WO2024031868A1

WO2024031868A1 - Attribute encryption-based device security authentication method and related apparatus thereof

Info

Publication number: WO2024031868A1
Application number: PCT/CN2022/133389
Authority: WO
Inventors: 赵奕捷; 成国强; 杨立扬
Original assignee: 天翼数字生活科技有限公司
Priority date: 2022-08-12
Filing date: 2022-11-22
Publication date: 2024-02-15
Also published as: CN115348076A; CN115348076B

Abstract

The present application discloses an attribute encryption-based device security authentication method and a related apparatus thereof. A terminal device encrypting a generated symmetric key and a generated random number by means of an attribute identification (ID) public key of an authentication server to obtain first encrypted information, and then sending a registration authentication request to the authentication server for authentication; decrypting, by means of the symmetric key, second encrypted information returned by the authentication server to obtain an attribute encryption ID private key and a random number, wherein the attribute encryption ID private key is generated by the authentication server according to attribute information of the terminal device, and the attribute information comprises position information, user information of a user bound with the terminal device, and a device factory ID; and verifying the legitimacy of an authentication server by means of random numbers, and after the authentication server is verified to be legitimate, storing an attribute encryption ID private key, such that the technical problem in the prior art that device security is affected due to the fact that device factory IDs are used as device keys for information encryption and transmission and then batched device keys are likely to be leaked due to leakage of manufacturer information is mitigated.

Description

A device security authentication method based on attribute encryption and related devices

Technical field

The present application relates to the field of network security technology, and in particular to a device security authentication method and related devices based on attribute encryption.

Background technique

In order to improve the security of information transmission, public and private key pairs are usually set for encrypted information transmission. Existing technologies mostly use the device factory ID as the device key for encrypted information transmission, which can easily lead to leakage of batch device keys due to leakage of manufacturer information and other reasons, thus leading to device security issues.

Contents of the invention

This application provides a device security authentication method and related devices based on attribute encryption, which is used to improve the existing technology of using the device factory ID as the device key for encrypted information transmission. It is easy to leak manufacturer information, resulting in batch device keys. Leakage, thus affecting technical issues of equipment security.

In view of this, the first aspect of this application provides a device security authentication method based on attribute encryption, which is applied to terminal devices. The method includes:

When accessing the authentication server in the blockchain for registration, initialize and generate a symmetric key and a random number, and encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the first encrypted information;

Send a registration authentication request carrying the first encryption information and the device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification;

Receive the second encrypted information returned by the authentication server after successful authentication, and decrypt the second encrypted information using the symmetric key to obtain the attribute encryption identification private key and a random number; wherein the attribute encryption identification private key is obtained by The authentication server is generated based on the attribute information of the terminal device. The attribute information includes location information, user information of the user bound to the terminal device and the device factory identification; the second encrypted information is generated by the authentication server. The symmetric key obtained by decrypting the first encrypted information with its own attribute identification private key is obtained by encrypting the attribute encryption identification private key and the decrypted random number;

The legitimacy of the authentication server is verified through the random number generated by itself and the random number decrypted. After verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.

Optionally, the terminal device is preset with the address of the authentication server when it leaves the factory, and the method further includes:

After binding the user, the terminal device sends attribute information to the authentication server according to the address of the authentication server.

Optionally, the acquisition process of the location information of the terminal device is:

When the terminal device accesses the blockchain, it calculates the location coordinates of the terminal device based on its relative position to the target node in the blockchain and the location coordinates of the target node to obtain the location information of the terminal device. .

Optionally, verifying the legitimacy of the authentication server by using the random number generated by itself and the decrypted random number includes:

Compare whether the random number generated by itself and the random number decrypted are the same;

If they are the same, verify that the authentication server is legal;

If they are not the same, it is verified that the authentication server is illegal.

