Cross authentication method and authentication device

Abstract

The present invention relates to a mutual authentication method and an authentication device for providing the same, and the authentication device of the present invention includes an authentication communication unit receiving first identification information from an electronic device requesting primary authentication, an authentication storage unit for storing second identification information, a one-way encryption algorithm, a random number generation algorithm, and an initial vector input during operation of the random number generation algorithm, and an authentication control unit comparing the first identification information with the second identification information to verify the first identification information, and determining whether to approve the primary authentication according to the verification result, wherein, if the primary authentication is approved, the authentication control unit encrypts the second identification information with the one-way encryption algorithm to generate an authentication cipher text, and transmits the authentication cipher text to the electronic device to request secondary authentication, and, if a first random number is received from the electronic device in response to the secondary authentication request, inputs the second identification information and the initial vector to the random number generation algorithm to generate a second random number, and compares the first random number with the second random number to verify the first random number, and determines whether to approve the secondary authentication according to the verification result.

Description

Technical Field

[0001] Cross-reference to related applications

[0002] This application claims priority and benefit to Korean Patent Application No. 10-2020-0121338, filed on September 21, 2020, with the Korean Intellectual Property Office, the entire contents of which are incorporated herein by reference.

[0003] This invention relates to a cross-certification method and an authentication apparatus for providing the method. Background Technology

[0004] Recently, rechargeable batteries have been widely used in mobile devices such as laptops and mobile phones, various powered transportation vehicles such as electric bicycles, electric vehicles, and hybrid vehicles, as backup power supplies for powering during power outages, and as high-capacity energy storage devices for pre-storing large amounts of electricity and powering other devices.

[0005] In particular, regarding devices that provide or store large amounts of electricity for electric vehicles (EVs) or energy storage systems (ESS), the battery consists of battery cells that are rechargeable batteries, battery modules with multiple battery cells connected in series, and battery packs with multiple battery modules connected in series and / or in parallel.

[0006] Specifically, the battery pack is managed by a battery management system (BMS). The BMS maintains and manages the batteries by monitoring their voltage, current, and temperature. The BMS manages the battery system, including the batteries and their peripheral devices, by, for example, predicting battery replacement times and proactively checking for battery defects.

[0007] For research and development purposes, some have attempted to store various data collected by a battery management system (BMS) on a remote central server. However, transmitting and storing data over wireless networks presents issues such as security and authentication. In other words, solutions are needed to address shortcomings including authentication of data transmitting and receiving / storing devices, as well as security against external malicious attacks. Summary of the Invention

[0008] Technical issues

[0009] The present invention aims to provide a cross-certification method for electronic devices and certification devices, which respectively request certification, approve the requested certification and thus perform cross-certification, and an certification device for providing the method.

[0010] Technical solution

[0011] This invention provides an authentication device comprising: an authentication communication unit for receiving first identification information from an electronic device requesting first authentication; an authentication storage unit for storing second identification information, a one-way encryption algorithm, a random number generation algorithm, and an initial vector input when running the random number generation algorithm; and an authentication control unit for comparing the first identification information with the second identification information to verify the first identification information, and determining whether to approve the first authentication based on the verification result. When approving the first authentication, the authentication control unit encrypts the second identification information using the one-way encryption algorithm to generate authentication ciphertext, and sends the authentication ciphertext to the electronic device to request the second authentication. When receiving a first random number from the electronic device in response to the request for the second authentication, the authentication control unit inputs the second identification information and the initial vector into the random number generation algorithm to generate a second random number, and compares the first random number with the second random number to verify the first random number, and determines whether to approve the second authentication based on the verification result.

[0012] The authentication control unit can use the second key of the two-way encryption algorithm to decrypt data encrypted with the first key of the two-way encryption algorithm, and can send data encrypted with the second key to the electronic device.

[0013] The first key can be a private key, and the second key can be a public key.

[0014] The first identification information and the second identification information may include the serial number of the electronic device and the serial number of the authentication device, respectively.

[0015] When the first identification information and the second identification information do not correspond to each other, or when the first random number and the second random number do not correspond to each other, the authentication control unit can block network access to the electronic device.

