WO2023082894A1

WO2023082894A1 - Authentication method between terminal side device and network side device, and system

Info

Publication number: WO2023082894A1
Application number: PCT/CN2022/123503
Authority: WO
Inventors: 潘龙
Original assignee: 杭州萤石软件有限公司
Priority date: 2021-11-10
Filing date: 2022-09-30
Publication date: 2023-05-19
Also published as: CN114051244A

Abstract

The present application discloses an authentication method between a terminal side device and a network side device, and a system. The method comprises: a local side device and an opposite side device interacts authentication protocol types at any local device side in devices of two parties of the terminal side device and the network side device, so as to determine the authentication protocol types supported by the devices of the two parties, wherein the authentication protocol types correspond to authentication modes. According to the present application, the problem of mutual dependence on authentication modes of the devices of the two parties in a software and hardware resource iteration process is avoided; moreover, abundant authentication protocol type negotiation resources are provided, acceleration of a negotiation speed of the authentication protocol type is also facilitated, and the authentication efficiency is improved.

Description

An authentication method and system between a terminal-side device and a network-side device

This application claims the priority of the Chinese patent application with the application number 202111324852.2 submitted to the China Patent Office on November 10, 2021. The contents are incorporated by reference in this application.

technical field

The present application relates to the field of wireless communication, and in particular, relates to an authentication method between a terminal-side device and a network-side device.

Background technique

At present, the authentication method between the terminal-side device and the network-side device usually completes the authentication by means of a pre-embedded public and private key and a certain fixed algorithm. For example, in the Internet of Things system, the Internet of Things devices and platforms respectively store public and private keys and the same algorithm in advance, and use the algorithm and public and private keys for authentication.

When the terminal-side device or network-side device is upgraded, the authentication algorithm of the upgraded device is usually also upgraded, so that the authentication algorithm of the device that has not been upgraded is no longer the same algorithm, resulting in the same algorithm between the upgraded device and the non-upgraded Authentication between devices is not possible.

Contents of the invention

The present application provides an authentication method between a terminal-side device and a network-side device, so as to avoid interdependence between the terminal-side device and/or the network-side device when performing authentication.

The present application provides an authentication method between a terminal-side device and a network-side device. The method includes, on the side of any of the terminal-side device and the network-side device,

The local device interacts with the other device's authentication protocol type to determine the authentication protocol type supported by both devices, wherein the authentication protocol type corresponds to an authentication method;

The local device performs authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, and enables the other device to perform authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type.

Preferably, the local device interacts with the counterparty device in an authentication protocol type, including,

The two devices exchange the first authentication protocol type supported by default by either device, and the second authentication protocol type selected from the authentication protocol type group when either device does not support the first authentication protocol type,

or

The two devices exchange the second authentication protocol type selected from the authentication protocol type group;

Wherein, the authentication protocol type group includes at least one authentication protocol type, and each authentication protocol type corresponds to an authentication method.

Preferably, the second authentication protocol type is: the authentication protocol type with the highest priority in the authentication protocol type group, and the authentication protocol type group is a terminal-side device authentication protocol type group and a network-side device authentication protocol type group the intersection of

The two devices exchange the first authentication protocol type supported by default by either device, and the second authentication protocol type selected from the authentication protocol type group when either device does not support the first authentication protocol type, including,

The local device sends the first authentication protocol type and the authentication protocol type group supported by any device by default to the opposite device, so that the opposite device selects the first authentication protocol type group from the authentication protocol type group if it does not support the first authentication protocol type. 2. Authentication protocol type, and send the adopted authentication protocol type to the local device.

Preferably, the two devices interact with the second authentication protocol type selected from the authentication protocol type group, including:

The local device sends the authentication protocol type group to the counterparty device, so that the counterparty device selects the second authentication protocol type from the authentication protocol type group and sends it to the local device,

The local device performs authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, and makes the opposite device perform authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, including ,

Both devices perform authentication using the authentication mode corresponding to the second authentication protocol type respectively.

The local device receives the second authentication protocol type from the other device, judges whether it supports the second authentication protocol type, and if not, notifies the other device to reselect, or selects the authentication protocol supported by the local device from the authentication protocol type group The type is sent to the other device, so that the other device selects the authentication protocol type supported by the other device from the supported authentication protocol types, and sends it to the local device.

Preferably, the authentication method includes one of a public-private key pair generation method, a total key generation method, a shared key generation method, an encryption and decryption method, and a digest generation method or any combination thereof,

The second authentication protocol type is the optimal authentication protocol type selected according to the security level;

The authentication between the two devices includes:

The first authentication that the own device is authenticated by the other device, and

The second authentication in which the local device authenticates the counterpart device.

Preferably, the first authentication of the local device being authenticated by the counterparty device includes:

On the local device side,

According to the public-private key pair generation method corresponding to the authentication protocol type, generate the public-private key pair of the local device,

According to the shared key generation method corresponding to the authentication protocol type, generate the shared key of the local device,

According to the encryption and decryption methods corresponding to the authentication protocol type, use the shared key to encrypt the public key to obtain the encrypted public key.

Send the first device ID, device verification code, and encrypted public key of the local device to the other device, so that the other device:

According to the shared key generation method corresponding to the authentication protocol type, use the first device identifier and the device verification code to generate the shared key of the other party's device,

According to the encryption and decryption method corresponding to the type of authentication protocol, use the shared key of the other party's device to decrypt the encrypted public key of the local device to obtain the public key of the local device.