The second aspect of this application provides a device security authentication method based on attribute encryption, which is applied to the authentication server. The method includes:

Receive the registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory identification carried in the registration authentication request, and decrypt the first encrypted information carried in the registration authentication request through its own attribute identification private key. Obtain the symmetric key and random number; the first encrypted information is encrypted and generated by the symmetric key and random number generated by the terminal device through the attribute identification public key pair of the authentication server;

After the authentication is successful, the attribute encryption identification private key of the terminal device is generated according to the attribute information of the terminal device, and the attribute encryption identification private key and the decrypted random number are encrypted with the decrypted symmetric key to obtain second encrypted information, the attribute information includes location information, user information of the user bound to the terminal device and the device factory identification;

Send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and a random number, and compares it with the symmetric key generated by itself. The random number and the decrypted random number verify the legitimacy of the authentication server, and after verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.

Optionally, generating an attribute encryption identification private key of the terminal device according to the attribute information of the terminal device includes:

Assign a device identification to the terminal device according to the attribute information of the terminal device;

Generate an attribute encryption identification private key of the terminal device according to the device identification of the terminal device.

The third aspect of this application provides a terminal device, including:

The initialization unit is used to initialize and generate a symmetric key and a random number when accessing the authentication server in the blockchain for registration, and to encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the third - encrypted information;

A sending unit configured to send a registration authentication request carrying the first encryption information and a device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification;

A receiving unit, configured to receive the second encrypted information returned by the authentication server after successful authentication, and to decrypt the second encrypted information using the symmetric key to obtain the attribute encryption identification private key and a random number; wherein, the attribute encryption The identification private key is generated by the authentication server based on the attribute information of the terminal device. The attribute information includes location information, user information of the user bound to the terminal device and the device factory identification; the second encrypted information The symmetric key obtained by the authentication server decrypting the first encrypted information using its own attribute identification private key is obtained by encrypting the attribute encryption identification private key and the decrypted random number;

The verification unit is configured to verify the legitimacy of the authentication server by comparing the random number generated by itself with the decrypted random number, and after verifying that the authentication server is legal, save the attribute encryption identification private key.

The fourth aspect of this application provides an authentication server, including:

The receiving unit is configured to receive the registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory identification carried in the registration authentication request, and authenticate the third ID carried in the registration authentication request through its own attribute identification private key. Decrypt an encrypted information to obtain a symmetric key and a random number; the first encrypted information is generated by encrypting the symmetric key and random number generated by the terminal device through the attribute identification public key of the authentication server;

An encryption unit, configured to generate an attribute encryption identification private key of the terminal device according to the attribute information of the terminal device after successful authentication, and use the decrypted symmetric key to combine the attribute encryption identification private key and the decrypted symmetric key. The random number is encrypted to obtain the second encrypted information, and the attribute information includes location information, user information of the user bound to the terminal device, and the device factory identification;

a sending unit, configured to send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and a random number, The legitimacy of the authentication server is verified through the random number generated by itself and the random number decrypted, and after verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.

A fifth aspect of this application provides a device security authentication system based on attribute encryption, including: the terminal device described in the third aspect and the authentication server described in the fourth aspect.

The sixth aspect of this application provides a device security authentication device based on attribute encryption, where the device includes a processor and a memory;

The memory is used to store program code and transmit the program code to the processor;

The processor is configured to execute any one of the attribute encryption-based device security authentication methods described in the first aspect according to the instructions in the program code, or to execute any one of the attribute encryption-based device security authentication methods described in the second aspect. method.

It can be seen from the above technical solutions that this application has the following advantages:

This application provides a device security authentication method based on attribute encryption, which is applied to terminal equipment. The method includes: when accessing the authentication server in the blockchain for registration, initializing the generation of symmetric keys and random numbers, and passing the authentication server The attribute identification public key encrypts the symmetric key and the random number to obtain the first encrypted information; sends a registration authentication request carrying the first encrypted information and the device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification; Receive the second encrypted information returned by the authentication server after successful authentication, and decrypt the second encrypted information through the symmetric key to obtain the attribute encryption identification private key and the random number; wherein the attribute encryption identification private key is generated by the authentication server based on the attribute information of the terminal device. , the attribute information includes location information, user information of the user bound to the terminal device, and device factory identification; the second encrypted information is encrypted by a symmetric key obtained by the authentication server decrypting the first encrypted information through its own attribute identification private key. The identity private key and the decrypted random number are encrypted; the legitimacy of the authentication server is verified through the random number generated by itself and the decrypted random number. After verifying that the authentication server is legitimate, the attribute encryption identity private key is saved.

