WO2024045092A1

WO2024045092A1 - Method and apparatus for determining unique identifier of device, and electronic device

Info

Publication number: WO2024045092A1
Application number: PCT/CN2022/116362
Authority: WO
Inventors: 刘恒亚; 齐麟
Original assignee: 西门子股份公司; 西门子（中国）有限公司
Priority date: 2022-08-31
Filing date: 2022-08-31
Publication date: 2024-03-07

Abstract

A method and apparatus for determining a unique identifier of a device, and an electronic device. The method comprises: acquiring a first device identifier of a first terminal device and a first client certificate of the first terminal device, wherein the first device identifier comprises a first MAC address and a first IP address; binding the first client certificate to the first device identifier to serve as a first binding record, wherein the first binding record is used for uniquely identifying the first terminal device; identifying, on the basis of the first client certificate, whether the first device identifier has changed to a second device identifier, wherein the second device identifier comprises a second MAC address and a second IP address, the second MAC address is different from the first MAC address, and/or the second IP address is different from the first IP address; and if it is identified that the first device identifier has changed to a second device identifier, replacing the first device identifier in the first binding record by the second device identifier, so as to update to the first binding record. On the basis of the method, the accuracy and efficiency of device identification can be increased.

Description

Methods, devices and electronic equipment for determining unique identification of equipment

Technical field

The present invention relates to the field of computer technology, and in particular, to a method, device and electronic device for determining a unique identifier of a device.

Background technique

Device identification is critical for certain business scenarios (e.g., asset management, network traffic analysis). In related technologies, the Internet Protocol (Internet Protocol, IP) address or the Media Access Control (Media Access Control, MAC) address of the device is usually used as a unique identifier for identifying the device. An IP address is a unique set of numbers used to identify a device connected to the Internet. The MAC address is used to identify a unique network interface in a device. The reason for using an IP address or MAC address as a unique identifier for a device is that it is easy to obtain from the network.

However, in complex network environments, devices cannot be accurately identified based on IP addresses or MAC addresses. For example, when the same device connects to the same network at different times, the IP address of the device may change. For another example, the same device may be connected to different networks at the same time through two or more network cards, and thus the device may be assigned multiple sets of IP addresses and MAC addresses. In these scenarios, the same device may be identified as different devices based on the device's IP address or MAC address, making device identification inaccurate.

Contents of the invention

In view of this, the present invention provides a method, device and electronic device for determining a unique identifier of a device, so as to at least partially solve the above technical problems.

In the first aspect, embodiments of the present application provide a method for determining a unique identifier of a device, including:

Obtaining a first device identification of the first terminal device and a first client certificate of the first terminal device, where the first device identification includes a first MAC address and a first IP address;

Binding the first client certificate and the first device identification as a first binding record, the first binding record being used to uniquely identify the first terminal device;

Based on the first client certificate, identify whether the first device identification is changed to a second device identification, wherein the second device identification includes a second MAC address and a second IP address, and the second MAC address is the same as the second device identification. The first MAC address is different, and/or the second IP address is different from the first IP address;

If it is recognized that the first device identifier has been changed to the second device identifier, the first device identifier in the first binding record is replaced with the second device identifier to update the first binding record.

In a possible implementation, identifying whether the first device identity is changed to a second device identity based on the first client certificate includes:

Obtain the second device identification of the second terminal device and the second client certificate of the second terminal device;

If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identification is changed to the third terminal device. 2. Equipment identification.

In a possible implementation, the obtaining the first device identification of the first terminal device and the first client certificate of the first terminal device includes:

From the interaction information between the first terminal device and the authentication server when accessing the network, the MAC address and client certificate of the first terminal device are obtained as the first MAC address and the first client certificate respectively. Certificate;

The IP address of the first terminal device is obtained as the first IP address from the interaction information between the first terminal device and the DHCP server when requesting the IP address.

In a possible implementation, the MAC address and client certificate of the first terminal device are obtained from the interaction information between the first terminal device and the authentication server when accessing the network, and are used as the The first MAC address and the first client certificate, including:

Obtain the authentication access start request sent by the first terminal device when accessing the network;

Obtain the MAC address of the first terminal device from the authentication access start request as the first MAC address;

Obtain the access authentication request sent by the first terminal device to the authentication server when performing network authentication;

Obtain the client certificate of the first terminal device from the access authentication request as the first MAC address.

In a possible implementation, the IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when requesting an IP address as the first IP address, include:

Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device;

Obtain the IP address of the first terminal device from the DHCP response as the first IP address.

