WO2023207113A1 - 一种设备互联安全认证系统、方法、装置、服务器及介质 - Google Patents

一种设备互联安全认证系统、方法、装置、服务器及介质 Download PDF

Info

Publication number
WO2023207113A1
WO2023207113A1 PCT/CN2022/137359 CN2022137359W WO2023207113A1 WO 2023207113 A1 WO2023207113 A1 WO 2023207113A1 CN 2022137359 W CN2022137359 W CN 2022137359W WO 2023207113 A1 WO2023207113 A1 WO 2023207113A1
Authority
WO
WIPO (PCT)
Prior art keywords
discovery
identification information
pairing
discovered
verification code
Prior art date
Application number
PCT/CN2022/137359
Other languages
English (en)
French (fr)
Inventor
钱进
侯腾
陈成钱
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2023207113A1 publication Critical patent/WO2023207113A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • H04L9/3073—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Definitions

  • the present invention relates to the field of information security technology, and in particular to a device interconnection security authentication system, method, device, server and medium.
  • the new generation of device interconnection based on distributed technology has the advantages of self-discovery, self-organizing network, high reliability, low latency, easy development, and resource sharing.
  • the prerequisite for this technology is that in the process of self-discovery of equipment self-organizing networks based on distributed soft buses, interconnection security authentication can be quickly completed between devices.
  • the discovery device A when performing device interconnection security authentication, the discovery device A first randomly generates a plaintext PIN code and displays it on the screen. Then the user enters the PIN code into the discovery device B, and then the discovery device B passes the distributed The soft bus technology transmits the PIN code to the discovery device A, and finally the discovery device A completes the interconnection security authentication based on the PIN code.
  • the existing technology uses an authentication scheme that displays plaintext PIN codes to complete single-factor authentication only through the bus between the discovering end device and the discovered end device, which has low security.
  • Embodiments of the present invention provide an equipment interconnection security authentication system, method, device, server and medium to solve the problem of low security of existing equipment interconnection security authentication methods.
  • Embodiments of the present invention provide a device interconnection security authentication system.
  • the system includes: a discovery device, a discovery device, a control device and a server;
  • the control device is used to obtain the first device identification information, pairing request time and pairing verification code of the discovery device, and send them to the server;
  • the discovered device is used to obtain the first device identification information and pairing request time of the discovered device;
  • the control device is also configured to obtain the second device identification information of the discovered device, as well as the first device identification information and pairing request time obtained by the discovered device, and send them to the server;
  • the server is configured to perform single-device security authentication on the discovering device and the discovered device respectively, and determine the pairing verification of the discovering device based on the received first device identification information and pairing request time. code, and send the pairing verification code to the discovered device according to the second device identification information;
  • the discovery-end device is also configured to send the received pairing verification code to the discovery-end device; the discovery-end device conducts the discovery-side device and the matching verification code according to its own pairing verification code and the received pairing verification code. The security authentication of the discovered end device.
  • the discovery device is configured to generate the first QR code based on the first device identification information, pairing request time and pairing verification code;
  • the control device is specifically configured to obtain the first device identification information, pairing request time and pairing verification code of the discovery device by scanning the first QR code;
  • the discovered device is configured to generate a second QR code based on its own second device identification information, the obtained first device identification information and the pairing request time;
  • the control device is specifically configured to obtain the second device identification information of the discovered device by scanning the second QR code, as well as the first device identification information and pairing request obtained by the discovered device. time.
  • control device is specifically configured to obtain the first device identification information, pairing request time and pairing verification code of the discovery device through near field communication NFC technology;
  • the control device is specifically configured to obtain the second device identification information of the discovered device through NFC technology, as well as the first device identification information and pairing request time obtained by the discovered device.
  • the server is specifically configured to perform single-device security authentication on the discovery end device based on the first public-private key pair negotiated with the discovery end device;
  • the key pair is used to perform single-device security authentication on the discovered device.
  • the discovery device is configured to use the first communication key negotiated with the server to encrypt the first device identification information, pairing request time and pairing verification code, and based on the encrypted first The device identification information, pairing request time and pairing verification code generate the first QR code;
  • the control device is specifically configured to obtain the first device identification information, pairing request time and pairing verification code of the discovery device by scanning the first QR code and decrypting it based on the first communication key. ;
  • the discovered device is configured to use the second communication key negotiated with the server to encrypt its own second device identification information, as well as the obtained first device identification information and pairing request time, and perform encryption based on Generate a second QR code from the encrypted second device identification information, first device identification information and pairing request time;
  • the control device is specifically configured to obtain the second device identification information of the discovered device by scanning the second QR code and decrypting it based on the second communication key, and the discovered device.
  • the first device identification information and pairing request time obtained by the device.
  • the server is specifically configured to use the second communication key to encrypt the determined pairing verification code of the discovery end device, and send the encrypted pairing verification code to the discovery end device. equipment;
  • the discovered device is also configured to receive an encrypted pairing verification code sent by the server, use the second communication key to decrypt the encrypted pairing verification code, and store the decrypted pairing verification code.
  • the pairing verification code is sent to the discovery device.
  • the discovery device is also used to broadcast its own first device identification information and pairing request time;
  • the discovery device is specifically configured to receive and obtain the first device identification information and pairing request time of the discovery device according to the broadcast information of the discovery device.
  • embodiments of the present invention provide a device interconnection security authentication method, which method includes:
  • the discovering device After performing single-device security authentication on the discovering device and the discovered device respectively, determine the pairing verification code of the discovering device according to the received first device identification information and pairing request time, and determine the pairing verification code of the discovering device according to the The second device identification information sends the pairing verification code to the discovered device; causes the discovered device to send the received pairing verification code to the discovering device; causes the discovering device according to The own pairing verification code and the received pairing verification code perform security authentication of the discovery end device and the discovery end device.
  • performing single-device security authentication on the discovery device and the discovery device respectively includes:
  • the discovery end device According to the first public and private key pair negotiated with the discovery end device, single device security authentication is performed on the discovery end device; according to the second public and private key pair negotiated with the discovery end device, the discovery end device is Perform single-device security certification.
  • an embodiment of the present invention provides a device for device interconnection security authentication.
  • the device includes:
  • the first receiving module is used to receive the first device identification information, pairing request time and pairing verification code of the discovery device obtained and sent by the control device;
  • the second receiving module is configured to receive the second device identification information of the discovered device obtained and sent by the control device, as well as the first device identification information and pairing request time obtained by the discovered device;
  • a sending module configured to determine the pairing verification code of the discovering device according to the received first device identification information and pairing request time after performing single device security authentication on the discovering device and the discovered device respectively. , and send the pairing verification code to the discovered device according to the second device identification information; cause the discovered device to send the received pairing verification code to the discovered device; make the discovered device
  • the discovery device performs security authentication on the discovery device and the discovery device based on its own pairing verification code and the received pairing verification code.
  • the sending module is specifically configured to perform single-device security authentication on the discovery end device based on the first public-private key pair negotiated with the discovery end device; The public and private key pairs are used to perform single-device security authentication on the discovered device.
  • embodiments of the present invention provide a server, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus;
  • Memory used to store computer programs
  • the processor is used to implement the uploading method steps when executing the program stored in the memory.
  • embodiments of the present invention provide a computer-readable storage medium.
  • a computer program is stored in the computer-readable storage medium.
  • the computer program is executed by a processor, the above method steps are implemented.
  • Embodiments of the present invention provide a device interconnection security authentication system, method, device, server and medium.
  • the system includes: a discovery end device, a discovery end device, a control device and a server; the control device is used to obtain all The first device identification information, pairing request time and pairing verification code of the discovery device are sent to the server; the discovery device is used to obtain the first device identification information and pairing request of the discovery device. time; the control device is also configured to obtain the second device identification information of the discovered device, the first device identification information and the pairing request time obtained by the discovered device, and send them to the server ;
  • the server is configured to determine the pairing of the discovery device according to the received first device identification information and pairing request time after performing single device security authentication on the discovery device and the discovery device respectively.
  • the discovered device is also used to send the received pairing verification code to the discovered device.
  • the discovery terminal device performs security authentication of the discovery terminal device and the discovered terminal device according to its own pairing verification code and the received pairing verification code.
  • the control device obtains the first device identification information, pairing request time and pairing verification code of the discovered device, and sends them to the server, obtains the second device identification information of the discovered device, and the discovered device
  • the device obtains the first device identification information and pairing request time and sends them to the server.
  • the server first performs single-device security authentication on the discovering device and the discovered device respectively. After the single-device security authentication, the server determines the pairing verification code of the discovering device based on the received first device identification information and pairing request time, and based on The second device identification information sends the pairing verification code to the discovered device. Then, the discovered device and the discovering device perform security authentication between the two devices.
  • the authentication elements in the embodiment of the present invention are divided into two parts.
  • One part performs single-device security authentication on the server, and the other part completes complete authentication between the discovering device and the discovered device. Only after passing the single-device security authentication, the device interconnection authentication is completed together. Compared with the single-factor authentication completed by the bus only in the existing technology, the security is higher.
  • Figure 1 is a conceptual diagram of distributed device interconnection in the prior art
  • Figure 2 is a flow chart of device self-discovery based on distributed soft buses in the prior art
  • Figure 3 is a verification flow chart using PIN code as a security authentication method in the prior art
  • Figure 4 is a flow chart of QR code authentication based on system components and servers provided by an embodiment of the present invention.
  • Figure 5 is a schematic structural diagram of a device interconnection security authentication system provided by an embodiment of the present invention.
  • Figure 6 is a schematic diagram of the device interconnection security authentication process provided by the embodiment of the present invention.
  • Figure 7 is a QR code scanning authentication module diagram of discovery terminal device A provided by an embodiment of the present invention.
  • Figure 8 is a soft bus broadcast module diagram provided by an embodiment of the present invention.
  • Figure 9 is a diagram of the code scanning authentication module of the discovered end device B provided by the embodiment of the present invention.
