Method and system for bidirectional authentication and session key negotiation of NFC passive lock

Abstract

The invention belongs to the technical field of key agreement, and particularly relates to a bidirectional authentication and session key agreement method and system for an NFC passive lock, and the method comprises the following steps: S1, a mobile phone side generates a first temporary private key and a first random number, and carries out the first temporary private key agreement on the basis of an identity label of the NFC passive lock, the first random number, and a first base point G and a second base point P of an elliptic curve; and calculating a first temporary public key by using the first hash function, and sending the first temporary public key and the first random number to the NFC passive lock. According to the invention, on the premise that the hardware storage burden of the NFC passive lock is not increased, safe bidirectional authentication and key negotiation are realized, the capability of resisting physical attacks and network attacks is improved, and the confidentiality and integrity of communication are guaranteed.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of key agreement, and particularly relates to a bidirectional authentication and session key agreement method and system for an NFC passive lock. BACKGROUND

[0002] With the rapid development of the Internet of Things technology, the near field communication (NFC) technology is often applied to the fields of intelligent door locks, mobile payments, identity recognition and the like due to its convenience and low power consumption. In particular, in the intelligent door lock system, the NFC passive lock becomes an important development direction in the market due to its advantages of not needing a built-in power supply, low cost and simple maintenance. The NFC passive lock completes power supply and data communication through the radio frequency field energy provided by an NFC reading and writing device such as a mobile phone in near field interaction. However, the communication channel between the mobile phone and the NFC passive lock is open, and is vulnerable to many security threats such as eavesdropping, replay attacks and man-in-the-middle attacks. Therefore, establishing a secure communication session between the two, realizing bidirectional identity authentication and session key agreement, is a core problem of guaranteeing the security of the NFC passive lock.

[0003] Most of the existing NFC security schemes use encryption algorithms to protect the communication content. Although the traditional symmetric encryption scheme has small computational overhead, it faces the problems of key distribution and management. The schemes based on the public key cryptography system, such as the elliptic curve cryptography, are suitable for application in resource-limited devices due to the advantages of short key length and high computational efficiency under the same security strength. The elliptic curve Diffie-Hellman key exchange protocol is a commonly used method for establishing a shared key. However, the standard ECDHE protocol itself does not provide identity authentication function and cannot resist man-in-the-middle attacks. Researchers have proposed some improved schemes to try to integrate identity information into the key exchange process. However, the need to store a long-term private key or certificate in the NFC passive lock not only increases the storage overhead, but also brings security risks. How to design a protocol that can realize efficient bidirectional authentication, avoid long-term private key storage, and fully adapt to the computational ability and storage space limitation of the NFC passive lock is still an important challenge in the current research field. SUMMARY

[0004] The application provides a bidirectional authentication and session key agreement method and system for an NFC passive lock to solve the technical problem of security risks and storage space limitation in the existing schemes.

[0005] In a first aspect, the application provides a bidirectional authentication and session key agreement method for an NFC passive lock, comprising the following steps: S1, generating a first temporary private key on a mobile phone side and a first random number , and generating a first message authentication code based on the identity of the NFC passive lock , the first random number , first base point G and second base point P of an elliptic curve, using a first hash function calculating a first temporary public key , the first temporary public key and the first random number to the NFC passive lock; S2, the NFC passive lock receives the first temporary public key and the first random number , the first random number is input into the built-in PUF to generate a second temporary private key , and a second random number is generated, a second temporary public key = ×G, the second temporary public key and the second random number are sent to the mobile phone end; the mobile phone end and the NFC passive lock obtain a shared elliptic curve point × and respectively by calculating , and the x coordinate is extracted from the shared elliptic curve point as a shared secret ; S3, based on the shared secret and the identity , an authentication key AK is calculated using a second hash function , and a third hash function is used for mutual authentication, wherein the mobile phone end calculates a first authentication code and sends it to the NFC passive lock for verification, and the NFC passive lock calculates a second authentication code and sends it to the mobile phone end for verification after verification; S4, after mutual authentication, both sides use KDF to calculate a session key based on the shared secret , the y coordinate of the shared elliptic curve point , the first random number and the second random number .

[0006] Further, in S1, the first temporary private key and the first random number are generated by a 256-bit secure random number generator.

[0007] Further, the first random number is input into the built-in PUF to generate a second temporary private key , including: The PUF is an arbiter physical unclonable function, and the first random number The challenge value is input to the arbiter PUF, and a stable second temporary private key is extracted from the response value output by the arbiter PUF using the fuzzy extractor .