In the second aspect, embodiments of the present application provide a device for determining a unique identifier of a device, including:

An acquisition module, configured to acquire a first device identification of the first terminal device and a first client certificate of the first terminal device, where the first device identification includes a first MAC address and a first IP address;

A binding module, configured to bind the first client certificate and the first device identification as a first binding record, where the first binding record is used to uniquely identify the first terminal device;

An identification module, configured to identify whether the first device identification is changed to a second device identification based on the first client certificate, wherein the second device identification includes a second MAC address and a second IP address, and the third The second MAC address is different from the first MAC address, and/or the second IP address is different from the first IP address;

An update module, configured to, if it is recognized that the first device identification has been changed to the second device identification, replace the first device identification in the first binding record with the second device identification to update it to the first binding record. Fixed record.

In a possible implementation, the identification module is specifically used to:

In a possible implementation, the acquisition module is specifically used to:

Obtaining the first device identification of the first terminal device and the first client certificate of the first terminal device includes:

In a possible implementation, the acquisition module is specifically used to:

Obtain the client certificate of the first terminal device from the access authentication request as the first client certificate.

In a possible implementation, the acquisition module is specifically used to:

Obtain the IP address of the first terminal device from the DHCP response.

In a third aspect, an electronic device is provided, including: a processor, a memory, a communication interface, and a communication bus. The processor, the memory, and the communication interface complete communication with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform operations corresponding to the method described in any one of the first aspects.

A fourth aspect provides a computer-readable storage medium on which computer-executable instructions are stored, wherein when executed, the computer-executable instructions cause the processor to perform any of the steps described in the first aspect. method.

Embodiments of the present application provide methods, devices and electronic devices for determining the unique identification of a device. Due to the uniqueness of the first client certificate of the first terminal device, even if the first device identification of the first terminal device is changed to the second device When identifying, that is, when the MAC address of the first terminal device changes from the first MAC address to the second MAC address and/or the IP address of the first terminal device changes from the first IP address to the second MAC address, based on the first The first client certificate of the terminal device can immediately identify the above changes and make updates, thereby uniquely and accurately identifying the device and improving the accuracy of device identification. In addition, since the first binding record is guaranteed to always uniquely identify the first terminal device based on the uniqueness and persistence of the first client certificate, when processing business logic such as device query, device update, device merging, and device binding, etc. , which can significantly reduce the complexity of business logic processing and improve work efficiency. At the same time, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device, avoiding the need to manually set other identity identifiers for the first terminal device to uniquely identify the first terminal device. Save labor costs.

Description of drawings

Figure 1 is an architectural diagram of a system suitable for the method for determining a unique identifier of a device provided by an embodiment of the present application;

Figure 2 is a schematic flow chart of a method for determining a unique identifier of a device provided by an embodiment of the present application;

Figure 3 is a schematic diagram of a process for obtaining the MAC address and client certificate of the first terminal device provided by an embodiment of the present application;

Figure 4 is a schematic diagram of a process for obtaining the IP address of a first terminal device provided by an embodiment of the present application;

Figure 5 is a signal flow diagram of a process for obtaining the MAC address, client certificate and IP address of the first terminal device provided by an embodiment of the present application;

Figure 6 is a schematic structural diagram of a device for determining a unique identifier of a device provided by an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

List of reference signs:

10: Terminal equipment 20: Access equipment 30: Authentication server

40: DHCP server 30A: Radius server

S201: Obtain the first device identification of the first terminal device and the first client certificate of the first terminal device

S202: Bind the first client certificate and the first device identification as the first binding record

S203. Based on the first client certificate, identify whether the first device identity is changed to the second device identity.

S204. If it is recognized that the first device identifier has been changed to the second device identifier, change the first device identifier in the first binding record.

The device identifier is replaced with the second device identifier to update the first binding record.

301, 401: MAC address 302: Client certificate 402: IP address

1: The first terminal device sends the authentication access start message <EAPoL start> to the access device.

2: The access device can send an identification request <EAP-Request/Identity> to the first terminal device

3: The first terminal device sends the identification response message <EAP-Respons/Identity> to the access device.

4: The access device encapsulates the identification response message <EAP-Respons/Identity> into a Radius access request message <RADIUS AcessRequset/Identity> and transmits it to the Raduis server

5: The Raduis server sends the TLS-Start request message <EAP-TLS-Request/StartTLS> to the first terminal device via the access device.

6: The first terminal device sends the client greeting message <EAP-TLS-Request/ClientHello> to the Raduis server via the access device.

7: The Raduis server sends a server greeting message <Radius Access-Challenge/ServerHello> to the first terminal device via the access device.

