WO2023160299A1 - 一种设备物理身份认证方法、系统、装置及第一平台 - Google Patents

一种设备物理身份认证方法、系统、装置及第一平台 Download PDF

Info

Publication number
WO2023160299A1
WO2023160299A1 PCT/CN2023/072108 CN2023072108W WO2023160299A1 WO 2023160299 A1 WO2023160299 A1 WO 2023160299A1 CN 2023072108 W CN2023072108 W CN 2023072108W WO 2023160299 A1 WO2023160299 A1 WO 2023160299A1
Authority
WO
WIPO (PCT)
Prior art keywords
platform
information
identified
digital signature
key
Prior art date
Application number
PCT/CN2023/072108
Other languages
English (en)
French (fr)
Inventor
潘龙
Original Assignee
杭州萤石软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州萤石软件有限公司 filed Critical 杭州萤石软件有限公司
Publication of WO2023160299A1 publication Critical patent/WO2023160299A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Definitions

  • the present application relates to the field of computer and network technologies, and in particular to a device physical identity authentication method, system, device and first platform.
  • platforms often only allow certified legal devices to perform business.
  • the platform can determine whether the device is a legitimate device by verifying the authority of the connected device. However, verifying permissions is often cumbersome. Therefore, the platform only verifies the authority of the device when the device is connected for the first time, and if the device passes the verification, it will assign a physical device identifier to the device.
  • the platform obtains the device physical identifier sent by the device. If there is a device physical identifier consistent with the device physical identifier sent by the device in the device physical identifier stored locally on the platform, the device is considered to be a legal device, allowing The device does business.
  • one platform cannot obtain the device physical identifier assigned to the device by another platform. Therefore, if a device is transferred from another platform to the one platform, the one platform cannot determine whether the device is a legitimate device based on the physical identifier assigned to the device by the other platform. Therefore, it is necessary to re-allocate a new device physical identifier for the device, resulting in different physical device identifiers of a device on different platforms, which is not conducive to cross-platform management of the device.
  • the purpose of the embodiments of the present application is to provide a device physical identity authentication method, system, device, and first platform, so as to keep the same device's physical ID on different platforms consistent, so as to facilitate cross-platform management of the device.
  • the specific technical scheme is as follows:
  • the embodiment of the present application provides a device physical identity authentication method, which is applied to the first platform, and the method includes:
  • the digital signature sent by the device to be identified and the first device information wherein the digital signature is obtained by encrypting the second device information by the second platform using a platform key, and the second device information is obtained by the device to be identified. device information sent to the second platform when entering the second platform;
  • the second device information is consistent with the first device information, it is determined that the device to be identified is a legitimate device.
  • the method also includes:
  • the encryption instruction information is sent by the second platform to the device to be identified, and is used to identify the platform key;
  • the platform key is determined according to the encryption indication information.
  • the acquiring the digital signature sent by the device to be identified and the first device information includes:
  • the device to be identified has obtained a digital signature from the second platform, obtain the digital signature and first device information sent by the device to be identified
  • the method also includes:
  • the device to be identified has not obtained the digital signature from the second platform, obtain the first information abstract sent by the device to be identified and the first device information, the first information abstract is the device to be identified according to Obtained by encrypting the first device information with a short-term key;
  • the device to be identified is a legitimate device.
  • the method also includes:
  • first information digest is consistent with the second information digest, encrypt the first device information with a platform key to obtain ciphertext;
  • the embodiment of the present application provides a cross-platform physical identification system, the system includes a first platform, a second platform, and a device to be identified, and the first platform is physically isolated from the second platform;
  • the device to be identified is configured to sequentially access the second platform and the first platform, and send second device information to the second platform when accessing the second platform;
  • the second platform is configured to determine whether the device to be identified is a legitimate device in response to the access to the second platform to be identified; if it is identified that the device to be identified is a legitimate device, use the platform to Encrypting the information of the second device with the station key to obtain a digital signature, and sending the digital signature to the device to be identified;
  • the device to be identified is further configured to send the digital signature and first device information to the first platform when accessing the first platform;
  • the first platform is configured to obtain the second device information from the digital signature according to the platform key; if the second device information is consistent with the first device information, determine that the pending Identify the device as legitimate.
  • the second platform is further configured to, if it is identified that the device to be identified is a legal device, send encrypted indication information for identifying the platform key to the device to be identified equipment;
  • the device to be identified is further configured to send the encrypted instruction information to the first platform when accessing the first platform;
  • the first platform is further configured to determine the platform key according to the encryption indication information.
  • the embodiment of the present application provides a device physical identity authentication device, which is applied to the first platform, and the device includes:
  • An information acquisition module configured to acquire the digital signature sent by the device to be identified and the first device information, wherein the digital signature is obtained by encrypting the second device information by the second platform using a platform key, and the second device information is Device information sent to the second platform when the device to be identified accesses the second platform;
  • a signature parsing module configured to parse the digital signature to obtain the second device information according to the platform key
  • a first verification module configured to determine that the device to be identified is a legitimate device if the second device information is consistent with the first device information.
  • the information acquiring module is further configured to acquire encrypted instruction information sent by the device to be identified, where the encrypted instruction information is sent to the device to be identified by the second platform, and used to identify the platform key;
  • the platform key is determined according to the encryption indication information.
  • the information obtaining module obtains the digital signature sent by the device to be identified and the first device information, including:
  • the device to be identified has obtained a digital signature from the second platform, obtain the digital signature sent by the device to be identified
  • the apparatus further includes a second verification module, configured to obtain the first information digest sent by the device to be identified and the first device information if the device to be identified has not obtained the digital signature from the second platform, and the The first information summary is obtained by encrypting the first device information by the device to be identified according to a short-term key;
  • the device to be identified is a legitimate device.
  • the apparatus further includes a signature generation module, configured to encrypt the first device information with a platform key if the first information digest is consistent with the second information digest, get the ciphertext;
  • the embodiment of the present application provides a first platform, including:
  • the processor is configured to implement the steps of the device physical identity authentication method described in any one of the first aspects above when executing the program stored in the memory.
  • the embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, any of the above-mentioned first aspects can be realized. Steps of the device physical identity authentication method.
  • the embodiment of the present application provides a computer program product, which, when run on a computer, enables the computer to execute any method for physical identity authentication of a device in the present application.
  • the device physical identity authentication method, system, device and first platform provided in the embodiments of the present application.
  • the second platform can encrypt the device information with the platform key to obtain a digital signature. Since the device information of the device to be identified will not change, even if the device to be identified is transferred from the second platform to the first platform, the first platform can also Determine the digital signature generated by the second platform for the device to be identified according to the device information, thereby determining whether the digital signature sent by the device to be identified is a digital signature generated by the second platform for the device to be identified.
  • the device to be identified is considered to be a device that has passed the verification of the second platform, so the device to be identified
  • the other device is a legitimate device.
  • the first platform can authenticate the physical identity of the device to be identified based on the digital signature generated by the second platform for the device to be identified, without re-generating a new digital signature for the device to be identified, so the device to be identified can be identified by the same digital signature, In this way, devices can be effectively managed across platforms.
  • FIG. 1 is a schematic flow diagram of a device physical identity authentication method provided in an embodiment of the present application
  • Fig. 2 is a schematic flow diagram of the first platform authenticating the physical identity of the device when the device provided by the embodiment of the present application accesses the first platform without accessing the second platform;
  • FIG. 3 is a schematic diagram of an application scenario of a device physical identity authentication method provided in an embodiment of the present application
  • FIG. 4 is a schematic diagram of the interaction of the device provided by the embodiment of the present application under the scenario where the second platform completes the physical identity distribution and transfers to the first platform;
  • FIG. 5 is a schematic structural diagram of a device physical identity authentication device provided in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the application scenarios of the device physical identity authentication method provided in this application will be exemplarily described below. It can be understood that the following example is only a possible application scenario of the device physical identity authentication method provided by the embodiment of this application. In other possible embodiments, the device physical method provided by the embodiment of this application can also be applied to other In the possible application scenarios, the following examples do not impose any restrictions on this.
  • the first platform and the second platform assign device physical identifiers to devices in both ways: assign devices to devices according to their access sequence physical identification. For example, if the device is connected to the platform for the first time, the platform will assign the device physical ID 1 to the device; if the device is connected to the platform for the second time, the platform will assign the device physical ID 2 to the device, and so on.
  • the device assigned by the first platform to the first device The physical ID is 10. Due to practical needs, the first device is transferred from the first platform to the second platform, because the first platform is physically isolated from the second platform. Therefore, the second platform cannot know the device physical identifier assigned by the first platform to the first device, so the second platform cannot judge whether the first device is a legitimate device based on the device identifier "10" sent by the first device, that is, the second platform cannot The device physical identifier of the first device authenticates the physical identity of the first device. In this case, the second platform needs to reassign a new device physical identifier to the first device. Since the first device is the sixth device connected to the second platform, the device physical identifier allocated to the first device by the second platform is 6.
  • first platform and the second platform assign different device physical identifiers to the same device.
  • first platform and the second platform may also assign the same device physical identifier to different devices, resulting in the inability of the device physical identifier to uniquely identify the device, making it difficult to manage devices across platforms based on the device physical identifier.
  • the embodiment of the present application provides a device physical identity authentication method, applied to the first platform
  • the first platform can be any platform, as shown in Figure 1
  • the device physical identity recognition method provided in the embodiment of the present application includes :
  • the second device information is obtained by parsing the digital signature.
