CN104158816A - Authentication method and device as well as server - Google Patents

Abstract

The present invention relates to an authentication method, device, and server. The method includes: the server receives an instruction sent by a message issuer, and the instruction is used to instruct the server to generate a key pair, so that the message issuer can generate a key pair according to the The private key in the key pair generates a digital signature; the server receives the first message sent by the message issuer, and the first message includes the public key in the key pair, digital signature, message and message issuer IP ; According to the IP of the message issuing end, the server matches the IP of the information issuing end with the preset white list; when the matching is successful, the server matches the message according to the public key and digital signature Verification is performed, and when the verification is successful, the message is pushed.

Description

Authentication method, device and server

technical field

The invention relates to the technical field of communication, in particular to an authentication method, device and server of a message push system.

Background technique

With the development of Internet of Things technology, people are more eager to obtain information and services from the Internet anytime, anywhere. However, more and more content is constantly flooding the Internet, and it is difficult for people to find the resources they are interested in through simple active search. In order to ensure that this information can be seen by users in a timely and effective manner, compared with the traditional pull method, the message push method meets the needs of practical applications. For distributed message push system applications, whether the published or subscribed messages can arrive in a safe and timely manner plays a very important role for both parties in the communication. The message push system needs to ensure the integrity and reliability of the message, and ensure that the message is not lost, repeated, or tampered with during transmission.

However, in the design of the existing message push system, due to the illegal copying of computer software, the leakage of communication, the data security is threatened, but the lack of security authentication mechanism has caused a security hole in the message push system.

Contents of the invention

The purpose of the present invention is to ensure the security of the message push system, to prevent individual users from illegally connecting, intruding, destroying data, and affecting network security.

In a first aspect, an embodiment of the present invention provides an authentication method, the method comprising:

The server receives an instruction sent by the message issuer, where the instruction is used to instruct the server to generate a key pair, so that the message issuer generates a digital signature according to the private key in the key pair;

The server receives the first message sent by the message issuer, the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer;

The server matches the IP of the message publishing end with a locally preset whitelist according to the IP of the message publishing end;

When the matching is successful, the server verifies the message according to the public key and the digital signature, and pushes the message when the verification is successful.

Preferably, the server verifying the message according to the public key and the digital signature specifically includes:

The server obtains the message digest of the message by using a hash algorithm;

The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful.

Preferably, the hash algorithm is specifically any one of MD2, MD4, MD5 or SHA-1.

Preferably, the server is an MQTT proxy server.

In a second aspect, an embodiment of the present invention provides an authentication device, the device comprising: a first receiving unit, a second receiving unit, a first matching unit, and a second matching unit;

The first receiving unit is configured for the server to receive an instruction sent by the message issuer, the instruction is used to instruct the server to generate a key pair, so that the message issuer can generate a key pair according to the private key in the key pair digital signature;

The second receiving unit is configured to receive a first message sent by a message issuer, where the first message includes the public key in the key pair, a digital signature, a message, and the IP of the message issuer;

The first matching unit is configured to match the IP of the message publishing end with a locally preset whitelist according to the IP of the message publishing end;

The second matching unit is configured to verify the message according to the public key and the digital signature, and push the message when the verification is successful.

Preferably, the second matching unit is specifically used for:

The server obtains the message digest of the message by using a hash algorithm;

The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful.

Preferably, the hash algorithm is specifically any one of MD2, MD4, MD5 or SHA-1.

Preferably, the server is an MQTT proxy server.

In a third aspect, an embodiment of the present invention provides a server, and the server includes:

The receiver receives an instruction sent by the message issuing end, the instruction is used to instruct the processor to generate a key pair, so that the message issuing end generates a digital signature according to the private key in the key pair;

The receiver is further configured to receive a first message sent by the message issuer, where the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer;

The processor, according to the IP of the message publishing end, matches the IP of the message publishing end with a preset white list in the memory;

The processor is further configured to, when the matching is successful, verify the message according to the public key and the digital signature.

The sender pushes the message after the verification is successful.

Preferably, the processor is specifically used for:

The processor obtains the message digest of the message by using a hash algorithm;

The processor uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful.