[0008] Further, the NFC passive lock obtains the shared elliptic curve point by calculating and , comprising: The NFC passive lock splices its own identity with the received first random number ; calculates a hash digest value using a first hash function , and converts the hash digest value into an integer h; calculates the elliptic curve point ; subtracts the point from the received first temporary public key to obtain an adjusted point ; performs elliptic curve scalar multiplication on the adjusted point using the second temporary private key to obtain the shared elliptic curve point .

[0009] Further, bidirectional authentication is performed using a third hash function , comprising: The mobile phone end splices the serialized byte string of the first temporary public key and the second random number , and performs message authentication code calculation on the spliced result using the authentication key AK as the key to generate a first authentication code ; After the NFC passive lock receives the first authentication code , it locally calculates a first authentication code for verification in the same way , and if is equal to , the mobile phone end is authenticated to pass; The NFC passive lock splices the serialized byte string of the second temporary public key and the first random number using the authentication key AK as the key, and performs message authentication code calculation on the spliced result to generate a second authentication code ; After the mobile phone end receives the second authentication code , it locally calculates a second authentication code for verification in the same way , and if is equal to , the NFC passive lock is authenticated to pass.

[0010] ​Further, the third hash function is a message authentication code algorithm based on SHA-256.

[0011] Further, the session key is calculated based on the shared secret , the y coordinate of the shared elliptic curve point , the first random number and the second random number using the KDF, including: The shared secret is serialized into a byte string as the input key material, the concatenation of the first random number and the second random number is taken as the salt value, and the y coordinate of the shared elliptic curve point is serialized into a byte string as the application-specific information, and a 128-bit session key is derived.

[0012] Further, in S1, the first hash function is the SHA-256 algorithm.

[0013] Further, in S1, the elliptic curve is the secp256r1 curve.

[0014] In a second aspect, the application provides a two-way authentication and session key negotiation system for NFC passive locks, including a memory and a processor, and the memory stores computer program instructions which, when executed by the processor, implement the two-way authentication and session key negotiation method for NFC passive locks.

[0015] The beneficial effects are: the application uses a physically unclonable function to generate a temporary private key of an NFC passive lock in response to a random number challenge from a mobile phone, which can resist side channel attacks, physical extraction and other attack means on hardware. By integrating the identity of the NFC passive lock into the calculation process of the temporary public key of the mobile phone, implicit binding of key exchange and identity information is achieved, so that the key negotiation process can naturally resist man-in-the-middle attacks, enhancing the inherent security of the protocol. After establishing a shared secret, an explicit two-way authentication challenge and response mechanism containing random numbers is designed, which not only can confirm the authenticity of each other's identity, but also can prevent replay attacks. The method realizes secure two-way authentication and key negotiation without increasing the hardware storage burden of the NFC passive lock, enhances the ability to resist physical and network attacks, and guarantees the confidentiality and integrity of communication. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of the two-way authentication and session key negotiation method for NFC passive locks. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0018] The embodiments of the NFC passive lock bidirectional authentication and session key negotiation method provided by the present application include the following steps: As shown in the figure, the NFC passive lock bidirectional authentication and session key negotiation method includes the following steps: Figure 1 S1, the mobile phone end generates a first temporary private key and a first random number , and calculates a first temporary public key based on the identity of the NFC passive lock , the first random number , a first base point G and a second base point P of an elliptic curve, using a first hash function , sends the first temporary public key and the first random number to the NFC passive lock.

[0019] Specifically, the mobile phone end selects a standard elliptic curve such as secp256r1, and the curve public parameters include the first base point G. Another public second base point P of the elliptic curve is preset. The mobile phone end generates an integer as the first temporary private key, and a 128-bit first random number through a cryptographically secure random number generator. The identity of the NFC passive lock is a unique serial number. The first hash function is SHA-256. The mobile phone end splices and , calculates the hash value using SHA-256, and uses the hash value as a scalar. The mobile phone end performs two elliptic curve scalar multiplication operations ×G and ( || )×P, and one elliptic curve point addition operation, to obtain the temporary public key point . The mobile phone end sends the coordinates of the first temporary public key and the first random number to the NFC passive lock through the NFC communication interface.