  • the second platform can encrypt the device information with the platform key to obtain a digital signature. Since the device information of the device to be identified will not change, even if the device to be identified is changed from The second platform is transferred to the first platform, and the first platform can also determine the digital signature generated by the second platform for the device to be identified according to the device information, so as to determine whether the digital signature sent by the device to be identified is that the second platform is the device to be identified Generated digital signature. If the digital signature sent by the device to be identified is the digital signature generated by the second platform for the device to be identified, the device to be identified is considered to be a device that has passed the verification of the second platform, and therefore the device to be identified is a legal device.
  • the first platform can authenticate the physical identity of the device to be identified based on the digital signature generated by the second platform for the device to be identified, without re-generating a new digital signature for the device to be identified, so the device to be identified can be identified by the same digital signature, In this way, devices can be effectively managed across platforms.
  • the second platform and the first platform may be the same platform or different platforms.
  • the second platform is different from the first platform is used as an example for illustration.
  • the principle is the same for the case where the second platform and the first platform are the same platform, so details are not repeated here.
  • the first device information may be any invariant information stored locally on the device to be identified.
  • the device serial number of the device to be recognized since the device serial number is burnt on the device to be recognized when the device to be recognized is generated, the device serial number of the device to be recognized will not change.
  • the first device information can also be the device verification code of the device to be recognized, and can also be any substring of the device serial number of the device to be recognized, any substring of the device verification code of the device to be recognized, or the device serial number of the device to be recognized
  • the concatenated character string obtained by concatenating the device verification code and the like is not limited in this embodiment.
  • the device to be identified before the first platform executes step S101, the device to be identified has already connected to the second platform, and the second platform has generated device information for the device to be identified.
  • the device information sent by the device to be recognized during the physical identity authentication process of the device to be recognized by the first platform is recorded as the first device information
  • the process of generating a digital signature for the device to be recognized by the second platform is recorded as the first device information.
  • the device information sent by the identification device is recorded as the second device information
  • the second device information should be exactly the same as the first device information.
  • the digital signature may be obtained by directly encrypting the second device information, or may be obtained by encrypting the preprocessed second device information after preprocessing the second device information.
  • the second device information is directly encrypted to obtain a digital signature; if the length of the second device information is not the preset length, the second device information is calculated.
  • the hash value of the backup information is encrypted, and the first preset length bits of the calculated hash value are encrypted to obtain a digital signature.
  • the length of the digital signature can be fixed and will not change with the length of the second device information, so as to facilitate subsequent processing.
  • the digital signature may be obtained by encrypting only the second device information, or may be obtained by jointly encrypting the second device information and other information.
  • the second platform encrypts the combined character string obtained by combining the second device information and the timestamp to obtain a digital signature, where the timestamp is used to indicate that the second platform starts to generate digital Signature moment.
  • the format of the combined string can be different according to different application scenarios.
  • the combined character string is a character string with a length of 20 bytes, wherein the 1st to 9th bytes are the second device information, the 10th byte is a fixed value "&", and the 11th to 20th bytes are Bytes are the timestamp.
  • the length of the second device information is not 9 bytes, the hash value of the second device information is calculated, and the first 9 bytes of the hash value are taken as the preprocessed second device information.
  • the analyzed second device information is preprocessed second device information, preprocess the first device information to obtain preprocessed first device information.
  • the second device information being consistent with the first device information means that the preprocessed second device information obtained through analysis is the same as the preprocessed first device information.
  • the preprocessing method is to calculate the hash value and take the first 9 bytes of the hash value, calculate the hash value of the first device, and take the first 9 bytes of the calculated hash value, Recorded as Platform Summary. If the platform summary is the same as the preprocessed second device information obtained through analysis, it is determined that the device to be identified is a legitimate device.
  • the second device information is consistent with the first device information means: the analyzed second device information has not been preprocessed It is the same as the first device information sent by the device to be identified.
  • platform key based on which the first platform parses the digital signature to obtain the second device information should be the same as the platform key based on which the second platform generates the digital signature.
  • platform keys may be stored in the first platform and the second platform respectively in advance.
  • the aforementioned method also includes:
  • S104 Acquire encrypted instruction information sent by the device to be identified.
  • the encrypted instruction information is sent by the second platform to the device to be identified, and is used to identify a platform key.
  • the device to be identified may send the digital signature and the encrypted indication information to the first platform respectively, or carry the digital signature and the encrypted indication information in the same message and send it to the first platform.
  • the device to be identified sends physical identification information to the first platform, and the physical identification information carries encrypted indication information and a digital signature.
  • the physical identification information is information with a length of 22 bytes, in which the first byte is encryption indication information, the second byte is a fixed value "&", and the third to 22nd bytes are digital signatures.
  • the encryption indication information is used to uniquely identify the platform key, that is, different encryption indication information corresponds to different platform keys, and the same encryption indication information corresponds to the same platform key.
  • the encryption indication information can be expressed as a two-digit hexadecimal number.
  • the relationship between the encryption indication information and the platform key can be As shown in Table 1:
  • the second row in Table 1 indicates that the encryption instruction information 0x00 corresponds to the first platform key
  • the third row in Table 1 indicates that the encryption instruction information 0x01 corresponds to the second platform key
  • 0x indicates that the encryption indication information is expressed in hexadecimal form.
  • the encrypted indication information sent by the second platform to the device to be identified is 0x00. If the platform key used by the second platform to generate the digital signature is the second platform key, the second platform sends the The encryption indication information of is 0x01, and so on.
  • the first platform determines that the platform key is the first platform key; if the encryption indication information is 0x01, then the first platform determines that the platform key is the second platform key. key, and so on.
  • the second platform can generate digital signatures through different keys, thereby reducing the possibility of digital signatures being cracked, so it is more difficult for illegal devices to pass authentication by forging digital signatures, effectively providing security.
  • the digital signature is generated by the second platform for the device to be identified.
  • the digital signature may be regarded as a physical device identifier of the device to be identified.
  • the combined information obtained by combining the digital signature and other information may also be regarded as the physical device identifier of the device to be identified.
  • the aforementioned device identification information is regarded as the device physical identification of the device to be identified.
  • the device to be identified Before the device to be identified accesses the second platform, the device to be identified cannot obtain the digital signature generated by the second platform for the device to be identified. Therefore, before performing S101, the device to be identified should have accessed the second platform.
  • the device to be identified has not obtained a digital signature from the second platform, obtain a first information digest and first device information sent by the device to be identified.
  • the first information digest is obtained by encrypting the first device information by the device to be identified according to the platform key.
  • the first information abstract is consistent with the second information abstract, it is considered that the short-term key used by the device to be identified and the long-term key used by the first platform are a key pair, so the device to be identified is considered to have passed The device that has passed the authority verification of the first platform, so the device to be identified is considered to be a legitimate device.
  • the device to be identified can be authenticated when the device to be identified has not been connected to the second platform, so as to prevent the legitimate device from being unable to perform services normally.
  • the aforementioned device physical identity authentication method further includes:
  • S205 Send the ciphertext to the device to be identified as a digital signature of the device to be identified.
  • FIG. 3 is a schematic diagram of an application scenario of the device physical identity authentication method provided by the embodiment of the present application.
  • platform A there are three platforms that are physically isolated from each other: platform A, platform B, and platform C.
  • IOT Internet Of Things, Internet of Things
  • IOT devices are first connected to platform A, and execute services under the scheduling of platform A.
  • IOT devices are transferred from platform A to platform B, and the business is performed under the scheduling of platform B.
  • IOT devices are transferred from platform B to platform C, and the business is executed under the scheduling of platform C.
  • IOT devices can be smart home control devices, including smart switches, smart lights, smart door locks, etc.
  • platform A, platform B, and platform C are different smart central control devices.
  • platform. Taking the IOT device as a smart switch as an example, the smart switch is first connected to the smart central control platform A, and performs switching actions under the scheduling of the smart central control platform A. After a period of time, due to actual needs, the smart switch needs to be transferred from the smart central control platform A to the smart central control platform B, and the smart central control platform B schedules the smart switch to perform switching actions. After another period of time, and in actual demand again, the smart switch is transferred from the smart central control platform B to the smart central control platform C, and the smart central control platform C schedules the smart switch to perform switching actions.
  • Sub-scenario 1 IOT devices are connected to platform A and execute services under the scheduling of platform A;
  • Sub-scenario 2 IOT devices are connected to platform B and execute services under the scheduling of platform B;
  • Sub-scenario 3 IOT devices are connected to platform C and execute services under the scheduling of platform C.
  • the IOT device is connected to the platform for the first time, so the IOT device has not been assigned a device physical identifier by any platform.
  • Platform A needs to perform physical identity authentication on the IOT device, and identify the IOT device as an IOT device when it is determined to be a legal device.
  • the device is assigned a physical device identifier.
  • the IOT device is equivalent to the aforementioned device to be identified, and platform A is equivalent to the aforementioned second platform.
  • platform A performs physical identity authentication on the IOT device to determine whether the connected IOT device is a legitimate device. If the connected IOT device is an illegal device, platform A interrupts the connection with the IOT device; if the connected IOT device is a legitimate device, platform A obtains the second device information of the IOT device, and based on the second device The device generates a device physical identifier and sends it to the IOT device so that the IOT device stores the device physical identifier locally on the IOT device.
  • the device physical identifier consists of 22 bytes, of which the first byte is used to indicate the encryption instruction information, the second byte is a fixed value "&", and the third to 22nd bytes are A digital signature encrypted with the platform key. If the length of the second device information is 9 bytes, the first to ninth bytes in the digital signature are the second device information. If the length of the second device information is not 9 bytes, the 1st to 9th bytes in the digital signature are the first 9 bytes of the hash value of the second device information, and the 10th byte in the digital signature It is a fixed value "&", and the 11th to 20th bytes are timestamps. In the following, for the convenience of description, a case where the length of the second device information is not 9 bytes is used for description.