8: The first terminal device sends the TLS response message <EAP-TLS-Response/Certificate> to the Raduis server via the access device.

9: The Raduis server sends the handshake completion message <EAP-TLS-Request/ChangeCipherSpec_Finished> to the first terminal device via the access device.

10: The Raduis server sends an access response message <Radius AccessResponse/Accept> to the access device.

11: The access device sends an authentication success message <EAP-Success> to the first terminal device.

12: The first terminal device sends a DHCP request <DHCP Request> to the DHCP server via the access device.

13: The DHCP server sends a DHCP response <DHCP ACK> to the first terminal device via the access device.

S501: Receive the authentication access start message <EAPoL Start> message from the first terminal device, and obtain the MAC address of the first terminal device.

S502: Obtain the client certificate of the first terminal device 1 from the TLS response message <EAP-TLS-Response/Certificate>

S503: Obtain the MAC address of the first terminal device from the DHCP request

S504: Obtain the IP address of the first terminal device from the DHCP response

60: Method used to determine the unique identification of the device 601: Obtain the module

602: Binding module 603: Identification module 604: Update module

70: Electronic equipment 702: Processor 704: Communication interface

706: Memory 708: Communication bus 710: Executable instructions

Detailed ways

In order to make the purpose, technical solutions, and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other technical solutions obtained by those of ordinary skill in the art fall within the scope of protection of this application.

Device identification is critical for certain business scenarios (e.g., asset management, network traffic analysis). In the related art, since IP addresses and MAC addresses are easy to obtain from the network, the IP address or MAC address is usually used as a unique identifier for identifying a device connected to the network.

However, as mentioned earlier, in some scenarios, when the same device accesses the same network at different times, the device's IP address may change. For example, the device's IP address switches from 172.x.x.2 to 172.x.x.3. . Therefore, in this scenario, the IP address cannot be used as a persistent unique identifier of the device. Identifying devices based on IP addresses may identify the same device as two different devices, resulting in inaccurate device identification.

For another example, in another scenario, a device has two different network cards, and the device can be connected to different networks at the same time. Since the device has two different network cards, the device will be assigned two sets of IP addresses and MAC addresses, that is, the device has a multi-valued unique identifier. In this scenario, the same device will be identified as two or more different devices based on IP address and MAC address, resulting in inaccurate device identification.

In addition, for some business scenarios, there are other problems when using the MAC address as the unique identifier of the device. For example, when performing network traffic analysis, it is often necessary to identify the data source of a packet (i.e., the device that sent the packet). However, since the MAC address of the data packet changes after it passes through a network device (such as a switch or router), the MAC address cannot be used to identify the data source.

Based on the above problems, embodiments of the present application provide a method and device for determining a unique identifier of a device, so as to at least partially solve the above technical problems.

The specific implementation of the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

In order to facilitate understanding, the architecture diagram of the system applicable to the embodiment of the present application is first described with reference to FIG. 1 . Figure 1 is an architectural diagram of a schematic system suitable for the method for determining a unique identifier of a device provided by an embodiment of the present application. As shown in Figure 1, the system includes: terminal equipment 10, such as factory equipment that needs to access the IT network or OT network; access equipment 20, such as switches and routers; authentication server 30, used to access the terminal equipment 10 The network authenticates the terminal device 10, such as the Radius server; and the DHCP server 40 is used to allocate dynamic IP addresses to the terminal device 10 in the local area network. The terminal device 10 accesses the network through the access device 20 . When accessing the network, the terminal device 10 needs to interact with the authentication server 30 through the access device 20 to complete access authentication. After the access authentication of the terminal device 10 is successful, the access device 20 interacts with the DHCP server 40 to request an IP address from the DHCP server 40, and the DHCP server allocates an IP address to the terminal device 10 in response to the request from the terminal device 10.

The method for determining the unique identifier of the device provided by the embodiment of the present application may be executed by the access device 20 or by other devices that are communicatively connected to the access device 20 . Based on the system in Figure 1, the method for determining the unique identifier of the device provided by the embodiment of the present application will be described in detail below.

Figure 2 is a flow chart of a method for determining a unique identifier of a device provided by an embodiment of the present application. This method may be performed by the access device 20 in Figure 1 or by other devices that are communicatively connected to the access device 20. As shown in Figure 2, the method includes:

S201. Obtain the first device identification of the first terminal device 10 and the first client certificate of the first terminal device 10.

The first device identifier includes a first MAC address and a first IP address.

