Interactive authentication method, device and system, computer equipment and readable storage medium

Abstract

An interactive authentication method is used for a sending end (A), and the sending end (A) is connected to a receiving end (B) in communication. The interactive authentication method includes: (S10) generating a first challenge and sending the first challenge to the receiving end (B); (S20) receiving a response sent by the receiving end (B), the response including first identity authentication information and a second challenge; (S30) encrypting the first identity authentication information and the second challenge by a first identity authentication key; (S40) generating a second identity authentication key and a second identity authentication information according to the first challenge; (S50) decrypting the first identity authentication information by using the second identity authentication key and matching the decrypted first identity authentication information with the second identity authentication information to perform identity authentication. In addition, the present application also discloses an interactive authentication device and system, a computer device, and a readable storage medium.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and more specifically, to an interactive authentication method, apparatus and system, computer equipment and readable storage medium. Background Art

[0002] With the rapid development of the Internet of Things, the number of terminal devices is increasing exponentially. In the future, more than 50% of communications will come from machine-to-machine (M2M). Intelligent devices will need to complete identity judgment on communication requests from other devices.

[0003] When the number of devices in the network reaches a certain level, the ID is stored in the non-volatile memory (NVM). This device can steal internal information through various means, that is, it will indirectly leak the ID of others in the network. Once stolen by an intruder, the intruder can imitate the ID to communicate with the device, and the security performance is low.

[0004] In addition, when the number of devices in the network reaches a certain level, each device needs to save the IDs of all devices in the network. When this number reaches a certain level, the maintenance and management of the entire network will become extremely complicated and inefficient. For example, if a device modifies its ID, everyone in the network needs to be notified. In addition, the current ID requires a special protocol to complete identity authentication with others, that is, identity authentication and data encryption require different functional circuits to complete, which greatly increases the complexity of the system. Summary of the invention

[0005] The embodiments of the present application provide an interactive authentication method, apparatus and system, a computer device and a readable storage medium.

[0006] The present application provides an interactive authentication method, which is used at a sending end, and the sending end is connected to a receiving end in communication. The interactive authentication method includes: generating a first challenge and sending the first challenge to the receiving end; receiving a response sent by the receiving end, the response including first identity authentication information and a second challenge, the first identity authentication information and the second challenge being encrypted by a first identity authentication key; generating a second identity authentication key and a second identity authentication information according to the first challenge; decrypting the first identity authentication information using the second identity authentication key and matching the decrypted first identity authentication information with the second identity authentication information for identity authentication.

[0007] In some embodiments, the first authentication key and the first authentication information are generated by a first encryption circuit at the receiving end based on a biased time-averaged frequency direct periodic synthesis technique and a physically unclonable technique according to the first challenge.

[0008] In some embodiments, the second authentication key and the second authentication information are generated by a second encryption circuit based on a biased time-averaged frequency direct periodic synthesis technique and a physically unclonable technology according to the first challenge by the transmitter, and the properties of the first encryption circuit and the second encryption circuit remain consistent.

[0009] In some embodiments, the use of the second identity authentication key to decrypt the first identity authentication information and matching the decrypted first identity authentication information with the second identity authentication information for identity authentication includes: when the decrypted first identity authentication information is the same as the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge; when the decrypted first identity authentication information is not the same as the second identity authentication information, determining that the identity authentication of the receiving end has failed, and the sending end stops communicating with the receiving end.

[0010] In some embodiments, when the first identity authentication information after decryption is the same as the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge includes: generating a first information key based on the decrypted second challenge; using the first information key to encrypt the transmission information to obtain encrypted information; and sending the encrypted information to the receiving end.

[0011] In some implementations, encrypting the transmission information using the first information key to obtain encrypted information includes: encrypting the transmission information using the first information key through logical operations using a stream encryption method.

[0012] In some embodiments, the interactive authentication method further includes: receiving first summary information sent by the receiving end, the first summary information being obtained by processing a second information key generated by the receiving end according to the second challenge through a preset algorithm; processing the first information key through a preset algorithm to obtain second summary information, and matching the first summary information and the second summary information for decoding authentication.

[0013] In some embodiments, matching the first summary information and the second summary information for decoding authentication includes: when the first summary information and the second summary information are the same, determining that the decoding authentication is successful and sending a confirmation signal to the receiving end to end the communication; when the first summary information and the second summary information are not the same, determining that the decoding authentication fails.

[0014] The present application also provides an interactive authentication method, which is used at a receiving end, and the receiving end is in communication connection with a sending end. The interactive authentication method comprises: receiving a first challenge sent by the sending end; generating a first identity authentication key, first identity authentication information, and a second challenge according to the first challenge; encrypting the first identity authentication information and the second challenge using the first identity authentication key; and sending the encrypted first identity authentication information and the second challenge as a response to the sending end for identity authentication.

[0015] In some embodiments, the interactive authentication method also includes: receiving encrypted information sent by a sender, the encrypted information being obtained by the sender encrypting transmission information according to a first information key, the first information key being generated by the sender according to the second challenge; generating a second information key according to the second challenge; and decrypting the encrypted information using the second information key to obtain the transmission information.

[0016] In some implementations, decrypting the encrypted information using the second information key to obtain the transmission information includes: decrypting the encrypted information using the second information key through logical operations using a stream encryption method.