By applying the authentication method, device and server provided by the embodiments of the present invention, when the matching is successful, the server verifies the message according to the public key and digital signature, and when successful, pushes the message to the message subscriber to ensure Ensures the security, integrity, reliability and non-repudiation of messages from the message publisher to the message subscriber, avoids tampering or illegal attacks on messages during transmission, meets the security requirements of enterprise-level applications, and is easy to deploy , cost saving, strong scalability, and can also be applied to other systems.

Description of drawings

FIG. 1 is an architecture diagram of a message push system based on the MQTT publish/subscribe mechanism provided by Embodiment 1 of the present invention;

FIG. 2 is a flowchart of an authentication method provided by Embodiment 1 of the present invention;

FIG. 3 is a topic-based publish/subscribe mechanism provided by Embodiment 1 of the present invention;

FIG. 4 is a schematic diagram of an authentication device provided in Embodiment 2 of the present invention;

FIG. 5 is a schematic diagram of a server provided by Embodiment 3 of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In order to facilitate the understanding of the embodiments of the present invention, further explanations will be given below with specific embodiments in conjunction with the accompanying drawings, which are not intended to limit the embodiments of the present invention.

The authentication method, device, and server provided in the embodiments of the present application are applicable to the scenario of security authentication for message push, especially applicable to the scenario of security authentication of the Message Queuing Telemetry Transport (MQTT) publish/subscribe mechanism system.

In order to ensure the security of the message push system and prevent individual users from illegally connecting and intruding to destroy data and affect network security, this application can pass IP authentication and digital signature mechanisms to ensure the security of message push operations.

FIG. 1 is an architecture diagram of a message push system based on the MQTT publish/subscribe mechanism provided by Embodiment 1 of the present invention.

The message push system mainly includes three parts: a message publishing terminal 110, a message server 120 (hereinafter also referred to as a server), and a message subscribing terminal 130. The message publisher 110 is equivalent to the producer of the message. Every time the application program produces a message, it is not directly delivered to the receiver of the message, but to the server, and the server 120 decides which receivers to send the message to. The message subscriber 130 is equivalent to the consumer of the message. The message subscriber 130 subscribes to the server 120 or unsubscribes the message. The message subscriber 130 has its own message receiving queue, and can unpack, decompress and decrypt the message as required deal with. The server 120 is the soul of the entire message push system, which performs relevant processing on the received messages and pushes them to the corresponding message subscribers 130 .

The authentication method provided by the embodiment of the present invention is described in detail below by taking FIG. 2 as an example. FIG. 2 is a flowchart of the authentication method provided by Embodiment 1 of the present invention. In the embodiment of the present invention, the subject of implementation is a device with processing capabilities: a server or a device , for example: MQTT proxy server. As shown in Figure 2, this embodiment specifically includes the following steps:

S210. The server receives an instruction sent by the message issuer, where the instruction is used to instruct the server to generate a key pair, so that the message issuer generates a digital signature according to the private key in the key pair.

The message publishing end can be but not limited to the web server in the IoT platform. Servers include but are not limited to MQTT proxy servers.

The server receives the instruction sent by the message issuer, and the instruction is used to call the digital signature authentication module in the server, and the server generates a key pair according to the instruction. Among them, the digital signature authentication module is a subroutine in the server, which can be regarded as a relatively independent module. When the message subscriber needs to perform corresponding processing, it only needs to call the corresponding module (processing subroutine). When using a key pair, call the digital signature authentication module. In order to describe the implementation process of the present invention in more detail, the software modules involved in the embodiments of the present invention are all located in the server.

The key pair includes a public key and a private key. The message publisher uses a hash algorithm to generate a message digest for the message to be sent. The private key is used to encrypt the message digest. The encrypted digest is the digital signature of the message .

Hash algorithms include but are not limited to Message-Digest Algorithm2 (MD2), MD4, MD5 or Secure Hash Algorithm (SHA-1).

S220. The server receives the first message sent by the message issuer, where the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer.

The message publishing end IP is the IP address of the web server.

The message is the data information to be released by the message publisher.

S230. Match the IP of the message issuing end with a preset whitelist according to the IP of the information issuing end.

A white list is preset in the server, and the white list is the IP of the message publishing end authorized by the server. The server can call its IP verification module to match the message issuer IP with the white list, wherein the IP verification module, like the digital signature verification module, is a processing subroutine in the server.