The first terminal equipment 10 corresponds to the terminal equipment shown in FIG. 1 , which may include factory equipment or other similar equipment connected to an OT network or an IT network.

The first client certificate is a digital certificate used to verify the legal identity of the first terminal device 10 during network communication. For the first terminal device 10, the first client certificate is unique and persistent.

In an implementation manner of this application, step S201 may include:

Step A: Obtain the MAC address and client certificate of the first terminal device 10 from the interaction information between the first terminal device 10 and the authentication server 30 when accessing the network, as the first MAC address and the first client certificate respectively.

Specifically, as shown in FIG. 3 , when the first terminal device 10 is connected to the Internet, the first terminal device 10 first needs to interact with the authentication server 30 through the access device 20 to complete access authentication. During the interaction process, the first terminal device 10 first provides its MAC address to the access device 20 . The access device 20 will interact with the first terminal device 10 according to the MAC address sent by the first terminal device 10 to request the user name, client certificate and other information of the first terminal device 10 to provide to the authentication server 30 to complete the first step. Authentication between a terminal device 10 and the authentication server 30.

During the above interaction process, the access device 20 can obtain the MAC address and client certificate of the first terminal device 10 from the interaction information between the first terminal device 10 and the authentication server 30 as the first MAC address and the first client certificate respectively. end certificate. In a possible implementation, the access device 20 obtains the authentication access start request sent by the first terminal device 10 when accessing the network; obtains the MAC address 301 of the first terminal device 10 from the authentication access start request, as the first MAC address; obtain the access authentication request sent by the first terminal device 10 to the authentication server 30 via the access device 20 when performing network authentication; obtain the client certificate 302 of the first terminal device 10 from the access authentication request , as the first client certificate.

In order to facilitate understanding of the above process, the above process will be described in detail below with reference to the example in FIG. 5 . Figure 5 is a signal flow diagram of a process for obtaining the MAC address, client certificate and IP address of the first terminal device 10 provided by the embodiment of this application. In FIG. 5 , the Raduis server 30A is used as the authentication server, and the EAP-TLS protocol is used for access authentication between the first terminal device 10 and the Raduis server as an example for explanation. It should be understood that FIG. 5 is only an example. In other embodiments, the first terminal device 10 and the authentication server 30 may use other suitable protocols for access authentication, which is not limited in this embodiment.

As shown in Figure 5, in information flow 1, the first terminal device 10 sends an authentication access start message <EAPoL start> (i.e., authentication access start request) to the access device 20, indicating that the access authentication starts. The authentication access start message <EAPoL start> carries the MAC address of the first terminal device 10.

According to the authentication access start message, the access device 20 can obtain the MAC address of the first terminal device 10 from the authentication access start message (ie, S501). Specifically, the MAC address of the first terminal device 10 is obtained from the data link layer according to the authentication access start message as the first MAC address. And, in response to receiving the authentication access start message, in information flow 2, the access device 20 may send an identification request <EAP-Request/Identity> to the first terminal device 10, requiring the first terminal device 10 to provide an identity identifier. .

In response to receiving the identification request message <EAP-Request/Identity>, in information flow 3, the first terminal device 10 sends an identification response message <EAP-Respons/Identity> to the access device 20, the content of which is the user's identity. .

In information flow 4, the access device 20 encapsulates the identification response message <EAP-Respons/Identity> into a Radius access request message <RADIUS AcessRequset/Identity> and transmits it to the Raduis server 30A.

After obtaining the identity of the first terminal device 10 from the Radius access request message <RADIUS AccessRequset/Identity>, the Raduis server 30A sends a TLS-Start request to the first terminal device 10 via the access device 20 in information flow 5. Message <EAP-TLS-Request/StartTLS>. It should be understood that in order to simplify the view, the process in which the access device 20 performs the message encapsulation and decapsulation process to forward the message between the first terminal device 10 and the Raduis server 30A is omitted in FIG. 5 . In practical applications, the communication process between the first terminal device 10 and the Raduis server 30A is all performed through the access device 20, which will not be described again.

After the first terminal device 10 receives the TLS-Start request message <EAP-TLS-Request/StatTLS>, the client hello message <EAP-TLS-Request/ is sent to the Raduis server 30A via the access device 20 in signal flow 6 ClientHello>, this message contains the supported TLS protocol version, supported encryption algorithm, supported compression method, etc.

In response to receiving the client hello message <EAP-TLS-Request/ClientHello>, in signal flow 7, the Raduis server 30A sends the server hello message <Radius Access-Challenge/ServerHello> to the first terminal device 10 via the access device 20 , the message contains information such as confirming the TLS protocol version used, confirming the encryption algorithm used, server certificate, and requesting the client to provide a certificate.