  • IOT devices are not connected to the platform for the first time, so IOT devices have been assigned device physical identifiers by platform A, and platform B performs physical identity authentication for IOT devices based on the device physical identifiers of IOT devices. However, due to the physical isolation between platform A and platform B, platform B does not locally store the device physical identifier assigned by platform A to the IOT device.
  • the IOT device is equivalent to the aforementioned device to be identified
  • platform A is equivalent to the aforementioned second platform
  • platform B is equivalent to the aforementioned first platform
  • platform B identifies the IOT device according to any device physical identification method provided in this application. Perform physical identification.
  • the IOT device in response to the IOT device accessing platform B, the IOT device sends the first device information and the physical identifier of the device to platform B, and platform B parses the physical identifier of the device to obtain encrypted indication information and a digital signature, and determines according to the encrypted indication information Platform key, use the determined platform key to decrypt the digital signature, so as to obtain the first 9 bytes of the hash value of the second device information, and platform B will decrypt the first device
  • the information is hashed to obtain the first 9 bytes of the hash value of the first device information.
  • Platform B determines whether the first 9 bytes of the hash value of the first device information are the same as the first 9 bytes of the hash value of the second device information, and if they are the same, the first device information is considered to be the same as the second device information , that is, the IOT device is a legal device, otherwise, if they are different, it is considered that the first device information is different from the second device information, that is, the IOT device is an illegal device.
  • platform B will subsequently identify the IOT device through the device physical identifier of the IOT device.
  • IOT devices are not connected to the platform for the first time, so the IOT devices have been assigned device physical identifiers by platform A, and platform C performs physical identity authentication on the IOT devices based on the device physical identifiers of the IOT devices. C are physically isolated, so platform C also does not locally store the device physical identifier assigned by platform A to the IOT device.
  • the IOT device is equivalent to the aforementioned device to be identified
  • platform A is equivalent to the aforementioned second platform
  • platform C is equivalent to the aforementioned first platform
  • platform C identifies the IOT device according to any device physical identification method provided in this application. Perform physical identification.
  • the way platform C performs physical identity authentication on IOT devices is the same as that of platform B.
  • platform C will subsequently identify the IOT device through the device physical identifier of the IOT device.
  • FIG. 4 A schematic diagram of the interaction under the scenario of a platform, each of which will be described below:
  • Auth1, Auth2, obtain short-term key request, obtain short-term key reply is the process of agreeing a short-term key (session key) between the device to be identified and the second platform. After agreeing on the session key, the device to be identified uses the short-term key to communicate with the first platform. The platform conducts subsequent business interactions.
  • the device to be identified After agreeing on the session key, the device to be identified sends a short-term key request carrying the information of the second device to the second platform.
  • the second platform In response to the short-term key request, the second platform generates a digital signature of the device to be identified based on the information of the second device, and based on The digital signature generates a physical device identification of the device to be identified.
  • the digital signature and the physical identification of the device reference may be made to the above-mentioned related descriptions, which will not be repeated here.
  • the second platform sends to the device to be identified the response to obtain the physical identification of the device, and the device to be identified obtains the physical identification of the device by parsing the response to obtain the physical identification of the device, and persists the physical identification of the device, that is, stores it locally on the device to be identified Physical identification of the device.
  • the device to be identified When the device to be identified subsequently performs business interaction with the second platform, it sends a service request to the second platform, and carries the second device information and the physical identifier of the device in the service request, and the second platform queries the physical identifier of the device assigned to the device to be identified, If the queried physical identifier of the device is consistent with the physical identifier of the device carried in the service request, the second platform determines that the device to be identified has passed the authentication, and then responds to the service request sent by the device to continue to interact with the device to be identified.
  • the device to be identified After the device to be identified is transferred from the second platform to the first platform, through Auth1, Auth2, obtaining a short-term key request, obtaining a short-term key reply and the process of agreeing on a short-term key (session key) with the first platform, when agreeing on a session key Afterwards, the device to be identified uses the short-term key to perform subsequent service interactions with the first platform.
  • the device to be identified When the device to be identified subsequently performs business interaction with the first platform, it sends a service request to the first platform, and carries the first device information and the physical identifier of the device in the service request.
  • the first platform queries the device physical identifier assigned to the device to be identified. If the queried device physical identifier is consistent with the device physical identifier carried in the service request, the first platform determines that the device to be identified has passed the authentication, and responds to the request sent by the device to be identified.
  • the business request continues the business interaction with the device to be identified.
  • the first platform uses the platform key to obtain device information from the digital signature in the device physical identifier. If the device information obtained by parsing is consistent with the first device information carried in the service request, the first platform determines that the device to be identified has passed the authentication, and then responds to the service request sent by the device to continue to interact with the device to be identified.
  • the device physical identifier carried in the service request is used as the device physical identifier assigned by the first platform to the device to be identified.
  • the embodiment of the present application also provides a cross-platform physical identity recognition system, including a first platform, a second platform, and a device to be identified, and the first platform is physically isolated from the second platform.
  • the device to be identified is used to sequentially access the second platform and the first platform, and send the second device information to the second platform when accessing the second platform;
  • the second platform is configured to determine whether the device to be identified is a valid device in response to accessing the second platform to be identified. If it is recognized that the device to be identified is a legitimate device, then use the platform key to encrypt the information of the second device, obtain a digital signature, and send the digital signature to the device to be identified;
  • the device to be identified is also used to send a digital signature and first device information to the first platform when accessing the first platform;
  • the first platform is configured to analyze the digital signature to obtain the second device information according to the platform key; if the second device information is consistent with the first device information, determine that the device to be identified is a legitimate device.
  • the first platform is the platform that the device to be identified accesses for the first time, that is, the device to be identified has not accessed any platform in the cross-platform device physical identification system before accessing the first platform.
  • the second platform is further configured to send encrypted indication information used to identify the platform key to the device to be identified if it is identified that the device to be identified is a legal device;
  • the device to be identified is also used to send encrypted instruction information to the first platform when accessing the first platform;
  • the first platform is further configured to determine the platform key according to the encryption indication information.
  • the embodiment of the present application also provides a device physical identity authentication device, which is applied to the first platform.
  • the device is shown in Figure 5, including:
  • the information acquisition module 501 is configured to acquire the digital signature sent by the device to be identified and the first device information, wherein the digital signature is obtained by encrypting the second device information by the second platform using a platform key, and the second device information is the device to be identified Device information sent to the second platform when accessing the second platform;
  • the first verification module 503 is configured to determine that the device to be identified is a legitimate device if the second device information is consistent with the first device information.
  • the information obtaining module is further configured to obtain encrypted instruction information sent by the device to be identified, the encrypted instruction information is sent by the second platform to the device to be identified, and is used to identify the platform key;
  • the information obtaining module obtains the digital signature sent by the device to be identified and the first device information, including:
  • the device to be identified has obtained a digital signature from the second platform, obtain the digital signature sent by the device to be identified and the information of the first device
  • the device also includes a second verification module, which is used to obtain the first information digest and the first device information sent by the device to be recognized if the device to be recognized has not obtained a digital signature from the second platform. obtained by encrypting the first device information with the key;
  • the device to be identified is a legitimate device.
  • the device further includes a signature generating module, configured to use a platform key to encrypt the first device information to obtain ciphertext if the first information digest is consistent with the second information digest;
  • the embodiment of the present application also provides a first platform, as shown in Figure 6, including:
  • Memory 601 used to store computer programs
  • the digital signature and first device information sent by the device to be identified where the digital signature is obtained by encrypting the second device information with the platform key by the second platform, and the second device information is sent when the device to be identified accesses the second platform Device information to the second platform;
  • the second device information is obtained by parsing the digital signature
  • the second device information is consistent with the first device information, it is determined that the device to be identified is a legal device.
  • the first platform provided in the embodiment of the present application may include other components besides the memory 601 and the processor 602.
  • the electronic device further includes a communication interface and a communication bus.
  • the communication bus mentioned above for the first platform may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (Extended Industry Standard Architecture, EISA) bus or the like.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus can be divided into an address bus, a data bus, a control bus, and the like.
  • the communication interface is used for communication between the electronic device and other devices.
  • the memory may include a random access memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory.
  • RAM Random Access Memory
  • NVM non-Volatile Memory
  • the memory may also be at least one storage device located far away from the aforementioned processor.
  • the above-mentioned processor can be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processor, DSP), a dedicated integrated Circuit (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.
  • CPU Central Processing Unit
  • NP Network Processor
  • DSP Digital Signal Processor
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • a computer-readable storage medium is also provided, and a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the physical identity of any of the above-mentioned devices is realized. Steps for the authentication method.
  • a computer program product including instructions is also provided, and when it is run on a computer, it causes the computer to execute any device physical identity authentication method in the above embodiments.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk (SSD)).
  • SSD Solid State Disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供了一种设备物理身份认证方法、系统、装置及第一平台，其中，所述方法应用于第一平台，所述方法包括：获取待识别设备发送的数字签名和第一设备信息，其中，所述数字签名为第二平台利用平台密钥对第二设备信息加密得到的，所述第二设备信息为所述待识别设备接入所述第二平台时发送至所述第二平台的设备信息；根据所述平台密钥，从所述数字签名中解析得到所述第二设备信息；若所述第二设备信息与所述第一设备信息一致，确定所述待识别设备为合法设备。可以实现同一设备在不同平台的设备物理标识保持一致，以便于对设备进行跨平台的管理。