According to the public-private key pair generation method corresponding to the authentication protocol type, use the private key of the other party's device and the public key of the local device to generate the total key of the other party's device.

According to the encryption and decryption mode corresponding to the authentication protocol type, the public key of the counterpart device is encrypted by using the general key of the counterpart device to obtain the encrypted public key of the counterpart device.

Preferably, the second authentication performed by the local device on the counterparty device includes,

The local device receives the encrypted public key of the other device sent by the other device,

According to the encryption and decryption method corresponding to the type of authentication protocol, use the shared key of the local device to decrypt the encrypted public key of the other party's device to obtain the public key of the other party's device.

According to the public-private key pair generation method corresponding to the authentication protocol type, use the private key of the local device and the public key of the other device to generate the total key of the local device.

According to the digest generation method corresponding to the authentication protocol type, use the total key of the local device to generate a digest for the first device identifier, and obtain the first result,

Sending the first result to the counterparty device, so that the counterparty device:

According to the digest generation method corresponding to the type of authentication protocol, use the total key of the counterparty device to generate a digest for the first device identifier to obtain a second result,

verifying the first result and the second result, and generating a session key and a second device identifier when the verification is passed,

According to the encryption and decryption method corresponding to the authentication protocol type, the session key and the second device identifier are encrypted using the total key of the other party's device to obtain the encrypted session key and the second device identifier,

Send the second result, the encrypted session key and the second device identifier to the local device;

The local device receives the second result from the opposite device, and the encrypted session key and the second device identifier,

According to the digest generation method corresponding to the authentication protocol type, use the total key of the local device to generate a digest for the first device identifier, and obtain the third result,

Verify the second result and the third result, and when the verification is passed, use the general key of the local device to decrypt the encrypted session key and the second device identifier according to the encryption and decryption method corresponding to the authentication protocol type.

The present application also provides a terminal-side device, including a memory and a processor, the memory stores a computer program, and the processor is configured to execute the steps of implementing any authentication method between the terminal-side device and the network-side device .

The present application further provides a network-side device, including a memory and a processor, the memory stores a computer program, and the processor is configured to execute the steps of implementing any authentication method between the terminal-side device and the network-side device .

The present application further provides an Internet of Things system, including the above-mentioned terminal-side device and the above-mentioned network-side device.

The present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any authentication method between the terminal-side device and the network-side device is implemented A step of.

This application provides an authentication method between a terminal-side device and a network-side device. The two devices perform authentication protocol type interaction, so that the two devices can find at least one authentication protocol type through negotiation, so that the two devices follow the negotiated authentication. The authentication method corresponding to the protocol type is used for authentication, which avoids the problem of interdependence between the two devices on the authentication method during the iterative process of software and hardware resources. In the case of the first authentication protocol type, the second authentication protocol type selected from the authentication protocol type group, or the second authentication protocol type selected from the authentication protocol type group through interaction, not only provides abundant authentication protocol type negotiation resources, It is also conducive to accelerating the negotiation speed of the authentication protocol type and improving the authentication efficiency.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application and the prior art, the following briefly introduces the accompanying drawings required in the embodiments and the prior art. Obviously, the accompanying drawings in the following description are only the present invention. For some embodiments of the application, those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of authentication between a terminal-side device and a network-side device according to an embodiment of the present application;

Fig. 2a and Fig. 2b are a schematic flow diagram of authentication between the terminal-side device and the network-side device;

Fig. 3a and Fig. 3b are schematic flow diagrams when the negotiation between the terminal side device and the network side device is inconsistent;

FIG. 4 is a schematic flow diagram of authentication between a terminal-side device and a network-side device in Embodiment 2 of the present application;

FIG. 5 is a schematic diagram of an authentication process between a terminal-side device and a network-side device in Embodiment 3 of the present application;

FIG. 6 is a schematic diagram of another authentication process between a terminal-side device and a network-side device in Embodiment 3 of the present application;

FIG. 7 is a schematic flow diagram of authentication between a terminal-side device and a network-side device according to Embodiment 4 of the present application;

FIG. 8 is a schematic diagram of another authentication process between a terminal-side device and a network-side device according to Embodiment 4 of the present application;

FIG. 9 is a schematic diagram of a terminal-side device or a network-side device;

FIG. 10 is a schematic diagram of a terminal-side device or a network-side device.

Detailed ways

In order to make the purpose, technical solution, and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and examples. Apparently, the described embodiments are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

This application uses the authentication protocol type negotiated between the terminal-side device and the network-side device to perform authentication using the authentication method corresponding to the authentication protocol type, so as to avoid interdependence between the terminal-side device and/or the network-side device when performing authentication.

