CN104660405A - Business equipment authentication method and equipment - Google Patents

Abstract

The invention discloses a business equipment authentication method which comprises the steps that: first, a platform server generates a provisional authentication certificate according to identification of business equipment; then, the platform server indicates wireless access equipment to generate a WLAN (Wireless Local Area Network) with a wireless function by taking the provisional authentication certificate as a WiFi SSID (Wireless Fidelity Service Set Identifier) and judges whether an agent authentication request is received from a mobile terminal within a preset time threshold; and finally, the business equipment is authenticated according to a provisional certificate and account information carried in the agent authentication request. Therefore, the mobile terminal can authenticate the business equipment only by scanning the WiFi SSID, and the convenient and quick authentication of various business equipment is achieved. The invention further discloses a platform server at the same time.

Description

A service equipment authentication method and equipment

technical field

The invention relates to the field of communication technology, in particular to a service equipment authentication method. The invention also relates to a business device.

Background technique

With the improvement of living standards, more and more home businesses that are closely related to people's daily life, such as smart home, home security, and home health, have entered the home. These service terminals need platform interaction to access network resources, communicate with external devices, and realize data storage, analysis, and sharing. For these business devices, the current common business authentication methods are:

(1) The service equipment is pre-installed with a SIM card for unique identity authentication;

(2) Enter the preset account number and password through the Web self-service page of the business device. The detailed process is shown in Figure 1;

(3) Proxy authentication is realized by scanning the QR code on the business terminal with the mobile client. Specifically, the detailed process for the home business proxy authentication is shown in Figure 2.

However, regardless of the above or any of the service authentication methods in the prior art, due to cost considerations, the terminal equipment of the home service does not carry the account identification similar to the SIM card, and generally cannot provide user-friendly user display and Input interface, such as screen, touch screen, keyboard, etc. Moreover, since these business devices are generally non-intelligent embedded devices with limited CPU processing and storage capabilities, it is difficult to provide local Web services, which will also increase equipment costs; at the same time, because users cannot know the dynamically assigned IP addresses of business devices, access to their The local web service page will also increase the user's usage threshold.

Contents of the invention

In view of the technical problems in the background technology, the present invention provides a wireless authentication method for business equipment, which is applied to a system including mobile terminals, business equipment, wireless access equipment, and platform servers. The method includes:

The platform server receives the authentication request sent by the service device, and the authentication request carries the identifier of the service device;

The platform server generates a temporary credential corresponding to the service device according to the identifier, and notifies the wireless access device to use the temporary credential as the service set identifier SSID to add a new wireless local area network WLAN, so that the The mobile terminal scans the WLAN and obtains the SSID;

The platform server judges whether the proxy authentication request from the mobile terminal is received within the preset time threshold, and further checks the proxy authentication request according to the temporary credentials and account information carried in the proxy authentication request after receiving the proxy authentication request. The above business equipment is authenticated.

Correspondingly, the present invention also proposes a platform server, which is applied to a system including a mobile terminal, service equipment, wireless access equipment, and a platform server, and further includes:

A receiving module, configured to receive an authentication request sent by the service device, where the authentication request carries the identifier of the service device;

A setting module, configured to generate a temporary credential corresponding to the service device according to the identification, and notify the wireless access device to use the temporary credential as the service set identifier SSID to add a new wireless local area network WLAN, so that all The mobile terminal scans the WLAN and obtains the SSID;

An authentication module, configured to determine whether a proxy authentication request from a mobile terminal is received within a preset time threshold, and further verify the proxy authentication request based on the temporary credentials and account information carried in the proxy authentication request after receiving the proxy authentication request. The service equipment performs authentication.

It can be seen that by applying the above technical solutions, the platform server first generates a temporary authentication credential according to the identification of the service device, and then the platform server instructs the wireless access device to use the temporary authentication credential as a WiFi SSID to generate a WLAN network with wireless functions, and judges Whether the proxy authentication request from the mobile terminal is received within the preset time threshold, and finally the service device is authenticated according to the temporary credentials and account information carried in the proxy authentication request. Therefore, the mobile terminal only needs to scan the WiFiSSID to authenticate the service equipment, realizing fast and convenient authentication for various types of service equipment.