After receiving the server hello message <EAP-TLS-Request/ServerHello>, the first terminal device 10 sends the TLS response message <EAP-TLS-Response/Certificate> to the Raduis server 30A via the access device 20 in the signal flow 8 , this message contains the client certificate of the first terminal device 10 . At this time, the access device 20 can also obtain the client certificate of the first terminal device 10 from the TLS response message <EAP-TLS-Response/Certificate> (ie, S502). Specifically, the client certificate of the first terminal device 10 is obtained from the transport layer according to the message as the first client certificate.

In response to receiving the TLS response message <EAP-TLS-Response/Certificate>, in signal flow 9, the Raduis server 30A sends a handshake completion message <EAP-TLS-Request/ChangeCipherSpec_Finished> to the first terminal device 10 via the access device 20 , indicating the end of the handshake, and in the signal flow 10, the Raduis server 30A sends the access response message <Radius AccessResponse/Accept> to the access device 20, indicating that the authentication is completed. After decapsulating the message, the access device 20 sends an authentication success message <EAP-Success> to the first terminal device 10 in the signal flow 11, and the authentication is completed.

As mentioned above, in the process of the first terminal device 10 interacting with the Raduis server 30A via the access device 20, the access device 20 may perform step S501, according to the authentication access received from the first terminal device 10 in the signal flow 1. Start message <EAPoL Start> message to obtain the MAC address of the first terminal device. Specifically, the MAC address of the first terminal device 10 is obtained from the data link layer according to the message as the first MAC address. In addition, the access device 20 may also perform step S502 to obtain the client certificate of the first terminal device 10 according to the TLS response message <EAP-TLS-Response/Certificate> received from the first terminal device 10 in the signal flow 8 . Specifically, the client certificate of the first terminal device 10 is obtained from the transport layer according to the message as the first client certificate.

Step B: Obtain the IP address of the first terminal device 10 as the first IP address from the interaction information between the first terminal device 10 and the DHCP server 40 when requesting the IP address.

Specifically, after the first terminal device 10 completes the access authentication, the first terminal device 10 interacts with the DHCP server via the access device 20 to obtain the dynamic IP address assigned by the DHCP server. For example, as shown in Figure 4, the first terminal device 10 can send its MAC address 401 to the access device 20, and the access device 20 forwards the MAC address 401 to the DHCP server. After the DHCP server determines the IP address for the MAC address, it sends the IP address 402 to the access device 20 , and the access device 20 forwards it to the first terminal device 10 . In this way, the first terminal device 10 obtains the IP address dynamically assigned to it by the access device 20 . During the interaction process between the DHCP server and the first terminal device 10, the access device 20 can obtain the MAC address sent by the first terminal device 10 to the DHCP server and the IP address assigned by the DHCP server to the first terminal device 10, and convert the IP address address as the first IP address.

For ease of understanding, continue to refer to Figure 5. When the first terminal device 10 requests an IP address, the first terminal device 10 sends a DHCP request <DHCP Request> to the DHCP server via the access device 20 in the signal flow 12. The request contains the MAC address of the first terminal device 10 . In response to receiving the DHCP request, in the signal flow 13, the DHCP server 40 sends a DHCP response <DHCP ACK> to the first terminal device 10 via the access device 20. The DHCP response includes the DHCP server 40 allocated for the first terminal device 10. IP address. It should be understood that in order to simplify the view, the process of the access device 20 forwarding the DHCP request and the DHCP response is omitted in Figure 5. It should be understood that in the actual application process, the communication between the first terminal device 10 and the DHCP server 40 is via the access Device 20 is carried out. When the access device 20 receives the DHCP request sent by the first terminal device 10 to the DHCP server 40, the access device 20 executes step S503 to obtain the MAC address of the first terminal device 10 from the DHCP request. In addition, when the access device 20 receives the DHCP response sent by the DHCP server 40 to the first terminal device 10, step S504 is performed to obtain the IP address of the first terminal device 10 from the DHCP response.

Returning to Figure 2, according to S202 in Figure 2, bind the first client certificate and the first device identifier as the first binding record;

The first binding record is used to uniquely identify the first terminal device 10 .

Specifically, after the access device 20 obtains the MAC address and client certificate of the first terminal device 10, the MAC address and the client certificate are bound, that is, the first MAC address and the first client certificate are bound. Thereafter, after receiving the MAC address and IP address of the first terminal device 10, the MAC address and IP address can be bound, thereby binding the MAC address, client certificate and IP address of the first terminal device 10 , as the first binding record to uniquely identify the first terminal device 10.