[0017] In some embodiments, the interactive authentication method further includes: processing the second information key through a preset algorithm to obtain first summary information, and sending the first summary information to the sending end for decoding authentication.

[0018] In some implementations, the interactive authentication method further includes: receiving a confirmation signal sent by the sending end to end the communication.

[0019] The present application also provides an interactive authentication sending device, which is used for a sending end, and the sending end is communicatively connected with a receiving end. The interactive authentication sending device includes: a first generation module, a first receiving module, a second generation module and a first authentication module. The first generation module is used to generate a first challenge and send the first challenge to the receiving end; the first receiving module is used to receive a response sent by the receiving end, the response includes first identity authentication information and a second challenge, and the first identity authentication information and the second challenge are encrypted by a first identity authentication key; the second generation module is used to generate a second identity authentication key and a second identity authentication information according to the first challenge; the first authentication module is used to decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information for identity authentication.

[0020] The present application also provides an interactive authentication receiving device, which is used for a receiving end, and the receiving end is communicatively connected with a sending end. The interactive authentication receiving device includes: a second receiving module, a third generating module, an encryption module, and a second authentication module. The second receiving module is used to receive a first challenge sent by the sending end; the third generating module is used to generate a first identity authentication key, a first identity authentication information, and a second challenge according to the first challenge; the encryption module is used to encrypt the first identity authentication information and the second challenge using the first identity authentication key; the second authentication module is used to send the encrypted first identity authentication information and the second challenge as a response to the sending end for identity authentication.

[0021] The present application also provides an interactive authentication system. The interactive authentication system includes: a sending end and a receiving end, the sending end is used to generate a first challenge and send the first challenge to the receiving end; the receiving end is used to receive the first challenge sent by the sending end, and is used to generate a first identity authentication key, a first identity authentication information, and a second challenge according to the first challenge, and is used to encrypt the first identity authentication information and the second challenge using the first identity authentication key, and is used to send the encrypted first identity authentication information and the second challenge to the sending end as a response; the sending end is used to generate a second identity authentication key and a second identity authentication information according to the first challenge, and is used to decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information for identity authentication.

[0022] The present application also provides a computer device, including a processor and a memory. The memory stores a computer program, and the computer program is executed by the processor to generate a first challenge and send the first challenge to the receiving end; receive a response sent by the receiving end, the response includes first identity authentication information and a second challenge, the first identity authentication information and the second challenge are encrypted by a first identity authentication key; generate a second identity authentication key and a second identity authentication information according to the first challenge; use the second identity authentication key to decrypt the first identity authentication information and match the decrypted first identity authentication information with the second identity authentication information to perform identity authentication.

[0023] The present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by one or more processors, it generates a first challenge and sends the first challenge to the receiving end; receives a response sent by the receiving end, the response including first identity authentication information and a second challenge, the first identity authentication information and the second challenge being encrypted by a first identity authentication key; generates a second identity authentication key and a second identity authentication information based on the first challenge; uses the second identity authentication key to decrypt the first identity authentication information and matches the decrypted first identity authentication information with the second identity authentication information for identity authentication.

[0024] The interactive authentication method, device and system, computer equipment and readable storage medium of the present application complete the identity authentication process through challenge response, and integrate identity authentication and data encryption. The key and identity ID are generated by the hardware TDP. Since the ID generated by the hardware is related to the hardware, it is only generated after power-on and cannot be migrated. It has a high degree of uniqueness, privacy and security, and does not need to be stored, which greatly increases the security of the system. In addition, the method has the characteristics of small area, low power consumption, easy integration, etc., and is suitable for FPGA chip systems due to its significant reconfigurability.

[0025] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0027] Figure 1 is an exemplary schematic diagram of the time average frequency of certain embodiments of the present application;

[0028] Figure 2 is a schematic diagram of a circuit structure of an exemplary clock generator according to certain embodiments of the present application;

[0029] Figure 3 is a schematic diagram of the structure of an exemplary integrated circuit of certain embodiments of the present application;

[0030] Figure 4 It is a schematic diagram of a scenario in which human bias is introduced into the interactive authentication method of certain embodiments of the present application;

[0031] Figure 5 is a schematic diagram of the architecture of a TAF-DPS-PUF digital fingerprint generator circuit in certain embodiments of the present application;

[0032] Figure 6 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0033] Figure 7 is a schematic diagram of the structure of an interactive authentication system of certain implementation modes of the present application;

[0034] Figure 8 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0035] Fig. 9 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0036] Fig.10 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0037] Fig.11 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0038] Fig.12 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0039] Fig.13 It is a flowchart of an interactive authentication method in some implementation modes of the present application;

[0040] Fig.14 It is a structural diagram of an interactive authentication sending device of certain implementation modes of the present application;

[0041] Fig.15 It is a structural diagram of an interactive authentication receiving device of certain embodiments of the present application. DETAILED DESCRIPTION

[0042] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0043] In the description of the present application, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application. In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0044] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection. It can be a mechanical connection or an electrical connection. It can be directly connected or indirectly connected through an intermediate medium. It can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to the specific circumstances.

[0045] The following describes the interactive authentication method and apparatus, system, computer device and readable storage medium of the embodiments of the present application with reference to the accompanying drawings.