Referring to FIG. 1 , FIG. 1 is a schematic flowchart of authentication between a terminal-side device and a network-side device according to an embodiment of the present application. The method includes,

Step 101, the terminal-side device and the network-side device perform authentication protocol type interaction to determine the authentication protocol type supported by both devices, so that the terminal-side device and the network-side device negotiate to obtain an authentication protocol type,

Step 102, the devices of both parties have corresponding authentication methods according to the types of supported authentication protocols, and perform authentication between the devices of both parties;

in,

The authentication protocol type corresponds to an authentication method;

The authentication between the two devices includes,

The first authentication that any one of the two devices is authenticated by the other device, and

This embodiment is selected, and the authentication protocol types are exchanged between the two devices, so that the two devices can find at least one authentication protocol type through negotiation, so that the two devices can perform authentication according to the authentication method corresponding to the negotiated authentication protocol type, avoiding The interdependence of authentication methods in the iterative process of software and hardware resources, further, through the first authentication protocol type supported by the interactive device by default, and the authentication protocol type group from the authentication protocol type group in the case that any device does not support the first authentication protocol type The selected second authentication protocol type, or the second authentication protocol type selected from the authentication protocol type group through interaction, not only provides abundant authentication protocol type negotiation resources, but also helps to speed up the authentication protocol type negotiation speed and improve authentication efficiency .

In S101, an authentication protocol type negotiated between the terminal-side device and the network-side device should be supported by the terminal-side device and should be supported by the network-side device. Exemplarily, assuming that the terminal-side device supports authentication protocol types 1-3, and the network-side device supports authentication protocol types 2-4, the authentication protocol type negotiated between the terminal-side device and the network-side device is authentication protocol type 2 or Authentication protocol type 3.

In S102 , the authentication method corresponding to the authentication protocol type means that the authentication protocol type corresponds to the authentication method, and the authentication between the devices of the two parties that complies with the authentication protocol type can be performed according to the authentication method.

Embodiment one

In this embodiment, the case where the terminal side device supports the first authentication protocol type by default and the network side terminal device also supports the first authentication protocol type is exchanged between the two devices respectively (see the examples shown in Fig. 2a and Fig. 2b below), and When the terminal-side device supports the first authentication protocol type but the network-side device does not support the first authentication protocol type, the network-side device selects the second authentication protocol type from the authentication protocol type group (see Figure 3a and Figure 3b below). The illustrated example) is described, wherein the authentication protocol type group is the intersection of the terminal-side device authentication protocol type group and the network-side device authentication protocol type group. For example, it is assumed that the terminal-side device supports authentication protocol types 1-3, If the network-side device supports authentication protocol types 2-4, the authentication protocol type group is {authentication protocol type 2, authentication protocol type 3}. The second authentication protocol type is the authentication protocol type with the highest priority in the authentication protocol type group. If the two parties do not have corresponding authentication types, that is, there is no intersection between the types of authentication protocols supported by the devices of both parties, the interaction is stopped.

Referring to Figs. 2a and 2b, Figs. 2a and 2b are schematic flowcharts of authentication between a terminal-side device and a network-side device. The authentication methods include,

Devices on the terminal side, such as IoT devices, mobile phones, tablets, etc.

Step 201, the terminal-side device obtains the first authentication protocol type, which is recorded as default_auth_type. The authentication protocol type can be the authentication protocol type supported by the device by default, or the authentication protocol type supported by the network-side device by default, but the first authentication protocol The type should be the authentication protocol type supported by the terminal-side device. Exemplarily, the terminal-side device determines the first authentication protocol type from multiple default authentication protocol types supported by the terminal-side device according to preset rules.

As shown in the table below, the first authentication protocol type corresponds to an authentication method, and the authentication method includes one of the public-private key pair generation method, the total key Masterkey generation method, the shared key Sharekey generation method, the encryption and decryption method, and the digest generation method or Any combination thereof; it is specifically determined according to authentication requirements, and the above method can be understood as a specific algorithm.

The second line in the above table indicates: authentication protocol type 1 stipulates that during the authentication process, a public-private key pair is generated by means of ECP_DP_SECP384R1, and a total key is generated by means of ECP_DP_SECP384R1, and the md5(md5(MD5(verification code devauthcode+device sequence devid)+identification to generate a shared key, encrypt and decrypt through AES128-GCM, and generate a digest through the release of Hmac_SHA384.

Step 202, obtain the authentication type protocol group supported by the terminal side equipment, denoted as auth_type_group, the authentication type protocol group includes more than one authentication protocol type, and each authentication protocol type corresponds to a public-private key pair generation method, a total key Masterkey generation method, Sharekey generation method, encryption and decryption method, summary generation method or any combination thereof. Specifically, it is determined according to authentication requirements. In this embodiment, it is a combination of all authentication methods. The above authentication method can be understood as a specific algorithm.

Step 203, read the first device identification and device verification code pre-stored in the terminal side device, which are devided and devauthcode respectively.

Wherein, the first device identifier may be a device serial number, the device serial number is used to identify a character string of the device, each physical device has a different identifier,

The device verification code is a string of strings stored in the device hardware, which is non-volatile and cannot be changed.

Step 204, according to the public-private key pair generation algorithm stipulated in the first authentication protocol type acquired in step 201, generate the public-private key pair of the terminal side device, which is recorded as dev_privatekey (the private key in the public-private key pair), dev_publickey (the public-private key pair) public key).

Step 205 , according to the shared key Sharekey generation algorithm stipulated in the first authentication protocol type obtained in step 201 , use the pre-stored devid and devauthcode to generate a terminal shared key, which is recorded as dev_sharekey.

Step 206, according to the encryption and decryption algorithm stipulated in the first authentication protocol type acquired in step 201, use the shared key Sharekey to encrypt the public key dev_publickey of the terminal to obtain the encrypted devic_publickey, which is denoted as cipher(devic_publickey).

