；
    向所述蓝牙Mesh设备转发所述配网器认证信息；
    其中，所述配网器认证信息是所述第一平台云根据共享根密钥ECDHSecret生成的，所述共享根密钥由所述第一平台云和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算得到。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    通过所述第二平台云，向所述第一平台云发送配置信息；
    接收源地址为所述蓝牙Mesh设备的设备公钥Device Public Key；
    通过所述第二平台云，向所述第一平台云发送所述设备公钥；
    其中，所述配置信息和所述设备公钥用于供所述第一平台云生成确认输入值ConfirmationInputs，所述配置信息包括：配置邀请协议数据单元值ProvisioningInvitePDUValue、配置能力协议数据单元值ProvisioningCapabilitiesPDUValue、配置开始协议数据单元值ProvisioningStartPDUValue中的至少一种。
  20. 根据权利要求19所述的方法，其特征在于，所述方法还包括：
    接收源地址为所述蓝牙Mesh设备的第一随机数；
    通过所述第二平台云，向所述第一平台云发送所述第一随机数，所述第一随机数用于供所述第一平台云生成所述确认输入值。
  21. 根据权利要求20所述的方法，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  22. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    通过所述第二平台云，接收源地址为所述第一平台云的配置端公钥Provisoning Public Key；
    向所述蓝牙Mesh设备转发所述配置端公钥。
  23. 根据权利要求18至22任一所述的方法，其特征在于，所述方法还包括：
    通过所述第二平台云，接收源地址为所述第一平台云的设备密钥DevKey、会话密钥SessionKey和会话随机数SessionNonce。
  24. 根据权利要求18至22任一所述的方法，其特征在于，所述方法还包括：
    接收源地址为所述蓝牙Mesh设备的第二随机数；
    通过所述第二平台云，向所述第一平台云发送所述第二随机数，所述第二随机数用于供所述第一平台云生成第一校对信息VerifyValue；
    通过所述第二平台云，接收源地址为所述第一平台云的所述第一校对信息；
    向所述蓝牙Mesh设备发送所述第一校对信息。
  25. 根据权利要求24所述的方法，其特征在于，
    所述第二随机数包含在UUID中。
  26. 一种接入认证方法，其特征在于，应用于第一平台云中，所述第一平台云是保存有蓝牙无线网格网络Mesh设备的认证信息的云端服务器，所述方法包括：
    响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述蓝牙Mesh设备处的认证信息相同；
    发送所述认证信息，所述认证信息的目的地址为第二平台网关，所述第二平台网关用于将所述蓝牙Mesh设备配置入网；
    其中，所述认证信息用于供所述第二平台网关对所述蓝牙Mesh设备进行认证。
  27. 根据权利要求26所述的方法，其特征在于，所述方法还包括：
    接收源地址为所述蓝牙Mesh设备的第三随机数；
    所述发送所述认证信息，包括：
    在所述第三随机数不在本地记录中的情况下，发送所述认证信息。
  28. 根据权利要求27所述的方法，其特征在于，
    所述第三随机数包含在通用唯一标识符UUID中。
  29. 一种接入认证方法，其特征在于，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述方法包括：
    通过所述第二平台云，接收所述第一平台云发送的认证信息AuthValue；
    根据所述认证信息，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
  30. 根据权利要求29所述的方法，其特征在于，所述方法还包括：
    接收源地址为所述蓝牙Mesh设备的第三随机数；
    通过所述第二平台云，向所述第一平台云发送所述第三随机数；
    其中，所述第三随机数用于供所述第一平台云确定是否向所述第二平台网关发送所述认证信息。
  31. 根据权利要求30所述的方法，其特征在于，
    所述第三随机数包含在通用唯一标识符UUID中。
  32. 根据权利要求29所述的方法，其特征在于，所述方法还包括：
    生成认证结果；
    向所述第二平台云发送所述认证结果。
  33. 一种接入认证方法，其特征在于，应用于蓝牙无线网格网络Mesh设备中，所述蓝牙Mesh设备由第二平台网关配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述方法包括：