[0046] The interactive authentication method of the present application integrates identity authentication and data encryption. The key and identity ID are generated by hardware TDP, where TDP technology can be explained as a combination of time-average-frequency direct period synthesis technology (TAF-DPS) and physical unclonable function technology (PUF). PUF is a "digital fingerprint" used as the unique identity of semiconductor devices (such as microprocessors). Since the ID generated by the hardware is related to the hardware and is only generated after power-on and cannot be migrated, it has a high degree of uniqueness, privacy and security, and does not need to be stored, which greatly increases the security of the system. In addition, the method has the characteristics of small area, low power consumption, and easy integration. Due to its significant reconfigurability, it is suitable for solutions for field-programmable gate arrays (FPGAs).

[0047] Understandably, if Figure 1 As shown in the figure, the time average frequency (TAF) is mainly composed of multiple cycles to form a pulse, which satisfies the effect of average frequency over a period of time. It can be described as:

[0048] T TAF =(1-r)T A +rT B

[0049] Among them, T TAF is the output pulse of TAF-DPS, T A and T B There are two periods, r represents T B The probability of occurrence is 1-r, which is T A The probability of occurrence.

[0050] See also Figure 2 The clock generator (TAF-DPS) may include: a first register R1, a second register R2, a third register R3, a fourth register R4, a first adder J11, a second adder J12, a first selector X1, a second selector X2, a third selector X3, a D flip-flop, a first inverter F01 and a second inverter F02.

[0051] Figure 2 The circuit structure diagram of an exemplary clock generator (eg, TAF-DPS) is shown. TAF-DPS mainly implements the working principle of TAF, and generates pulses of any frequency through control word F, and the relationship is as follows:

[0052]

[0053] Where F is the control word of TAF-DPS, which satisfies F=I+r, I is an integer, and r is a decimal between 0 and 1. is the phase difference between K adjacent input pulses.

[0054] Assume that the clock signal 108 transmitted to any clock generator TAF-DPS is CLK, and compared with the ideal clock CLK0 of the TAF-DPS, the clock delay of the clock signal 108 when transmitted to the TAF-DPS is ψ. Then the clock signal 108 transmitted to the TAF-DPS can be described as:

[0055]

[0056] Where ψ is usually the time delay caused by the long-distance transmission and load of the line. Assume that there are n functional modules in the integrated circuit S1 (refer to Figure 3 As shown), the clock signal transmitted to each TAF-DPS can be described as:

[0057]

[0058] Among them, ψ1, ψ2, ψ3…ψ n Each TAF-DPS has clock deviation due to clock distribution, and CLK0 is the ideal clock of the TAF-DPS.

[0059] In order to generate a unique chip fingerprint, this application uses a traditional TDP circuit whose error comes from manufacturing process deviation. When we introduce deviation artificially, the TDP circuit becomes a biased TDP. Since the magnitude of the artificially introduced deviation is much larger than the process deviation, the properties of the biased TDP can be guaranteed to be consistent, that is, the same challenge is input and the same response is generated. We call this biased TDP BTDP (Biased TDP). Please refer to Figure 4 , Among them, artificially introducing deviation means controlling the delay of the TDP line within the corresponding difference range. PUF is to design the two lines to be completely consistent, and then introduce deviation during production. The symmetric protocol in the symmetrical BDTP circuit of this application is based on the biased TAF-DPS-PUF, that is, transferring this deviation to the design period, and the delay of the two lines is different during design, for example Figure 1 In , if you make If the delay is larger, 0 is generated.

[0060] It can be understood that the system circuits of the transmitter and receiver in the interactive authentication method of the present application contain the time-averaged frequency direct periodic synthesis technology and physically unclonable function (BTDP circuit) with the same specifications of bias.

[0061] This application is an interactive authentication method based on biased TAF-DPS-PUF (TDP) technology. The circuit diagram of TAF-DPS-PUF is as follows Figure 5 As shown,

[0062] Among them, the clock period of TAF-DPS1 can be expressed as:

[0063]

[0064] The clock cycle of TAF-DPS2 can be expressed as:

[0065]

[0066] in, . and They are identical during design, but manufacturing deviations are introduced during production, causing and is inconsistent, so we define:

[0067] when When satisfied, the circuit DFF outputs a fixed value bm=1.

[0068] when When satisfied, the circuit DFF outputs a fixed value bm=0.

[0069] Through a series of We get a fixed 0 / 1 sequence by combining the above, which is the digital fingerprint of the chip. For example, if the sequence is 1010100, then 1010100 is the digital fingerprint. In the embodiment of the present application, the digital fingerprint may refer to the identity authentication key and identity authentication information of the present application.

[0070] The interactive authentication method of the embodiment of the present application is described below in conjunction with a specific embodiment. The interactive authentication method of the embodiment of the present application, wherein the implementation system corresponding to the interactive authentication method of the embodiment of the present application is a multi-party interactive process. Therefore, for the convenience of explanation, the description is first focused on the sending end, as follows:

[0071] Specifically, Figure 6 is an exemplary flow chart of an interactive authentication method based on a sending end side, wherein the sending end is connected to the receiving end for communication (such as Figure 7 As shown), the interactive authentication method includes:

[0072] S101: Generate a first challenge and send the first challenge to a receiving end;

[0073] S102: Receive a response sent by the receiving end, where the response includes first identity authentication information and a second challenge, where the first identity authentication information and the second challenge are encrypted by a first identity authentication key;

[0074] S103: Generate a second identity authentication key and second identity authentication information according to the first challenge;

[0075] S104: Decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information to perform identity authentication.