Description

一种设备物理身份认证方法、系统、装置及第一平台
本申请要求于2022年2月25日提交中国专利局、申请号为202210181942.9发明名称为“一种设备物理身份认证方法、系统、装置及第一平台”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机及网络技术领域，特别是涉及一种设备物理身份认证方法、系统、装置及第一平台。
背景技术
出于安全考虑，平台往往仅允许经过认证的合法设备执行业务。相关技术中，平台可以通过验证接入的设备的权限来判断设备是否为合法设备。但是，验证权限往往较为繁琐。因此，平台仅在设备第一次接入时验证设备的权限，若设备通过验证，则为设备分配设备物理标识。当有设备请求执行业务时，平台获取该设备发送的设备物理标识，若平台本地存储的设备物理标识中存在与设备发送的设备物理标识一致的设备物理标识，则认为该设备为合法设备，允许该设备执行业务。
但是，若存在多个物理隔离的平台，由于一个平台无法获取另一个平台为设备分配的设备物理标识。因此，若设备从另一个平台转移至该一个平台，则该一个平台无法根据另一个平台为设备分配的物理标识判断该设备是否为合法设备。因此，需要重新为该设备分配新的设备物理标识，导致一个设备在不同平台处的物理设备标识不同，不利于对设备的跨平台管理。
发明内容
本申请实施例的目的在于提供一种设备物理身份认证方法、系统、装置及第一平台，以实现同一设备在不同平台的设备物理标识保持一致，以便于对设备进行跨平台管理。具体技术方案如下：
第一方面，本申请实施例提供了一种设备物理身份认证方法，应用于第一平台，所述方法包括：
获取待识别设备发送的数字签名和第一设备信息，其中，所述数字签名为第二平台利用平台密钥对第二设备信息加密得到的，所述第二设备信息为所述待识别设备接入所述第二平台时发送至所述第二平台的设备信息；
根据所述平台密钥，从所述数字签名中解析得到所述第二设备信息；
若所述第二设备信息与所述第一设备信息一致，确定所述待识别设备为合法设备。
在一种可能的实施例中，所述方法还包括：
获取所述待识别设备发送的加密指示信息，所述加密指示信息为所述第二平台发送至所述待识别设备的，并且用于标识所述平台密钥；
根据所述加密指示信息确定所述平台密钥。
在一种可能的实施例中，所述获取待识别设备发送的数字签名和第一设备信息，包括：
若待识别设备已从第二平台获取数字签名，获取所述待识别设备发送的所述数字签名和第一设备信息
所述方法还包括：
若待识别设备未从所述第二平台获取所述数字签名，获取所述待识别设备发送的第一信息摘要和所述第一设备信息，所述第一信息摘要为所述待识别设备根据短期密钥对所述第一设备信息进行加密得到的；
使用所述短期密钥对应的长期密钥对所述第一设备信息进行加密，得到第二信息摘要；
若所述第一信息摘要与所述第二信息摘要一致，确定所述待识别设备为合法设备。
在一种可能的实施例中，所述方法还包括：
若所述第一信息摘要与所述第二信息摘要一致，利用平台密钥对所述第一设备信息进行加密，得到密文；
将所述密文发送至所述待识别设备，作为所述待识别设备的数字签名。
第二方面，本申请实施例提供了一种跨平台物理身份识别系统，所述系统包括第一平台、第二平台以及待识别设备，所述第一平台与所述第二平台物理隔离；
所述待识别设备，用于依次接入所述第二平台和所述第一平台，并在接入所述第二平台时向所述第二平台发送第二设备信息；
所述第二平台，用于响应于所述待识别接入所述第二平台，确定所述待识别设备是否为合法设备；若识别出所述待识别设备为合法设备，则利用平 台密钥对所述第二设备信息加密，得到数字签名，并将所述数字签名发送至所述待识别设备；
所述待识别设备，还用于在接入所述第一平台时向所述第一平台发送所述数字签名和第一设备信息；
所述第一平台，用于根据所述平台密钥，从所述数字签名解析得到所述第二设备信息；若所述第二设备信息与所述第一设备信息一致，则确定所述待识别设备为合法设备。
在一种可能的实施例中，所述第二平台，还用于若识别出所述待识别设备为合法设备，则将用于标识所述平台密钥的加密指示信息发送至所述待识别设备；
所述待识别设备，还用于在接入所述第一平台时向所述第一平台发送所述加密指示信息；
所述第一平台，还用于根据所述加密指示信息确定所述平台密钥。
第三方面，本申请实施例提供了一种设备物理身份认证装置，应用于第一平台，所述装置包括：
信息获取模块，用于获取待识别设备发送的数字签名和第一设备信息，其中，所述数字签名为第二平台利用平台密钥对第二设备信息加密得到的，所述第二设备信息为所述待识别设备接入所述第二平台时发送至所述第二平台的设备信息；
签名解析模块，用于根据所述平台密钥，从所述数字签名中解析得到所述第二设备信息；
第一验证模块，用于若所述第二设备信息与所述第一设备信息一致，确定所述待识别设备为合法设备。
在一种可能的实施例中，所述信息获取模块，还用于获取所述待识别设备发送的加密指示信息，所述加密指示信息为所述第二平台发送至所述待识别设备的，并且用于标识所述平台密钥；
根据所述加密指示信息确定所述平台密钥。
在一种可能的实施例中，所述信息获取模块获取待识别设备发送的数字签名和第一设备信息，包括：
若待识别设备已从第二平台获取数字签名，获取所述待识别设备发送的 所述数字签名和第一设备信息
所述装置还包括第二验证模块，用于若待识别设备未从所述第二平台获取所述数字签名，获取所述待识别设备发送的第一信息摘要和所述第一设备信息，所述第一信息摘要为所述待识别设备根据短期密钥对所述第一设备信息进行加密得到的；
使用所述短期密钥对应的长期密钥对所述第一设备信息进行加密，得到第二信息摘要；
若所述第一信息摘要与所述第二信息摘要一致，确定所述待识别设备为合法设备。
在一种可能的实施例中，所述装置还包括签名生成模块，用于若所述第一信息摘要与所述第二信息摘要一致，利用平台密钥对所述第一设备信息进行加密，得到密文；
将所述密文发送至所述待识别设备，作为所述待识别设备的数字签名。
第四方面，本申请实施例提供了一种第一平台，包括：
存储器，用于存放计算机程序；
处理器，用于执行存储器上所存放的程序时，实现上述第一方面任一所述的设备物理身份认证方法步骤。
第五方面，本申请实施例提供了一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现上述第一方面任一所述的设备物理身份认证方法步骤。
第六方面，本申请实施例提供了一种计算机程序产品，当其在计算机上运行时，使得计算机执行本申请中的任一设备物理身份认证方法。
本申请实施例有益效果：
本申请实施例提供的设备物理身份认证方法、系统、装置及第一平台。可以由第二平台通过平台密钥对设备信息进行加密得到数字签名，由于待识别设备的设备信息并不会改变，因此即使待识别设备从第二平台转移至第一平台，第一平台也可以根据设备信息确定出第二平台为待识别设备生成的数字签名，从而确定出待识别设备发送的数字签名是否为第二平台为待识别设备生成的数字签名。若待识别设备发送的数字签名为第二平台为待识别设备生成的数字签名，则认为待识别设备是通过第二平台验证的设备，因此待识 别设备为合法设备。可见，第一平台能够根据第二平台为待识别设备生成的数字签名对待识别设备的物理身份进行认证，无需重新为待识别设备生成新的数字签名，因此能够通过同一数字签名标识待识别设备，从而能够有效地对设备进行跨平台的管理。
当然，实施本申请的任一产品或方法并不一定需要同时达到以上所述的所有优点。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。
图1为本申请实施例提供的设备物理身份认证方法的一种流程示意图；