Step 207, the first authentication protocol type obtained in step 201, the authentication type protocol group obtained in step 202, the first device identifier devid and devauthcode obtained in step 203, and the cipher(devic_publickey ) to the network side device.

In the above process, in view of the fact that in most practical applications, the network-side device is upgraded but the terminal-side device is not upgraded, resulting in the failure of authentication, therefore, the probability that the terminal-side device supports the default first authentication protocol type is relatively high. In this way, parameter calculations for authentication can be performed in advance, such as calculating public-private key pairs, shared keys, encrypted public keys, etc.; in addition, the first authentication protocol type and authentication type The verification code and cipher (devic_publickey) are sent to the network side, which helps to reduce the number of times the terminal side device sends to the network side device, thereby helping to improve the reliability of the authentication process.

As a modification, the first authentication protocol type and authentication type protocol group can be sent to the network side before reading the first device identification and device verification code pre-stored by the terminal side device, so as to communicate with the network side for the authentication protocol type negotiation.

Devices on the network side, such as platforms, servers, etc.

Step 208, judging whether the first authentication protocol type of the terminal-side device is supported.

Step 209, determine the first authentication protocol type that supports the terminal-side device.

Step 210, according to the public-private key pair generation algorithm stipulated in the first authentication protocol type, generate the public-private key pair of the network side device, recorded as plt_privatekey, plt_publickey, where plt_privatekey is the private key in the public-private key pair, and plt_publickey is the public-private key pair 's public key.

Step 211, according to the shared key generation algorithm stipulated in the first authentication protocol type, use the pre-stored devid and devauthcode to generate the shared key of the network side device, denoted as plt_sharekey.

Step 212, according to the encryption and decryption algorithm stipulated in the first authentication protocol type, use plt_sharekey as the key to decrypt the cipher (dev_publickey) to obtain dev_publickey.

Step 213, according to the general key generation algorithm stipulated in the first authentication protocol type, use the private key plt_privatekey and dev_publickey of the network side device to generate a network side device master key, denoted as plt_masterkey.

Step 214, according to the encryption and decryption algorithm stipulated in the first authentication protocol type, use the general key of the network side device to encrypt the public key plt_publickey of the network side device, and obtain the encrypted public key of the network side device, which is recorded as cipher(plt_publickey) .

Step 215, transmit the cipher (plt_publickey) and the adopted authentication protocol type to the terminal side device through the TCP session.

On the terminal side device,

Step 216, receiving the authentication protocol type from the network-side device, and judging that the authentication protocol type of the network-side device is consistent with the authentication protocol type default_auth_type of the terminal-side device.

Step 217, if consistent, decrypt the cipher (plt_publickey) using the shared key dev_sharekey of the terminal-side device according to the decryption algorithm agreed by default_auth_type to obtain the public key plt_publickey of the network-side device.

Step 218, according to the general key generation algorithm agreed by default_auth_type, use the private key dev_privatekey of the terminal-side device and the private key plt_publickey of the network-side device to generate the general key of the terminal-side device, which is recorded as dev_masterkey.

The total key is a relatively long-term key generated by the terminal-side device and the network-side device during the authentication process, and its life cycle is controlled by the network-side device.

Step 219, according to the digest generation algorithm agreed by default_auth_type, use the master key dev_masterkey of the terminal side device to generate a digest for devid, and obtain the first result, which is recorded as Digest(devid).

Step 220, transmit the first result Digest (devid) to the network side device through the TCP session.

On the network side device,

Step 221, according to the digest generation algorithm agreed by default_auth_type, use the total key plt_masterkey of the network side device to generate a digest for devid, and obtain the second result, which is recorded as Digest1(devid)

Step 222, verify the first result Digest(devid) and the second result Digest1(devid).

Step 223, if the verification is passed, generate a session key sessionkey and a second device ID deviceid, and the second device ID is assigned to the terminal side device by the network side device; otherwise, the authentication fails, and the authentication process ends.

Step 224, according to the decryption algorithm agreed by default_auth_type, use the total key plt_masterkey of the network side device to encrypt the sessionkey and deviceid to obtain the encrypted session key cipher(sessionkey), and the encrypted second device identifier cipher( deviceid).

Step 225, according to the digest generation algorithm agreed by default_auth_type, use the master key plt_masterkey of the network side device to generate a digest for devid, and obtain the third result, which is denoted as Digest2(devid).

Since the total key is usually within the lifetime, the third result is the same as the second result, and the calculation of the third result may not be performed.

Step 226, send the cipher (deviceid), cipher (sessionkey), and Digest2 (devid) or Digest1 (devid) to the terminal side device through the TCP session.

On the terminal side device,

Step 227, according to the digest generation algorithm agreed by default_auth_type, use the total key dev_masterkey of the terminal side device to generate a digest for devid, and obtain the fourth result, which is recorded as Digest3(devid),

Step 228, check the third result Digest2(devid) and the fourth result Digest3(devid), or check the second result Digest1(devid) and the fourth result Digest3(devid).

Step 229, when the verification is passed, according to the encryption and decryption algorithm agreed by default_auth_type, use the total key dev_masterkey of the terminal side device to decrypt the cipher (deviceid) and cipher (sessionkey) to obtain the session key sessionkey and the second device identifier deviceid, Otherwise, the authentication fails, and the authentication process ends.

Step 230 , in view of possible session link changes during the authentication process, transmit the first result Digest (devid) to the network side device again through the TCP session.