[0076] Specifically, see Figure 7 , the interactive authentication method of the present application first generates a first challenge F from the sending end to the receiving end, wherein the first challenge F is a control word information, for example, the specific value of F can be: F=108, F=384. The sending end can refer to terminal A, and the receiving end can refer to terminal B. The communication starts from terminal A, terminal A randomly generates a first challenge F, and sends the first challenge F to terminal B after encryption. The subsequent embodiments of the present application are all described with the sending end A and the receiving end B.

[0077] After receiving the first challenge F from the sending end A, the receiving end B generates a corresponding response according to the first challenge F. The response includes the first identity authentication key and the first identity authentication information. The first authentication key for authentication, The ID for authentication is the first authentication information. At the same time, the receiving end B will generate a new second challenge , the second challenge Same as the first challenge F. Second challenge The response generated according to the first challenge F is generated by intercepting the numbers in the response according to the preset protocol relationship between the sender A and the receiver B. For example, the first challenge F is 308, and the number of the response generated according to the first challenge F is 12344308. If the preset protocol relationship between the sender A and the receiver B is to intercept the last three digits in the response, the second challenge is obtained. The same as the first challenge F is 308. It should be noted that the first challenge F and the second challenge 308 is only a simple example for explaining the interactive authentication method of the present application. In actual applications, the first challenge F and the second challenge It can be other more complex numbers, which are not explained here one by one.

[0078] It is understandable that BTDP can be regarded as a function y=f(x), and its working mechanism is the same as PUF. The new challenge means giving x a new value, such as x=x0, and then getting y0=f(x0), where y0 is the response.

[0079] Then, the receiving end B will use the first authentication key First identity verification information And the second challenge Encryption is simple and highly secure. The encrypted ID and the new second challenge Sent to sender A.

[0080] It is understandable that the ID needs to be encrypted. If it is not encrypted, it can be stolen during the transmission of the ID. The ID is encrypted using a key. The encryption method can be stream encryption, which is not limited to the encryption method of stream encryption. It can also be other encryption methods, which are not limited here.

[0081] Specifically, the stream encryption method can be performed by performing an XOR process on the first identity authentication information, that is, performing an XOR logic operation: , to obtain the encrypted first identity authentication information.

[0082] Among them, XOR is a mathematical operator. It is used for logical operations. The mathematical symbol of XOR is "⊕", and the computer symbol is "xor". Its operation rule is: a⊕b. If the values ​​of a and b are different, the XOR result is 1. If the values ​​of a and b are the same, the XOR result is 0. XOR is also called half-addition operation, and its operation rule is equivalent to binary addition without carry: in binary, 1 represents true and 0 represents false. The operation rule of XOR is: 0⊕0=0, 1⊕0=1, 0⊕1=1, 1⊕1=0 (the same is 0, different is 1). For example, the first identity authentication information (ID) is represented in binary as 101001, and the first identity authentication key is 010101. The second identity authentication information (ID) encrypted according to the first identity authentication key 010101 is calculated bit by bit on the first identity authentication key and the first identity authentication information according to the XOR logic operation, and it can be concluded that the encrypted first identity authentication information (ID) is 111100.

[0083] It should be noted that the method of performing logical operation on the first identity verification information is not limited to the XOR operation method, and may also be other methods, such as "AND" or "NOT" operation, which is not limited here.

[0084] It can be understood that the sender A can generate a second identity authentication key and a second identity authentication information according to the first challenge F. That is, the second identity authentication key and the second identity authentication information refer to the response generated by the sender A according to the first challenge F. Then, the sender A decrypts the first identity authentication information using the second identity authentication key and matches the decrypted first identity authentication information with the second identity authentication information generated by itself to perform identity authentication.

[0085] Among them, see Figure 8 , using the second identity authentication key to decrypt the first identity authentication information and matching the decrypted first identity authentication information with the second identity authentication information to perform identity authentication (ie, step S104) includes:

[0086] S1041: When the decrypted first identity authentication information is identical to the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge;

[0087] S1042: When the decrypted first identity authentication information is different from the second identity authentication information, it is determined that the identity authentication of the receiving end has failed, and the sending end and the receiving end stop communicating.

[0088] Specifically, please combine Fig. 9 , the sender A receives the first identity authentication information from the receiver B , and use its own BTDP A Generate the second authentication key through the first challenge F and the second identity verification information is At this time, the sender A can decrypt the ID information of the receiver B ( ), and the decrypted first authentication information The second identity verification information generated by the sender A itself Compare them, if the two are consistent, complete the identity authentication of the receiving end B, if the two are inconsistent, stop the communication.

[0089] Understandably, the first identity verification information With the second identity verification information All of them are responses generated based on the first challenge F. Therefore, if the first identity authentication information and the second identity authentication information are the same, it means that the identities of the sender A and the receiver B are the same, and the verification is successful. If the first identity authentication information and the second identity authentication information are different, it means that the first identity authentication key is incorrect or the first identity authentication information is incorrect, the identities of the sender A and the receiver B are inconsistent, the verification fails, and the communication between the sender A and the receiver B is stopped.