In this application, the location information of the terminal device, the user information of the user bound to the terminal device, and the device factory identification are used to generate the private key of the terminal device, which can avoid the leakage of the manufacturer's burning of devices with the same ID or the leakage of production list information. This leads to the leakage of device encryption information, thereby improving device security; moreover, the terminal device uses the attribute identification public key encryption information of the authentication server to obtain the first encrypted information. Only the legitimate server (possessing the attribute identification private key of the authentication server) can Decrypt the first encrypted information to obtain the symmetric key and random number, so when the authentication server uses the symmetric secret key to encrypt the random number and send it to the terminal device, the terminal device can verify the authenticity of the authentication server by decrypting the random number; at the same time, because only legitimate Only the authentication server can decrypt the symmetric key, and it is safe to use the symmetric key to encrypt and distribute the attribute encryption identification private key, thus improving the existing technology of using the device factory ID as the device key for encrypted information transmission, which is easy because The leakage of manufacturer information leads to the leakage of batch device keys, thus affecting the technical issues of device security.

Description of drawings

In order to explain the embodiments of the present application or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting any creative effort.

Figure 1 is a schematic flow chart of a device security authentication method based on attribute encryption applied to terminal devices provided by an embodiment of the present application;

Figure 2 is a schematic diagram of the position relationship of a terminal device provided by an embodiment of the present application;

Figure 3 is another schematic flowchart of a device security authentication method based on attribute encryption applied to an authentication server provided by an embodiment of the present application;

Figure 4 is a schematic structural diagram of a terminal device provided by an embodiment of the present application;

Figure 5 is a schematic structural diagram of an authentication server provided by an embodiment of the present application.

Detailed ways

In order to enable those in the technical field to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only These are part of the embodiments of this application, but not all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

For ease of understanding, please refer to Figure 1. This embodiment of the present application provides a device security authentication method based on attribute encryption, which is applied to terminal devices. The method includes:

Step 101: When accessing the authentication server in the blockchain for registration, initially generate a symmetric key and a random number, and encrypt the symmetric key and the random number to obtain the first encrypted information.

When a terminal device (can be a camera, etc.) is connected to the authentication server in the blockchain for registration, the terminal device is initialized, randomly generates a symmetric key and a random number, and can use the attribute identification public key of the authentication server to encrypt the symmetric The key and random number are used to obtain the first encrypted information.

When the terminal device leaves the factory, the address of the authentication server can be preset for direct network registration, which is suitable for large-scale distribution of IoT device networks. When the terminal device registers with the network and binds the user to the network, it can send its own attribute information to the authentication server according to the address of the authentication server. The attribute information can include location information and user information of the user bound to the terminal device (such as the user's mobile phone number). , ID number, registered account, etc.) and device factory identification (such as device factory ID).

When a terminal device is connected to the blockchain, it can calculate the position coordinates of the terminal device through the relative position of the fixed node in the blockchain and the position coordinates of the fixed node, and obtain the position information (X, Y, Z) of the terminal device. . Referring to Figure 2, the terminal device is a newly connected blockchain device node. According to the relative position L1 of the newly connected blockchain device node and the blockchain fixed node server 1, and the relative position L1 of the blockchain fixed node server 2 The relative position L2, the relative position L3 to the blockchain fixed node server 3, the position coordinates (X1, Y1, Z1) of the blockchain fixed node server 1, the position coordinates (X2, Y2, Z2), the position coordinates (X3, Y3, Z3) of the blockchain fixed node server 3 can establish the following relationship:

L1 ² = (X1-X) ² + (Y1-Y) ² + (Z1-Z) ² ;

L2 ² =(X2-X) ² +(Y2-Y) ² +(Z2-Z) ² ;

L3 ² = (X3-X) ² + (Y3-Y) ² + (Z3-Z) ² ;

By solving the above relationship, the position coordinates (X, Y, Z) of the newly connected blockchain device node can be calculated, thereby obtaining the position information of the terminal device.

Step 102: Send a registration authentication request carrying the first encryption information and the device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification.