It should be understood that when the first terminal device 10 accesses the network, the access device 20 can always obtain a triplet consisting of the MAC address, client certificate and IP address of the first terminal device 10, and thereby identify the first terminal device 10. Terminal device 10.

Wherein, the second device identification includes a second MAC address and a second IP address, the second MAC address is different from the first MAC address, and/or the second IP address is different from the first IP address;

As mentioned above, in complex application scenarios, the same terminal device may have two MAC addresses or due to various other reasons, the MAC address of the same terminal device obtained by the access device 20 may change. Due to the uniqueness of client certificates, the same end device only has unique and persistent client certificates. When the MAC address of the same terminal device changes, this change can be easily identified based on the client certificate of the terminal device during the authentication access process. Therefore, when the first MAC address of the first terminal device 10 changes from the first MAC address to the second MAC address, the access device 20 can easily identify this change based on the client certificate, which will facilitate subsequent timely The MAC address is updated to ensure unique identification of the first terminal device 10 .

Similarly, as mentioned above, since the DHCP server 40 dynamically allocates IP addresses, after the first terminal device 10 completes the authentication access and accesses the network at different times, its IP address will also change. Due to the uniqueness and persistence of the first client certificate, this change can be identified based on the first client certificate. In addition, during the authentication access process, whether the MAC address of the first terminal device 10 changes is identified based on the first client certificate, and the MAC address is updated in time when the MAC address changes. Therefore, in a subsequent stage, whether the IP address of the first terminal device 10 is changed from the first IP address to the second IP address can also be directly identified based on the MAC address of the first terminal device 10 .

In a specific implementation of the present application, based on the first client certificate, identifying whether the first device identity is changed to the second device identity includes: obtaining the second device identity of the second terminal device and the second device identity of the second terminal device. Client certificate; if the second client certificate is the same as the first client certificate, it is determined that the first terminal device 10 and the second terminal device are the same terminal device, and the first device identification is changed to the second device identification.

The second terminal device and the first terminal device 10 may be the same device or different devices. The access device 20 may obtain the second device identification of the second terminal device in the same manner as the first device identification of the first terminal device 10 . Due to the uniqueness and persistence of the client certificate, the access device 20 can determine whether the second terminal device is the same as the first client certificate based on whether the second client certificate in the second device identification of the second terminal device is the same as the first client certificate. Whether a terminal device 10 is the same terminal device. If during the authentication access process, the first client certificate is the same as the first client certificate, but the first MAC address and the second MAC address are different, it can be determined that the first terminal device 10 and the second terminal device are the same terminal device. , and the MAC address of the first terminal device 10 changes. Similarly, if after the access authentication is completed, the first terminal device 10 and the second terminal device with the same MAC address are obtained and have the first IP address and the second IP address respectively, and the first IP address and the second IP address are different. , it can be determined that the first terminal device 10 and the second terminal device are the same terminal device, and the IP address of the first terminal device 10 is changed from the first IP address to the second IP address.

S204. If it is recognized that the first device identifier has been changed to the second device identifier, replace the first device identifier in the first binding record with the second device identifier to update the first binding record.

Specifically, when it is recognized that the MAC address of the first terminal device 10 changes from the first MAC address to the second MAC address, the first MAC address in the first binding record may be updated to the second MAC address to update The first binding record ensures the unique identification of the first terminal device 10 . Similarly, when the IP address of the first terminal device 10 changes from the first IP address to the second IP address, the first IP address in the first binding record can be updated to the second IP address to update the first IP address. Binding records. When it is recognized that the MAC address of the first terminal device 10 has changed from the first MAC address to the second MAC address, and the IP address of the terminal device has changed from the first IP address to the second IP address, the first binding record can be The first MAC address in is updated to the second MAC address, and the first IP address is updated to the second IP address to update the first binding record, thereby ensuring unique identification of the first terminal device 10 .

In the embodiment of the present application, due to the uniqueness of the first client certificate of the first terminal device, even when the first device identification of the first terminal device is changed to the second device identification, that is, the MAC address of the first terminal device When the first MAC address is changed to the second MAC address and/or the IP address of the first terminal device is changed from the first IP address to the second MAC address, the above changes can be immediately identified based on the first client certificate of the first terminal device. And make updates to uniquely and accurately identify devices and improve device identification accuracy. In addition, since the first binding record is guaranteed to always uniquely identify the first terminal device based on the uniqueness and persistence of the first client certificate, when processing business logic such as device query, device update, device merging, and device binding, etc. , which can significantly reduce the complexity of business logic processing and improve work efficiency. At the same time, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device, avoiding the need to manually set other identity identifiers for the first terminal device to uniquely identify the first terminal device. Save labor costs.