[0016] Another embodiment of the present invention provides a cross-authentication method in an authentication method in which an authentication device performs cross-authentication with an electronic device including the same authentication information. The cross-authentication method includes: receiving first identification information from an electronic device requesting first authentication; comparing the first identification information with stored second identification information to verify the first identification information; when the comparison results show that they correspond to each other and pass verification, encrypting the second identification information using a one-way encryption algorithm to generate authentication ciphertext; sending the authentication ciphertext to the electronic device to request second authentication; receiving a first random number from the electronic device in response to the request for second authentication; inputting an initial vector and the second identification information input when running a random number generation algorithm into the random number generation algorithm to generate a second random number; comparing the first random number and the second random number; and when the comparison results show that they correspond to each other, determining approval for the second authentication.

[0017] The authentication device can use the second key of the two-way encryption algorithm to decrypt the data received by the first key of the two-way encryption algorithm, and can send the data encrypted with the second key to the electronic device.

[0018] The first key can be a private key, and the second key can be a public key.

[0019] The first identification information and the second identification information may include the serial number of the electronic device and the serial number of the authentication device, respectively.

[0020] The cross-authentication method may also include the following steps: after verifying the first identification information, when the comparison results show that they do not correspond to each other, blocking network access to the electronic device.

[0021] The cross-authentication method may also include the following steps: after comparing a first random number and a second random number, if it is found that the first random number and the second random number do not correspond to each other, network access to the electronic device is blocked.

[0022] Technical effect

[0023] This invention can identify the various devices performing cross-certification and can provide a highly reliable authentication method and apparatus. Attached Figure Description

[0024] Figure 1 An authentication system according to an implementation method is shown.

[0025] Figure 2 It shows Figure 1 The configuration of electronic devices.

[0026] Figure 3 It shows Figure 1 The structure of the authentication device.

[0027] Figure 4 A flowchart of an authentication method according to an implementation method is shown.

[0028] Figure 5 It shows the method for execution Figure 4 The operation flowchart of the electronic device and authentication device for the authentication method. Detailed Implementation

[0029] In the following description, embodiments disclosed herein will be described in detail with reference to the accompanying drawings. In this specification, identical or similar components will be designated by identical or similar reference numerals, and repeated descriptions will be omitted. The terms "module" and "unit" used with respect to components in the following description are used only for ease of explanation. Therefore, these terms do not in themselves have the meaning or function of distinguishing them from each other. In describing embodiments of this disclosure, detailed descriptions of well-known techniques associated with the invention will be omitted if it is determined that such detailed descriptions may obscure the spirit of the invention. The accompanying drawings are provided merely to facilitate understanding of the embodiments disclosed herein and should not be construed as limiting the spirit of the disclosure herein. It should be understood that the invention includes all modifications, equivalents, and substitutions without departing from the scope and spirit of the invention.

[0030] Ordinal terms such as first, second, etc., are used only to describe various components and are not to be construed as limiting these components. These terms are only used to distinguish one component from others.

[0031] It should be understood that when a component is referred to as "connected" or "coupled" to another component, the component may be directly connected or coupled to the other component, or connected or coupled to the other component with other components placed between them. On the other hand, it should be understood that when a component is referred to as "directly connected or coupled" to another component, the component may be connected or coupled to the other component without any other components placed between them.

[0032] It should also be understood that the terms “comprising” or “having” as used in this specification specify the presence of the stated features, figures, steps, operations, components, parts, or combinations thereof, but do not exclude the presence or addition of one or more other features, figures, steps, operations, components, parts, or combinations thereof.

[0033] A "network" refers to the interconnected structure of various nodes, such as terminals and servers, that exchange information, and includes Local Area Networks (LANs), Wide Area Networks (WANs), the Internet (WWW), wired / wireless data communication networks, telephone networks, and wired / wireless television communication networks. Examples of data communication networks include 3G, 4G, 5G, the 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), WiMAX, Wi-Fi, Bluetooth, infrared, ultrasonic, visible light communication (VLC), and LiFi.

[0034] Figure 1 An authentication system according to an implementation method is shown.

[0035] Reference Figure 1 The authentication system 1 includes an electronic device 20 and an authentication device 30.