After the terminal device connects to the authentication server, it sends a registration authentication request carrying the first encryption information and the device factory identification to the authentication server. The authentication server authenticates the terminal device through the device factory identification, verifies the legality of the device, and identifies it through its own attributes. The private key decrypts the first encrypted information to obtain the symmetric key and random number; after the authentication server verifies that the device is legal, that is, after the authentication is successful, the authentication server generates the attribute encryption identification private key of the terminal device based on the attribute information of the terminal device, and then decrypts it to obtain The symmetric key encrypts the attribute encryption identification private key of the terminal device and the decrypted random number to obtain the second encrypted information, and then returns the second encrypted information to the terminal device.

Among them, the process of generating the attribute encryption identification private key of the terminal device according to the attribute information of the terminal device can be:

Allocate a device identification to the terminal device according to the attribute information of the terminal device; generate an attribute encryption identification private key of the terminal device according to the device identification of the terminal device.

The authentication server can combine the location information, user information and device factory identification to generate the device identification of the terminal device. For example, the location information, user information and device factory identification are directly concatenated as the device identification of the terminal device. The authentication server can use the SM9 algorithm according to The device identification of the terminal device generates the attribute encryption identification private key of the terminal device, and can also generate the attribute encryption identification public key of the terminal device. The attribute encryption identification public key is stored in the authentication server, and the attribute encryption private key needs to be stored in the terminal device. After the authentication, information is encrypted and transmitted through the attribute encryption identification public key and the attribute encryption identification private key. It can be understood that the attribute identification private key and attribute identification public key of the authentication server can also be generated based on the attribute information (location information, authentication server identification, etc.) of the authentication server through the SM9 algorithm.

In the embodiment of this application, the location information of the terminal device, the user information of the bound user, and the device factory identification are combined in the blockchain as the attribute encryption identification public key of the terminal device to perform security authentication of the device in the blockchain. Utilize the terminal device's location information, user information, and device factory identification and other device attribute information as the device's public and private keys to uniquely identify the terminal device, thereby avoiding device encryption information caused by manufacturers burning devices with the same ID or leaking production list information. Leakage problem; Moreover, when the terminal device changes the binding user or the device location is transferred, the attribute information of the terminal device is updated, and the public and private keys of the corresponding terminal device will also change, thus avoiding information leakage and confusion. The same terminal device changes the binding After the user is logged in, because the user information has changed, the public and private keys corresponding to the terminal device have also changed. The subsequent binding user of the same terminal device will not know the public and private key information corresponding to the previous binding user, which improves the security of the terminal device. sex.

Step 103: Receive the second encrypted information returned by the authentication server after successful authentication, and decrypt the second encrypted information using the symmetric key to obtain the attribute encryption identification private key and random number.

After receiving the second encrypted information returned by the authentication server, the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and random number.

Step 104: Verify the legitimacy of the authentication server by comparing the random number generated by itself with the random number decrypted. After verifying that the authentication server is legitimate, save the attribute encryption identification private key.

The terminal device verifies the legitimacy of the authentication server by comparing the random number generated by itself with the random number decrypted in the above steps. If the terminal device compares the random number generated by itself with the random number decrypted, it verifies the authentication. The server is legitimate. If the random number generated by itself is compared with the random number obtained by decryption, it is verified that the authentication server is illegal. After verifying that the authentication server is legitimate, the terminal device saves the attribute encryption identity private key in the local hardware storage chip.

In the embodiment of this application, the location information of the terminal device, the user information of the user bound to the terminal device, and the device factory identification are used to generate the private key of the terminal device, which can avoid burning the same ID device or production list for the manufacturer. Information leakage leads to the leakage of device encryption information, thereby improving device security; moreover, the terminal device uses the attribute identification public key of the authentication server to encrypt the information to obtain the first encrypted information, and only the legitimate server (possessing the attribute identification private key of the authentication server ) can decrypt the first encrypted information to obtain the symmetric key and random number. Therefore, when the authentication server uses the symmetric secret key to encrypt the random number and sends it to the terminal device, the terminal device can verify the authenticity of the authentication server by decrypting the random number; at the same time, because Only the legal authentication server can decrypt the symmetric key. It is safe to use the symmetric key to encrypt and distribute the attribute encryption identification private key. This improves the existing technology of using the device factory ID as the device key for encrypted information transmission. There is It is easy for the leakage of manufacturer information to lead to the leakage of batch device keys, thus affecting the technical issues of device security.