图2为本申请实施例提供的设备在未曾接入第二平台的情况下接入第一平台时第一平台对设备物理身份进行认证的流程示意图；
图3为本申请实施例提供的设备物理身份认证方法的一种应用场景示意图；
图4为本申请实施例提供的设备在第二平台完成物理身份分配并转移至第一平台的情景下的交互示意图；
图5为本申请实施例提供的设备物理身份认证装置的一种结构示意图；
图6为本申请实施例提供的电子设备的一种结构示意图。
具体实施方式
为使本申请的目的、技术方案、及优点更加清楚明白，以下参照附图并举实施例，对本申请进一步详细说明。显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为了更清楚的对本申请提供的设备物理身份认证方法进行说明，下面将对本申请提供的设备物理身份认证方法的应用场景进行示例性的说明。可以理解的是，以下示例仅是本申请实施例提供的设备物理身份认证方法的一种可能的应用场景，在其他可能的实施例中，本申请实施例提供的设备物理方法也可以应用于其他可能的应用场景中，以下示例对此不做任何限制。
假设存在两个物理隔离的平台，分别记为第一平台和第二平台，并且假设第一平台和第二平台为设备分配设备物理标识的方式均为：根据设备的接入顺序为设备分配设备物理标识。例如，若设备第一个接入平台，则平台为设备分配的设备物理标识1，若设备第二个接入平台，则平台为设备分配的设备物理标识2，依次类推。
假设第一平台已经接入10个设备，而第二平台已经接入5个设备，将第十个接入第一平台的设备称为第一设备，则第一平台为第一设备分配的设备物理标识为10。出于实际需求，第一设备从第一平台转移至第二平台，由于第一平台与第二平台物理隔离。因此第二平台无法知悉第一平台为第一设备分配的设备物理标识，因而第二平台无法根据第一设备发送的设备标识“10”判断第一设备是否为合法设备，即第二平台无法根据第一设备的设备物理标识认证第一设备的物理身份。此种情况下，第二平台需要重新为第一设备分配新的设备物理标识。由于第一设备是第六个接入第二平台的设备，故第二平台为第一设备分配的设备物理标识为6。
可见，第一平台和第二平台为同一设备分配了不同的设备物理标识。同理，第一平台和第二平台也可能为不同设备分配相同的设备物理标识，导致设备物理标识无法唯一标识设备，导致难以根据设备物理标识对设备进行跨平台管理。
基于此，本申请实施例提供了一种设备物理身份认证方法，应用于第一平台，第一平台可以为任一平台，如图1所示，本申请实施例提供的设备物理身份识别方法包括：
S101，获取待识别设备发送的数字签名和第一设备信息，其中，数字签名为第二平台利用平台密钥对第二设备信息加密得到的，第二设备信息为待识别设备接入第二平台时发送至第二平台的设备信息。
S102，根据平台密钥，从数字签名中解析得到第二设备信息。
S103，若第二设备信息与第一设备信息一致，确定待识别设备为合法设备。
选用该实施例，可以由第二平台通过平台密钥对设备信息进行加密得到数字签名，由于待识别设备的设备信息并不会改变，因此即使待识别设备从 第二平台转移至第一平台，第一平台也可以根据设备信息确定出第二平台为待识别设备生成的数字签名，从而确定出待识别设备发送的数字签名是否为第二平台为待识别设备生成的数字签名。若待识别设备发送的数字签名为第二平台为待识别设备生成的数字签名，则认为待识别设备是通过第二平台验证的设备，因此待识别设备为合法设备。
可见，第一平台能够根据第二平台为待识别设备生成的数字签名对待识别设备的物理身份进行认证，无需重新为待识别设备生成新的数字签名，因此能够通过同一数字签名标识待识别设备，从而能够有效地对设备进行跨平台的管理。
下面将分别对前述S101-S103进行说明：
在S101中，第二平台与第一平台可以是同一平台也可以是不同平台。下文中为描述方便，仅以第二平台为不同于第一平台的情况为例进行说明，对于第二平台与第一平台是同一平台的情况原理是相同的，因此在此不再赘述。
第一设备信息可以为待识别设备本地存储的任何不变化的信息。如待识别设备的设备序列号，由于设备序列号是在产生待识别设备时烧录于待识别设备上的，因此待识别设备的设备序列号不会发生变化。第一设备信息也可以是待识别设备的设备验证码，还可以是待识别设备的设备序列号的任意子串、待识别设备的设备验证码的任意子串、待待识别设备的设备序列号和设备验证码拼接得到的拼接字符串等，本实施例对此不做任何限制。
在本申请实施例中，在第一平台执行步骤S101之前，待识别设备已接入第二平台，且第二平台已为该待识别设备生成设备信息。本文中为描述方便，将第一平台对待识别设备进行设备物理身份认证过程中待识别设备发送的设备信息记为第一设备信息，并将第二平台为待识别设备生成数字签名的过程中待识别设备发送的设备信息记为第二设备信息，第二设备信息应当与第一设备信息完全相同。
数字签名可以是直接对第二设备信息进行加密得到的，也可以是对第二设备信息进行预处理后，再对经过预处理的第二设备信息进行加密得到的。示例性的，若第二设备信息的长度为预设长度，则直接对第二设备信息进行加密，得到数字签名，若第二设备信息的长度不为预设长度，则计算第二设 备信息的哈希值，并对计算得到的哈希值的前预设长度位进行加密，得到数字签名。选用该实施例，可以使得数字签名的长度为定值，不会随着第二设备信息的长度变化而变化，以便于后续处理。
并且，数字签名可以是仅对第二设备信息进行加密得到，还可以是对第二设备信息以及其他信息共同加密得到的。示例性的，在一种可能的实施例中，第二平台对第二设备信息和时间戳组合得到的组合字符串进行加密，得到数字签名，其中，时间戳用于表示第二平台开始生成数字签名的时刻。选用该实施例，可以避免为具有相同设备信息的待识别设备分配相同的设备物理标识，从而使得平台能够区别设备信息相同的待识别设备。
组合字符串的格式根据应用场景的不同可以不同。示例性的，组合字符串为长度为20个字节的字符串，其中第1至第9个字节为第二设备信息，第10个字节为固定值“&”，第11至第20个字节为时间戳。该示例中，若第二设备信息的长度不为9个字节，则计算第二设备信息的哈希值，并取哈希值的前9个字节作为经过预处理的第二设备信息。
在S102中，可以理解的是，若第二平台是对经过预处理的第二设备信息进行加密得到数字签名的，则根据平台密钥从数字签名中解析得到的第二设备信息同样为经过预处理的设备信息。反之，若第二平台是对未经过预处理的第二设备信息进行加密得到数字签名的，则根据平台密钥从数字签名中解析得到的第二设备信息为未经过预处理的设备信息。
在S103中，若解析得到的第二设备信息为经过预处理的第二设备信息，则对第一设备信息进行预处理，得到经过预处理的第一设备信息。第二设备信息与第一设备信息一致是指：解析得到的经过预处理的第二设备信息与经过预处理的第一设备信息相同。
示例性的，假设预处理的方式为计算哈希值，并取哈希值的前9字节，则计算第一设备的哈希值，并取计算得到的哈希值的前9字节，记为平台摘要。若平台摘要与解析得到的经过预处理的第二设备信息相同，则确定待识别设备为合法设备。
若解析得到的第二设备信息为未经过预处理的第二设备信息，则第二设备信息与第一设备信息一致是指：解析得到的未经过预处理的第二设备信息 与的待识别设备发送的第一设备信息相同。
在前述S102中，第一平台从数字签名中解析得到第二设备信息所根据的平台密钥应当与第二平台生成数字签名时所根据的平台密钥相同。在一种可能的实施例中，可以预先将平台密钥分别存储于第一平台和第二平台。
在另一种可能的实施例中，前述方法还包括：
S104，获取待识别设备发送的加密指示信息，加密指示信息为第二平台发送至待识别设备的，并且用于标识平台密钥。