Description of drawings

FIG. 1 is a schematic diagram of a home service authentication process based on a preset account number/password in the prior art;

FIG. 2 is a schematic diagram of a home business agent authentication process based on two-dimensional code scanning in the prior art;

Fig. 3 is a schematic flow chart of a service equipment authentication method proposed by the present invention;

Fig. 4 is a schematic diagram of a service equipment authentication system proposed by the example of the present invention;

FIG. 5 is a schematic diagram of a temporary authentication credential issuance process proposed by a specific embodiment of the present invention;

FIG. 6 is a schematic diagram of a proxy authentication certificate issuance process proposed by a specific embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a platform server proposed by the present invention.

Detailed ways

In order to solve the defects of difficult authentication and inconvenient use of users caused by the low cost and limited functions of business equipment in the prior art, the present invention proposes a business equipment authentication method. First, the temporary authentication certificate is determined by the interaction between the business equipment and the business platform , and then the terminal management platform uses the temporary authentication credential as the WiFi SSID to generate a network with the function of wireless access AP, so that the mobile terminal can authenticate it when it scans the WiFi SSID, so that various types of business equipment can be quickly implemented. Easy authentication.

As shown in Figure 3, it is a schematic flow chart of a service equipment authentication method proposed by the present invention, including the following steps:

S301. The platform server receives an authentication request sent by the service device, where the authentication request carries an identifier of the service device.

S302. The platform server generates a temporary credential corresponding to the service device according to the identifier, and notifies the wireless access device to use the temporary credential as a service set identifier SSID to add a new wireless local area network WLAN, so that The mobile terminal scans the WLAN and acquires the SSID.

For security reasons, business equipment needs to complete the authentication within a period of time after generating the temporary credentials. The platform business equipment needs to set a validity period for the temporary credentials. Return to the service equipment, so that the service equipment sends a proxy authentication prompt message to the mobile terminal.

After receiving the temporary credential and validity period information sent by the platform server, the business device will periodically and proactively send a service access request carrying the identity of the business device and the temporary credential to the platform server. At this time, the platform server will Do the following:

If the authentication of the service device fails, the platform server returns an access failure response to the service device, so that the service device stops sending the service access request periodically;

If the authentication of the service device is successful, the platform server returns an authentication success response to the service device, so that the service device prompts that the authentication of the mobile terminal is successful.

S303. The platform server judges whether a proxy authentication request from a mobile terminal is received within a preset time threshold, and further according to the temporary credential and account information carried in the proxy authentication request after receiving the proxy authentication request Authenticate the service equipment.

It should be noted that the corresponding relationship between the account information and the service device identifier is preset in the platform server, and the proxy authentication request is generated by the mobile terminal after confirming that the account information entered by the user matches the preset account information, which ensures that the mobile The proxy authentication request sent by the terminal can correspond to the service equipment one by one, and the authentication will not fail due to confusion with other service equipment. Specifically, in this step, the platform server will authenticate the proxy authentication request and business equipment in the following ways:

If the platform server receives the proxy authentication request from the mobile terminal within the preset time threshold, and the temporary credential of the service device corresponding to the account information is consistent with the temporary credential carried in the proxy authentication request, the platform The server confirms that the authentication of the service equipment is successful, and releases the access authority of the service equipment;

If the platform server does not receive the proxy authentication request from the mobile terminal within the preset time threshold, or the temporary credential of the service device corresponding to the account information is inconsistent with the temporary credential carried in the proxy authentication request, the The platform server confirms that the authentication of the service equipment fails.

In addition, regardless of whether the authentication result for the business device is successful or failed, the temporary certificate has expired or is invalid, so the WLAN named after it is not needed, so the platform server will notify the wireless access device to revoke the corresponding WLAN and delete it. SSID.

In order to further illustrate the technical idea of the present invention, the technical solution of the present invention will now be described in conjunction with specific application scenarios. As shown in Figure 4, it is a schematic diagram of the business equipment authentication system proposed by the present invention, including the following equipment:

Wireless access devices: Home devices with wireless access capabilities, such as home gateways, are managed by the home device management platform.