    响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述第一平台云处的认证信息相同。
  34. 一种接入认证装置，其特征在于，应用于第一平台云中，所述第一平台云是保存有蓝牙无线网格网络Mesh设备的认证信息的云端服务器，所述装置包括：生成模块；
    所述生成模块，用于和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算，生成共享根密钥ECDHSecret，所述蓝牙Mesh设备由第二平台网关配置入网；
    所述生成模块，用于根据所述共享根密钥，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
  35. 根据权利要求34所述的装置，其特征在于，所述配网器认证信息包括配置端确认值provisioner confirmation；
    所述生成模块，用于根据所述共享根密钥，生成确认密钥ConfirmationKey；
    所述生成模块，用于生成配置端随机数provisioner random，所述配置端随机数与所述蓝牙Mesh设备的认证信息AuthValue形成第一明文；
    所述生成模块，用于使用所述确认密钥对所述第一明文进行加密，生成所述配置端确认值。
  36. 根据权利要求35所述的装置，其特征在于，
    所述生成模块，用于获取确认输入值ConfirmationInputs；
    所述生成模块，用于根据所述确认输入值，生成确认盐值ConfirmationSalt；
    所述生成模块，用于根据所述确认盐值、所述共享根密钥和字符串“prck”，生成所述确认密钥。
  37. 根据权利要求36所述的装置，其特征在于，所述装置还包括：接收模块；
    所述接收模块，用于接收源地址为所述第二平台网关的配置信息；
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的设备公钥Device Public Key；
    所述生成模块，用于生成配置端公钥Provisoning Public Key；
    根据所述配置信息、所述设备公钥和所述配置端公钥，生成所述确认输入值；
    其中，所述配置信息包括：配置邀请协议数据单元值ProvisioningInvitePDUValue、配置能力协议数据单元值ProvisioningCapabilitiesPDUValue、配置开始协议数据单元值ProvisioningStartPDUValue中的至少一种。
  38. 根据权利要求37所述的装置，其特征在于，
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第一随机数；
    所述生成模块，用于根据所述第一随机数、所述配置信息、所述设备公钥和所述配置端公钥，生成所述确认输入值。
  39. 根据权利要求38所述的装置，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  40. 根据权利要求39所述的装置，其特征在于，所述装置还包括：发送模块；
    所述发送模块，用于发送所述配置端公钥，所述配置端公钥的目的地址为所述蓝牙Mesh设备。
  41. 根据权利要求34至40任一所述的装置，其特征在于，所述装置还包括：发送模块；
    所述发送模块，用于发送设备密钥DevKey、会话密钥SessionKey和会话随机数SessionNonce，所述设备密钥、所述会话密钥和所述会话随机数的目的地址为所述第二平台网关。
  42. 根据权利要求34至40任一所述的装置，其特征在于，所述装置还包括：接收模块和发送模块；
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第二随机数；
    所述生成模块，用于使用所述蓝牙Mesh设备的认证信息对所述第二随机数进行加密，生成第一校对信息VerifyValue；
    所述发送模块，用于发送所述第一校对信息，所述第一校对信息的目的地址为所述蓝牙Mesh设备；
    其中，所述第一校对信息用于供所述蓝牙Mesh设备判断是否终止配网流程。
  43. 根据权利要求42所述的装置，其特征在于，
    所述第二随机数包含在UUID中。
  44. 一种接入认证装置，其特征在于，应用于蓝牙无线网格网络Mesh设备中，所述装置包括：生成模块；
    所述生成模块，用于和第一平台云进行椭圆曲线算法ECDH计算，生成共享根密钥ECDHSecret；
    其中，所述第一平台云是保存有所述蓝牙Mesh设备的认证信息的云端服务器，所述蓝牙Mesh设备由第二平台网关配置入网，所述共享根密钥用于生成设备确认值deviceconfirmation，所述设备确认值用于与所述第一平台云进行接入认证。
  45. 根据权利要求44所述的装置，其特征在于，所述装置还包括：接收模块、流程终止模块和发送模块；
    所述接收模块，用于通过所述第二平台网关，接收源地址为所述第一平台云的配置端公钥Provisoning Public Key；