[0020] In an optional embodiment, the first temporary private key and the first random number​ generated by a 256-bit secure random number generator; the first hash function is the SHA-256 algorithm; the elliptic curve is the secp256r1 curve.

[0021] Specifically, the hardware security module inside the mobile phone calls a secure random number generator that meets the NIST SP800-90A standard, which continuously collects noise from a physical entropy source. This process generates a 256-bit random number twice in succession; The first generated random number is used as the first temporary private key , for example The value of is the hexadecimal number 18E14A7B6A307F426A94F8114701E7C8E774E7F9A47E2C2035DB29A206321725. The second generated random number is used as the first random number , for example The value of is the hexadecimal number C9A3F45B8E6F4B2D8C1A7E9F6D5C4B3A29E8D7C6B5A4F392E1D0C9B8A7F6E5D4.

[0022] The first hash function is specified as the SHA-256 algorithm, which can map input data of any length to a fixed 256-bit hash value. The curve used in elliptic curve cryptography is secp256r1, which provides a security strength of 128 bits, and parameters such as the base point P and the order n are public standards, ensuring interoperability and security between different devices. For example, the x-coordinate of the base point P is: 6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296.

[0023] S2, the NFC passive lock receives the first temporary public key and the first random number After that, the first random number is input into the built-in PUF to generate the second temporary private key , and the second random number is generated, the second temporary public key = ×G, the second temporary public key and the second random number are sent to the mobile phone; the mobile phone and the NFC passive lock respectively obtain the shared elliptic curve point × and by calculating and extracts the x-coordinate as a shared secret . .

[0024] In particular, the NFC passive lock receives energy and data through the antenna and . It inputs the received as a challenge to the internal PUF circuit. The PUF circuit generates a unique, unpredictable but repeatable response according to the unique physical microstructure, to the challenge . The response is subjected to SHA-256 hash operation and modulo operation on the order of the elliptic curve, to obtain an integer as the second temporary private key . At the same time, the NFC passive lock generates a 128-bit second random number using a hardware random number generator. The NFC passive lock performs an elliptic curve scalar multiplication operation ×G, to obtain the second temporary public key . The NFC passive lock sends and back to the mobile phone end through the NFC interface.

[0025] After receiving the second temporary public key , the mobile phone end performs an elliptic curve scalar multiplication operation on using the held first temporary private key , that is, calculates . The NFC passive lock end, using the same first hash function , identity and received first random number , calculates the value of , performs an elliptic curve point subtraction operation, subtracts the value from the received first temporary public key , to obtain an intermediate result . The NFC passive lock performs scalar multiplication on the intermediate result using the second temporary private key , that is, calculates . Due to the commutative law of elliptic curve operation, the shared elliptic curve point calculated by both parties is exactly the same. Both parties extract the x-coordinate component of the shared elliptic curve point as the shared secret .

[0026] In an optional embodiment, the first random number is input into the built-in PUF to generate the second temporary private key , including: The PUF is an arbiter physical unclonable function, and the first random number The challenge value is input to the arbitrator PUF, and a stable second temporary private key is extracted from the response value output by the arbitrator PUF using a fuzz extractor. .

[0027] Specifically, the NFC passive lock's chip integrates a 64-level arbiter physically unclonable function. When the lock receives a 256-bit first random number... At that time, it will The first 64 bits are used as the challenge value. Each challenge value controls the selection input of a first-stage multiplexer, thus determining the path of a pair of parallel circuits. Due to submicron-level physical differences in the manufacturing process, there will always be a slight difference in the signal transmission delay between the two paths. An arbitrator at the end of the circuit determines which path's signal arrives first, outputting a 1-bit response value of 0 or 1. This process is repeated four times, using the first random number. Different segments are used as challenge values ​​to generate a 256-bit raw response.

[0028] Specifically, due to fluctuations in ambient temperature and voltage, the arbitrator's PUF response to the same challenge value may contain a small number of bit errors, making it unstable. To generate a fixed private key, a PUF response measurement is performed during the initialization phase before the lock leaves the factory, from which a stable 256-bit second temporary private key is generated. And an auxiliary data string. This auxiliary data string does not reveal any information about... Any information is stored in the lock's non-volatile memory. During the actual authentication process, when the PUF determines the challenge value... When a new, potentially noisy, response is generated, the fuzzy extractor algorithm combines the noisy response with a pre-stored auxiliary data string and uses an error-correcting code mechanism to recover the second temporary private key, which is identical to the one used in the initialization phase. .