  • Figure 10 is a business architecture diagram of the financial terminal operating system infrastructure platform provided by the embodiment of the present invention.
  • Figure 11 is a flow chart showing the prerequisite for self-organizing network and self-connection of multiple devices according to the embodiment of the present invention, which is to first complete the trust binding between devices;
  • Figure 12 is a flow chart of device interconnection security authentication provided by an embodiment of the present invention.
  • Figure 13 is a framework diagram of device interconnection security authentication provided by an embodiment of the present invention.
  • Figure 14 is a schematic structural diagram of a device interconnection security authentication device provided by an embodiment of the present invention.
  • Figure 15 is a schematic structural diagram of a server provided by an embodiment of the present invention.
  • the new generation of device interconnection based on distributed technology has the characteristics of self-discovery, self-organizing network, high reliability, and low cost. Latency, easy development, resource sharing and other advantages.
  • Figure 2 is a flow chart of device self-discovery based on distributed soft bus. (1) The discovered device B publishes services; (2) The discovered device A sends a broadcast in the LAN; (3) The discovered device B receives the broadcast. , sending a unicast to discovery device A; (4) Discovery device A receives the unicast and updates device information.
  • the discovery device A randomly generates a PIN code; (2) the user enters the PIN code randomly generated by the discovery device A into the discovery device B; (3) the discovery device B enters the PIN code Sent to discovery device A: (4) Discovery device A confirms that the PIN code sent by discovery device B is consistent with the PIN code generated by itself, and the verification is passed. That is, the first step in the device interconnection security authentication process is the trust binding between devices.
  • the discovery device A first randomly generates a plaintext PIN code and displays it on the screen. Then the user enters the PIN code into the discovery device B, and then The discovered device B transmits the PIN code to the discovered device A through distributed soft bus technology, and finally the discovered device A completes the interconnection security authentication based on the PIN code.
  • Embodiments of the present invention take into account the above technical problems and focus on the interconnection security issues of Internet of Things terminal devices in various industries based on domestically produced independent controllable operating systems.
  • the trust binding method between devices no longer uses PIN code verification with low security.
  • Figure 4 is a flow chart of QR code authentication based on system components and servers provided by an embodiment of the present invention.
  • the discovering device A generates a QR code for users to scan using a control device (such as a mobile phone); (2) the discovering device A sends authentication elements to the discovered device B; (3) the discovered device The discovery device B generates a QR code, which contains the authentication elements sent by the discovery device A, so that the user can use the control device to scan; (4)
  • the server performs single-device security on the discovery device A and the discovery device B respectively.
  • Authentication (5) The server sends the verification code of discovery device A to discovery device B; (6) Discovery device B returns the verification code to discovery device A; (7) Discovery device A performs verification Code verification passed.
  • the discovery device A and the discovery device B in the embodiment of the present invention may be a mobile phone, a smart watch, a microwave oven, a coffee machine, etc.
  • interconnection authentication through APP or small program can attract traffic for enterprises and obtain user data and device data.
  • the secure QR code combines system components and servers with high security and can be deeply customized for permission management.
  • the APP or mini program can unbind the device at any time.
  • the embodiment of the present invention focuses on the trust binding process between devices in device interconnection security.
  • the innovative invention lies in: based on key security management of system components and servers, while achieving high-security single-device authentication, combined with distributed soft bus technology , thereby achieving high-security multi-device interconnection authentication.
  • the core idea and essence is to separate the security authentication elements of the device. Some of them are stored in the server through the network, and some are transmitted through the device soft bus. Then the network is used for server authentication, and then the soft bus is used for device side authentication.
  • Figure 5 is a schematic structural diagram of a device interconnection security authentication system provided by an embodiment of the present invention.
  • the system includes: a discovery device 11, a discovery device 12, a control device 13 and a server 14;
  • the control device 13 is used to obtain the first device identification information, pairing request time and pairing verification code of the discovery device 11, and send them to the server 14;
  • the discovered device 12 is used to obtain the first device identification information and pairing request time of the discovered device 11;
  • the control device 13 is also configured to obtain the second device identification information of the discovered device 12, as well as the first device identification information and pairing request time obtained by the discovered device 12, and send them to the server14;
  • the server 14 is configured to perform single-device security authentication on the discovery device 11 and the discovery device 12 respectively, and determine the discovery device according to the received first device identification information and pairing request time. 11, and send the pairing verification code to the discovered device 12 according to the second device identification information;
  • the discovery end device 12 is also used to send the received pairing verification code to the discovery end device 11; the discovery end device 11 performs the discovery based on its own pairing verification code and the received pairing verification code. Security authentication of the end device and the discovered end device.
  • the device interconnection security authentication system includes: discovery device 11, discovery device 12, control device 13 and server 14. Among them, discovery device 11 and discovery device 12 are located in the same local area network. The device 11 and the discovered device 12 are connected through a distributed soft bus. The control device 13 obtains the authentication factors of the discovering end device 11 and the discovered end device 12 through QR code scanning, or obtains the authentication factors of the discovering end device 11 and the discovered end device 12 through near field communication NFC technology. The discovery device 11, the discovery device 12, and the control device are respectively connected to the server through the network.
  • the control device 13 is generally a smartphone.
  • the process of the control device obtaining the first device identification information, pairing request time and pairing verification code of the discovery device includes: the discovery device based on the first device identification information, pairing request time and pairing The verification code generates a first QR code; the control device obtains the first device identification information, pairing request time and pairing verification code of the discovery device by scanning the first QR code.
  • the process of controlling the device to obtain the second device identification information of the discovered device, and the first device identification information and pairing request time obtained by the discovered device includes: the discovered device The device generates a second QR code based on its own second device identification information, the obtained first device identification information and the pairing request time; the control device obtains the second QR code of the discovered device by scanning the second QR code.
  • Device identification information, as well as the first device identification information and pairing request time obtained by the discovered device includes: the discovered device The device generates a second QR code based on its own second device identification information, the obtained first device identification information and the pairing request time; the control device obtains the second QR code of the discovered device by scanning the second QR code.
  • the discovery device is used to encrypt the first device identification information, pairing request time and pairing verification code using the first communication key negotiated with the server. Process, and generate the first QR code based on the encrypted first device identification information, pairing request time and pairing verification code;
  • the control device is specifically configured to obtain the first device identification information, pairing request time and pairing verification code of the discovery device by scanning the first QR code and decrypting it based on the first communication key;
  • the discovered device is configured to use the second communication key negotiated with the server to encrypt its own second device identification information, as well as the obtained first device identification information and pairing request time, and based on the encrypted The second device identification information, the first device identification information and the pairing request time generate a second QR code;
  • the control device is specifically configured to scan the second QR code and decrypt it based on the second communication key to obtain the second device identification information of the discovered device, and the first device identification obtained by the discovered device. Information and pairing request times.
  • the control device obtains the first device identification information, pairing request time and pairing verification code of the discovery device through near field communication NFC technology.
  • the control device uses NFC technology to obtain the second device identification information of the discovered device, as well as the first device identification information and pairing request time obtained by the discovered device.
  • the control device can also obtain the first device identification information, pairing request time and pairing verification code of the discovery device through near field communication NFC technology.
  • the control device can also obtain the second device identification information of the discovered device through NFC technology, as well as the first device identification information and pairing request time obtained by the discovered device.
  • the process by which the discovered device obtains the first device identification information and pairing request time of the discovering device includes: the discovering device broadcasts its first device identification information and pairing request time in the local area network; the discovered device receives and performs the pairing request according to the discovering device's first device identification information and pairing request time.
  • the broadcast information of the device is used to obtain the first device identification information and pairing request time of the discovery device.
  • the server performs single-device security authentication on the discovery-side device and the discovery-side device respectively. Specifically, the server performs single-device security authentication on the discovery-side device based on the first public-private key pair negotiated with the discovery-side device; and performs single-device security authentication on the discovery-side device based on the second public-private key pair negotiated with the discovery-side device. Certification.
  • the first public-private key pair negotiated between the server and the discovery device.
  • the discovery device adds a digital signature to the data sent to the server based on the private key pair in the first public-private key pair.
  • the server digitally signs the data based on the public key pair in the first public-private key pair.
  • Perform signature verification If the signature verification passes, it is confirmed that the single-device security authentication of the discovery device is completed.
  • the second public-private key pair negotiated between the server and the discovered device.
  • the discovered device adds a digital signature to the data sent to the server based on the private key pair in the second public-private key pair.
  • the server uses the public key pair in the second public-private key pair.
  • the digital signature is verified. If the verification passes, it is determined that the single-device security authentication of the discovered device is completed.
  • the server After the server performs single-device security authentication on the discovering device and the discovered device respectively, it determines the pairing of the discovering device corresponding to the first device identification information and pairing request time based on the received first device identification information and pairing request time. verification code, and send the pairing verification code to the discovered device according to the second device identification information.
  • the discovered device sends the received pairing verification code to the discovering device.
  • the discovering device determines whether its own pairing verification code is consistent with the received pairing verification code. If they are consistent, the discovering device and the discovered device perform security authentication. Complete. If they are inconsistent, the security authentication of the discovery device and the discovery device fails.
  • the server is specifically configured to use the second communication key to encrypt the determined pairing verification code of the discovery device, and send the encrypted pairing verification code to the discovery device.
  • the discovered end device is also used to receive the encrypted pairing verification code sent by the server, use the second communication key to decrypt the encrypted pairing verification code, and send the decrypted pairing verification code. to the discovery device.
  • the control device obtains the first device identification information, pairing request time and pairing verification code of the discovered device, and sends them to the server, obtains the second device identification information of the discovered device, and the discovered device
  • the device obtains the first device identification information and pairing request time and sends them to the server.
  • the server first performs single-device security authentication on the discovering device and the discovered device respectively. After the single-device security authentication, the server determines the pairing verification code of the discovering device based on the received first device identification information and pairing request time, and based on The second device identification information sends the pairing verification code to the discovered device. Then, the discovered device and the discovering device perform security authentication between the two devices.
  • the authentication elements in the embodiment of the present invention are divided into two parts.