Business equipment: access business resources on the home business platform and execute local business logic; the method in this proposal is mainly for devices without display and input interfaces, and can also be used for other business equipment.

Mobile device client: a proxy authentication client installed on the user's mobile device, which has a home user account. After passing the authentication, it can provide proxy authentication for other home business devices;

Business platform: a part of the platform server that provides home business services and authenticates business access;

Device management platform: Like the business platform, it is a part of the platform server and manages home devices, mainly including parameter settings, device upgrades, status collection, error alarms, etc.

Based on the above system, a schematic diagram of the temporary authentication certificate issuance flow chart of the technical solution of the present invention is shown in Figure 5, including the following steps:

S501. After the home wireless access device (such as home gateway, device identification 2) is powered on, it establishes a management channel with the home device management platform;

S502. After the user retrieves the registered home service device (device ID 1) bound to the account from the operator's business hall, activate the service on the device;

S503. The home service device sends a service access request to the home service platform, and the request message carries the identifier of the home service device;

S504. The home service platform generates a random temporary authentication certificate, which is composed of an authentication prefix, a service number, and a random code, and does not exceed 32 bytes;

S505. The home service platform requests the home device management platform to set the temporary authentication credential as the SSID of the newly added wireless local area network of the home wireless access device;

S506. The home device management platform searches for the home wireless access device bound thereto, and sets the temporary authentication credential as a new SSID on the home wireless access device;

S507. The home service platform sets a validity period (such as 2 minutes) for the temporary authentication certificate, and returns the temporary authentication certificate to the home service device;

S508, the home service device periodically (for example: 10 seconds) initiates a service access request to the home service platform, and the temporary authentication credential is carried in the message;

S509, because the authentication fails, all the periodic service access requests of the home service equipment return a failure response;

S510. After the home service platform detects that the temporary authentication credential is expired, request the home device management platform to cancel the SSID previously added for the temporary authentication credential;

S511. After the home service device sends the service access request, if it receives a temporary authentication credential invalidation failure response, stop the periodic service access request.

After completing the issuance process of the temporary credentials, the business equipment will be certified according to the following proxy certification process, including:

S601, the user opens the client terminal on the mobile device, and the client terminal passes the user login authentication of the service platform;

S602, the user selects on the client terminal to perform proxy authentication for the home service device, and the client terminal on the mobile device starts to scan the SSID of the wireless signal in the surrounding environment;

S603. After detecting the SSID with the temporary authentication credential, the client on the mobile device initiates a proxy authentication request to the service platform, and the request message carries the user account and the temporary authentication credential;

S604. After receiving the proxy authentication request, the home service platform checks the validity of the temporary authentication certificate and the binding relationship between the account and the device, and releases the service access authority to the home service device if passed;

S605, after the proxy authentication is passed, the home service platform will return a correct response to the periodic service access request of the home service device, and the service can be accessed normally subsequently;

S606. After detecting that the temporary authentication credential is expired, the home service platform requests the home device management platform to cancel the SSID previously added for the temporary authentication credential.

In order to achieve the above technical objectives, the present invention also proposes a platform server, which is applied to a system including mobile terminals, business equipment, wireless access equipment, and platform servers, as shown in Figure 7, and also includes:

A receiving module 710, configured to receive an authentication request sent by the service device, where the authentication request carries the identifier of the service device;

The setting module 720 is configured to generate a temporary credential corresponding to the service device according to the identification, and notify the wireless access device to use the temporary credential as the service set identifier SSID to add a new wireless local area network WLAN, so that The mobile terminal scans the WLAN and acquires the SSID;

The authentication module 730 is configured to determine whether a proxy authentication request from a mobile terminal is received within a preset time threshold, and further base the temporary credentials and account information carried in the proxy authentication request on receipt of the proxy authentication request. Authenticate the service equipment.

In a specific application scenario, the authentication module 730 is specifically used for:

If the receiving module 710 receives a proxy authentication request from a mobile terminal within a preset time threshold, and the temporary credential of the service device corresponding to the account information is consistent with the temporary credential carried in the proxy authentication request, the The authentication module 730 confirms that the authentication of the service equipment is successful, and releases the access authority of the service equipment;

If the receiving module 710 does not receive the proxy authentication request from the mobile terminal within the preset time threshold, or the temporary credential of the service device corresponding to the account information is inconsistent with the temporary credential carried in the proxy authentication request, the The authentication module 730 confirms that the authentication of the service equipment fails.