On the network side device,

Step 231, according to the digest generation algorithm agreed by default_auth_type, use the total key plt_masterkey of the network side device to generate a digest for devid again through a digest generation algorithm (such as the hmac-sha384 algorithm), and obtain the fifth result, which is recorded as Digest4(devid).

Since the total key is usually within the lifetime, the fifth result is the same as the second result, and the calculation of the fifth result may not be performed.

Step 232, check the first result and the fifth result, or check the first result and the second result,

Step 233, when the verification is passed, store devid, deviceid, plt_masterkey, and sessionkey as a record; otherwise, the authentication fails, and the authentication process ends.

On the terminal side device,

Step 234, use the session key sessionkey as the key for communicating with the network side device, encrypt the context to be transmitted, and obtain the encrypted context, which is denoted as cipher(context).

Step 235, transmit the encrypted context cipher (context) to the network side device through the TCP session.

The aforementioned steps 204 to 215 are the first authentication in which the terminal-side device authenticates the network-side device.

The aforementioned steps 216-235 are the second authentication in which the network-side device authenticates the terminal-side device.

Referring to Fig. 3a and Fig. 3b, Fig. 3a and Fig. 3b are schematic flow charts when the negotiation between the terminal-side device and the network-side device is inconsistent.

On the terminal side device,

Steps 301-307 are the same as steps 201-207.

On the network side device,

Step 308, judging whether the first authentication protocol type of the terminal-side device is supported.

Step 309, if not supported, select the second authentication protocol type from the authentication type protocol group according to the received authentication type protocol group auth_type_group, the second authentication protocol type is the optimal authentication protocol type selected according to the security level, record is vote_auth_type.

Step 310, transmit the second authentication protocol type to the terminal side device through the TCP session.

On the terminal side device,

Step 311, look up vote_auth_type in auth_type_group.

Step 312, set vote_auth_type as the authentication protocol type of this authentication.

Since the authentication type protocol group comes from the terminal-side device, and the second authentication protocol type is selected by the network-side device from the authentication type protocol group, the second authentication protocol type must be included in the authentication type protocol group, therefore, step 311 ~312 may not be executed.

Step 313, according to the public-private key pair generation algorithm stipulated in the authentication protocol type vote_auth_type acquired in step 312, generate the public-private key pair of the terminal side device, recorded as dev_privatekey, dev_publickey,

Step 314, according to the shared key generation algorithm stipulated in the authentication protocol type vote_auth_type obtained in step 312, use the pre-stored devid and devauthcode to generate the shared key of the terminal side device, which is recorded as dev_sharekey.

Step 315, according to the encryption and decryption algorithm stipulated in the authentication protocol type vote_auth_type obtained in step 312, use the shared key to encrypt devic_public, and obtain the encrypted devic_public, which is recorded as cipher(devic_public).

Step 316, transmit the cipher (devic_public) obtained in step 315 to the network side device through the TCP session.

On the network side device,

Step 317, according to the public-private key pair generation algorithm stipulated in the selected authentication protocol type vote_auth_type, generate a public-private key pair on the network side, recorded as plt_privatekey, plt_publickey, where plt_privatekey is the private key in the public-private key pair, and plt_publickey is the public-private key pair public key in .

Step 318, according to the shared key generation algorithm specified in the authentication protocol type vote_auth_type. Use the pre-stored devid and devauthcode to generate the shared key of the network side device, which is recorded as plt_sharekey.

Step 319, according to the encryption and decryption algorithm stipulated in the authentication protocol type vote_auth_type, use plt_sharekey as the key to decrypt the cipher (dev_publickey) to obtain dev_publickey.

Step 320, according to the general key generation algorithm specified in the authentication protocol type vote_auth_type, use the private key plt_privatekey and dev_publickey of the network-side device to generate the general key of the network-side device, denoted as plt_masterkey.

Step 321, according to the encryption and decryption algorithm stipulated in the authentication protocol type vote_auth_type, use the general key of the network side device to encrypt the public key plt_publickey of the network side device, and obtain the encrypted public key of the network side device, which is recorded as cipher(plt_publickey ).

Step 322, transmit the cipher (plt_publickey) to the terminal side device through the TCP session.

On the terminal side device,

Step 323: According to the encryption and decryption algorithm agreed by vote_auth_type, use the shared key dev_sharekey of the terminal-side device to decrypt the cipher (plt_publickey) to obtain the public key plt_publickey of the network-side device.

Step 324, according to the general key key generation algorithm stipulated by vote_auth_type, use the private key dev_privatekey of the terminal-side device and the private key plt_publickey of the network-side device to generate the general key of the terminal-side device, denoted as dev_masterkey.

Step 325, according to the digest generation algorithm agreed by vote_auth_type, use the master key dev_masterkey of the terminal side device to generate a digest for devid, and obtain the first result, which is recorded as Digest(devid).

Step 326, transmit the first result Digest(devid) to the network side device through the TCP session.

On the network side device,

Step 327, according to the digest generation algorithm agreed by vote_auth_type, use the master key plt_masterkey on the network side to generate a digest for devid, and obtain the second result, which is recorded as Digest1(devid).

Step 328, verify the first result Digest(devid) and the second result Digest1(devid).

Step 329, when the verification is passed, generate the session key sessionkey and the second device identifier deviceid, and store devid, deviceid, masterkey, and sessionkey as a record.