  • One part performs single-device security authentication on the server, and the other part completes complete authentication between the discovering device and the discovered device. Only after passing the single-device security authentication, the device interconnection authentication is completed together. Compared with the single-factor authentication completed by the bus only in the existing technology, the security is higher.
  • FIG. 6 is a schematic diagram of the device interconnection security authentication process provided by an embodiment of the present invention. The process includes:
  • S101 Receive the first device identification information, pairing request time and pairing verification code of the discovery device obtained and sent by the control device.
  • S102 Receive the second device identification information of the discovered device obtained and sent by the control device, as well as the first device identification information and pairing request time obtained by the discovered device.
  • S103 After performing single-device security authentication on the discovering device and the discovered device respectively, determine the pairing verification code of the discovering device based on the received first device identification information and pairing request time, and determine the pairing verification code of the discovering device according to The second device identification information sends the pairing verification code to the discovered device; causes the discovered device to send the received pairing verification code to the discovered device; causes the discovered device to The device performs security authentication on the discovery device and the discovery device based on its own pairing verification code and the received pairing verification code.
  • the single-device security authentication of the discovery-side device and the discovery-side device respectively includes:
  • the discovery end device According to the first public and private key pair negotiated with the discovery end device, single device security authentication is performed on the discovery end device; according to the second public and private key pair negotiated with the discovery end device, the discovery end device is Perform single-device security certification.
  • the device interconnection security authentication method provided by the embodiment of the present invention is applied to the server in the device interconnection security authentication system.
  • the device (including the discovery device and the discovered device) negotiates the communication key and the device public and private key pair with the server.
  • the device information is synchronized to the server (same meaning as the enterprise cloud below) and bound with the user's authorization.
  • the server negotiates the key with the device, and the server saves the device identification information, communication key, and device public key. Key, the device saves device identification information, communication keys, and device private keys. These keys will be used for user device authentication and data communication in the following step 2.
  • Discovery device A generates a secure QR code, and the APP/mini program scans the code to authenticate single device A.
  • FIG. 7 is a QR code scanning authentication module diagram of the discovery terminal device A provided by the embodiment of the present invention.
  • the discovery device A encrypts the communication key to generate a secure QR code.
  • the QR code consists of the server Uri (uniform resource identifier), the device's unique identification code, the pairing request device name (the device name of the device that first initiated the pairing request), The pairing request time, and the pairing verification code (the verification code generated by the device that initiated the pairing request according to certain rules, used for the final verification of device trust binding, the certain rules can be random, or certain algorithm rules) are finally generated.
  • the server saves the device request device name, pairing request time and pairing verification code, and the relevant data is decrypted by the communication key.
  • FIG. 8 is a soft bus broadcast module diagram provided by an embodiment of the present invention.
  • Discovery device A broadcasts its pairing request device name and pairing request time to the soft bus, and all devices (device B, device C, etc.) located in the same LAN automatically receive the message.
  • the discovered device B generates a secure QR code, and the APP/mini program scans the code to authenticate single device B.
  • Figure 9 is a module diagram of the code scanning authentication module of the discovered device B provided by the embodiment of the present invention.
  • the discovered device B is encrypted with the communication key to generate a secure QR code.
  • the QR code consists of the enterprise cloud Uri, device unique identification code, pairing request device name (obtained in step 2), and pairing request time (obtained in step 2). And finally generated. Scan the QR code through the APP/mini program and combine the public and private keys of the device to complete the single-device authentication of the discovered device B in the enterprise cloud.
  • the enterprise cloud completes the interconnection authentication between discovery device A and discovery device B and issues a pairing verification code.
  • the enterprise cloud After the enterprise cloud authenticates the discovered device B, it finds the pairing verification code corresponding to the discovered device A in the database based on the pairing request device name and the pairing request time, thereby completing the interconnection between the discovered device A and the discovered device B in the enterprise cloud. Certification. Subsequently, the enterprise cloud delivers the pairing verification code ciphertext to the discovered device B, and the data is encrypted by the communication key.
  • the pairing verification code is returned on the soft bus to complete the device interconnection authentication on the device side.
  • the discovered device B receives the pairing verification code and returns it to the discovering device A on the soft bus. After the discovering device A completes the verification code verification, the soft bus notifies the discovered device B, and finally completes the interconnection security authentication on the device side. .
  • Figure 10 is a business architecture diagram of the financial terminal operating system infrastructure platform provided by the embodiment of the present invention.
  • the financial payment component or security component
  • the patent proposal is realized Solutions for secure interconnection of devices.
  • FIG 11 is a flowchart showing a flow chart of the self-organizing network and self-connection of multiple devices provided by the embodiment of the present invention.
  • the premise is to first complete the trust binding between devices. 0.
  • the acceptance terminal and the IOT device generate device identification and device keys; 1. Pairing between devices, including pairing by NFC, Bluetooth, QR code scanning, etc.; 2.
  • the acceptance terminal performs verification code verification; 3.
  • the acceptance terminal generates a session key 4.
  • the encrypted session key is sent to the opposite IOT device; 5.
  • the IOT device decrypts the session key and saves it; 6.
  • the IOT device responds to the acceptance terminal that the session key negotiation is completed; 7.
  • the session key is encrypted and accepted by the terminal device.
  • the key is sent to the opposite end IOT device; 8.
  • the IOT device session key decrypts the device public key and saves it; 9.
  • the session key encryption IOT device public key is sent to the opposite end acceptance terminal; 10.
  • the acceptance terminal session key decrypts the device public
  • Figure 12 is a flow chart of device interconnection security authentication provided by the embodiment of the present invention.
  • Figure 13 is a framework diagram of device interconnection security authentication provided by the embodiment of the present invention.
  • the discovery device A generates a QR code and sends a broadcast through the soft bus.
  • the mobile APP /The applet scans and parses the code, and sends the discovery device A information to the enterprise cloud.
  • the enterprise cloud authenticates the discovery device A and saves the discovery device A information.
  • the discovered device B receives the information broadcast by the discovered device A, generates a QR code, and the mobile APP/mini program scans and parses the code, and sends the discovered device B information to the enterprise cloud, and the enterprise cloud authenticates the discovered device B.
  • the QR code method can be replaced by NFC (Near Field Communication (NFC)) or Bluetooth.
  • Figure 14 is a schematic structural diagram of a device interconnection security authentication device provided by an embodiment of the present invention.
  • the device includes:
  • the first receiving module 141 is used to receive the first device identification information, pairing request time and pairing verification code of the discovery device obtained and sent by the control device;
  • the second receiving module 142 is configured to receive the second device identification information of the discovered device obtained and sent by the control device, as well as the first device identification information and pairing request time obtained by the discovered device;
  • the sending module 143 is configured to determine the pairing verification of the discovering device according to the received first device identification information and pairing request time after performing single device security authentication on the discovering device and the discovered device respectively. code, and send the pairing verification code to the discovered device according to the second device identification information; cause the discovered device to send the received pairing verification code to the discovered device; cause The discovery device performs security authentication on the discovery device and the discovery device based on its own pairing verification code and the received pairing verification code.
  • the sending module 143 is specifically configured to perform single-device security authentication on the discovery end device based on the first public and private key pair negotiated with the discovery end device; and based on the second public and private key negotiated with the discovery end device. Yes, perform single-device security authentication on the discovered device.
  • the embodiment of the present invention also provides a server, as shown in Figure 15, including: a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, The communication interface 302 and the memory 303 complete communication with each other through the communication bus 304;
  • the memory 303 stores a computer program. When the program is executed by the processor 301, the processor 301 performs the following steps:
  • the discovering device After performing single-device security authentication on the discovering device and the discovered device respectively, determine the pairing verification code of the discovering device according to the received first device identification information and pairing request time, and determine the pairing verification code of the discovering device according to the The second device identification information sends the pairing verification code to the discovered device; causes the discovered device to send the received pairing verification code to the discovering device; causes the discovering device according to The own pairing verification code and the received pairing verification code perform security authentication of the discovery end device and the discovery end device.
  • embodiments of the present invention also provide a server. Since the principle of solving the problem of the above server is similar to the device interconnection security authentication method, the implementation of the above server can be referred to the implementation of the method, and repeated details will not be repeated.
  • the communication bus mentioned by the server can be the Peripheral Component Interconnect (PCI) bus or the Extended Industry Standard Architecture (EISA) bus, etc.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the communication bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 302 is used for communication between the above-mentioned server and other devices.
  • the memory may include random access memory (Random Access Memory, RAM) or non-volatile memory (Non-Volatile Memory, NVM), such as at least one disk memory.
  • RAM Random Access Memory
  • NVM Non-Volatile Memory
  • the memory may also be at least one storage device located remotely from the aforementioned processor.
  • the above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array, or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • NP Network Processor
  • DSP Digital Signal Processing
  • embodiments of the present invention also provide a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program that can be executed by a server.
  • the program When the program is stored in the server, When running on the server, the following steps are implemented when the server is executed:
  • the discovering device After performing single-device security authentication on the discovering device and the discovered device respectively, determine the pairing verification code of the discovering device according to the received first device identification information and pairing request time, and determine the pairing verification code of the discovering device according to the The second device identification information sends the pairing verification code to the discovered device; causes the discovered device to send the received pairing verification code to the discovering device; causes the discovering device according to The own pairing verification code and the received pairing verification code perform security authentication of the discovery end device and the discovery end device.
  • embodiments of the present invention also provide a computer-readable storage medium. Since the principle of solving problems when the processor executes the computer program stored on the computer-readable storage medium is similar to the device interconnection security authentication method, Therefore, the implementation of the processor executing the computer program stored in the computer-readable storage medium can be referred to the implementation of the method, and repeated details will not be described again.
  • the above-mentioned computer-readable storage media can be any available media or data storage devices that can be accessed by the processor in the server, including but not limited to magnetic storage such as floppy disks, hard disks, tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., as well as semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD), etc.
  • magnetic storage such as floppy disks, hard disks, tapes, magneto-optical disks (MO), etc.
  • optical storage such as CD, DVD, BD, HVD, etc.
  • semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD), etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明公开了一种设备互联安全认证系统、方法、装置、服务器及介质，控制设备获取发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至服务器，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至服务器。服务器先分别对发现端设备和被发现端设备进行单设备安全认证，单设备安全认证之后，再根据接收到的第一设备标识信息和配对请求时间，确定发现端设备的配对验证码，并根据第二设备标识信息，将配对验证码发送至被发现端设备。再由被发现端设备和发现端设备进行两设备之间的安全认证。相较于现有技术仅由总线完成的单要素认证，安全性更高。