In specific application scenarios, it also includes:

The revocation module is configured to notify the wireless access device to revoke the WLAN and delete the SSID after the authentication module 730 confirms that the authentication of the service device succeeds or fails.

In a specific application scenario, the setting module 720 is also configured to set the validity period for the temporary voucher after generating the temporary voucher corresponding to the business device according to the identification, and return the temporary voucher and the validity period information to to the service device, so that the service device sends a proxy authentication prompt message to the mobile terminal;

Wherein, the length of the validity period is the same as the preset time threshold.

In a specific application scenario, the receiving module 710 is also configured to receive the service access request periodically sent by the service device after the setting module 720 returns the temporary credential and validity period information to the service device , the service access request carries the identifier of the service device and the temporary credential;

If the authentication of the service device fails, the receiving module 710 returns an access failure response to the service device, so that the service device stops sending the service access request periodically;

If the authentication of the service device is successful, the receiving module 710 returns an authentication success response to the service device, so that the service device prompts that the authentication of the mobile terminal is successful.

In specific application scenarios, it also includes:

A storage module, storing the preset corresponding relationship between the account information and the service device identifier, and the proxy authentication request is generated by the mobile terminal after confirming that the account information input by the user matches the preset account information .

By applying the above technical solutions, the platform server first generates a temporary authentication credential according to the identification of the business device, and then the platform server instructs the wireless access device to use the temporary authentication credential as a WiFiSSID to generate a WLAN network with wireless functions, and judges that the time threshold Whether to receive the proxy authentication request from the mobile terminal, and finally authenticate the service device according to the temporary credentials and account information carried in the proxy authentication request. Therefore, the mobile terminal only needs to scan the WiFi SSID to authenticate the business equipment, realizing fast and convenient authentication for various types of business equipment.

Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be realized by hardware, or by software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.), including several The instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in various implementation scenarios of the present invention.

Those skilled in the art can understand that the accompanying drawing is only a schematic diagram of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present invention.

Those skilled in the art can understand that the modules in the devices in the implementation scenario can be distributed among the devices in the implementation scenario according to the description of the implementation scenario, or can be located in one or more devices different from the implementation scenario according to corresponding changes. The modules of the above implementation scenarios can be combined into one module, or can be further split into multiple sub-modules.

The above serial numbers of the present invention are for description only, and do not represent the pros and cons of the implementation scenarios.

The above disclosures are only some specific implementation scenarios of the present invention, however, the present invention is not limited thereto, and any changes conceivable by those skilled in the art shall fall within the protection scope of the present invention.

Claims (12)

1. a business device wireless authentication method, is applied in the system comprising mobile terminal, business device, radio reception device, Platform Server, it is characterized in that, described method also comprises:

Described Platform Server receives the authentication request that described business device sends, and carries the mark of described business device in described authentication request;

Described Platform Server generates the scrip corresponding with described business device according to described mark, and notify that described radio reception device is with the described scrip WLAN WLAN new for service set identifier SSID sets up, to make described mobile terminal described WLAN scanned and obtain described SSID;

Described Platform Server judges in preset time threshold, whether receive the proxy authentication request coming from mobile terminal, and carries out certification according to the scrip carried in described proxy authentication request and accounts information to described business device further after receiving described proxy authentication request.

2. the method for claim 1, it is characterized in that, described Platform Server judges in preset time threshold, whether receive the proxy authentication request coming from mobile terminal, and according to the scrip carried in described proxy authentication request and accounts information, certification is carried out to described business device further after receiving described proxy authentication request, be specially:

If described Platform Server in preset time threshold adduction to the proxy authentication request coming from mobile terminal, and the scrip of business device corresponding to described accounts information is consistent with the scrip carried in described proxy authentication request, described Platform Server confirms described business device authentication success, decontrols the access rights of described business device;

If described Platform Server does not receive the proxy authentication request coming from mobile terminal in preset time threshold, or the scrip carried in the scrip of business device corresponding to described accounts information and described proxy authentication request is inconsistent, described Platform Server confirms described business device authentification failure.