[0090] In some embodiments, the first authentication key and first identity verification information The receiving end B is configured to generate a first encryption circuit (such as a first encryption circuit) based on a biased time average frequency direct periodic synthesis technology (TAF-DPS) and a physically unclonable function (PUF) according to a first challenge F. Figure 5 BTDP B generate.

[0091] In some embodiments, the second authentication key and second identity verification information The second encryption circuit BTDP based on the biased time average frequency direct periodic synthesis technology (TAF-DPS) and the physical unclonable technology (PUF) can be generated by the transmitter A according to the first challenge F. A Generate, the first encryption circuit BTDP B and the second encryption circuit BTDP A The properties of the two terminals are kept consistent, that is, the same challenge is input and the same response is generated, so that the encryption and decryption methods of the sender A and the receiver B are consistent.

[0092] See also Fig. 9 In some embodiments, when the decrypted first identity authentication information is the same as the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge (step S1041) includes:

[0093] S10411: Generate a first information key according to the decrypted second challenge;

[0094] S10412: Encrypt the transmission information using the first information key to obtain encrypted information;

[0095] S10413: Send the encrypted information to the receiving end.

[0096] Specifically, when the identity authentication of the receiving end B is passed, the sending end A will decode the second challenge The sender A uses the second challenge Generate a series of first information keys Then, the sender A uses the first information key Encrypt the plaintext PT to get the ciphertext , the plaintext PT is the information that the sender A wants to transmit to the receiver B, and the ciphertext CT is sent to the receiver B. The receiver B can then use the second challenge Self-generated second information key The received ciphertext CT is decrypted to obtain the plaintext PTB.

[0097] In some embodiments, encrypting the transmission information using the first information key to obtain the encrypted information includes: encrypting the transmission information using the first information key through a stream encryption method through a logical operation, wherein the logical operation is an exclusive OR operation.

[0098] Specifically, both encryption and decryption can adopt stream encryption (bit encryption), that is, encryption is performed separately according to the number of bits. In other embodiments of the present application, other encryption methods can also be used, which are not limited here. The embodiments of the present application all adopt XOR encryption and decryption, and the encryption process is consistent with the decryption process, as shown below:

[0099] Encryption process: y=x XOR k

[0100] Decryption process: x=y XOR k=(x XOR k) XOR k=x

[0101] Among them, y is the ciphertext, x is the original text, and k is the key.

[0102] It should be noted that the logic operation processing method here is not limited to the XOR operation method, and can also be other methods, such as "AND" and "NOT" operations, etc., which are not limited here.

[0103] The interactive authentication method of this application integrates data encryption and identity authentication. The stream encryption (bit encryption) method increases the complexity of the key, which brings great challenges to external destroyers invading the system. The symmetric BDTP circuit provides a way for two terminals to authenticate their identities. The two terminals have the same circuit, that is, they have the same ID, and can simply complete the authentication process through a challenge response pair.

[0104] See also Fig.10 In some embodiments, the interactive authentication method further comprises:

[0105] S105: Receive first summary information sent by the receiving end, where the first summary information is obtained by processing a second information key generated by the receiving end according to the second challenge through a preset algorithm;

[0106] S106: Process the first information key through a preset algorithm to obtain second summary information, and match the first summary information with the second summary information to perform decoding authentication.

[0107] Among them, see Fig.11 , step S60 further includes:

[0108] S1061: When the first summary information and the second summary information are the same, determine that the decoding authentication is successful and send a confirmation signal to the receiving end to end the communication;

[0109] S1062: When the first digest information and the second digest information are not identical, determine that the decoding authentication fails.

[0110] Specifically, the preset algorithm may be a hash algorithm, or other algorithms that realize reducing the first information key to the second summary information and reducing the second information key to the first summary information. In the embodiment of the present application, the preset algorithm is described as a hash algorithm. Figure 7 , the receiving end B will all the second information keys The first summary information hash is reduced through the hash algorithm ( ), and send it to the sender A. The sender A will send all the first information keys The second summary information hash is reduced through the hash algorithm ( ), and hash the second summary information ( ) and the first summary information hash sent by the receiving end B ( ) for comparison. If the two are consistent, the decoding is correct. If the two are inconsistent, the decoding is wrong.

[0111] In some embodiments, when the hash algorithm is verified, the sending end A sends a confirmation signal to the receiving end B, which may be an ACK signal, to prove that the entire communication process is completed correctly and to end the communication. When a decoding error occurs, if the summary information is not completely sent or an error occurs during the transmission process, the receiving end B may be controlled to resend the first summary information, and the first summary information may be re-compared with the second summary information to prove again whether the decoding is correct.

[0112] In summary, the interactive authentication method of the present application first automatically generates a symmetric key through a symmetrical BTDP circuit, without the need for key transmission, which effectively solves the problem of how to transmit the key when the key and the original text are the same length when using a stream encryption method. Secondly, since the ID and key are placed in non-volatile storage, there is a risk of being stolen. The interactive authentication method of the present application will only generate the corresponding key and ID when the BTDP circuit is working and loaded, without any storage, which increases the difficulty of cracking. In addition, the interactive authentication method of the present application completes identity authentication and data transmission through one circuit, increases circuit reusability, and reduces the overall overhead of the interactive authentication system.