Description

一种设备互联安全认证系统、方法、装置、服务器及介质
相关申请的交叉引用
本申请要求在2022年04月25日提交中国专利局、申请号为202210444433.0、申请名称为“一种设备互联安全认证系统、方法、装置、服务器及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及信息安全技术领域，尤其涉及一种设备互联安全认证系统、方法、装置、服务器及介质。
背景技术
相较于传统的端到端设备互联，如手动配对的设备互联，新一代基于分布式技术的设备互联具有自发现、自组网、高可靠、低时延、易开发、资源共享等优势。该技术的前提条件是在基于分布式软总线的设备自组网自发现过程中，设备之间可以快速完成互联安全认证。
现有技术在进行设备互联安全认证时，发现端设备A先随机生成一个明文PIN码，展示在屏幕上，接着用户将该PIN码输入被发现端设备B，然后被发现端设备B通过分布式软总线技术将PIN码传输到发现端设备A，最后发现端设备A完成基于PIN码的互联安全认证。
现有技术通过显示明文PIN码的认证方案，仅由发现端设备和被发现端设备之间的总线完成单要素认证，安全性较低。
发明内容
本发明实施例提供了一种设备互联安全认证系统、方法、装置、服务器及介质，用以解决现有的设备互联安全认证方法安全性较低的问题。
本发明实施例提供了一种设备互联安全认证系统，所述系统包括：发现 端设备、被发现端设备、控制设备和服务器；
所述控制设备，用于获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至所述服务器；
所述被发现端设备，用于获取所述发现端设备的第一设备标识信息和配对请求时间；
所述控制设备，还用于获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至所述服务器；
所述服务器，用于分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；
所述被发现端设备，还用于将接收到的配对验证码发送至所述发现端设备；所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
进一步地，所述发现端设备，用于基于第一设备标识信息、配对请求时间和配对验证码生成第一二维码；
所述控制设备，具体用于通过扫描所述第一二维码，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
所述被发现端设备，用于基于自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间生成第二二维码；
所述控制设备，具体用于通过扫描所述第二二维码，获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
进一步地，所述控制设备，具体用于通过近场通信NFC技术，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
所述控制设备，具体用于通过NFC技术，获取所述被发现端设备的第二 设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
进一步地，所述服务器，具体用于根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
进一步地，所述发现端设备，用于采用与所述服务器协商的第一通信密钥，对第一设备标识信息、配对请求时间和配对验证码进行加密处理，并基于加密处理后的第一设备标识信息、配对请求时间和配对验证码生成第一二维码；
所述控制设备，具体用于通过扫描所述第一二维码，并基于所述第一通信密钥进行解密，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
所述被发现端设备，用于采用与所述服务器协商的第二通信密钥，对自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间进行加密处理，并基于加密处理后的第二设备标识信息、第一设备标识信息和配对请求时间生成第二二维码；
所述控制设备，具体用于通过扫描所述第二二维码，并基于所述第二通信密钥进行解密，获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
进一步地，所述服务器，具体用于采用所述第二通信密钥对确定出的所述发现端设备的配对验证码进行加密处理，将加密处理后的配对验证码发送至所述被发现端设备；
所述被发现端设备，还用于接收所述服务器发送的加密处理后的配对验证码，采用所述第二通信密钥对所述加密处理后的配对验证码进行解密处理，将解密处理后的配对验证码发送至所述发现端设备。
进一步地，所述发现端设备，还用于广播自身的第一设备标识信息和配对请求时间；
所述被发现端设备，具体用于接收并根据所述发现端设备的广播信息，获取所述发现端设备的第一设备标识信息和配对请求时间。
另一方面，本发明实施例提供了一种设备互联安全认证方法，所述方法包括：
接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
进一步地，所述分别对所述发现端设备和被发现端设备进行单设备安全认证包括：
根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
再一方面，本发明实施例提供了一种设备互联安全认证装置，所述装置包括：
第一接收模块，用于接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
第二接收模块，用于接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
发送模块，用于分别对所述发现端设备和被发现端设备进行单设备安全 认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
进一步地，所述发送模块，具体用于根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
再一方面，本发明实施例提供了一种服务器，包括处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
存储器，用于存放计算机程序；
处理器，用于执行存储器上所存放的程序时，实现上送方法步骤。
再一方面，本发明实施例提供了一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现上述方法步骤。
本发明实施例提供了一种设备互联安全认证系统、方法、装置、服务器及介质，所述系统包括：发现端设备、被发现端设备、控制设备和服务器；所述控制设备，用于获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至所述服务器；所述被发现端设备，用于获取所述发现端设备的第一设备标识信息和配对请求时间；所述控制设备，还用于获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至所述服务器；所述服务器，用于分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；所述被发现端设备，还用于将接收到的配对验证码发送至所述发 现端设备；所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
上述的技术方案具有如下优点或有益效果：
由于在本发明实施例中，控制设备获取发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至服务器，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至服务器。服务器先分别对发现端设备和被发现端设备进行单设备安全认证，单设备安全认证之后，再根据接收到的第一设备标识信息和配对请求时间，确定发现端设备的配对验证码，并根据第二设备标识信息，将配对验证码发送至被发现端设备。再由被发现端设备和发现端设备进行两设备之间的安全认证。本发明实施例认证要素分两部分，一部分在服务器进行单设备安全认证，一部分发现端设备和被发现端设备之间完成完全认证，只有通过单设备安全认证之后，再经一起完成设备互联认证。相较于现有技术仅由总线完成的单要素认证，安全性更高。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术中基于分布式的设备互联概念图；
图2为现有技术中基于分布式软总线的设备自发现流程图；
图3为现有技术中采用PIN码作为安全认证方式的验证流程图；
图4为本发明实施例提供的基于系统组件和服务器的二维码认证流程图；
图5为本发明实施例提供的设备互联安全认证系统结构示意图；
图6为本发明实施例提供的设备互联安全认证过程示意图；
图7为本发明实施例提供的发现端设备A扫码认证模块图；
图8为本发明实施例提供的软总线广播模块图；
图9为本发明实施例提供的被发现端设备B扫码认证模块图；
图10为本发明实施例提供的在金融终端操作系统基础设施平台业务架构图；
图11为本发明实施例提供的多设备进行自组网和自连接的前提是先完成设备间的信任绑定流程图；
图12为本发明实施例提供的设备互联安全认证的流程图；
图13为本发明实施例提供的设备互联安全认证框架图；
图14为本发明实施例提供的设备互联安全认证装置结构示意图；
图15为本发明实施例提供的服务器结构示意图。
具体实施方式
下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
首先结合附图对本发明实施例的背景进行详细介绍。