FIG. 6 is a schematic structural diagram of a device for determining a unique identifier of a device provided by an embodiment of the present application. The device 60 may be the access device in Figure 1, may also be integrated in the access device, or may be communicatively connected with the access device to execute the method for determining the unique identification of the device provided by the foregoing method embodiment. As shown in 5, the device includes:

Obtaining module 601 is used to obtain the first device identification of the first terminal device and the first client certificate of the first terminal device, where the first device identification includes the first MAC address and the first IP address;

The binding module 602 is used to bind the first client certificate and the first device identification as the first binding record, and the first binding record is used to uniquely identify the first terminal device;

Identification module 603, configured to identify whether the first device identity is changed to a second device identity based on the first client certificate. The second device identity includes a second MAC address and a second IP address, and the second MAC address and the first MAC address is different, and/or, the second IP address is different from the first IP address;

Update module 604, configured to replace the first device identifier in the first binding record with the second device identifier to update it to the first device identifier if it is recognized that the first device identifier has been changed to the second device identifier. Binding records.

If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identification is changed to the second device identification.

In a possible implementation, the acquisition module is specifically used to:

From the interaction information between the first terminal device and the access authentication server when accessing the network, obtain the MAC address and client certificate of the first terminal device as the first MAC address and the first client certificate respectively;

Obtain the IP address of the first terminal device as the first IP address from the interaction information between the first terminal device and the DHCP server when requesting the IP address.

In a possible implementation, the acquisition module is specifically used to:

Obtain the MAC address of the first terminal device from the authentication access start request;

Obtain the client certificate of the first terminal device from the access authentication request.

In a possible implementation, the acquisition module is specifically used to:

Obtain the IP address of the first terminal device from the DHCP response.

The device for determining the unique identifier of the device provided in this embodiment is used to implement the corresponding methods for determining the unique identifier of the device in the multiple method embodiments mentioned above, and has the beneficial effects of the corresponding method embodiments, which will not be described again here. . In addition, for the functional implementation of each module in the device for determining the unique identification of a device in this embodiment, reference can be made to the description of the corresponding part in the foregoing method embodiment, and details will not be described again here.

FIG. 7 is a schematic structural diagram of an electronic device provided by an embodiment of the present application. The electronic device 70 may be the access device 20 in FIG. 1 , may also be integrated in the access device 20 , or may be communicatively connected with the access device 20 to perform the steps provided by the foregoing method embodiments for determining the unique identification of the device. Methods. As shown in Figure 7, the electronic device may include: a processor 702, a communication interface 704, a memory 706 storing a program (at least one executable instruction 710), and a communication bus 708.

The processor, communication interface, and memory communicate with each other through the communication bus.

Communication interface, used to communicate with other electronic devices or servers.

The processor is used to execute the program. Specifically, it can execute the relevant steps in the above method embodiments.

Specifically, the program may include program code including computer operating instructions.

The processor may be a processor CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement embodiments of the present application. The one or more processors included in the smart device can be the same type of processor, such as one or more CPUs; or they can be different types of processors, such as one or more CPUs and one or more ASICs.

Memory, used to store programs. The memory may include high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk memory.

The program can specifically be used to cause the processor to execute the method for determining the unique identification of the device provided in the foregoing method embodiment.

In addition, for the specific implementation of each step in the program, please refer to the corresponding steps and corresponding descriptions in the units in the above method embodiments, which will not be described again here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the above-described devices and modules can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be described again here.

It should be pointed out that according to the needs of implementation, each component/step described in the embodiments of this application can be split into more components/steps, or two or more components/steps or partial operations of components/steps can be combined into New components/steps to achieve the purpose of the embodiments of this application.

The above-mentioned methods according to the embodiments of the present application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or by The computer code downloaded by the network is originally stored in a remote recording medium or a non-transitory machine-readable medium and will be stored in a local recording medium, so that the method described here can be stored using a general-purpose computer, a special-purpose processor or a programmable computer. or such software processing on a recording medium of dedicated hardware (such as ASIC or FPGA). It will be understood that a computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code when the software or computer code is used by the computer, When accessed and executed by a processor or hardware, the methods described herein are implemented. Furthermore, when a general-purpose computer accesses code for implementing the methods illustrated herein, execution of the code converts the general-purpose computer into a special-purpose computer for performing the methods illustrated herein.