    所述流程终止模块，用于在所述配置端公钥保存在本地记录中的情况下，终止配网流程；
    所述发送模块，用于在所述配置端公钥不在本地记录中的情况下，反馈设备公钥Device Public Key。
  46. 根据权利要求44所述的装置，其特征在于，所述装置还包括：发送模块；
    所述发送模块，用于发送第一随机数，所述第一随机数的目的地址为所述第一平台云；
    其中，所述第一随机数用于供所述第一平台云生成确认输入值ConfirmationInputs。
  47. 根据权利要求46所述的装置，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  48. 根据权利要求44所述的装置，其特征在于，所述装置还包括：发送模块；
    所述发送模块，用于发送第二随机数，所述第二随机数的目的地址为所述第一平台云；
    其中，所述第二随机数用于供所述第一平台云生成第一校对信息VerifyValue。
  49. 根据权利要求48所述的装置，其特征在于，所述装置还包括：计算模块、接收模块和流程终止模块；
    所述计算模块，用于根据所述第二随机数，计算第二校对信息；
    所述接收模块，用于通过所述第二平台网关，接收源地址为所述第一平台云的所述第一校对信息；
    所述流程终止模块，用于在所述第一校对信息和所述第二校对信息不同的情况下，终止配网流程。
  50. 根据权利要求48所述的装置，其特征在于，
    所述第二随机数包含在UUID中。
  51. 一种接入认证装置，其特征在于，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述装置包括：接收模块和发送模块；
    所述接收模块，用于通过所述第二平台云，接收源地址为所述第一平台云的配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证；
    所述发送模块，用于向所述蓝牙Mesh设备转发所述配网器认证信息；
    其中，所述配网器认证信息是所述第一平台云根据共享根密钥ECDHSecret生成的，所述共享根密钥由所述第一平台云和所述蓝牙Mesh设备进行椭圆曲线算法ECDH计算得到。
  52. 根据权利要求51所述的装置，其特征在于，
    所述发送模块，用于通过所述第二平台云，向所述第一平台云发送配置信息；
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的设备公钥Device Public Key；
    所述发送模块，用于通过所述第二平台云，向所述第一平台云发送所述设备公钥；
    其中，所述配置信息和所述设备公钥用于供所述第一平台云生成确认输入值ConfirmationInputs，所述配置信息包括：配置邀请协议数据单元值ProvisioningInvitePDUValue、配置能力协议数据单元值ProvisioningCapabilitiesPDUValue、配置开始协议数据单元值ProvisioningStartPDUValue中的至少一种。
  53. 根据权利要求52所述的装置，其特征在于，
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第一随机数；
    所述发送模块，用于通过所述第二平台云，向所述第一平台云发送所述第一随机数，所述第一随机数用于供所述第一平台云生成所述确认输入值。
  54. 根据权利要求53所述的装置，其特征在于，
    所述第一随机数包含在通用唯一标识符UUID中。
  55. 根据权利要求51所述的装置，其特征在于，
    所述接收模块，用于通过所述第二平台云的转发，接收源地址为所述第一平台云的配置端公钥Provisoning Public Key；
    所述发送模块，用于向所述蓝牙Mesh设备转发所述配置端公钥。
  56. 根据权利要求51至55任一所述的装置，其特征在于，
    所述接收模块，用于通过所述第二平台云，接收源地址为所述第一平台云的设备密钥DevKey、会话密钥SessionKey和会话随机数SessionNonce。
  57. 根据权利要求51至55任一所述的装置，其特征在于，
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第二随机数；
    所述发送模块，用于通过所述第二平台云，向所述第一平台云发送所述第二随机数，所述第二随机数用于供所述第一平台云生成第一校对信息VerifyValue；
    所述接收模块，用于通过所述第二平台云，接收源地址为所述第一平台云的所述第一校对信息；
    所述发送模块，用于向所述蓝牙Mesh设备发送所述第一校对信息。
  58. 根据权利要求57所述的装置，其特征在于，
    所述第二随机数包含在UUID中。
  59. 一种接入认证装置，其特征在于，应用于第一平台云中，所述第一平台云是保存有蓝牙无线网格网络Mesh设备的认证信息的云端服务器，所述装置包括：生成模块和发送模块；