相较于传统的端到端设备互联，如手动配对，如图1所示基于分布式的设备互联概念图，新一代基于分布式技术的设备互联具有自发现、自组网、高可靠、低时延、易开发、资源共享等优势。
该技术的前提条件是在基于分布式软总线的设备自组网自发现过程中，设备之间可以快速完成互联安全认证。图2为基于分布式软总线的设备自发现流程图，(1)被发现端设备B发布服务；(2)发现端设备A在局域网内发送广播；(3)被发现端设备B收到广播，发送单播给发现端设备A；(4)发现端设备A收到单播，更新设备信息。
相关技术中，HarmonyOS(华为鸿蒙操作系统)采用已登录的华为账号作为设备互联安全认证方式；OpenHarmony(开源鸿蒙操作系统)采用PIN 码作为安全认证方式，在图2的自发现流程步骤(3)发生之前，发现端设备A与被发现端设备B之间完成基于PIN码的设备互联安全认证以后，才能继续进行组网和连接。图3为采用PIN码作为安全认证方式的验证流程图。如图3所示，(1)发现端设备A随机生成PIN码；(2)用户在被发现端设备B输入发现端设备A随机生成的PIN码；(3)被发现端设备B将PIN码发送至发现端设备A：(4)发现端设备A确认被发现端设备B发送的PIN码与自身生成的PIN码一致，验证通过。即设备互联安全认证过程中的第一步是设备间的信任绑定，发现端设备A先随机生成一个明文PIN码，展示在屏幕上，接着用户将该PIN码输入被发现端设备B，然后被发现端设备B通过分布式软总线技术将PIN码传输到发现端设备A，最后发现端设备A完成基于PIN码的互联安全认证。
HarmonyOS的互联安全认证的问题在于商业模式与华为公司强绑定；OpenHarmony的互联安全认证的问题在于(1)无商业模式，企业无法获取相应账号对应的数据和流量入口。(2)明文PIN码验证的安全等级低，任何设备可联。(3)第一次输入PIN码互联之后，不具备设备解绑功能。
本发明实施例考虑到上述技术问题，聚焦基于国产自主可控操作系统的各行业物联网终端设备的互联安全问题，其设备间信任绑定方式不再使用安全性不高的PIN码验证，通过开发操作系统发行版和制定相关标准，结合分布式软总线，定制化的设备互联安全系统组件以及服务器(包括企业云服务器)，在设备信任绑定过程中为设备生成安全二维码，用户通过企业APP或小程序(云闪付)扫码完成设备绑定进而完成设备互联安全认证。
图4为本发明实施例提供的基于系统组件和服务器的二维码认证流程图。如图4所示，(1)发现端设备A生成二维码，以便用户使用控制设备(如手机)扫描；(2)发现端设备A发送认证要素到被发现端设备B；(3)被发现端设备B生成二维码，二维码中包含发现端设备A发送的认证要素，以便用户使用控制设备扫描；(4)服务器分别对发现端设备A和被发现端设备B进行单设备安全认证；(5)服务器将发现端设备A的验证码下发给被发现端设 备B；(6)被发现端设备B将验证码返回给发现端设备A；(7)发现端设备A进行验证码验证通过。本发明实施例中的发现端设备A和被发现端设备B可以是手机、智能手表、微波炉、咖啡机等等。
本发明实施例提供的方案，通过APP或小程序做互联认证可以为企业引流，并获取用户数据和设备数据。安全二维码结合系统组件和服务器的方式安全性高，可做权限管理的深度定制。APP或小程序可随时解绑设备。
本发明实施例聚焦在设备互联安全中的设备间信任绑定过程，创新发明点在于：基于系统组件和服务器的密钥安全管理，实现高安全的单设备认证的同时，结合分布式软总线技术，进而实现高安全的多设备互联认证。核心思想和本质是将设备的安全认证要素进行分离，一部分走网络存入服务器，一部分走设备软总线传输，再走网络进行服务器认证，再走软总线进行设备端认证。
实施例1：
图5为本发明实施例提供的设备互联安全认证系统结构示意图，该系统包括：发现端设备11、被发现端设备12、控制设备13和服务器14；
所述控制设备13，用于获取所述发现端设备11的第一设备标识信息、配对请求时间和配对验证码，并发送至所述服务器14；
所述被发现端设备12，用于获取所述发现端设备11的第一设备标识信息和配对请求时间；
所述控制设备13，还用于获取所述被发现端设备12的第二设备标识信息，以及所述被发现端设备12获取到的第一设备标识信息和配对请求时间，并发送至所述服务器14；
所述服务器14，用于分别对所述发现端设备11和被发现端设备12进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备11的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备12；
所述被发现端设备12，还用于将接收到的配对验证码发送至所述发现端 设备11；所述发现端设备11根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
如图5所示，设备互联安全认证系统包括：发现端设备11、被发现端设备12、控制设备13和服务器14，其中，发现端设备11和被发现端设备12位于同一局域网内，发现端设备11和被发现端设备12通过分布式软总线连接。控制设备13通过二维码扫描的方式获取发现端设备11和被发现端设备12的认证要素，或者通过近场通信NFC技术，获取发现端设备11和被发现端设备12的认证要素。发现端设备11、被发现端设备12、控制设备分别与服务器通过网络连接。控制设备13一般是智能手机。
对于具有屏幕显示功能的发现端设备11，控制设备获取发现端设备的第一设备标识信息、配对请求时间和配对验证码的过程包括：发现端设备基于第一设备标识信息、配对请求时间和配对验证码生成第一二维码；控制设备通过扫描所述第一二维码，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码。对于具有屏幕显示功能的被发现端设备12，控制设备获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间的过程包括：被发现端设备基于自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间生成第二二维码；控制设备通过扫描所述第二二维码，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间。
为了进一步提高设备互联认证的安全性，在本发明实施例中，发现端设备，用于采用与服务器协商的第一通信密钥，对第一设备标识信息、配对请求时间和配对验证码进行加密处理，并基于加密处理后的第一设备标识信息、配对请求时间和配对验证码生成第一二维码；
控制设备，具体用于通过扫描所述第一二维码，并基于第一通信密钥进行解密，获取发现端设备的第一设备标识信息、配对请求时间和配对验证码；
被发现端设备，用于采用与服务器协商的第二通信密钥，对自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间进行加密处 理，并基于加密处理后的第二设备标识信息、第一设备标识信息和配对请求时间生成第二二维码；
控制设备，具体用于通过扫描所述第二二维码，并基于第二通信密钥进行解密，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间。
对于不具有屏幕显示功能的发现端设备11，控制设备通过近场通信NFC技术，获取发现端设备的第一设备标识信息、配对请求时间和配对验证码。对于不具有屏幕显示功能的被发现端设备12，控制设备通过NFC技术，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间。
需要说明的是，对于具有屏幕显示功能的发现端设备11，控制设备也可以通过近场通信NFC技术，获取发现端设备的第一设备标识信息、配对请求时间和配对验证码。对于具有屏幕显示功能的被发现端设备12，控制设备也可以通过NFC技术，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间。
被发现端设备获取发现端设备的第一设备标识信息和配对请求时间的过程包括：发现端设备在局域网内广播自身的第一设备标识信息和配对请求时间；被发现端设备接收并根据发现端设备的广播信息，获取发现端设备的第一设备标识信息和配对请求时间。
服务器分别对发现端设备和被发现端设备进行单设备安全认证。具体的，服务器根据与发现端设备协商的第一公私钥对，对发现端设备进行单设备安全认证；根据与被发现端设备协商的第二公私钥对，对被发现端设备进行单设备安全认证。
服务器与发现端设备协商的第一公私钥对，发现端设备根据第一公私钥对中的私钥对向服务器发送的数据添加数字签名，服务器根据第一公私钥对中的公钥对数字签名进行验签，如果验签通过，确定对发现端设备进行单设备安全认证完成。服务器与被发现端设备协商的第二公私钥对，被发现端设 备根据第二公私钥对中的私钥对向服务器发送的数据添加数字签名，服务器根据第二公私钥对中的公钥对数字签名进行验签，如果验签通过，确定对被发现端设备进行单设备安全认证完成。
服务器分别对发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的第一设备标识信息和配对请求时间，确定发现端设备的与第一设备标识信息和配对请求时间对应的配对验证码，并根据第二设备标识信息，将配对验证码发送至被发现端设备。被发现端设备将接收到的配对验证码发送至发现端设备，发现端设备判断自身的配对验证码和接收到的配对验证码是否一致，如果一致，发现端设备和被发现端设备的安全认证完成，如果不一致，发现端设备和被发现端设备的安全认证失败。
为了进一步提高设备互联认证的安全性，服务器，具体用于采用第二通信密钥对确定出的发现端设备的配对验证码进行加密处理，将加密处理后的配对验证码发送至被发现端设备；被发现端设备，还用于接收所述服务器发送的加密处理后的配对验证码，采用第二通信密钥对加密处理后的配对验证码进行解密处理，将解密处理后的配对验证码发送至发现端设备。