其中，待识别设备可以分别将数字签名和加密指示信息发送至第一平台，也可以将数字签名和加密指示信息携带于同一信息中发送至第一平台。示例性的，在一种可能的实施例中，待识别设备向第一平台发送物理标识信息，物理标识信息中携带有加密指示信息和数字签名。例如，物理标识信息为长度22个字节的信息，其中第1个字节为加密指示信息，第2个字节为固定值“&”，第3至22个字节为数字签名。
加密指示信息用于唯一标识平台密钥，即不同加密指示信息对应于不同的平台密钥，相同的加密指示信息对应于同一平台密钥。示例性的，以加密指示信息的长度为1字节为例，则加密指示信息可以表示为一个两位的十六进制数，该示例中，加密指示信息与平台密钥之间的关系可如表1所示：
表1.加密指示信息-平台密钥对应关系表
其中，表1中第2行表示：加密指示信息0x00对应于第一平台密钥，表1中第3行表示：加密指示信息0x01对应于第二平台密钥，依次类推。其中，0x表示加密指示信息以十六进制形式表示。
以表1为例，若第二平台生成数字签名时所使用的平台密钥为第一平台密 钥，则第二平台发送至待待识别设备的加密指示信息为0x00，若第二平台生成数字签名时所使用的平台密钥为第二平台密钥，则第二平台发送至待待识别设备的加密指示信息为0x01，依次类推。
S105，根据加密指示信息确定平台密钥。
仍以前述表1为例，若加密指示信息为0x00，则第一平台确定平台密钥为第一平台密钥，若加密指示信息为0x01，则第一平台确定平台密钥为第二平台密钥，依次类推。
选用该实施例，使得第二平台可以通过不同的密钥生成数字签名，从而降低了数字签名被破解的可能性，因此非法设备更加难以通过伪造数字签名通过认证，有效提供了安全性。
数字签名为第二平台为待识别设备生成的，在一种可能的实施例中，可以将数字签名视为待识别设备的设备物理标识。在另一种可能的实施例中，也可以将数字签名和其他信息组合得到的组合信息视为待识别设备的设备物理标识。例如，将前述设备标识信息视为待识别设备的设备物理标识。
并且，在待识别设备接入第二平台前，待识别设备无法获取第二平台为待识别设备生成的数字签名。因此，在执行S101前，待识别设备应当曾经接入过第二平台。
对于待识别设备未曾接入过第二平台的情况，可以参见图2，包括：
S201，若待识别设备未从第二平台获取数字签名，获取待识别设备发送的第一信息摘要和第一设备信息。
其中，第一信息摘要为待识别设备根据平台密钥对第一设备信息加密得到的。
S202，使用平台密钥对第一设备信息进行加密，得到第二信息摘要。
S203，若第一信息摘要与第二信息摘要一致，则确定待识别设备为合法设备。
若第一信息摘要与第二信息摘要一致，则认为待识别设备所使用的短期密钥与第一平台所使用的长期密钥为一对密钥对，因此待识别设备为已经通 过第一平台权限验证的设备，因此认为待识别设备为合法设备。
选用该实施例，可以在待识别设备未曾接入第二平台的情况下对待识别设备进行认证，以避免合法设备无法正常执行业务。
可以理解的是，若待识别设备未从第二平台获取数字签名，则认为待识别设备尚未被分配设备物理标识，因此第一平台需要为待识别设备分配设备物理标识。因此，在一种可能的实施例中，在前述图2的基础上，前述设备物理身份认证方法还包括：
S204，若第一信息摘要与第二信息摘要一致，利用平台密钥对第一设备信息进行加密，得到密文。
S205，将密文发送至待识别设备，作为待识别设备的数字签名。
为了更清楚的对本申请实施例提供的设备物理身份认证方法进行说明，下面将结合第一平台、第二平台、待识别设备进行示例性的说明。参见图3，图3所示为本申请实施例提供的设备物理身份认证方法的一种应用场景示意图。图3所示的应用场景中存在三个彼此物理隔离的平台：平台A、平台B以及平台C。其中，IOT(Internet Of Things，物联网)设备首先接入平台A，并在平台A的调度下执行业务。一段时间后，出于实际需求，IOT设备被从平台A转移至平台B，并在平台B的调度下执行业务。又一段时间后，出于实际需求，IOT设备被从平台B转移至平台C，并在平台C的调度下执行业务。
示例性的，在一些可能的实际应用场景中，IOT设备可以为智能家居控制设备，包括智能开关、智能灯、智能门锁等等设备，平台A、平台B以及平台C为不同的智能中控平台。以IOT设备为智能开关为例，该智能开关首先接入智能中控平台A，并在智能中控平台A的调度下执行开关动作。一段时间后，处于实际需求，该智能开关需要从智能中控平台A转移至智能中控平台B，由智能中控平台B调度该智能开关执行开关动作。又一段时间后，又处于实际需求，该智能开关又被从智能中控平台B转移至智能中控平台C，由智能中控平台C调度该智能开关执行开关动作。
下面将分别对该应用场景中存在的以下三个子场景进行说明：
子场景1：IOT设备接入平台A，并在平台A的调度下执行业务；
子场景2：IOT设备接入平台B，并在平台B的调度下执行业务；
子场景3：IOT设备接入平台C，并在平台C的调度下执行业务。
对于子场景1：IOT设备第一次接入平台，因此IOT设备尚未被任意平台分配设备物理标识，平台A需要对IOT设备进行物理身份认证，并在确定IOT设备为合法设备的情况下为IOT设备分配设备物理标识。
在子场景1中，IOT设备相当于前述待识别设备，平台A相当于前述第二平台。响应于IOT设备接入平台A，平台A对IOT设备进行物理身份认证，以确定接入的IOT设备是否为合法设备。若接入的IOT设备为非法设备，则平台A中断与IOT设备的连接，若接入的IOT设备为合法设备，则平台A获取IOT设备的第二设备信息，并基于第二设备信息为IOT设备生成设备物理标识，并发送至IOT设备以使得IOT设备在IOT设备本地保存设备物理标识。
在该示例中，设备物理标识由22个字节组成，其中，第1个字节用于表示加密指示信息，第2个字节为固定值“&”，第3至第22个字节为经过平台密钥加密的数字签名。若第二设备信息的长度为9字节，则数字签名中第1至第9个字节为第二设备信息。若第二设备信息的长度不为9字节，则数字签名中第1至第9个字节为第二设备信息的哈希值的前9个字节，数字签名中的第10个字节为固定值“&”，第11至第20个字节为时间戳。下文中为描述方便，以第二设备信息的长度不为9个字节的情况进行说明。
对于子场景2：IOT设备并非第一次接入平台，因此IOT设备已经被平台A分配设备物理标识，平台B基于IOT设备的设备物理标识对IOT设备进行物理身份认证。但是由于平台A与平台B之间物理隔离，因此平台B本地并未存储平台A为IOT设备分配的设备物理标识。
在子场景2中，IOT设备相当于前述待识别设备，平台A相当于前述第二平台，平台B相当于前述第一平台，平台B按照本申请提供的任一设备物理身份识别方法对IOT设备进行物理身份认证。
在该示例中，响应于IOT设备接入平台B，IOT设备将第一设备信息和设备物理标识发送至平台B，平台B解析设备物理标识得到加密指示信息和数字签名，并根据加密指示信息确定平台密钥，使用所确定的平台密钥对数字签名进行解密，从而得到第二设备信息的哈希值的前9个字节，平台B对第一设备 信息进行哈希，得到第一设备信息的哈希值的前9个字节。平台B确定第一设备信息的哈希值的前9个字节与第二设备信息的哈希值的前9个字节是否相同，若相同，则认为第一设备信息与第二设备信息相同，即IOT设备为合法设备，反之，若不同，则认为第一设备信息与第二设备信息不同，即IOT设备为非法设备。
若IOT设备为合法设备，则平台B后续通过IOT设备的设备物理标识识别IOT设备。
对于子场景3：IOT设备并非第一次接入平台，因此IOT设备已经被平台A分配设备物理标识，平台C基于IOT设备的设备物理标识对IOT设备进行物理身份认证，但是由于平台A与平台C之间物理隔离，因此平台C本地同样并未存储平台A为IOT设备分配的设备物理标识。