Embodiments of the present application also provide a computer-readable storage medium on which computer-executable instructions are stored, wherein when executed, the computer-executable instructions cause the processor to perform any of the foregoing method embodiments. method described. It has the same working principle and technical effect as the aforementioned method embodiment. To avoid redundancy, details will not be explained here.

The present invention has been shown and described in detail through the drawings and preferred embodiments above. However, the present invention is not limited to these disclosed embodiments. Based on the above-mentioned multiple embodiments, those skilled in the art will know that the above-mentioned different embodiments can be combined. The code review means in the method can lead to more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

A method for determining a device's unique identifier, including:

Obtain a first device identification of the first terminal device and a first client certificate of the first terminal device (S201), where the first device identification includes a first MAC address and a first IP address;

Bind the first client certificate and the first device identification as a first binding record (S202), the first binding record is used to uniquely identify the first terminal device;

Based on the first client certificate, identify whether the first device identification is changed to a second device identification (S203), where the second device identification includes a second MAC address and a second IP address, and the second MAC The address is different from the first MAC address, and/or the second IP address is different from the first IP address;

If it is recognized that the first device identification has been changed to the second device identification, the first device identification in the first binding record is replaced with the second device identification to update to the first binding record ( S204).
The method of claim 1, wherein identifying whether the first device identity is changed to a second device identity based on the first client certificate (S203) includes:

Obtain the second device identification of the second terminal device and the second client certificate of the second terminal device;

If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identification is changed to the third terminal device. 2. Equipment identification.
The method according to claim 1 or 2, characterized in that said obtaining the first device identification of the first terminal device and the first client certificate of the first terminal device includes:

From the interaction information between the first terminal device and the authentication server when accessing the network, the MAC address and client certificate of the first terminal device are obtained as the first MAC address and the first client certificate respectively. Certificate;

The IP address of the first terminal device is obtained as the first IP address from the interaction information between the first terminal device and the DHCP server when requesting the IP address.
The method according to claim 3, characterized in that the MAC address and client certificate of the first terminal device are obtained from the interaction information between the first terminal device and the authentication server when accessing the network, As the first MAC address and the first client certificate respectively, include:

Obtain the authentication access start request sent by the first terminal device when accessing the network;

Obtain the MAC address of the first terminal device from the authentication access start request as the first MAC address;

Obtain the access authentication request sent by the first terminal device to the authentication server when performing network authentication;

Obtain the client certificate of the first terminal device from the access authentication request as the first client certificate.
The method of claim 3, wherein the IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when requesting the IP address as the third terminal device. An IP address, including:

Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device;

Obtain the IP address of the first terminal device from the DHCP response as the first IP address.
A device for determining the unique identification of equipment, including:

Obtaining module (601), configured to obtain a first device identification of the first terminal device and a first client certificate of the first terminal device, where the first device identification includes a first MAC address and a first IP address. ;

Binding module (602), configured to bind the first client certificate and the first device identification as a first binding record, the first binding record being used to uniquely identify the first terminal device ;

An identification module (603), configured to identify whether the first device identification is changed to a second device identification based on the first client certificate, where the second device identification includes a second MAC address and a second IP address, The second MAC address is different from the first MAC address, and/or the second IP address is different from the first IP address;

Update module (604), configured to, if it is recognized that the first device identification has changed to the second device identification, replace the first device identification in the first binding record with the second device identification to update to First binding record.
The device according to claim 6, characterized in that the identification module (603) is specifically used to:

Obtain the second device identification of the second terminal device and the second client certificate of the second terminal device;

If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identification is changed to the third terminal device. 2. Equipment identification.
The device according to claim 7, characterized in that the acquisition module (602) is specifically used to:

Obtaining the first device identification of the first terminal device and the first client certificate of the first terminal device includes:

From the interaction information between the first terminal device and the authentication server when accessing the network, the MAC address and client certificate of the first terminal device are obtained as the first MAC address and the first client certificate respectively. Certificate;

The IP address of the first terminal device is obtained as the first IP address from the interaction information between the first terminal device and the DHCP server when requesting the IP address.
An electronic device includes: a processor (702), a memory (706), a communication interface (704) and a communication bus (708). The processor, the memory and the communication interface complete each other through the communication bus. communication between; the memory is used to store at least one executable instruction (710), the executable instruction causes the processor to perform operations corresponding to the method described in any one of claims 1-5.
A computer-readable storage medium having computer-executable instructions stored thereon, wherein the computer-executable instructions, when executed, cause the processor to perform the method according to any one of claims 1 to 5.