When the IP of the message issuing end matches the white list successfully, it means that the message issuing end is legal, and at this time, go to step S240.

When the IP of the message publisher fails to match the white list, it means that the message publisher is illegal, and the server returns an error message to the message publisher.

S240, when the matching is successful, the server verifies the message according to the public key and the digital signature, and pushes the message when the verification is successful.

The server invokes its digital signature authentication module to verify the message.

Preferably, the server verifying the message according to the public key and the digital signature specifically includes:

The server obtains the message digest of the message by using a hash algorithm;

The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful. At this point, the server pushes the message to the message subscriber, and returns a success prompt to the message publisher.

When the message digest is different from the decrypted message digest, verification fails. At this time, the server does not push the message to the message subscriber, and returns an error prompt to the message publisher.

Wherein, the message subscribing end is a terminal, including but not limited to a mobile phone, a tablet computer, a notebook computer, and a desktop computer.

It can be understood that the hash algorithm used by the server to obtain the message digest and the hash algorithm used by the message publisher to extract the message digest are the same algorithm.

Further, the message includes a message subject;

After the verification is successful, the message server matches the subject of the message with the subject of the message subscriber, and pushes the message corresponding to the subject of the message to the corresponding message subscriber.

Specifically, as shown in FIG. 3 , FIG. 3 is a topic-based publish/subscribe mechanism provided by Embodiment 1 of the present invention. In Figure 3, the server can arrange the legal messages sent by the received message publisher. The example is not limited. The server can arrange the messages according to the message topics to form a topic queue. For example, the messages can be classified into Messages containing topic X, topic Y, etc. The message subscriber connects to the server, completes the registration to obtain a registered account, and subscribes or cancels its own topic. The message subscriber may include one terminal or multiple terminals. The one or more terminals subscribe to messages of different or the same subject, and the server will The message is pushed to the corresponding terminal. For example, terminal A and terminal C subscribe to topic X, and the server pushes the message of topic X to terminal A and terminal C. Terminal B subscribes to topic Y, and the server sends the message of topic Y Push to terminal B.

Using the authentication method provided by the embodiment of the present invention, the server matches the IP of the message issuing end with the preset white list according to the IP of the message issuing end; Verification, when the verification is successful, the message is pushed to the message subscriber, which ensures the security, integrity, reliability and non-repudiation of the message from the message publisher to the message subscriber, and avoids the message being damaged during transmission. From tampering or illegal attacks, it meets the security requirements of enterprise-level applications. It is easy to deploy, saves costs, and has strong scalability. It can also be applied to other systems.

Fig. 4 is a schematic diagram of an authentication device provided by Embodiment 2 of the present invention. As shown in FIG. 4, in this embodiment, it includes: a first receiving unit 410, a second receiving unit 420, a first matching unit 430, and a second matching unit 440;

The first receiving unit 410 is used for the server to receive an instruction sent by the message issuer, the instruction is used to instruct the server to generate a key pair, so that the message issuer can use the private key in the key pair to generate a digital signature;

The second receiving unit 420 is configured to receive a first message sent by a message issuer, where the first message includes the public key in the key pair, a digital signature, a message, and the IP of the message issuer;

The first matching unit 430 is configured to match the message publisher IP with a preset whitelist according to the message publisher IP;

The second matching unit 440 is configured to verify the message according to the public key and the digital signature, and push the message when the verification is successful.

Optionally, the second matching unit 440 is specifically configured to:

The server obtains the message digest of the message by using a hash algorithm;

The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful.

Optionally, the hash algorithm is specifically any one of MD2, MD4, MD5 or SHA-1.

Optionally, the server is an MQTT proxy server.

Using the authentication device provided by the embodiment of the present invention, the server matches the message issuing end IP with the preset white list according to the message issuing end IP; Signature to verify the message, and when the verification is successful, push the message to the message subscriber, ensuring the security, integrity, reliability and non-repudiation of the message from the message publisher to the message subscriber , which avoids tampering or illegal attacks on messages during transmission, meets the security requirements of enterprise-level applications, is simple to deploy, saves costs, and has strong scalability. It can also be applied to other systems.

