openharmony_ci
dc74b04beb
fix_free_after_push
Created-by: Chuxiong_KOU
Commit-by: kou-chuxiong
Merged-by: openharmony_ci
Description: ### 一、内容说明（相关的Issue）
### 二、建议测试周期和提测地址
建议测试完成时间：xxxx.xx.xx
投产上线时间：xxxx.xx.xx
提测地址：CI环境/压测环境
测试账号：
### 三、变更内容
* 3.1 关联PR列表
* 3.2 数据库和部署说明
1. 常规更新
2. 重启unicorn
3. 重启sidekiq
4. 迁移任务：是否有迁移任务，没有写 "无"
5. rake脚本：`bundle exec xxx RAILS_ENV = production`；没有写 "无"
* 3.4 其他技术优化内容（做了什么，变更了什么）
- 重构了 xxxx 代码
- xxxx 算法优化
* 3.5 废弃通知（什么字段、方法弃用？）
* 3.6 后向不兼容变更（是否有无法向后兼容的变更？）
### 四、研发自测点（自测哪些？冒烟用例全部自测？）
自测测试结论：
### 五、测试关注点（需要提醒QA重点关注的、可能会忽略的地方）
检查点：
| 需求名称 | 是否影响xx公共模块 | 是否需要xx功能 | 需求升级是否依赖其他子产品 |
|------|------------|----------|---------------|
| xxx | 否 | 需要 | 不需要 |
| | | | |
接口测试：
性能测试：
并发测试：
其他：
See merge request: openharmony/security_device_auth!1349
deviceauth
Introduction
The device authentication module belongs to the security subsystem of OpenHarmony. It manages the entire lifecycle of trust relationships between devices, including establishment, maintenance, use, and cancellation, and implements authentication and secure session key exchange between trusted devices. It provides basic capabilities for trusted interconnections between devices that run OpenHarmony.
The device authentication module provides the following capabilities:
- Device trust relationship management: manages the establishment, maintenance, and cancellation of trust relationships between devices in a unified manner; allows the isolation and controllable sharing of trust relationships created by different services.
- Device trust relationship authentication: authenticates trust relationships between devices, allows trusted devices to exchange secure session keys with each other, and sets up connections between trusted devices through the DSoftBus.
The device authentication module consists of three submodules: device group management, device group authentication, and account-irrelevant P2P device authentication. The following figure shows the logical architecture of the device authentication module.
Figure 1 Architecture of the device authentication module
In the architecture:
- Device group management: allows you to manage the trust relationships between the local device and other devices created by different services in a unified manner, create trust relationships between devices using the provided APIs, create an account-irrelevant device group, add trusted devices to the group, and create a trust relationship between isolated devices.
- Device group authentication: allows devices to authenticate the trust relationships that have been established between them and exchange session keys.
- Account-irrelevant P2P device authentication: allows two devices to establish a trust relationship based on a shared secret, and exchange a session key for secure communication based on the trusted relationship.
Directory Structure
/base/security/device_auth
├── frameworks # Device authentication framework code
├── hals # HAL code for the tool library
│ ├── inc # Tool library header files
│ └── src # Tool library source files
├── interfaces # APIs exposed externally
└── services # Device authentication services
├── common # Common code
├── group_auth # Device group authentication
├── group_manager # Device group management
├── module # Authenticator module (including the account-irrelevant P2P device authenticator)
└── session # Scheduling and session management module
Usage
Available APIs
The device group management sub-module abstracts trust relationships established by different services between devices into trust groups and provides unified APIs for creating, deleting, and querying groups. The device group authentication sub-module provides trusted device authentication and end-to-end session key exchange based on the trust groups.
Table 1 APIs in DeviceGroupManager
Table 2 APIs in GroupAuthManager
int32_t AuthDevice(int64_t authReqId, const char *authParams, const DeviceAuthCallback *gaCallback) |
|
int32_t ProcessData(int64_t authReqId, const uint8_t *data, uint32_t dataLen, |
Repositories Involved
Security subsystem