[0029] In an optional embodiment, the NFC passive lock respectively calculates Obtain shared elliptic curve points ,include: NFC passive locks identify themselves With the first random number received Perform concatenation; use the first hash function. Calculate the hash digest value and convert it into an integer h; calculate the elliptic curve points. From the first temporary public key received Subtraction point Get the adjusted points Using a second temporary private key For the adjusted points Perform scalar multiplication on elliptic curves to obtain the points on the shared elliptic curve. .

[0030] Specifically, assuming the identity identifier of an NFC passive lock The first random number received is byte string 4C4F434B303031. The byte string is C9A3...E5D4. The NFC passive lock concatenates the two byte strings sequentially into a new long byte string. It takes the concatenated byte string as input and calls the SHA-256 algorithm to calculate a 256-bit hash digest value. This digest value is interpreted as a large integer h. The NFC passive lock performs elliptic curve scalar multiplication, multiplying the integer h by the second base point P of the secp256r1 curve to obtain a new elliptic curve point, denoted as... .

[0031] The first temporary public key sent from the mobile device It is itself an elliptic curve point. The NFC passive lock performs subtraction on elliptic curve points, that is, using... Subtract the points calculated above Result point Subtraction of a point on an elliptic curve is defined as adding the negative of a point. NFC passive locks use a second temporary private key generated via PUF. A 256-bit integer, for points Perform elliptic curve scalar multiplication. The result of the operation is the shared elliptic curve points. This point contains secret information from both the mobile device and the lock, laying the foundation for the subsequent generation of session keys.

[0032] S3, based on shared secrets and identity identifier Using the second hash function Calculate the authentication key AK and use a third hash function. Two-way authentication is performed, with the mobile device calculating the first authentication code. The code is then sent to the NFC passive lock for verification. After successful verification, the NFC passive lock calculates a second authentication code. And send it to the mobile device for verification.

[0033] Specifically, the second hash function and the third hash function Both are SHA-256 encoded. The two parties will share the secret. Identity identifier with NFC passive lock To splice together, using Calculate the hash value to generate the authentication key AK. The mobile device then sends the authentication key AK and its own first temporary public key to the device. and the second random number received from the lock and send to the NFC passive lock. The NFC passive lock calculates an authentication code in the same way and compares with the received If they are the same, the authentication of the phone is successful. After the authentication is passed, the NFC passive lock concatenates the authentication key AK, its own second temporary public key and the first random number received from the phone and sends to the phone. The phone also calculates and compares, if they are the same, the authentication of the NFC passive lock is successful.

[0034] In an optional embodiment, a third hash function is used for mutual authentication, including: The phone concatenates the serialized byte string of the first temporary public key and the second random number and calculates a message authentication code on the concatenation result using the authentication key AK as the key, to generate a first authentication code ; After the NFC passive lock receives the first authentication code , it calculates a first authentication code for verification in the same way , if is equal to , the authentication of the phone is passed; The NFC passive lock concatenates the serialized byte string of the second temporary public key and the first random number and calculates a message authentication code on the concatenation result using the authentication key AK as the key, to generate a second authentication code ; After the phone receives the second authentication code , it calculates a second authentication code for verification in the same way , if is equal to , the authentication of the NFC passive lock is passed.

[0035] Specifically, to verify the legitimacy of the phone, the phone first compresses and serializes the first temporary public key into a 33-byte string according to the X9.62 standard, and then concatenates it with the 32-byte second random number generated by the NFC passive lock into a 65-byte message. The phone uses the pre-shared authentication key AK as the key to calculate a message authentication code on the 65-byte message, to generate a first authentication code ​​​​The function's key calculates the message authentication code for a 65-byte message and generates the first authentication code. And send it to the lock. The lock receives it. Then, using their stored authentication key AK and the known first temporary public key... And the second random number I generated myself Repeat the exact same splicing and calculation process locally to obtain a verification code. By comparing byte by byte and received If they are completely identical, it proves that the message source is a mobile device holding the correct authentication key AK, and the authentication is successful.