在子场景3中，IOT设备相当于前述待识别设备，平台A相当于前述第二平台，平台C相当于前述第一平台，平台C按照本申请提供的任一设备物理身份识别方法对IOT设备进行物理身份认证。平台C对IOT设备进行物理身份认证的方式与平台B相同，可以参见前述关于子场景2的相关说明，在此不再赘述。
若IOT设备为合法设备，则平台C后续通过IOT设备的设备物理标识识别IOT设备。
下面将对待识别设备、第一平台以及第二平台之间的交互过程进行说明，可以参见图4，图4所示为本申请实施例提供的设备在第二平台完成物理身份分配并转移至第一平台的情景下的交互示意图，下面将分别对其中各个步骤进行说明：
Auth1、Auth2、获取短期密钥请求、获取短期密钥答复为待识别设备与第二平台约定短期密钥(session key)的过程，在约定session key后，待识别设备使用短期密钥与第一平台进行后续的业务交互。
在约定sessionkey后，待识别设备向第二平台发送携带有第二设备信息的短期密钥请求，响应于短期密钥请求，第二平台根据第二设备信息生成待识别设备的数字签名，并基于数字签名生成待识别设备的设备物理标识。关于数字签名和设备物理标识可以参见前述相关描述在此不再赘述。
第二平台向待识别设备发送携带有设备物理标识的获取设备物理标识答复，待识别设备通过解析获取设备物理标识答复得到设备物理标识，并将设备物理标识持久化，即在待识别设备本地存储设备物理标识。
后续待识别设备与第二平台进行业务交互时，向第二平台发送业务请求，并在业务请求中携带第二设备信息和设备物理标识，第二平台查询为待识别设备分配的设备物理标识，若查询到的设备物理标识与业务请求中携带的设备物理标识一致，则第二平台确定待识别设备通过认证，从而响应待识别设备发送的业务请求与待识别设备继续进行业务交互。
待识别设备在从第二平台转移至第一平台后，通过Auth1、Auth2、获取短期密钥请求、获取短期密钥答复与第一平台约定短期密钥(session key)的过程，在约定session key后，待识别设备使用短期密钥与第一平台进行后续的业务交互。
后续待识别设备与第一平台进行业务交互时，向第一平台发送业务请求，并在业务请求中携带第一设备信息和设备物理标识。第一平台查询为待识别设备分配的设备物理标识，若查询到的设备物理标识与业务请求中携带的设备物理标识一致，则第一平台确定待识别设备通过认证，从而响应待识别设备发送的业务请求与待识别设备继续进行业务交互。
若第一平台未查询到为待识别设备分配的设备物理标识，则第一平台利用平台密钥从设备物理标识中的数字签名内解析得到设备信息。若解析得到的设备信息与业务请求中携带的第一设备信息一致，则第一平台确定待识别设备通过认证，从而响应待识别设备发送的业务请求与待识别设备继续进行业务交互。并将业务请求中携带的设备物理标识作为第一平台为待识别设备分配的设备物理标识。
对应于前述设备物理身份认证方法，本申请实施例还提供了一种跨平台物理身份识别系统，包括第一平台、第二平台以及待识别设备，第一平台与第二平台物理隔离。
其中，待识别设备，用于依次接入第二平台和第一平台，并在接入第二平台时向第二平台发送第二设备信息；
第二平台，用于响应于待识别接入第二平台，确定待识别设备是否为合 法设备；若识别出待识别设备为合法设备，则利用平台密钥对第二设备信息加密，得到数字签名，并将数字签名发送至待识别设备；
待识别设备，还用于在接入第一平台时向第一平台发送数字签名和第一设备信息；
第一平台，用于根据平台密钥，从数字签名解析得到第二设备信息；若第二设备信息与第一设备信息一致，则确定待识别设备为合法设备。
第一平台为待识别设备第一次接入的平台，即待识别设备在接入第一平台之前，未接入跨平台设备物理身份识别系统中的任一平台。
在一种可能的实施例中，第二平台，还用于若识别出待识别设备为合法设备，则将用于标识平台密钥的加密指示信息发送至待识别设备；
待识别设备，还用于在接入第一平台时向第一平台发送加密指示信息；
第一平台，还用于根据加密指示信息确定平台密钥。
对应于前述设备物理身份认证方法，本申请实施例还提供了一种设备物理身份认证装置，应用于第一平台，装置如图5所示，包括：
信息获取模块501，用于获取待识别设备发送的数字签名和第一设备信息，其中，数字签名为第二平台利用平台密钥对第二设备信息加密得到的，第二设备信息为待识别设备接入第二平台时发送至第二平台的设备信息；
签名解析模块502，用于根据平台密钥，从数字签名中解析得到第二设备信息；
第一验证模块503，用于若第二设备信息与第一设备信息一致，确定待识别设备为合法设备。
在一种可能的实施例中，信息获取模块，还用于获取待识别设备发送的加密指示信息，加密指示信息为第二平台发送至待识别设备的，并且用于标识平台密钥；
根据加密指示信息确定平台密钥。
在一种可能的实施例中，信息获取模块获取待识别设备发送的数字签名和第一设备信息，包括：
若待识别设备已从第二平台获取数字签名，获取待识别设备发送的数字签名和第一设备信息
装置还包括第二验证模块，用于若待识别设备未从第二平台获取数字签名，获取待识别设备发送的第一信息摘要和第一设备信息，第一信息摘要为待识别设备根据短期密钥对第一设备信息进行加密得到的；
使用短期密钥对应的长期密钥对第一设备信息进行加密，得到第二信息摘要；
若第一信息摘要与第二信息摘要一致，确定待识别设备为合法设备。
在一种可能的实施例中，装置还包括签名生成模块，用于若第一信息摘要与第二信息摘要一致，利用平台密钥对第一设备信息进行加密，得到密文；
将密文发送至待识别设备，作为待识别设备的数字签名。
本申请实施例还提供了一种第一平台，如图6所示，包括：
存储器601，用于存放计算机程序；
处理器602，用于执行存储器601上所存放的程序时，实现如下步骤：
获取待识别设备发送的数字签名和第一设备信息，其中，数字签名为第二平台利用平台密钥对第二设备信息加密得到的，第二设备信息为待识别设备接入第二平台时发送至第二平台的设备信息；
根据平台密钥，从数字签名中解析得到第二设备信息；
若第二设备信息与第一设备信息一致，确定待识别设备为合法设备。
本申请实施例提供的第一平台除了包括存储器601和处理器602以外，还可以包括其他组件，示例性的，在一种可能的实施例中，电子设备还包括通信接口、通信总线。
上述第一平台提到的通信总线可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。
通信接口用于上述电子设备与其他设备之间的通信。
存储器可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。可选的，存储器还可以是至少一个位于远离前述处理器的存储装置。
上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。
在本申请提供的又一实施例中，还提供了一种计算机可读存储介质，该计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现上述任一设备物理身份认证方法的步骤。
在本申请提供的又一实施例中，还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例中任一设备物理身份认证方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述仅为本申请的较佳实施例，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本申请的保护范围内。