Step 330, according to the encryption and decryption algorithm agreed upon by vote_auth_type, use the master key plt_masterkey of the network side device to encrypt sessionkey and deviceid to obtain the encrypted session key cipher(sessionkey), and the encrypted second device identifier cipher( deviceid).

Step 331, send cipher (deviceid), cipher (sessionkey), and Digest1 (devid) to the terminal side device through the TCP session.

On the terminal side device,

Step 332 , according to the digest generation algorithm stipulated by vote_auth_type, using the master key dev_masterkey of the terminal side device, to generate a digest for devid to obtain a third result, which is denoted as Digest2(devid).

Step 333, verify the second result Digest1(devid) and the third result Digest2(devid).

Step 334, when the verification is passed, according to the encryption and decryption algorithm stipulated by vote_auth_type, the master key dev_masterkey of the terminal side device is used to decrypt cipher (deviceid) and cipher (sessionkey) to obtain the session key sessionkey and the second device identifier deviceid.

In step 335, the session key is used as the key for communicating with the network side, and the context to be transmitted is encrypted to obtain the encrypted context, which is denoted as cipher(context).

Step 336, transmit the encrypted context cipher (context) to the network side device through the TCP session.

The foregoing steps 304 to 316 are the first authentication in which the terminal-side device authenticates the network-side device.

The foregoing steps 317 to 335 are the second authentication in which the network-side device authenticates the terminal-side device.

In this embodiment, the decision-making power of the negotiation rests with the network side device, thus ensuring that the optimal authentication protocol type is selected within the range of authentication protocol types supported by the terminal side device.

Embodiment two

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of authentication between a terminal-side device and a network-side device according to Embodiment 2 of the present application. The authentication methods include:

In step 401, the network-side device sends the first authentication protocol type and authentication protocol type group supported by default by any device to the terminal-side device.

Wherein, the first authentication protocol type may be supported by the terminal-side device by default. For example, when the terminal-side device accesses the network-side device, the network side may obtain the default authentication protocol type supported by the terminal-side device; the first authentication protocol type may also be It is supported by the network side device by default.

In step 402, the terminal-side device judges whether it supports the first authentication protocol type.

If not, select a second authentication protocol type from the authentication protocol type group and send it to the network side device, where the second authentication protocol type is the optimal authentication protocol type supported by the terminal side device selected according to the security level. In this example, the authentication protocol type group is the intersection of the authentication protocol type supported by the terminal-side device and the authentication protocol type supported by the network-side device, so the second authentication protocol type selected from the authentication protocol type group is supported by the network-side device, And it is supported by the terminal side equipment.

If yes, perform authentication using the authentication mode corresponding to the first authentication protocol type, and send the supported first authentication protocol type to the network side device.

Step 403, the network side device performs authentication according to the authentication mode corresponding to the received authentication protocol type.

If the network side device receives the second authentication protocol type from the terminal side device, then use the authentication method corresponding to the second authentication protocol type to perform authentication;

Otherwise, the network side device uses the authentication mode corresponding to the first authentication protocol type to perform authentication.

As analyzed above, both the first authentication protocol type and the second authentication protocol type are the authentication protocol types supported by the network-side device, so the network-side device can use the authentication method corresponding to the first authentication protocol type for authentication, and can also Authentication is performed using the authentication mode corresponding to the second authentication protocol type.

The specific authentication process may be the same as that in Embodiment 1.

Embodiment Three

In this embodiment, any local device among the two devices sends an authentication protocol type group to the other device, so that the other device selects the second authentication protocol type from the authentication protocol type group and sends it to the local device.

Referring to FIG. 5 , FIG. 5 is a schematic flowchart of authentication between a terminal-side device and a network-side device in Embodiment 3 of the present application. The authentication methods include,

In step 501, the terminal-side device sends the group of authentication protocol types supported by the terminal-side device to the network-side device.

Step 502, the network-side device selects a second authentication protocol type from the authentication protocol type group, and sends it to the terminal-side device, where the second authentication protocol type is the optimal authentication protocol type selected according to the security level.

In step 503, the terminal-side device and the network-side device respectively use the authentication mode corresponding to the second authentication protocol type to perform authentication.

The specific authentication process may be the same as that in Embodiment 1.

Referring to FIG. 6 , FIG. 6 is another schematic flowchart of authentication between the terminal-side device and the network-side device in Embodiment 3 of the present application. The authentication methods include,

Step 601, the network side device authenticates the protocol type group to the sending terminal side device,

Preferably, the authentication protocol type group is a set of authentication protocol types supported by the terminal-side device, which can be obtained when the terminal-side device accesses the network.

Step 602, the terminal side device selects a second authentication protocol type from the authentication protocol type group, and sends it to the network side device, the second authentication protocol type is the optimal authentication protocol type selected according to the security level,

Step 603, the terminal-side device and the network-side device respectively use the authentication mode corresponding to the second authentication protocol type to perform authentication.

The specific authentication process may be the same as that in Embodiment 1.

Embodiment four

In this embodiment, any local device among the terminal-side device and the network-side device sends an authentication protocol type group to the other device, so that the other device selects the second authentication protocol type from the authentication protocol type group and sends it to the local device. square equipment,

The local device receives the second authentication protocol type from the counterparty device, judges whether it supports the second authentication protocol type, and if not, notifies the counterparty device to reselect, for example, the counterparty device selects one by one from the authentication protocol type group, and returns to the local device until all the authentication protocol types in the authentication protocol type group have been traversed; or, in order to improve the efficiency of interaction, select the authentication protocol type supported by the local device from the authentication protocol type group and send it to the other device, so that the other device Select the authentication protocol type supported by the peer device from the supported authentication protocol types, and send it to the local device.