[0036] To verify the legitimacy of the NFC passive lock, the authentication process is reversed once. The NFC passive lock transmits the second temporary public key. The serialized string is converted to a 33-byte string, and then compared with the first 32-byte random number sent from the mobile device. Concatenate them into a 65-byte message. The NFC passive lock uses the same authentication key AK, through... The function calculates the second authentication code. And send it to the mobile device. The mobile device receives the second authentication code. Then, similarly, they used their stored authentication key AK and the known second temporary public key locally. and the first random number you generated Perform the same calculation to obtain the verification code. If the calculated With received If the identities are completely equal, the mobile phone confirms the legitimacy of the NFC passive lock. At this point, two-way authentication is complete, ensuring that the identities of both communicating parties are trustworthy.

[0037] In an optional embodiment, the third hash function It is a message authentication code algorithm based on SHA-256.

[0038] Specifically, during two-way authentication, a first authentication code is generated. Second authentication code The third hash function It is explicitly identified as the HMAC-SHA256 algorithm. The HMAC-SHA256 algorithm is a key-based hash function that uses SHA-256 as its core hash engine. When the mobile device calculates the first authentication code... At that time, it uses the authentication key AK and the concatenated message data as the two inputs to the HMAC-SHA256 function.

[0039] The calculation process of HMAC-SHA256 follows the standard of RFC2104. The authentication key AK is processed by internal and external padding constants, and the processed key and the message data are subjected to two consecutive SHA-256 hash operations. This process produces a 256-bit output, i.e. the authentication code. For example, the formula for calculating the first authentication code at the mobile phone end is HMAC-SHA256. Due to the characteristics of the HMAC algorithm, even if an attacker intercepts the message and the authentication code, it is impossible to forge or tamper with a new authentication code without knowing the authentication key AK, thereby ensuring the security of the authentication process.

[0040] S4, after the two-way authentication is passed, the two parties use the KDF to calculate the session key based on the shared secret , the y-coordinate of the shared elliptic curve point , the first random number and the second random number .

[0041] Specifically, after both two-way authentications are successful, the two parties use a standard key derivation function (KDF), such as the HMAC-based key derivation function HKDF-SHA256. The two parties input the shared secret , i.e. the x-coordinate of the shared elliptic curve point as the initial key material, and the y-coordinate of the shared elliptic curve point , the first random number at the mobile phone end and the second random number at the NFC passive lock end as the salt value or context information into the KDF. The KDF goes through two stages of extraction and expansion to generate a session key of a predetermined length, such as 128 bits or 256 bits. This session key can be used in symmetric encryption algorithms such as AES to protect the confidentiality and integrity of subsequent communication contents.

[0042] In an optional embodiment, the session key is calculated using the KDF based on the shared secret , the y-coordinate of the shared elliptic curve point , the first random number and the second random number , including: The extraction and expansion KDF based on the hash-based message authentication code is used to serialize the shared secret as the input key material, to input the concatenation value of the first random number and the second random number as the salt value, and to serialize the y-coordinate of the shared elliptic curve point as the application-specific information to derive a 128-bit session key.

[0043] Specifically, the key derivation process is divided into two stages: extraction and expansion. In the extraction stage, the function converts the shared secret computed by the mobile phone into a 32-byte input key material IKM. Meanwhile, a 32-byte first random number is concatenated with a 32-byte second random number to form a 64-byte salt value. The extraction of HKDF uses the salt value to perform an HMAC operation, such as HMAC-SHA256, on the input key material IKM to generate a high-entropy 32-byte pseudo-random key PRK. Although the PRK is not the final session key, it is a cryptographically strong intermediate key.

[0044] In the expansion stage, the function uses the pseudo-random key PRK generated in the previous step as the key for HMAC. To bind the generated session key to the current communication context, the y-coordinate of the shared elliptic curve point computed by both parties is extracted and serialized into a 32-byte string as the application-specific information info. The expansion step generates the key material by performing an HMAC operation on info, in the form of HMAC-SHA256(PRK, info || 0x01). Since the target session key length is 128 bits, i.e., 16 bytes, the HKDF expansion function will take the first 16 bytes from the output as the final session key. This key will be used for symmetric encryption algorithms such as AES to protect the confidentiality and integrity of subsequent communication content.

[0045] The embodiments of the NFC passive lock bidirectional authentication and session key negotiation system provided by the application are as follows: The NFC passive lock bidirectional authentication and session key negotiation system comprises a processor and a memory, and the memory stores computer program instructions which, when executed by the processor, implement the NFC passive lock bidirectional authentication and session key negotiation method described above.

[0046] The NFC passive lock bidirectional authentication and session key negotiation system further comprises a communication interface and other components familiar to those skilled in the art, the settings and functions of which are known in the art, and thus will not be described here.