[0113] The following describes the interactive authentication method of an embodiment of the present application focusing on the receiving end side.

[0114] Specifically, Fig.12 is an exemplary flow chart of an interactive authentication method centered at a receiving terminal B, wherein the receiving terminal B is in communication connection with a sending terminal A (eg Figure 7 As shown), the method comprises:

[0115] S201: receiving a first challenge sent by a sender;

[0116] S202: Generate a first identity authentication key, first identity authentication information, and a second challenge according to the first challenge;

[0117] S203: Encrypt the first identity authentication information and the second challenge using the first identity authentication key;

[0118] S204: Send the encrypted first identity authentication information and the second challenge as a response to the sending end for identity authentication.

[0119] Specifically, after receiving the first challenge F from the sending end A, the receiving end B generates a corresponding response according to the first challenge F. The response includes: and , As the first authentication key for authentication, The authentication ID is used as the first authentication information and a new second challenge is generated , by the first authentication key First identity verification information And the second challenge Encryption, the encryption method is simple and highly secure. The encrypted ID and the new challenge are sent to the sender A.

[0120] See also Fig.13 In some embodiments, the interactive authentication method further comprises:

[0121] S205: receiving encrypted information sent by the sending end, where the encrypted information is obtained by the sending end by encrypting the transmission information according to the first information key, where the first information key is generated by the sending end according to the second challenge;

[0122] S206: Generate a second information key according to the second challenge;

[0123] S207: Decrypt the encrypted information using the second information key to obtain the transmission information.

[0124] The encrypted information may be decrypted by using the second information key through a stream encryption method and a logical operation. Specifically, the logical operation may be an exclusive OR operation.

[0125] In some embodiments, the interactive authentication method further comprises:

[0126] S208: Process the second information key through a preset algorithm to obtain first summary information, and send the first summary information to the sending end for decoding authentication.

[0127] The preset algorithm may be a hash algorithm or other algorithm that reduces the second information key to the first summary information.

[0128] In some embodiments, the interactive authentication method further includes: receiving a confirmation signal sent by the sending end to end the communication.

[0129] It should be noted that the above-mentioned interactive authentication method described mainly at the sending end is also applicable to the receiving end of the embodiment of the present application. The implementation principle is similar and will not be repeated here.

[0130] In summary, the interactive authentication method of the present application first automatically generates a symmetric key through a symmetric BTDP circuit, without the need for key transmission, which effectively solves the problem of how to transmit the key when the key and the original text are the same length when using a stream encryption method. Secondly, since the ID and key are placed in non-volatile storage, there is a risk of being stolen. The interactive authentication method of the present application will only generate the corresponding key and ID when the circuit is working and loaded, without any storage, which increases the difficulty of cracking. In addition, the interactive authentication method of the present application completes identity authentication and data transmission through one circuit, which increases the circuit reusability and reduces the overall overhead of the interactive authentication system.

[0131] To implement the above embodiment, please combine Fig.14 The present application also provides an interactive authentication sending device 100, which is used for a sending end and is connected to a receiving end for communication. The interactive authentication sending device 100 includes: a first generating module 101, a first receiving module 102, a second generating module 103 and a first authentication module 104.

[0132] The first generating module 101 is used to generate a first challenge and send the first challenge to the receiving end B.

[0133] The first receiving module 102 is used to receive a response sent by the receiving end B, where the response includes first identity authentication information and a second challenge, and the first identity authentication information and the second challenge are encrypted by a first identity authentication key.

[0134] The second generating module 103 is used to generate a second identity authentication key and second identity authentication information according to the first challenge.

[0135] The first authentication module 104 is used to decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information to perform identity authentication.

[0136] It should be noted that the aforementioned interactive authentication method described mainly at the sending end is also applicable to the interactive authentication sending device 100 at the sending end of the embodiment of the present application. The implementation principle is similar and will not be repeated here.

[0137] In summary, the interactive authentication sending device 100 of the present application completes the identity authentication process through a challenge response pair, integrating identity authentication and data encryption. The key and identity ID are both generated by the hardware TDP. Since the ID generated by the hardware is related to the hardware, it is only generated after power-on and cannot be migrated. It has a high degree of uniqueness, privacy and security, and does not require storage, which greatly increases the security of the system.

[0138] To implement the above embodiment, please combine Fig.15 The present application also provides an interactive authentication receiving device 200, which is used for a receiving end, and the receiving end is connected to a sending end for communication. The interactive authentication device 200 includes: a second receiving module 201, a third generating module 202, an encryption module 203 and a second authentication module 204.

[0139] The second receiving module 201 is used to receive the first challenge sent by the sending end.

[0140] The third generating module 202 is used to generate a first identity authentication key, first identity authentication information and a second challenge according to the first challenge.

[0141] The encryption module 203 is used to encrypt the first identity authentication information and the second challenge using the first identity authentication key.

[0142] The second authentication module 204 is used to send the encrypted first identity authentication information and the second challenge as a response to the sending end for identity authentication.

[0143] It should be noted that the aforementioned interactive authentication method described mainly at the receiving end is also applicable to the interactive authentication receiving device 200 at the receiving end of the embodiment of the present application. The implementation principle is similar and will not be repeated here.