Claims (13)

  1. 一种设备物理身份认证方法，其特征在于，应用于第一平台，所述方法包括：
    获取待识别设备发送的数字签名和第一设备信息，其中，所述数字签名为第二平台利用平台密钥对第二设备信息加密得到的，所述第二设备信息为所述待识别设备接入所述第二平台时发送至所述第二平台的设备信息；
    根据所述平台密钥，从所述数字签名中解析得到所述第二设备信息；
    若所述第二设备信息与所述第一设备信息一致，确定所述待识别设备为合法设备。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取所述待识别设备发送的加密指示信息，所述加密指示信息为所述第二平台发送至所述待识别设备的，并且用于标识所述平台密钥；
    根据所述加密指示信息确定所述平台密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述获取待识别设备发送的数字签名和第一设备信息，包括：
    若待识别设备已从第二平台获取数字签名，获取所述待识别设备发送的所述数字签名和第一设备信息
    所述方法还包括：
    若待识别设备未从所述第二平台获取所述数字签名，获取所述待识别设备发送的第一信息摘要和所述第一设备信息，所述第一信息摘要为所述待识别设备根据短期密钥对所述第一设备信息进行加密得到的；
    使用所述短期密钥对应的长期密钥对所述第一设备信息进行加密，得到第二信息摘要；
    若所述第一信息摘要与所述第二信息摘要一致，确定所述待识别设备为合法设备。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    若所述第一信息摘要与所述第二信息摘要一致，利用平台密钥对所述第一设备信息进行加密，得到密文；
    将所述密文发送至所述待识别设备，作为所述待识别设备的数字签名。
  5. 一种跨平台物理身份识别系统，其特征在于，所述系统包括第一平台、 第二平台以及待识别设备，所述第一平台与所述第二平台物理隔离；
    所述待识别设备，用于依次接入所述第二平台和所述第一平台，并在接入所述第二平台时向所述第二平台发送第二设备信息；
    所述第二平台，用于响应于所述待识别接入所述第二平台，确定所述待识别设备是否为合法设备；若识别出所述待识别设备为合法设备，则利用平台密钥对所述第二设备信息加密，得到数字签名，并将所述数字签名发送至所述待识别设备；
    所述待识别设备，还用于在接入所述第一平台时向所述第一平台发送所述数字签名和第一设备信息；
    所述第一平台，用于根据所述平台密钥，从所述数字签名解析得到所述第二设备信息；若所述第二设备信息与所述第一设备信息一致，则确定所述待识别设备为合法设备。
  6. 根据权利要求5所述的系统，其特征在于，所述第二平台，还用于若识别出所述待识别设备为合法设备，则将用于标识所述平台密钥的加密指示信息发送至所述待识别设备；
    所述待识别设备，还用于在接入所述第一平台时向所述第一平台发送所述加密指示信息；
    所述第一平台，还用于根据所述加密指示信息确定所述平台密钥。
  7. 一种设备物理身份认证装置，其特征在于，应用于第一平台，所述装置包括：
    信息获取模块，用于获取待识别设备发送的数字签名和第一设备信息，其中，所述数字签名为第二平台利用平台密钥对第二设备信息加密得到的，所述第二设备信息为所述待识别设备接入所述第二平台时发送至所述第二平台的设备信息；
    签名解析模块，用于根据所述平台密钥，从所述数字签名中解析得到所述第二设备信息；
    第一验证模块，用于若所述第二设备信息与所述第一设备信息一致，确定所述待识别设备为合法设备。
  8. 根据权利要求7所述的装置，其特征在于，所述信息获取模块，还用于获取所述待识别设备发送的加密指示信息，所述加密指示信息为所述第二 平台发送至所述待识别设备的，并且用于标识所述平台密钥；
    根据所述加密指示信息确定所述平台密钥。
  9. 根据权利要求7所述的装置，其特征在于，所述信息获取模块获取待识别设备发送的数字签名和第一设备信息，包括：
    若待识别设备已从第二平台获取数字签名，获取所述待识别设备发送的所述数字签名和第一设备信息
    所述装置还包括第二验证模块，用于若待识别设备未从所述第二平台获取所述数字签名，获取所述待识别设备发送的第一信息摘要和所述第一设备信息，所述第一信息摘要为所述待识别设备根据短期密钥对所述第一设备信息进行加密得到的；
    使用所述短期密钥对应的长期密钥对所述第一设备信息进行加密，得到第二信息摘要；
    若所述第一信息摘要与所述第二信息摘要一致，确定所述待识别设备为合法设备。
  10. 根据权利要求9所述的装置，其特征在于，所述装置还包括签名生成模块，用于若所述第一信息摘要与所述第二信息摘要一致，利用平台密钥对所述第一设备信息进行加密，得到密文；
    将所述密文发送至所述待识别设备，作为所述待识别设备的数字签名。
  11. 一种第一平台，其特征在于，包括：
    存储器，用于存放计算机程序；
    处理器，用于执行存储器上所存放的程序时，实现权利要求1-4任一所述的方法步骤。
  12. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1-4任一所述的方法步骤。
  13. 一种计算机程序产品，当其在计算机上运行时，使得计算机执行时实现权利要求1-4任一所述的方法步骤。
PCT/CN2023/072108 2022-02-25 2023-01-13 一种设备物理身份认证方法、系统、装置及第一平台 WO2023160299A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210181942.9A CN114584313B (zh) 2022-02-25 2022-02-25 一种设备物理身份认证方法、系统、装置及第一平台
CN202210181942.9 2022-02-25

Publications (1)

Publication Number Publication Date
WO2023160299A1 true WO2023160299A1 (zh) 2023-08-31

Family

ID=81774625

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/072108 WO2023160299A1 (zh) 2022-02-25 2023-01-13 一种设备物理身份认证方法、系统、装置及第一平台

Country Status (2)

Country Link
CN (1) CN114584313B (zh)
WO (1) WO2023160299A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114584313B (zh) * 2022-02-25 2023-11-03 杭州萤石软件有限公司 一种设备物理身份认证方法、系统、装置及第一平台

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6826690B1 (en) * 1999-11-08 2004-11-30 International Business Machines Corporation Using device certificates for automated authentication of communicating devices
US20050097316A1 (en) * 2003-11-01 2005-05-05 Kim Dae-Youb Digital signature method based on identification information of group members, and method of acquiring identification information of signed-group member, and digital signature system for performing digital signature based on identification information of group members
US20160099814A1 (en) * 2013-06-13 2016-04-07 Intel Corporation Secure pairing for secure communication across devices
US9992029B1 (en) * 2017-04-05 2018-06-05 Stripe, Inc. Systems and methods for providing authentication to a plurality of devices
CN113783829A (zh) * 2020-11-26 2021-12-10 北京沃东天骏信息技术有限公司 跨平台实现设备接入的方法和装置
CN114584313A (zh) * 2022-02-25 2022-06-03 杭州萤石软件有限公司 一种设备物理身份认证方法、系统、装置及第一平台

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9923881B2 (en) * 2015-10-14 2018-03-20 Mcafee, Llc System, apparatus and method for migrating a device having a platform group
CN112491881B (zh) * 2020-11-26 2023-05-12 中国人寿保险股份有限公司 跨平台单点登录方法、系统、电子设备及存储介质
CN112637211B (zh) * 2020-12-24 2022-09-20 国网河北省电力有限公司信息通信分公司 一种基于区块链的跨域访问的认证方法及系统
CN113114465B (zh) * 2021-03-19 2022-10-11 青岛海尔科技有限公司 归属权限的处理方法及装置、存储介质、电子装置
CN113572728B (zh) * 2021-06-09 2023-06-02 杭州华橙软件技术有限公司 认证物联网设备的方法、装置、设备及介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6826690B1 (en) * 1999-11-08 2004-11-30 International Business Machines Corporation Using device certificates for automated authentication of communicating devices
US20050097316A1 (en) * 2003-11-01 2005-05-05 Kim Dae-Youb Digital signature method based on identification information of group members, and method of acquiring identification information of signed-group member, and digital signature system for performing digital signature based on identification information of group members
US20160099814A1 (en) * 2013-06-13 2016-04-07 Intel Corporation Secure pairing for secure communication across devices
US9992029B1 (en) * 2017-04-05 2018-06-05 Stripe, Inc. Systems and methods for providing authentication to a plurality of devices
CN113783829A (zh) * 2020-11-26 2021-12-10 北京沃东天骏信息技术有限公司 跨平台实现设备接入的方法和装置
CN114584313A (zh) * 2022-02-25 2022-06-03 杭州萤石软件有限公司 一种设备物理身份认证方法、系统、装置及第一平台

Also Published As

Publication number Publication date
CN114584313B (zh) 2023-11-03
CN114584313A (zh) 2022-06-03

Similar Documents

Publication Publication Date Title
CN108055274B (zh) 一种基于联盟链存储数据的加密与共享方法及系统
WO2020237868A1 (zh) 数据传输方法、电子设备、服务器及存储介质
US9774595B2 (en) Method of authentication by token
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
US9294468B1 (en) Application-level certificates for identity and authorization
US8984295B2 (en) Secure access to electronic devices
US9219722B2 (en) Unclonable ID based chip-to-chip communication
JP7421771B2 (ja) Ｉｏｔサービスを実施するための方法、アプリケーションサーバ、ｉｏｔ装置および媒体
WO2017020452A1 (zh) 认证方法和认证系统
US20030208681A1 (en) Enforcing file authorization access
WO2013056622A1 (zh) 验证机顶盒接入身份的方法和认证服务器
US10389693B2 (en) Keys for encrypted disk partitions
KR102137122B1 (ko) 보안 체크 방법, 장치, 단말기 및 서버
US9443067B1 (en) System for the distribution and deployment of applications, with provisions for security and policy conformance
US10560528B2 (en) Cloud-based management of access to a data storage system on a local network
WO2020102974A1 (zh) 一种数据访问方法、数据访问装置及移动终端
WO2023141876A1 (zh) 数据传输方法、装置、系统、电子设备及可读介质
WO2023160299A1 (zh) 一种设备物理身份认证方法、系统、装置及第一平台
JP2024501326A (ja) アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード
CN114157434A (zh) 登录验证方法、装置、电子设备及存储介质
CN113645226A (zh) 一种基于网关层的数据处理方法、装置、设备及存储介质
CN111988262B (zh) 认证方法、装置及服务器、存储介质
CN112242976B (zh) 一种身份认证方法及装置
CN113992336B (zh) 基于区块链的加密网络离线数据可信交换方法及装置
WO2022062688A1 (zh) 消息推送方法、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23758924

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023758924

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023758924

Country of ref document: EP

Effective date: 20240925