Referring to FIG. 7 , FIG. 7 is a schematic flowchart of authentication between a terminal-side device and a network-side device according to Embodiment 4 of the present application. The authentication methods include:

Step 701, the terminal side device sends the authentication protocol type group to the network side device.

Step 702, the network side device selects a second authentication protocol type from the authentication protocol type group, and sends it to the terminal side device, the second authentication protocol type is the optimal authentication protocol type selected according to the security level.

Step 703, the terminal-side device receives the second authentication protocol type from the peer device, and judges whether the second authentication protocol type is supported.

If not, notify the network-side device so that the network-side device can re-select, or select the authentication protocol type supported by the terminal-side device from the authentication protocol type group and send it to the network-side device,

If supported, send the second authentication protocol type to the network side device.

In step 704, the terminal-side device and the network-side device respectively use authentication methods corresponding to the authentication protocol type to perform authentication.

The specific authentication process may be the same as that in Embodiment 1.

Referring to FIG. 8 , FIG. 8 is another schematic flowchart of authentication between a terminal-side device and a network-side device according to Embodiment 4 of the present application. The authentication methods include,

Step 801, the network side device sends the authentication protocol type group to the terminal side device,

Step 802, the terminal side device selects a second authentication protocol type from the authentication protocol type group and sends it to the network side device, the second authentication protocol type is the optimal authentication protocol type supported by the terminal side device selected according to the security level ,

Step 803, the network side device receives the second authentication protocol type from the opposite device, and judges whether the second authentication protocol type is supported,

If not, notify the terminal side device so that the terminal side device reselects, or the network side device selects the authentication protocol type supported by the network side device from the authentication protocol type group and sends it to the terminal side device,

If supported, sending the second authentication protocol type to the terminal side device,

In step 804, the terminal-side device and the network-side device respectively use authentication methods corresponding to the authentication protocol type to perform authentication.

The specific authentication process may be the same as that in Embodiment 1.

Referring to FIG. 9, FIG. 9 is a schematic diagram of a terminal-side device or a network-side device. The device includes,

The interaction module is used to interact with the other party's equipment on the authentication protocol type to determine the authentication protocol type supported by both devices, wherein the authentication protocol type corresponds to an authentication method;

The authentication module is configured to authenticate the devices of both parties according to the authentication mode corresponding to the determined authentication protocol type.

The interactive modules include,

The first interaction module is used to interact with the first authentication protocol type supported by default by any device,

The second interaction module is used for interacting with the second authentication protocol type selected from the authentication protocol type group when the first authentication protocol type is not supported; or for interacting with the second authentication protocol selected from the authentication protocol type group type.

Authentication modules include,

The first authentication module is used for the first authentication of the own device by the other device;

The second authentication module is used for the own device to perform the second authentication on the counterpart device.

Referring to FIG. 10 , FIG. 10 is a schematic diagram of a terminal-side device or a network-side device. It includes a memory and a processor, the memory stores a computer program, and the processor is configured to execute the steps of implementing the authentication method between the terminal-side device and the network-side device.

The memory may include a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located far away from the aforementioned processor.

The above-mentioned processor can be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processing, DSP), dedicated integrated Circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

The embodiment of the present application also provides a computer-readable storage medium, where a computer program is stored in the storage medium, and when the computer program is executed by a processor, the authentication method between the terminal-side device and the network-side device is implemented. step.

In yet another embodiment provided by the present application, a computer program product containing instructions is also provided. When it is run on a computer, the computer executes the communication between any terminal-side device and the network-side device in the above-mentioned embodiments. authentication method.

For the embodiment of the device/network side device/storage medium, since it is basically similar to the embodiment of the method, the description is relatively simple, and for the related parts, please refer to the part of the description of the embodiment of the method.

In this document, relational terms such as first and second etc. are used only to distinguish one entity or operation from another without necessarily requiring or implying any such relationship between these entities or operations. Actual relationship or sequence. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

The above is only a preferred embodiment of the application, and is not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the application should be included in the application. within the scope of protection.

The above are only preferred embodiments of the application, and are not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the application shall be included in the protection of the application. within the range.

Claims

An authentication method between a terminal-side device and a network-side device, characterized in that the method includes, on the side of any own device in both the terminal-side device and the network-side device,

The local device interacts with the other device's authentication protocol type to determine the authentication protocol type supported by both devices, wherein the authentication protocol type corresponds to an authentication method;

The local device performs authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, and enables the other device to perform authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type.
The authentication method according to claim 1, wherein the authentication protocol type interaction between the own device and the counterpart device includes,

The two devices exchange the first authentication protocol type supported by default by either device, and the second authentication protocol type selected from the authentication protocol type group when either device does not support the first authentication protocol type,

or

The two devices exchange the second authentication protocol type selected from the authentication protocol type group;

Wherein, the authentication protocol type group includes at least one authentication protocol type, and each authentication protocol type corresponds to an authentication method.
The authentication method according to claim 2, wherein the second authentication protocol type is: the authentication protocol type with the highest priority in the authentication protocol type group, and the authentication protocol type group is a terminal-side device authentication protocol The intersection of the type group and the network-side device authentication protocol type group;