[0144] In summary, the interactive authentication receiving device 200 of the present application completes the identity authentication process through challenge response, integrating identity authentication and data encryption. The key and identity ID are both generated by the hardware TDP. Since the ID generated by the hardware is related to the hardware, it is only generated after power-on and cannot be migrated. It has a high degree of uniqueness, privacy and security, and does not require storage, which greatly increases the security of the system.

[0145] See also Figure 7 The present application also provides an interactive authentication system 1000. The interactive authentication system 1000 includes: a sending end A and a receiving end B.

[0146] The sending end A is used to generate a first challenge F and send the first challenge to the receiving end B.

[0147] The receiving end B is used to receive the first challenge F sent by the sending end A, and to generate a first identity authentication key, a first identity authentication information and a second challenge according to the first challenge F, and to use the first identity authentication key to authenticate the first identity authentication information and the second challenge Encryption is performed, and the encrypted first identity authentication information and the second challenge are sent to the sending end A as a response.

[0148] The sender A is used to generate a second identity authentication key and second identity authentication information according to the first challenge, and to decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information for identity authentication.

[0149] The interactive authentication system 1000 of the present application completes the identity authentication process of the sender and the receiver through a challenge response pair, and integrates identity authentication and data encryption. The key and identity ID are generated by the hardware TDP. Since the ID generated by the hardware is related to the hardware, it is only generated after power-on and cannot be migrated. It has a high degree of uniqueness, privacy and security, and does not need to be stored, which greatly increases the security of the system. In addition, the method has the characteristics of small area, low power consumption, and easy integration. Due to its significant reconfigurability, it is suitable for solutions for field-programmable gate arrays (FPGAs).

[0150] The present application also provides a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the interactive authentication method of any of the above-mentioned embodiments is implemented.

[0151] The embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed by one or more processors, the interactive authentication method of any of the above embodiments is implemented.

[0152] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), etc.

[0153] In the present application, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0154] The disclosure below provides many different embodiments or examples to realize the different structures of the present application. In order to simplify the disclosure of the present application, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present application. In addition, the present application can repeat reference numbers and / or reference letters in different examples, and this repetition is for the purpose of simplification and clarity, which itself does not indicate the relationship between the various embodiments and / or settings discussed. In addition, the various specific processes and material examples provided by the present application, but those of ordinary skill in the art can appreciate the application of other processes and / or the use of other materials.

[0155] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0156] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. An interactive authentication method, used at a sending end, wherein the sending end is connected to a receiving end for communication, characterized in that: The interactive authentication method comprises: generating a first challenge and sending the first challenge to the receiving end; receiving a response sent by the receiving end, the response comprising first identity authentication information and a second challenge, wherein the first identity authentication information and the second challenge are encrypted by a first identity authentication key; generating a second identity authentication key and second identity authentication information according to the first challenge; Decrypting the first identity authentication information using the second identity authentication key and matching the decrypted first identity authentication information with the second identity authentication information for identity authentication; The first identity authentication key and the first identity authentication information are generated by a first encryption circuit based on a biased time average frequency direct periodic synthesis technique and a physical unclonable technique at the receiving end according to the first challenge; The second authentication key and the second authentication information are generated by the second encryption circuit based on the biased time-averaged frequency direct periodic synthesis technology and the physical unclonable technology according to the first challenge by the sending end, and the properties of the first encryption circuit and the second encryption circuit are consistent.

2. The interactive authentication method according to claim 1, characterized in that: The step of decrypting the first identity authentication information by using the second identity authentication key and matching the decrypted first identity authentication information with the second identity authentication information to perform identity authentication includes: In the case where the decrypted first identity authentication information is the same as the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge; When the decrypted first identity authentication information is different from the second identity authentication information, it is determined that the identity authentication of the receiving end has failed, and the sending end stops communicating with the receiving end.

3. The interactive authentication method according to claim 2, characterized in that: When the decrypted first identity authentication information is the same as the second identity authentication information, determining that the identity authentication of the receiving end is passed and decrypting the second challenge includes: generating a first information key according to the decrypted second challenge; Encrypting the transmission information using the first information key to obtain encrypted information; The encrypted information is sent to the receiving end.

4. The interactive authentication method according to claim 3, characterized in that: The step of encrypting the transmission information by using the first information key to obtain the encrypted information comprises: The transmission information is encrypted by using the first information key through logical operation in a stream encryption manner.

5. The interactive authentication method according to claim 3, characterized in that: The interactive authentication method further comprises: receiving first summary information sent by the receiving end, where the first summary information is obtained by processing a second information key generated by the receiving end according to the second challenge through a preset algorithm; The first information key is processed into second summary information through a preset algorithm, and the first summary information and the second summary information are matched to perform decoding authentication.

6. The interactive authentication method according to claim 5, characterized in that: The matching the first summary information and the second summary information for decoding authentication comprises: When the first digest information and the second digest information are the same, determining that the decoding authentication is successful and sending a confirmation signal to the receiving end to end the communication; When the first digest information and the second digest information are different, it is determined that the decoding authentication fails.