    所述生成模块，用于响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述蓝牙Mesh设备处的认证信息相同；
    所述发送模块，用于发送所述认证信息，所述认证信息的目的地址为第二平台网关，所述第二平台网关用于将所述蓝牙Mesh设备配置入网；
    其中，所述认证信息用于供所述第二平台网关对所述蓝牙Mesh设备进行认证。
  60. 根据权利要求59所述的装置，其特征在于，所述装置还包括：接收模块；
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第三随机数；
    所述发送模块，用于在所述第三随机数不在本地记录中的情况下，发送所述认证信息。
  61. 根据权利要求60所述的装置，其特征在于，
    所述第三随机数包含在通用唯一标识符UUID中。
  62. 一种接入认证装置，其特征在于，应用于第二平台网关中，所述第二平台网关用于将蓝牙无线网格网络Mesh设备配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述第二平台网关对应的云端服务器为第二平台云，所述装置包括：接收模块和生成模块；
    所述接收模块，用于通过所述第二平台云，接收所述第一平台云发送的认证信息AuthValue；
    所述生成模块，用于根据所述认证信息，生成配网器认证信息，所述配网器认证信息用于与所述蓝牙Mesh设备进行接入认证。
  63. 根据权利要求62所述的装置，其特征在于，所述装置还包括：发送模块；
    所述接收模块，用于接收源地址为所述蓝牙Mesh设备的第三随机数；
    所述发送模块，用于通过所述第二平台云，向所述第一平台云发送所述第三随机数；
    其中，所述第三随机数用于供所述第一平台云确定是否向所述第二平台网关发送所述认证信息。
  64. 根据权利要求63所述的装置，其特征在于，
    所述第三随机数包含在通用唯一标识符UUID中。
  65. 根据权利要求62所述的装置，其特征在于，所述装置还包括：发送模块；
    所述生成模块，用于生成认证结果；
    所述发送模块，用于向所述第二平台云发送所述认证结果。
  66. 一种接入认证装置，其特征在于，应用于蓝牙无线网格网络Mesh设备中，所述蓝牙Mesh设备由第二平台网关配置入网，所述蓝牙Mesh设备由第一平台云保存所述蓝牙Mesh设备的认证信息，所述装置包括：生成模块；
    所述生成模块，用于响应于所述蓝牙Mesh设备开始进行配网流程，生成对应于本次配网流程的认证信息AuthValue，所述认证信息与所述第一平台云处的认证信息相同。
  67. 一种第一平台云，其特征在于，所述第一平台云包括：
    处理器；
    与所述处理器相连的收发器；
    用于存储所述处理器的可执行指令的存储器；
    其中，所述处理器被配置为加载并执行所述可执行指令以实现如权利要求1至10，或如权利要求26至28任一所述的接入认证方法。
  68. 一种第二平台网关，其特征在于，所述第二平台网关包括：
    处理器；
    与所述处理器相连的收发器；
    用于存储所述处理器的可执行指令的存储器；
    其中，所述处理器被配置为加载并执行所述可执行指令以实现如权利要求18至25，或如权利要求29至32任一所述的接入认证方法。
  69. 一种蓝牙无线网格网络Mesh设备，其特征在于，所述蓝牙Mesh设备包括：
    处理器；
    与所述处理器相连的收发器；
    用于存储所述处理器的可执行指令的存储器；
    其中，所述处理器被配置为加载并执行所述可执行指令以实现如权利要求11至17，或如权利要求33任一所述的接入认证方法。
  70. 一种计算机可读存储介质，其特征在于，所述可读存储介质中存储有可执行指令，所述可执行指令由处理器加载并执行以实现如权利要求1至33任一所述的接入认证方法。
PCT/CN2020/103637 2020-07-22 2020-07-22 接入认证方法、装置、设备及存储介质 WO2022016435A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080101163.2A CN115669209A (zh) 2020-07-22 2020-07-22 接入认证方法、装置、设备及存储介质
PCT/CN2020/103637 WO2022016435A1 (zh) 2020-07-22 2020-07-22 接入认证方法、装置、设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/103637 WO2022016435A1 (zh) 2020-07-22 2020-07-22 接入认证方法、装置、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2022016435A1 true WO2022016435A1 (zh) 2022-01-27