The above is an embodiment of an attribute encryption-based device security authentication method applied to a terminal device provided by this application. The following is an attribute encryption-based device security authentication method applied to an authentication server provided by this application.

Please refer to Figure 3. An embodiment of the present application provides a device security authentication method based on attribute encryption, which is applied to the authentication server. The method includes:

Step 301: Receive the registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory identification carried in the registration authentication request, and use its own attribute identification private key to decrypt the first encrypted information carried in the registration authentication request to obtain the symmetric encryption keys and random numbers.

After receiving the registration authentication request sent by the terminal device, the authentication server authenticates the terminal device according to the device factory identification carried in the registration authentication request, verifies the legitimacy of the terminal device through the device factory identification, and authenticates the registration through its own attribute identification private key. The first encrypted information carried in the request is decrypted to obtain the symmetric key and random number. The first encrypted information is encrypted and generated by a symmetric key and a random number generated by the terminal device through initialization of the attribute identification public key pair of the authentication server.

Step 302: After the authentication is successful, generate the attribute encryption identification private key of the terminal device according to the attribute information of the terminal device, and encrypt the attribute encryption identification private key and the decrypted random number with the decrypted symmetric key to obtain the second encryption. Information, attribute information includes location information, user information of the user bound to the terminal device, and device factory identification.

After authenticating that the terminal device is legitimate, the authentication server generates the attribute encryption identification private key of the terminal device based on the attribute information of the terminal device. Specifically, the authentication server assigns a device identification to the terminal device according to the attribute information of the terminal device; and generates an attribute encryption identification private key of the terminal device according to the device identification of the terminal device.

The authentication server can combine the location information, user information and device factory identification to generate the device identification of the terminal device. For example, the location information, user information and device factory identification are directly concatenated as the device identification of the terminal device. The authentication server can use the SM9 algorithm according to The device identification of the terminal device generates the attribute encryption identification private key of the terminal device, and can also generate the attribute encryption identification public key of the terminal device. The attribute encryption identification public key is stored in the authentication server, and the attribute encryption private key needs to be stored in the terminal device. Subsequent information is encrypted and transmitted through the attribute encryption identification public key and the attribute encryption identification private key. It can be understood that the attribute identification private key and attribute identification public key of the authentication server can also be generated based on the attribute information of the authentication server through the SM9 algorithm.

Among them, when the terminal device registers on the network and binds the user to the Internet, it can send its own attribute information to the authentication server according to the address of the authentication server. The attribute information can include location information, user information of the user bound to the terminal device (such as user Mobile phone number, ID number, registered account number, etc.) and device factory identification (such as device factory ID).

L1 ² = (X1-X) ² + (Y1-Y) ² + (Z1-Z) ² ;

L2 ² =(X2-X) ² +(Y2-Y) ² +(Z2-Z) ² ;

L3 ² = (X3-X) ² + (Y3-Y) ² + (Z3-Z) ² ;

The embodiment of this application uses the location information of the terminal device, the user information of the bound user, and the device factory identification to uniquely identify the terminal device as the public and private keys of the device, thereby avoiding the need for manufacturers to burn devices with the same ID. Or the problem of device encryption information leakage caused by the leakage of production list information; and when the terminal device changes the bound user or the device location is transferred, the attribute information of the terminal device is updated, and the public and private keys of the corresponding terminal device will also change, thus avoiding information Leakage and confusion. After the bound user of the same terminal device is changed, because the user information has changed, the public and private keys corresponding to the terminal device have also changed. The subsequent bound user of the same terminal device will not know the corresponding key of the previous bound user. Public and private key information improves the security of terminal equipment.

Step 303: Send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and the random number, and compares the random number generated by itself with the decrypted random number. Verify the legality of the authentication server through data, and after verifying that the authentication server is legal, save the attribute encryption identification private key.