FIG. 5 is a schematic diagram of a server provided by Embodiment 3 of the present invention. As shown in FIG. 5 , this embodiment includes: a receiver 510 , a processor 520 , a memory 530 , and a transmitter 540 . The receiver 510, the processor 520, the memory 530 and the transmitter 540 are connected through a system bus (not shown in FIG. 5 ).

The receiver 510 receives an instruction sent by the message issuer, where the instruction is used to instruct the processor to generate a key pair, so that the message issuer generates a digital signature according to the private key in the key pair;

The receiver 510 is further configured to receive a first message sent by the message issuer, where the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer;

The processor 520, according to the IP of the message issuing end, matches the IP of the information issuing end with the preset white list in the memory 530;

The processor 520 is further configured to, when the matching is successful, verify the message according to the public key and the digital signature.

The sender 540 pushes the message after the verification is successful.

Optionally, the processor 520 is specifically configured to:

The processor obtains the message digest of the message by using a hash algorithm;

The processor uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message;

When the message digest is the same as the decrypted message digest, the verification is successful.

The server can use the method shown in Figure 3 to push the message to the message subscriber, which will not be repeated here.

Professionals should further realize that the units and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the relationship between hardware and software Interchangeability. In the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, within the spirit and principles of the present invention, any modification, equivalent replacement, improvement, etc., shall be included in the protection scope of the present invention.

Claims (10)

1. An authentication method, characterized in that the method comprises: The server receives an instruction sent by the message issuer, where the instruction is used to instruct the server to generate a key pair, so that the message issuer generates a digital signature according to the private key in the key pair; The server receives the first message sent by the message issuer, the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer; The server matches the IP of the message publishing end with a locally preset whitelist according to the IP of the message publishing end; When the matching is successful, the server verifies the message according to the public key and the digital signature, and pushes the message when the verification is successful. 2. The method according to claim 1, wherein the server verifying the message according to the public key and the digital signature specifically includes: The server obtains the message digest of the message by using a hash algorithm; The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message; When the message digest is the same as the decrypted message digest, the verification is successful. 3. The method according to claim 1 or 2, wherein the hash algorithm is specifically any one of message digest algorithms MD2, MD4, MD5 and secure hash algorithm SHA-1. 4. The method of claim 1, wherein the server is a Message Queuing Telemetry Transport (MQTT) proxy server. 5. An authentication device, characterized in that the device comprises: a first receiving unit, a second receiving unit, a first matching unit, and a second matching unit; The first receiving unit is configured for the server to receive an instruction sent by the message issuer, the instruction is used to instruct the server to generate a key pair, so that the message issuer can generate a key pair according to the private key in the key pair digital signature; The second receiving unit is configured to receive a first message sent by a message issuer, where the first message includes the public key in the key pair, a digital signature, a message, and the IP of the message issuer; The first matching unit is configured to match the IP of the message publishing end with a locally preset whitelist according to the IP of the message publishing end; The second matching unit is configured to verify the message according to the public key and the digital signature, and push the message when the verification is successful. 6. The device according to claim 5, wherein the second matching unit is specifically used for: The server obtains the message digest of the message by using a hash algorithm; The server uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message; When the message digest is the same as the decrypted message digest, the verification is successful. 7. The device according to claim 5 or 6, wherein the hash algorithm is specifically any one of MD2, MD4, MD5 or SHA-1. 8. The device according to claim 5, wherein the server is an MQTT proxy server. 9. A server, characterized in that the server comprises: The receiver receives an instruction sent by the message issuing end, the instruction is used to instruct the processor to generate a key pair, so that the message issuing end generates a digital signature according to the private key in the key pair; The receiver is further configured to receive a first message sent by the message issuer, where the first message includes the public key in the key pair, the digital signature, the message, and the IP of the message issuer; The processor, according to the IP of the message publishing end, matches the IP of the message publishing end with a preset white list in the memory; The processor is further configured to, when the matching is successful, verify the message according to the public key and the digital signature. The sender pushes the message after the verification is successful. 10. The server according to claim 9, wherein the processor is specifically configured to: The processor obtains the message digest of the message by using a hash algorithm; The processor uses the public key to decrypt the digital signature of the message, and obtains the digest of the decrypted message; When the message digest is the same as the decrypted message digest, the verification is successful.