由于在本发明实施例中，控制设备获取发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至服务器，获取被发现端设备的第二设备标识信息，以及被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至服务器。服务器先分别对发现端设备和被发现端设备进行单设备安全认证，单设备安全认证之后，再根据接收到的第一设备标识信息和配对请求时间，确定发现端设备的配对验证码，并根据第二设备标识信息，将配对验证码发送至被发现端设备。再由被发现端设备和发现端设备进行两设备之间的安全认证。本发明实施例认证要素分两部分，一部分在服务器进行单设备安全认证，一部分发现端设备和被发现端设备之间完成完全认证，只有通过单设备安全认证之后，再经一起完成设备互联认证。相较于现有技术仅由总线完成的单要素认证，安全性更高。
实施例2：
图6为本发明实施例提供的设备互联安全认证过程示意图，该过程包括：
S101：接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码。
S102：接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
S103：分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
所述分别对所述发现端设备和被发现端设备进行单设备安全认证包括：
根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
本发明实施例提供的设备互联安全认证方法应用于设备互联安全认证系统中的服务器。
下面结合附图对本发明实施例提供的设备互联安全认证过程进行详细说明。
1、设备初始化过程中设备(包括发现端设备和被发现端设备)与服务器协商通信密钥和设备公私钥对。
设备出厂第一次启动后，经用户授权，将设备信息同步给服务器(与下文的企业云含义相同)绑定，服务器与设备端协商密钥，服务器保存设备标识信息、通信密钥、设备公钥，设备端保存设备标识信息、通信密钥、设备私钥，这些密钥将在以下步骤2中用户设备认证和数据通信。
2、设备安全互联过程中的设备间信任绑定过程。
1)发现端设备A生成安全二维码，APP/小程序扫码认证单设备A。
图7为本发明实施例提供的发现端设备A扫码认证模块图。发现端设备A由通信密钥加密生成安全二维码，该二维码由服务器Uri(统一资源标识符)、设备唯一识别码、配对请求设备名(首先发起配对请求的设备的设备名)、配对请求时间、以及配对验证码(发起配对请求的设备根据一定规则生成的验证码，用于设备信任绑定的最终验证，一定规则可以是随机，或者一定的算法规则)而最终生成。通过APP/小程序扫码，结合设备公私钥在服务器完成发现端设备A的单设备认证，服务器保存设备请求设备名、配对请求时间和配对验证码，相关数据由通信密钥解密。
2)软总线广播配对信息。
图8为本发明实施例提供的软总线广播模块图。发现端设备A向软总线广播自己的配对请求设备名和配对请求时间，位于同一局域网中的所有设备(设备B、设备C等)自动接收该消息。
3)被发现端设备B生成安全二维码，APP/小程序扫码认证单设备B。
图9为本发明实施例提供的被发现端设备B扫码认证模块图。被发现端设备B由通信密钥加密生成安全二维码，该二维码由企业云Uri、设备唯一识别码、配对请求设备名(由步骤2获取)、配对请求时间(由步骤2获取)而最终生成。通过APP/小程序扫码，结合设备公私钥在企业云完成被发现端设备B的单设备认证。
4)企业云完成发现端设备A和被发现端设备B互联认证并下发配对验证码。
企业云认证被发现端设备B以后，根据配对请求设备名和配对请求时间，在数据库中找到发现端设备A对应的配对验证码，从而在企业云完成发现端设备A和被发现端设备B的互联认证。随后，企业云向被发现端设备B下发配对验证码密文，数据由通信密钥加密。
5)软总线上返回配对验证码在设备端完成设备互联认证。
被发现端设备B收到配对验证码，在软总线上将其返回发现端设备A，发现端设备A完成验证码验证后，由软总线通知被发现端设备B，最终完成 设备端的互联安全认证。
下面结合具体示例对本发明实施例提供的设备互联安全认证过程进行说明。
图10为本发明实施例提供的在金融终端操作系统基础设施平台业务架构图，通过金融终端设备中的金融支付组件(或安全组件)，以及银联云TSM中台的建设，实现本专利提案中有关设备安全互联的方案。
图11为本发明实施例提供的多设备进行自组网和自连接的前提是先完成设备间的信任绑定流程图。0、受理终端和IOT设备生成设备标识和设备密钥；1、设备间配对，包括NFC、蓝牙、扫码等方式的配对；2、受理终端进行验证码校验；3、受理终端生成会话密钥；4、加密会话密钥发往对端的IOT设备；5、IOT设备解密会话密钥并保存；6、IOT设备向受理终端应答会话密钥协商完成；7、会话密钥加密受理终端设备公钥发往对端的IOT设备；8、IOT设备会话密钥解密设备公钥并保存；9、会话密钥加密IOT设备公钥发往对端的受理终端；10、受理终端会话密钥解密设备公钥并保存。
图12为本发明实施例提供的设备互联安全认证的流程图，图13为本发明实施例提供的设备互联安全认证框架图，发现端设备A生成二维码，通过软总线发送广播，手机APP/小程序扫码并解析，上送发现端设备A信息至企业云，企业云对发现端设备A认证通过并保存发现端设备A信息。被发现端设备B接收发现端设备A广播的信息，生成二维码，手机APP/小程序扫码并解析，上送被发现端设备B信息至企业云，企业云对被发现端设备B认证通过并查询配对验证码，下发配对验证码至被发现端设备B。被发现端设备B由软总线向发现端设备A返回配对验证码。发现端设备A验证通过，结束。其中二维码方式可由NFC(近场通信(Near Field Communication，简称NFC))或蓝牙替代。
实施例3：
图14为本发明实施例提供的设备互联安全认证装置结构示意图，该装置包括：
第一接收模块141，用于接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
第二接收模块142，用于接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
发送模块143，用于分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
所述发送模块143，具体用于根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
实施例4：
在上述各实施例的基础上，本发明实施例中还提供了一种服务器，如图15所示，包括：处理器301、通信接口302、存储器303和通信总线304，其中，处理器301，通信接口302，存储器303通过通信总线304完成相互间的通信；
所述存储器303中存储有计算机程序，当所述程序被所述处理器301执行时，使得所述处理器301执行如下步骤：
接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配 对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
基于同一发明构思，本发明实施例中还提供了一种服务器，由于上述服务器解决问题的原理与设备互联安全认证方法相似，因此上述服务器的实施可以参见方法的实施，重复之处不再赘述。
服务器提到的通信总线可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
通信接口302用于上述服务器与其他设备之间的通信。
存储器可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。可选地，存储器还可以是至少一个位于远离前述处理器的存储装置。
上述处理器可以是通用处理器，包括中央处理器、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(Digital Signal Processing，DSP)、专用集成电路、现场可编程门陈列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。
实施例5：
在上述各实施例的基础上，本发明实施例还提供了一种计算机存储可读存储介质，所述计算机可读存储介质内存储有可由服务器执行的计算机程序，当所述程序在所述服务器上运行时，使得所述服务器执行时实现如下步骤：
接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所 述被发现端设备获取到的第一设备标识信息和配对请求时间；
分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
基于同一发明构思，本发明实施例中还提供了一种计算机可读存储介质，由于处理器在执行上述计算机可读存储介质上存储的计算机程序时解决问题的原理与设备互联安全认证方法相似，因此处理器在执行上述计算机可读存储介质存储的计算机程序的实施可以参见方法的实施，重复之处不再赘述。
上述计算机可读存储介质可以是服务器中的处理器能够存取的任何可用介质或数据存储设备，包括但不限于磁性存储器如软盘、硬盘、磁带、磁光盘(MO)等、光学存储器如CD、DVD、BD、HVD等、以及半导体存储器如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD)等。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或 多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (13)