The authentication server sends the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information through the symmetric key generated by itself to obtain the attribute encryption identification private key and the random number. The terminal device compares the random number generated by itself with the decrypted Whether the random numbers are the same is used to verify the legitimacy of the authentication server. If the random number generated by itself is compared with the random number obtained by decryption, it is verified that the authentication server is legitimate. If the random number generated by itself is compared with the random number obtained by decryption, it is verified that the authentication server is legitimate. If the random numbers are different, it is verified that the authentication server is illegal; after verifying that the authentication server is legal, the terminal device saves the attribute encryption identification private key in the local hardware storage chip.

The above is an embodiment of a device security authentication method based on attribute encryption applied to an authentication server provided by this application. The following is an embodiment of a terminal device provided by this application.

Please refer to Figure 4. A terminal device provided by an embodiment of the present application includes:

Initialization unit 401 is used to initialize and generate a symmetric key and a random number when accessing the authentication server in the blockchain for registration, and to encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the first encrypted information. ;

The sending unit 402 is configured to send a registration authentication request carrying the first encryption information and the device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification;

The receiving unit 403 is configured to receive the second encrypted information returned by the authentication server after successful authentication, and decrypt the second encrypted information through the symmetric key to obtain the attribute encryption identification private key and the random number; wherein the attribute encryption identification private key is determined by the authentication server according to The attribute information of the terminal device is generated. The attribute information includes location information, user information of the user bound to the terminal device and device factory identification; the second encrypted information is obtained by the authentication server decrypting the first encrypted information through its own attribute identification private key. The symmetric key is obtained by encrypting the attribute encryption identification private key and the decrypted random number;

The verification unit 404 is used to verify the legitimacy of the authentication server through the random numbers generated by itself and the random numbers decrypted. After verifying that the authentication server is legal, save the attribute encryption identification private key.

The above is an embodiment of a terminal device provided by this application, and the following is an embodiment of an authentication server provided by this application.

Please refer to Figure 5. An authentication server provided by an embodiment of this application includes:

The receiving unit 501 is configured to receive a registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory ID carried in the registration authentication request, and decrypt the first encrypted information carried in the registration authentication request through its own attribute identification private key. Obtain the symmetric key and random number; the first encrypted information is encrypted and generated by the symmetric key and random number generated by the terminal device through the attribute identification public key pair of the authentication server;

The encryption unit 502 is configured to, after successful authentication, generate the attribute encryption identification private key of the terminal device based on the attribute information of the terminal device, and encrypt the attribute encryption identification private key and the decrypted random number using the decrypted symmetric key. The second encrypted information, the attribute information includes location information, user information of the user bound to the terminal device, and device factory identification;

The sending unit 503 is used to send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information through the symmetric key generated by itself to obtain the attribute encryption identification private key and random number, and decrypts the random number through the self-generated random number. The random number verifies the legitimacy of the authentication server, and after verifying that the authentication server is legitimate, saves the attribute encryption identification private key.

The embodiment of this application also provides a device security authentication system based on attribute encryption, including: the terminal device and authentication server in the aforementioned embodiment;

The terminal device is used to initialize and generate a symmetric key and a random number when accessing the authentication server in the blockchain for registration, and to encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the first encrypted information; Send a registration authentication request carrying the first encryption information and the device factory identification to the authentication server;

The authentication server is used to authenticate the terminal device according to the device factory identification, and decrypt the first encrypted information through its own attribute identification private key to obtain the symmetric key and random number; after the verification is successful, generate The attribute encryption identification private key of the terminal device is encrypted with the decrypted symmetric key and the decrypted random number to obtain the second encrypted information, and the second encrypted information is sent to the terminal device; wherein, Attribute information includes location information, user information of the user bound to the terminal device, and device factory identification;

The terminal device is also used to decrypt the second encrypted information through the symmetric key generated by itself to obtain the attribute encryption identification private key and random number; and verify the legitimacy of the authentication server through the random number generated by itself and the random number decrypted. After the authentication server is legitimate, save the attribute encryption identification private key.