3. method as claimed in claim 2, is characterized in that, also comprise:

After described Platform Server confirms described business device authentication success or authentification failure, described Platform Server notifies that described radio reception device is cancelled described WLAN and deletes described SSID.

4. the method for claim 1, is characterized in that, after described Platform Server generates the scrip corresponding with described business device according to described mark, also comprises:

Described Platform Server is that described scrip arranges the term of validity, and the length of the described term of validity is identical with described preset time threshold;

Described scrip and term of validity information are back to described business device by described Platform Server, send proxy authentication prompting message to make described business device to described mobile terminal.

5. method as claimed in claim 4, is characterized in that, after described scrip and term of validity information are back to described business device by described Platform Server, also comprise:

Described Platform Server receives the Operational Visit request that described business device periodically sends, and carries the mark of described business device and described scrip in described Operational Visit request;

If described business device authentification failure, described Platform Server, to described business device backward reference failure response, sends described Operational Visit request to make described business device dwelling period;

If described business device authentication success, described Platform Server, to the success response of described business device return authentication, points out the success of described mobile terminal authentication to make described business device.

6. the method for claim 1, is characterized in that, be preset with in described Platform Server described account information and described business device identify between corresponding relation, also comprise:

Described proxy authentication request is generate after the account information of described mobile terminal in confirmation user input is mated with described default account information.

7. a Platform Server, is applied in the system comprising mobile terminal, business device, radio reception device, Platform Server, it is characterized in that, also comprise:

Receiver module, for receiving the authentication request that described business device sends, carries the mark of described business device in described authentication request;

Module is set, for generating the scrip corresponding with described business device according to described mark, and notify that described radio reception device is with the described scrip WLAN WLAN new for service set identifier SSID sets up, to make described mobile terminal described WLAN scanned and obtain described SSID;

Authentication module, in preset time threshold, whether receive for judging the proxy authentication request coming from mobile terminal, and according to the scrip carried in described proxy authentication request and accounts information, certification is carried out to described business device further after receiving described proxy authentication request.

8. Platform Server as claimed in claim 7, is characterized in that, described authentication module, specifically for:

If described receiver module in preset time threshold adduction to the proxy authentication request coming from mobile terminal, and the scrip of business device corresponding to described accounts information is consistent with the scrip carried in described proxy authentication request, described authentication module confirms described business device authentication success, decontrols the access rights of described business device;

If described receiver module does not receive the proxy authentication request coming from mobile terminal in preset time threshold, or the scrip carried in the scrip of business device corresponding to described accounts information and described proxy authentication request is inconsistent, described authentication module device confirms described business device authentification failure.

9. Platform Server as claimed in claim 8, is characterized in that, also comprise:

Remove module, after confirming described business device authentication success or authentification failure when described authentication module, notify that described radio reception device is cancelled described WLAN and deletes described SSID.

10. Platform Server as claimed in claim 7, is characterized in that,

Described module is set also for after generating the scrip corresponding with described business device according to described mark, for described scrip arranges the term of validity, and described scrip and term of validity information are back to described business device, send proxy authentication prompting message to make described business device to described mobile terminal;

Wherein, the length of the described term of validity is identical with described preset time threshold.

11. Platform Servers as claimed in claim 10, is characterized in that,

Described receiver module, also for arranging after described scrip and term of validity information be back to described business device by module described, receive the Operational Visit request that described business device periodically sends, in described Operational Visit request, carry the mark of described business device and described scrip;

If described business device authentification failure, described receiver module, to described business device backward reference failure response, sends described Operational Visit request to make described business device dwelling period;

If described business device authentication success, described receiver module, to the success response of described business device return authentication, points out the success of described mobile terminal authentication to make described business device.

12. Platform Servers as claimed in claim 7, is characterized in that, also comprise:

Memory module, store described account information and described business device identify between default corresponding relation, described proxy authentication request is described mobile terminal confirming that the account information of user's input generates after mating with described default account information.