[0047] In this disclosure, a "storage medium" or "computer readable medium" can be any available medium that can be accessed by a general purpose or special purpose computer system. By way of example, and not limitation, such computer readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code means in the form of computer readable instructions or data structures and that can be accessed by a general purpose or special purpose computer system, or a combination thereof. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or combination thereof) to a computer, the computer properly views the connection as a computer readable medium. Thus, any such connection is properly termed a computer readable medium. Combinations of the above should also be included within the scope of the computer readable media.

[0048] The above are preferred embodiments of the present application, not to limit the protection scope of the present application, therefore: any equivalent changes made according to the structure, shape, principle of the present application, should be covered within the protection scope of the present application.

Claims

1. A method for mutual authentication and session key agreement of NFC passive lock, characterized in that, The method comprises the following steps: S1, the mobile phone end generates a first temporary private key and a first random number , and based on the identity of the NFC passive lock , the first random number , the first base point G and the second base point P of the elliptic curve, the first hash function calculates the first temporary public key , the first temporary public key and the first random number are sent to the NFC passive lock; S2, NFC passive lock receives the first temporary public key and the first random number Then, the first random number is input into the built-in PUF to generate a second temporary private key , and a second random number is generated = × G, the second temporary public key and the second random number are sent to the mobile phone end; the mobile phone end and the NFC passive lock respectively obtain the shared elliptic curve point × and by calculating from the shared elliptic curve point , and the x coordinate is extracted as the shared secret ; S3, both sides based on shared secret and identity , using the second hash function authentication key AK is calculated, and using the third hash function two-way authentication, wherein the mobile phone side calculates the first authentication code and sent to the NFC passive lock for verification, NFC passive lock in the verification through the calculation of the second authentication code and sent to the mobile phone for verification; S4, after the two-way authentication is passed, the two parties use KDF to calculate the session key based on the shared secret , the y-coordinate of the shared elliptic curve point , the first random number and the second random number .

2. The mutual authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, S1, the first temporary private key and the first random number generated by a 256-bit secure random number generator.

3. The mutual authentication and session key agreement method of NFC passive lock according to claim 1, wherein, The first random number Inputting the built-in PUF generates a second temporary private key , comprising: PUF is a physical unclonable function of the arbitrator, and the first random number is input as a challenge value to the arbitrator PUF, and a stable second temporary private key is extracted from a response value output from the arbitrator PUF using a fuzzy extractor .

4. The mutual authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, NFC passive lock is obtained by calculating and obtaining a shared elliptic curve point , comprising:​ The NFC passive lock will identify itself with the received first random number and perform splicing; using a first hash function to calculate a hash digest value and convert the hash digest value into an integer h; calculate the elliptic curve point ; subtract the point from the received first temporary public key to obtain an adjusted point ; using the second temporary private key to perform elliptic curve scalar multiplication operation on the adjusted point to obtain a shared elliptic curve point .

5. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, wherein, Utilizing a third hash function Performing mutual authentication, comprising: The mobile device uses the authentication key AK as the key to access the first temporary public key. Serialized byte string and second random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate the first authentication code. ; NFC passive lock receives the first authentication code After, the first authentication code for verification is calculated in the same way locally If Is equal to , the authentication mobile terminal passes The NFC passive lock uses the authentication key AK as the key and the second temporary public key. Serialized byte string and first random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate a second authentication code. ; The mobile phone receives the second authentication code After that, the second authentication code for verification is calculated in the same way locally If is equal to , the NFC passive lock is authenticated.

6. The bidirectional authentication and session key agreement method of NFC passive lock according to claim 1 or 5, characterized in that, Third hash function is a message authentication code algorithm based on SHA-256.

7. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, Using KDF, based on shared secrets Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key, including: A shared secret is used to derive a 128-bit session key using an extraction and expansion KDF based on a hash-based message authentication code The first random number and the concatenation of the second random number are serialized into byte strings and used as salt values, and the y-coordinate of a shared elliptic curve point is serialized into a byte string and used as application-specific information.

8. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, In S1, the first hash function is the SHA-256 algorithm.

9. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, wherein, In S1, the elliptic curve is a secp256r1 curve.

10. A bidirectional authentication and session key agreement system for NFC passive lock, characterized in that, The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method for bidirectional authentication and session key negotiation of the NFC passive lock according to any one of claims 1-9 is realized.

Images