In the embodiment of this application, the location information of the terminal device, the user information of the user bound to the terminal device, and the device factory identification are used to generate the private key of the terminal device, which can avoid burning the same ID device or production list for the manufacturer. Information leakage leads to the leakage of device encryption information, thereby improving device security; moreover, the terminal device uses the attribute identification public key of the authentication server to encrypt the information to obtain the first encrypted information, and only the legitimate server (which has the attribute identification private key of the authentication server) ) can decrypt the first encrypted information to obtain the symmetric key and random number. Therefore, when the authentication server uses the symmetric secret key to encrypt the random number and sends it to the terminal device, the terminal device can verify the authenticity of the authentication server by decrypting the random number; at the same time, because Only the legitimate authentication server can decrypt the symmetric key. It is safe to use the symmetric key to encrypt and distribute the attribute encryption identification private key. This improves the existing technology of using the device factory ID as the device key for encrypted information transmission. There is It is easy for the leakage of manufacturer information to lead to the leakage of batch device keys, thus affecting the technical issues of device security.

The embodiment of the present application also provides a device security authentication device based on attribute encryption. The device includes a processor and a memory;

Memory is used to store program code and transmit the program code to the processor;

The processor is configured to execute the aforementioned attribute encryption-based device security authentication method applied to the terminal device according to instructions in the program code, or execute the attribute encryption-based device security authentication method applied to the authentication server.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

The terms "first", "second", "third", "fourth", etc. (if present) in the description of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe specific objects. Sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the application described herein can, for example, be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

It should be understood that in this application, "at least one (item)" refers to one or more, and "plurality" refers to two or more. "And/or" is used to describe the relationship between associated objects, indicating that there can be three relationships. For example, "A and/or B" can mean: only A exists, only B exists, and A and B exist simultaneously. , where A and B can be singular or plural. The character "/" generally indicates that the related objects are in an "or" relationship. “At least one of the following” or similar expressions thereof refers to any combination of these items, including any combination of a single item (items) or a plurality of items (items). For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c" ”, where a, b, c can be single or multiple.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for executing all or part of the steps of the methods described in various embodiments of the application through a computer device (which can be a personal computer, a server, or a network device, etc.). The aforementioned storage media include: U disk, mobile hard disk, read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), random access memory (English full name: Random Access Memory, English abbreviation: RAM), magnetic Various media that can store program code, such as discs or optical disks.

As mentioned above, the above embodiments are only used to illustrate the technical solution of the present application, but not to limit it. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still make the foregoing technical solutions. The technical solutions described in each embodiment may be modified, or some of the technical features may be equivalently replaced; however, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions in each embodiment of the present application.

Claims

A device security authentication method based on attribute encryption, which is characterized in that it is applied to terminal devices. The method includes:

When accessing the authentication server in the blockchain for registration, initialize and generate a symmetric key and a random number, and encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the first encrypted information;

Send a registration authentication request carrying the first encryption information and the device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification;

Receive the second encrypted information returned by the authentication server after successful authentication, and decrypt the second encrypted information using the symmetric key to obtain the attribute encryption identification private key and a random number; wherein the attribute encryption identification private key is obtained by The authentication server is generated based on the attribute information of the terminal device, the attribute information includes location information, user information of the user bound to the terminal device and the device factory identification; the second encrypted information is generated by the authentication server The symmetric key obtained by decrypting the first encrypted information with its own attribute identification private key is obtained by encrypting the attribute encryption identification private key and the decrypted random number;

The legitimacy of the authentication server is verified through the random number generated by itself and the random number decrypted. After verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.
The device security authentication method based on attribute encryption according to claim 1, characterized in that the address of the authentication server is preset when the terminal device leaves the factory, and the method further includes:

After binding the user, the terminal device sends attribute information to the authentication server according to the address of the authentication server.
The device security authentication method based on attribute encryption according to claim 1, characterized in that the acquisition process of the location information of the terminal device is:

When the terminal device accesses the blockchain, it calculates the location coordinates of the terminal device based on its relative position to the target node in the blockchain and the location coordinates of the target node to obtain the location information of the terminal device. .
The device security authentication method based on attribute encryption according to claim 1, characterized in that the verification of the legitimacy of the authentication server through the random number generated by itself and the decrypted random number includes:

Compare whether the random number generated by itself and the random number decrypted are the same;

If they are the same, verify that the authentication server is legal;

If they are not the same, it is verified that the authentication server is illegal.
A device security authentication method based on attribute encryption, which is characterized in that it is applied to an authentication server. The method includes:

Receive the registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory identification carried in the registration authentication request, and decrypt the first encrypted information carried in the registration authentication request through its own attribute identification private key. Obtain the symmetric key and random number; the first encrypted information is encrypted and generated by the symmetric key and random number generated by the terminal device through the attribute identification public key pair of the authentication server;

After the authentication is successful, the attribute encryption identification private key of the terminal device is generated according to the attribute information of the terminal device, and the attribute encryption identification private key and the decrypted random number are encrypted with the decrypted symmetric key to obtain second encrypted information, the attribute information includes location information, user information of the user bound to the terminal device and the device factory identification;

Send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and a random number, and compares it with the symmetric key generated by itself. The random number and the decrypted random number verify the legitimacy of the authentication server, and after verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.
The device security authentication method based on attribute encryption according to claim 5, characterized in that generating the attribute encryption identification private key of the terminal device according to the attribute information of the terminal device includes:

Assign a device identification to the terminal device according to the attribute information of the terminal device;

Generate an attribute encryption identification private key of the terminal device according to the device identification of the terminal device.
A terminal device, characterized by including:

The initialization unit is used to initialize and generate a symmetric key and a random number when accessing the authentication server in the blockchain for registration, and to encrypt the symmetric key and the random number through the attribute identification public key of the authentication server to obtain the third - encrypted information;

A sending unit configured to send a registration authentication request carrying the first encryption information and a device factory identification to the authentication server, and the authentication server authenticates the terminal device according to the device factory identification;

A receiving unit, configured to receive the second encrypted information returned by the authentication server after successful authentication, and to decrypt the second encrypted information using the symmetric key to obtain the attribute encryption identification private key and a random number; wherein, the attribute encryption The identification private key is generated by the authentication server based on the attribute information of the terminal device. The attribute information includes location information, user information of the user bound to the terminal device and the device factory identification; the second encrypted information The symmetric key obtained by the authentication server decrypting the first encrypted information using its own attribute identification private key is obtained by encrypting the attribute encryption identification private key and the decrypted random number;

The verification unit is configured to verify the legitimacy of the authentication server by comparing the random number generated by itself with the decrypted random number, and after verifying that the authentication server is legal, save the attribute encryption identification private key.
An authentication server, characterized by including:

The receiving unit is configured to receive the registration authentication request sent by the terminal device, authenticate the terminal device according to the device factory identification carried in the registration authentication request, and authenticate the third ID carried in the registration authentication request through its own attribute identification private key. Decrypt an encrypted information to obtain a symmetric key and a random number; the first encrypted information is generated by encrypting the symmetric key and random number generated by the terminal device through the attribute identification public key of the authentication server;

An encryption unit, configured to generate an attribute encryption identification private key of the terminal device according to the attribute information of the terminal device after successful authentication, and use the decrypted symmetric key to combine the attribute encryption identification private key and the decrypted symmetric key. The random number is encrypted to obtain the second encrypted information, and the attribute information includes location information, user information of the user bound to the terminal device, and the device factory identification;

A sending unit configured to send the second encrypted information to the terminal device, so that the terminal device decrypts the second encrypted information using the symmetric key generated by itself to obtain the attribute encryption identification private key and a random number, The legitimacy of the authentication server is verified through the random number generated by itself and the random number decrypted, and after verifying that the authentication server is legitimate, the attribute encryption identification private key is saved.
A device security authentication system based on attribute encryption, characterized by comprising: the terminal device according to claim 7 and the authentication server according to claim 8.
A device security authentication device based on attribute encryption, characterized in that the device includes a processor and a memory;

The memory is used to store program code and transmit the program code to the processor;

The processor is configured to execute the attribute encryption-based device security authentication method described in any one of claims 1-4 according to the instructions in the program code, or execute the attribute-based encryption described in any one of claims 5-6. Device security certification method.