  1. 一种设备互联安全认证系统，所述系统包括：发现端设备、被发现端设备、控制设备和服务器；
    所述控制设备，用于获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码，并发送至所述服务器；
    所述被发现端设备，用于获取所述发现端设备的第一设备标识信息和配对请求时间；
    所述控制设备，还用于获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间，并发送至所述服务器；
    所述服务器，用于分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；
    所述被发现端设备，还用于将接收到的配对验证码发送至所述发现端设备；所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
  2. 如权利要求1所述的系统，其中，所述发现端设备，用于基于第一设备标识信息、配对请求时间和配对验证码生成第一二维码；
    所述控制设备，具体用于通过扫描所述第一二维码，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
    所述被发现端设备，用于基于自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间生成第二二维码；
    所述控制设备，具体用于通过扫描所述第二二维码，获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
  3. 如权利要求1所述的系统，其中，所述控制设备，具体用于通过近场通信NFC技术，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
    所述控制设备，具体用于通过NFC技术，获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
  4. 如权利要求1所述的系统，其中，所述服务器，具体用于根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
  5. 如权利要求2所述的系统，其中，所述发现端设备，用于采用与所述服务器协商的第一通信密钥，对第一设备标识信息、配对请求时间和配对验证码进行加密处理，并基于加密处理后的第一设备标识信息、配对请求时间和配对验证码生成第一二维码；
    所述控制设备，具体用于通过扫描所述第一二维码，并基于所述第一通信密钥进行解密，获取所述发现端设备的第一设备标识信息、配对请求时间和配对验证码；
    所述被发现端设备，用于采用与所述服务器协商的第二通信密钥，对自身的第二设备标识信息，以及获取到的第一设备标识信息和配对请求时间进行加密处理，并基于加密处理后的第二设备标识信息、第一设备标识信息和配对请求时间生成第二二维码；
    所述控制设备，具体用于通过扫描所述第二二维码，并基于所述第二通信密钥进行解密，获取所述被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间。
  6. 如权利要求5所述的系统，其中，所述服务器，具体用于采用所述第二通信密钥对确定出的所述发现端设备的配对验证码进行加密处理，将加密处理后的配对验证码发送至所述被发现端设备；
    所述被发现端设备，还用于接收所述服务器发送的加密处理后的配对验证码，采用所述第二通信密钥对所述加密处理后的配对验证码进行解密处理，将解密处理后的配对验证码发送至所述发现端设备。
  7. 如权利要求1所述的系统，所述发现端设备，还用于广播自身的第一设备标识信息和配对请求时间；
    所述被发现端设备，具体用于接收并根据所述发现端设备的广播信息，获取所述发现端设备的第一设备标识信息和配对请求时间。
  8. 一种设备互联安全认证方法，所述方法包括：
    接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
    接收控制设备获取并发送的被发现端设备的第二设备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
    分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
  9. 如权利要求8所述的方法，其中，所述分别对所述发现端设备和被发现端设备进行单设备安全认证包括：
    根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
  10. 一种设备互联安全认证装置，所述装置包括：
    第一接收模块，用于接收控制设备获取并发送的发现端设备的第一设备标识信息、配对请求时间和配对验证码；
    第二接收模块，用于接收控制设备获取并发送的被发现端设备的第二设 备标识信息，以及所述被发现端设备获取到的第一设备标识信息和配对请求时间；
    发送模块，用于分别对所述发现端设备和被发现端设备进行单设备安全认证之后，根据接收到的所述第一设备标识信息和配对请求时间，确定所述发现端设备的配对验证码，并根据所述第二设备标识信息，将所述配对验证码发送至所述被发现端设备；使所述被发现端设备将接收到的配对验证码发送至所述发现端设备；使所述发现端设备根据自身的配对验证码和接收到的配对验证码进行所述发现端设备和所述被发现端设备的安全认证。
  11. 如权利要求10所述的装置，其中，所述发送模块，具体用于根据与所述发现端设备协商的第一公私钥对，对所述发现端设备进行单设备安全认证；根据与所述被发现端设备协商的第二公私钥对，对所述被发现端设备进行单设备安全认证。
  12. 一种服务器，包括处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
    存储器，用于存放计算机程序；
    处理器，用于执行存储器上所存放的程序时，实现权利要求8或9所述的方法步骤。
  13. 一种计算机可读存储介质，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求8或9所述的方法步骤。
PCT/CN2022/137359 2022-04-25 2022-12-07 一种设备互联安全认证系统、方法、装置、服务器及介质 WO2023207113A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210444433.0A CN114866251B (zh) 2022-04-25 2022-04-25 一种设备互联安全认证系统、方法、装置、服务器及介质
CN202210444433.0 2022-04-25