The two devices exchange the first authentication protocol type supported by default by either device, and the second authentication protocol type selected from the authentication protocol type group when either device does not support the first authentication protocol type, including:

The local device sends the first authentication protocol type and the authentication protocol type group supported by any device by default to the opposite device, so that the opposite device selects the first authentication protocol type group from the authentication protocol type group if it does not support the first authentication protocol type. 2. Authentication protocol type, and send the adopted authentication protocol type to the local device.
The authentication method according to claim 2, wherein the two devices interact with the second authentication protocol type selected from the authentication protocol type group, comprising:

The local device sends the authentication protocol type group to the counterparty device, so that the counterparty device selects the second authentication protocol type from the authentication protocol type group and sends it to the local device,

The local device performs authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, and makes the opposite device perform authentication between the two devices according to the authentication method corresponding to the determined authentication protocol type, including ,

Both devices perform authentication using the authentication mode corresponding to the second authentication protocol type respectively.
The authentication method according to claim 2, wherein the two devices interact with the second authentication protocol type selected from the authentication protocol type group, comprising:

The local device sends the authentication protocol type group to the counterparty device, so that the counterparty device selects the second authentication protocol type from the authentication protocol type group and sends it to the local device,

The local device receives the second authentication protocol type from the other device, judges whether it supports the second authentication protocol type, and if not, notifies the other device to reselect, or selects the authentication protocol supported by the local device from the authentication protocol type group The type is sent to the other device, so that the other device selects the authentication protocol type supported by the other device from the supported authentication protocol types, and sends it to the local device.
The authentication method according to claim 1, wherein the authentication method includes one of a public-private key pair generation method, a total key generation method, a shared key generation method, an encryption and decryption method, a digest generation method or any of them combination,

The second authentication protocol type is the optimal authentication protocol type selected according to the security level;

The authentication between the two devices includes:

The first authentication that the own device is authenticated by the other device, and

The second authentication in which the local device authenticates the counterpart device.
The authentication method according to claim 6, wherein the first authentication of the own device being authenticated by the other device includes:

On the local device side,

According to the public-private key pair generation method corresponding to the authentication protocol type, generate the public-private key pair of the local device,

According to the shared key generation method corresponding to the authentication protocol type, generate the shared key of the local device,

According to the encryption and decryption methods corresponding to the authentication protocol type, use the shared key to encrypt the public key to obtain the encrypted public key.

Send the first device ID, device verification code, and encrypted public key of the local device to the other device, so that the other device:

According to the shared key generation method corresponding to the authentication protocol type, use the first device identifier and the device verification code to generate the shared key of the other party's device,

According to the encryption and decryption method corresponding to the type of authentication protocol, use the shared key of the other party's device to decrypt the encrypted public key of the local device to obtain the public key of the local device.

According to the public-private key pair generation method corresponding to the authentication protocol type, use the private key of the other party's device and the public key of the local device to generate the total key of the other party's device.

According to the encryption and decryption mode corresponding to the authentication protocol type, the public key of the counterpart device is encrypted by using the general key of the counterpart device to obtain the encrypted public key of the counterpart device.
The authentication method according to claim 6, characterized in that, the second authentication of the authentication performed by the own device on the opposite device includes,

The local device receives the encrypted public key of the other device sent by the other device,

According to the encryption and decryption method corresponding to the type of authentication protocol, use the shared key of the local device to decrypt the encrypted public key of the other party's device to obtain the public key of the other party's device.

According to the public-private key pair generation method corresponding to the authentication protocol type, use the private key of the local device and the public key of the other device to generate the total key of the local device.

According to the digest generation method corresponding to the authentication protocol type, use the total key of the local device to generate a digest for the first device identifier of the local device, and obtain the first result,

Sending the first result to the counterparty device, so that the counterparty device:

According to the digest generation method corresponding to the type of authentication protocol, use the total key of the counterparty device to generate a digest for the first device identifier to obtain a second result,

verifying the first result and the second result, and generating a session key and a second device identifier when the verification is passed,

According to the encryption and decryption method corresponding to the authentication protocol type, the session key and the second device identifier are encrypted using the total key of the other party's device to obtain the encrypted session key and the second device identifier,

Send the second result, the encrypted session key and the second device identifier to the local device;

The local device receives the second result from the opposite device, and the encrypted session key and the second device identifier,

According to the digest generation method corresponding to the authentication protocol type, use the total key of the local device to generate a digest for the first device identifier, and obtain the third result,

Verify the second result and the third result, and when the verification is passed, use the general key of the local device to decrypt the encrypted session key and the second device identifier according to the encryption and decryption method corresponding to the authentication protocol type.
A terminal-side device, characterized in that it includes a memory and a processor, the memory stores a computer program, and the processor is configured to implement the connection between the terminal-side device and the network-side device according to any one of claims 1 to 8. The steps of the authentication method between.
A network-side device, characterized in that it includes a memory and a processor, the memory stores a computer program, and the processor is configured to implement the connection between the terminal-side device and the network-side device according to any one of claims 1 to 8. The steps of the authentication method between.
An Internet of Things system, characterized by comprising the terminal-side device as claimed in claim 9 and the network-side device as claimed in claim 10 .
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1-8 are implemented.