Family

ID=79728467

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/103637 WO2022016435A1 (zh) 2020-07-22 2020-07-22 接入认证方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN115669209A (zh)
WO (1) WO2022016435A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117556411B (zh) * 2024-01-10 2024-05-10 鼎铉商用密码测评技术(深圳)有限公司 密码的生成方法、密码的生成设备以及可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10404704B2 (en) * 2014-09-09 2019-09-03 Arm Ip Limited Communication mechanism for data processing devices
CN110418322A (zh) * 2019-08-09 2019-11-05 四川虹美智能科技有限公司 基于蓝牙Mesh网络的配网方法及系统、一种节点
CN110505606A (zh) * 2018-05-18 2019-11-26 阿里巴巴集团控股有限公司 蓝牙Mesh网络及其配网鉴权方法、设备和存储介质
US20200169572A1 (en) * 2018-11-28 2020-05-28 Qualcomm Incorporated Detection of security threats in a mesh network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10404704B2 (en) * 2014-09-09 2019-09-03 Arm Ip Limited Communication mechanism for data processing devices
CN110505606A (zh) * 2018-05-18 2019-11-26 阿里巴巴集团控股有限公司 蓝牙Mesh网络及其配网鉴权方法、设备和存储介质
US20200169572A1 (en) * 2018-11-28 2020-05-28 Qualcomm Incorporated Detection of security threats in a mesh network
CN110418322A (zh) * 2019-08-09 2019-11-05 四川虹美智能科技有限公司 基于蓝牙Mesh网络的配网方法及系统、一种节点

Also Published As

Publication number Publication date
CN115669209A (zh) 2023-01-31

Similar Documents

Publication Publication Date Title
US10701060B2 (en) Public key infrastructure exchange using netconf for Openflow enabled switches
US10827351B2 (en) Network authentication method, relay node, and related system
US7929703B2 (en) Methods and system for managing security keys within a wireless network
CN110581854B (zh) 基于区块链的智能终端安全通信方法
US9450951B2 (en) Secure over-the-air provisioning solution for handheld and desktop devices and services
WO2017129089A1 (zh) 无线网络连接方法、装置及存储介质
US20180034643A1 (en) SSL Gateway with Integrated Hardware Security Module
EP2264940A2 (en) Authentication information management method in home network and an apparatus therefor
CN111740966B (zh) 一种基于区块链网络的数据处理方法及相关设备
WO2009065356A1 (fr) Procédé, système et dispositif de réseau pour une authentification mutuelle
JP7451696B2 (ja) 結合デバイスおよび関連デバイスのためのリモートアテステーションモードネゴシエーション方法
WO2019110018A1 (zh) 通信网络系统的消息验证方法、通信方法和通信网络系统
WO2022100356A1 (zh) 身份认证系统、方法、装置、设备及计算机可读存储介质
CN113595847B (zh) 远程接入方法、系统、设备和介质
CN106535089B (zh) 机器对机器虚拟私有网络
WO2022016435A1 (zh) 接入认证方法、装置、设备及存储介质
US20220006654A1 (en) Method to establish an application level ssl certificate hierarchy between master node and capacity nodes based on hardware level certificate hierarchy
WO2024012318A1 (zh) 设备接入方法、系统以及非易失性计算机存储介质
CN116204914A (zh) 一种可信隐私计算方法、装置、设备及存储介质
US8949598B2 (en) Method and apparatus for secured embedded device communication
CN113986464A (zh) 虚拟机安全迁移的方法和系统
CN112751664B (zh) 一种物联网组网方法、装置和计算机可读存储介质
US20230045486A1 (en) Apparatus and Methods for Encrypted Communication
US20220070161A1 (en) Multi-way trust formation in a distributed system
WO2022099703A1 (zh) 接入认证方法、平台网关和平台云

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20946191

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20946191

Country of ref document: EP

Kind code of ref document: A1