Publications (1)

Publication Number Publication Date
WO2023207113A1 true WO2023207113A1 (zh) 2023-11-02

Family

ID=82634004

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137359 WO2023207113A1 (zh) 2022-04-25 2022-12-07 一种设备互联安全认证系统、方法、装置、服务器及介质

Country Status (2)

Country Link
CN (1) CN114866251B (zh)
WO (1) WO2023207113A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114866251B (zh) * 2022-04-25 2023-07-07 中国银联股份有限公司 一种设备互联安全认证系统、方法、装置、服务器及介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104378145A (zh) * 2014-11-27 2015-02-25 北京深思数盾科技有限公司 蓝牙设备的配对方法及系统
US20160021485A1 (en) * 2014-07-15 2016-01-21 Comcast Cable Communications, Llc Systems And Methods For Managing Network Devices
CN109040013A (zh) * 2018-06-20 2018-12-18 联想(北京)有限公司 智能耳机的认证方法及装置
CN112669585A (zh) * 2020-12-15 2021-04-16 广州极飞科技有限公司 用于设备配对的方法、处理器、移动终端及服务器
CN113301543A (zh) * 2020-02-21 2021-08-24 华为技术有限公司 一种发现及配网的方法、电子设备和系统
CN114866251A (zh) * 2022-04-25 2022-08-05 中国银联股份有限公司 一种设备互联安全认证系统、方法、装置、服务器及介质

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8220032B2 (en) * 2008-01-29 2012-07-10 International Business Machines Corporation Methods, devices, and computer program products for discovering authentication servers and establishing trust relationships therewith
JP5521736B2 (ja) * 2010-04-23 2014-06-18 富士ゼロックス株式会社 通信制御装置、通信制御プログラム及び通信制御システム
US10666642B2 (en) * 2016-02-26 2020-05-26 Ca, Inc. System and method for service assisted mobile pairing of password-less computer login
CN107113315B (zh) * 2016-04-15 2020-11-13 深圳前海达闼云端智能科技有限公司 一种身份认证方法、终端及服务器
CN107566314B (zh) * 2016-06-30 2021-05-14 斑马智行网络(香港)有限公司 一种数据传输系统、方法和设备
JP2018148463A (ja) * 2017-03-07 2018-09-20 株式会社Ｎｔｔドコモ 認証システム、認証情報生成装置、被認証装置及び認証装置
CN107733852B (zh) * 2017-08-24 2019-06-21 北京三快在线科技有限公司 一种身份验证方法及装置，电子设备
CN107835509B (zh) * 2017-10-18 2020-09-22 广州视睿电子科技有限公司 一种设备间互连的方法、装置、系统、设备和存储介质
CN109729046B (zh) * 2017-10-31 2022-04-26 北京京东尚科信息技术有限公司 二维码扫描方法和终端、认证方法和服务器及服务系统
CN108471610B (zh) * 2018-03-02 2021-02-02 杨宪国 蓝牙连接控制系统
CN110636062B (zh) * 2019-09-20 2022-02-08 百度在线网络技术（北京）有限公司 设备的安全交互控制方法、装置、电子设备及存储介质
US11516256B2 (en) * 2020-05-20 2022-11-29 Dell Products L.P. Certificate authorization policy for security protocol and data model capable devices
CN111783068B (zh) * 2020-06-03 2024-05-07 中移（杭州）信息技术有限公司 设备认证方法、系统、电子设备及存储介质
CN112637145B (zh) * 2020-12-08 2023-04-28 北京北信源软件股份有限公司 一种网络设备互联认证方法及系统
CN113746633B (zh) * 2021-08-05 2023-10-17 深圳Tcl新技术有限公司 物联网设备绑定方法、装置、系统、云服务器和存储介质
CN114390488A (zh) * 2022-01-12 2022-04-22 福州汇思博信息技术有限公司 一种实现设备快速互联的方法与系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160021485A1 (en) * 2014-07-15 2016-01-21 Comcast Cable Communications, Llc Systems And Methods For Managing Network Devices
CN104378145A (zh) * 2014-11-27 2015-02-25 北京深思数盾科技有限公司 蓝牙设备的配对方法及系统
CN109040013A (zh) * 2018-06-20 2018-12-18 联想(北京)有限公司 智能耳机的认证方法及装置
CN113301543A (zh) * 2020-02-21 2021-08-24 华为技术有限公司 一种发现及配网的方法、电子设备和系统
CN112669585A (zh) * 2020-12-15 2021-04-16 广州极飞科技有限公司 用于设备配对的方法、处理器、移动终端及服务器
CN114866251A (zh) * 2022-04-25 2022-08-05 中国银联股份有限公司 一种设备互联安全认证系统、方法、装置、服务器及介质

Also Published As

Publication number Publication date
CN114866251B (zh) 2023-07-07
CN114866251A (zh) 2022-08-05
TW202344006A (zh) 2023-11-01

Similar Documents

Publication Publication Date Title
CN102595404B (zh) 用于存储和执行访问控制客户端的方法及装置
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
JP5650230B2 (ja) 低レイテンシーのピア・セッション確立
US9887838B2 (en) Method and device for secure communications over a network using a hardware security engine
AU2011309758B2 (en) Mobile handset identification and communication authentication
US11134069B2 (en) Method for authorizing access and apparatus using the method
US9166975B2 (en) System and method for secure remote access to a service on a server computer
US11736304B2 (en) Secure authentication of remote equipment
WO2020140931A1 (zh) 区块链的访问控制方法和装置以及电子设备
CN105099673A (zh) 一种授权方法、请求授权的方法及装置
WO2015180589A1 (zh) 终端设备的登录方法、终端设备和云端服务器
US9137224B2 (en) System and method for secure remote access
WO2015180689A1 (zh) 验证信息的获取方法及装置
WO2023241176A1 (zh) 通信方法、装置、设备、存储介质及程序产品
WO2023030009A1 (zh) 智能设备的跨平台绑定方法、系统及相关设备
CN111949958B (zh) Oauth协议中的授权认证方法及装置
WO2023231774A1 (zh) 用于tlcp协议的握手过程的身份验证方法
WO2023207113A1 (zh) 一种设备互联安全认证系统、方法、装置、服务器及介质
US11870760B2 (en) Secure virtual personalized network
WO2023082894A1 (zh) 一种终端侧设备与网络侧设备之间的认证方法、系统
US20230052917A1 (en) Pairing method applied to short-range communication system and wireless device
US10834063B2 (en) Facilitating provisioning of an out-of-band pseudonym over a secure communication channel
TWI835491B (zh) 一種設備互聯安全認證系統、方法、裝置、伺服器及介質
CN114549206A (zh) 一种交易抗抵赖的方法、系统、电子设备及可读存储介质
CN113535852A (zh) 基于区块链的文件处理方法、文件访问方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22939927

Country of ref document: EP

Kind code of ref document: A1