7. An interactive authentication method, used at a receiving end, the receiving end being communicatively connected with a sending end, characterized in that: The interactive authentication method comprises: receiving a first challenge sent by the sending end; generating a first identity authentication key, first identity authentication information, and a second challenge according to the first challenge; encrypting the first identity authentication information and the second challenge using the first identity authentication key; sending the encrypted first identity authentication information and the second challenge to the sending end as a response, so that the sending end generates a second identity authentication key and a second identity authentication information according to the first challenge, decrypts the first identity authentication information using the second identity authentication key, and matches the decrypted first identity authentication information with the second identity authentication information for identity authentication; The first identity authentication key and the first identity authentication information are generated by a first encryption circuit based on a biased time average frequency direct periodic synthesis technique and a physical unclonable technique at the receiving end according to the first challenge; The second authentication key and the second authentication information are generated by the second encryption circuit based on the biased time-averaged frequency direct periodic synthesis technology and the physical unclonable technology according to the first challenge by the sending end, and the properties of the first encryption circuit and the second encryption circuit are consistent.

8. The interactive authentication method according to claim 7, characterized in that: The interactive authentication method further comprises: receiving encrypted information sent by a sending end, where the encrypted information is obtained by the sending end by encrypting transmission information according to a first information key, where the first information key is generated by the sending end according to the second challenge; generating a second information key according to the second challenge; The encrypted information is decrypted using the second information key to obtain the transmission information.

9. The interactive authentication method according to claim 8, characterized in that: The decrypting the encrypted information by using the second information key to obtain the transmission information comprises: The encrypted information is decrypted using the second information key through logical operation in a stream encryption manner.

10. The interactive authentication method according to claim 8, characterized in that: The interactive authentication method further comprises: The second information key is processed by a preset algorithm to obtain first summary information, and the first summary information is sent to the sending end for decoding authentication.

11. The interactive authentication method according to claim 7, characterized in that: The interactive authentication method further comprises: A confirmation signal sent by the sending end is received to end the communication.

12. An interactive authentication sending device, used for a sending end, the sending end is connected to a receiving end for communication, characterized in that: The interactive authentication sending device comprises: A first generating module, the first generating module is used to generate a first challenge and send the first challenge to the receiving end; A first receiving module, the first receiving module is used to receive a response sent by the receiving end, the response includes first identity authentication information and a second challenge, the first identity authentication information and the second challenge are encrypted by a first identity authentication key; a second generating module, the second generating module being configured to generate a second identity authentication key and second identity authentication information according to the first challenge; a first authentication module, the first authentication module being used to decrypt the first identity authentication information using the second identity authentication key and to match the decrypted first identity authentication information with the second identity authentication information for identity authentication; The first identity authentication key and the first identity authentication information are generated by a first encryption circuit based on a biased time average frequency direct periodic synthesis technique and a physical unclonable technique at the receiving end according to the first challenge; The second authentication key and the second authentication information are generated by the second encryption circuit based on the biased time-averaged frequency direct periodic synthesis technology and the physical unclonable technology according to the first challenge by the sending end, and the properties of the first encryption circuit and the second encryption circuit are consistent.

13. An interactive authentication receiving device, used at a receiving end, the receiving end being communicatively connected with a sending end, characterized in that: The interactive authentication receiving device comprises: A second receiving module, the second receiving module is used to receive the first challenge sent by the sending end; a third generating module, the third generating module being configured to generate a first identity authentication key, first identity authentication information, and a second challenge according to the first challenge; an encryption module, the encryption module being configured to encrypt the first identity authentication information and the second challenge using the first identity authentication key; a second authentication module, wherein the second authentication module is used to send the encrypted first identity authentication information and the second challenge to the sending end as a response, so that the sending end generates a second identity authentication key and a second identity authentication information according to the first challenge, and uses the second identity authentication key to decrypt the first identity authentication information, and matches the decrypted first identity authentication information with the second identity authentication information to perform identity authentication; The first identity authentication key and the first identity authentication information are generated by a first encryption circuit based on a biased time average frequency direct periodic synthesis technique and a physical unclonable technique at the receiving end according to the first challenge; The second authentication key and the second authentication information are generated by the second encryption circuit based on the biased time-averaged frequency direct periodic synthesis technology and the physical unclonable technology according to the first challenge by the sending end, and the properties of the first encryption circuit and the second encryption circuit are consistent.

14. An interactive authentication system, characterized in that: The interactive authentication system comprises: a sending end and a receiving end, The sending end is used to generate a first challenge and send the first challenge to the receiving end; The receiving end is used to receive the first challenge sent by the sending end, and to generate a first identity authentication key, first identity authentication information, and a second challenge according to the first challenge, and to encrypt the first identity authentication information and the second challenge using the first identity authentication key, and to send the encrypted first identity authentication information and the second challenge as a response to the sending end; The sending end is used to generate a second identity authentication key and second identity authentication information according to the first challenge, and to decrypt the first identity authentication information using the second identity authentication key and match the decrypted first identity authentication information with the second identity authentication information for identity authentication; The first identity authentication key and the first identity authentication information are generated by a first encryption circuit based on a biased time average frequency direct periodic synthesis technique and a physical unclonable technique at the receiving end according to the first challenge; The second authentication key and the second authentication information are generated by the second encryption circuit based on the biased time-averaged frequency direct periodic synthesis technology and the physical unclonable technology according to the first challenge by the sending end, and the properties of the first encryption circuit and the second encryption circuit are consistent.

15. A computer device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the computer program is executed by the processor to implement the method according to any one of claims 1 to 11.

16. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by one or more processors, the method of any one of claims 1 to 11 is implemented.

Images