[0036] Figure 1 The battery management system (BMS) 10 shown monitors the cell voltage, current, and temperature of the battery pack (not shown) in real time to adjust the voltage between multiple battery cells to be uniform and prevent overcharging / discharging to manage the battery in optimal condition. The battery management system (BMS) 10 can estimate the battery's state of charge (SOC) and state of health (SOH). In this context, the information generated in the battery system, including measured cell voltage, current, and temperature, as well as estimated SOC and SOH, is defined as battery data (hereinafter referred to as data). The device for generating the data is illustrated as... Figure 1 The battery management system (BMS) 10 is included, but not limited to, and can include devices used to generate data in many fields.

[0037] Electronic device 20 performs cross-certification with certification device 30 before sending data to remote certification device 30. According to embodiments, electronic device 20 can be configured with battery system together with battery management system (BMS) 10, and can be included in various types of systems such as electric vehicle (EV) or energy storage system (ESS).

[0038] The authentication device 30 performs cross-authentication with the electronic device 20 before receiving and storing the data. According to embodiments, the authentication device 30 can be configured with a storage system along with a database (not shown) and can be included in various systems such as servers or data centers.

[0039] Figure 2 It shows Figure 1 The configuration of electronic devices.

[0040] Reference Figure 2 The electronic device 20 includes a device communication unit 21, a device storage unit 23, and a device control unit 25.

[0041] The device communication unit 21 may include a first communication module for communicating with the battery management system (BMS) 10 and a second communication module for communicating with the authentication device 30 via a radio network.

[0042] The first communication module may include a communication protocol for communication between devices in an electric vehicle (EV) and may receive data from the battery management system (BMS) 10. For example, the first communication module may include a controller area network (CAN) communication module, a local interconnect network (LIN) communication module, or a FlexRay communication module.

[0043] The second communication module can send / receive data to / from the authentication device 30 via a radio network. For example, the second communication module may include a radio internet module such as a wireless LAN (WLAN), Wi-Fi, wireless broadband (WiBro), global microwave interconnection access (WiMAX), or high-speed downlink packet access (HSDPA).

[0044] The device storage unit 23 may include a first area for storing first authentication information for cross-certification and a second area for temporarily storing data received from the battery management system (BMS) 10. According to another embodiment, data generated by the battery management system (BMS) 10 is not temporarily stored in the second area of ​​the device storage unit 23, but can be sent to the authentication device 30 when cross-certification is successful.

[0045] The device storage unit 23 may include at least one type of storage medium from the following: flash memory, hard disk, micro multimedia card, card type memory (e.g., SD or XD memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disk, and optical disk.

[0046] The first authentication information may include first identification information for identifying the device sending and receiving data, a two-way encryption algorithm, a one-way encryption algorithm, a random number generation algorithm, and an initial vector input when running the random number generation algorithm. According to an implementation, the first authentication information may include the same information as the second authentication information.

[0047] The first identification information may include the serial number of the device used to transmit data after cross-certification is approved. For example, the serial number of the device used to transmit data may include one of the serial number of the electronic device 20, the serial number of the battery from which data will be collected, and the serial number of the battery management system (BMS) 10 used to collect data.

[0048] The first identification information may include the serial number of the device used to receive and store data after cross-certification approval. For example, the serial number of the device used to receive and store data may include one of the serial number of the certification device 30 and the serial number of the server or data center used to store the data.

[0049] According to the implementation, the first identification information may include the serial number of the electronic device 20 and the serial number of the authentication device 30. That is, the first identification information may include identification information of the first party and the second party used to perform cross-certification.

[0050] A two-way encryption algorithm is an encryption algorithm used for both encryption and decryption. When cross-authentication is performed between the electronic device 20 and the authentication device 30, the data sent and received can be encrypted using a two-way encryption algorithm and can then be sent. According to an embodiment, the electronic device 20 and the authentication device 30 can use an asymmetric key type two-way encryption algorithm, which uses different keys for encryption and decryption.

[0051] For example, electronic device 20 can use a private key to perform encryption and decryption, while authentication device 30 can use a public key to perform encryption and decryption.

[0052] In detail, electronic device 20 sends ciphertext generated by encrypting data with its private key to authentication device 30. Authentication device 30 can decrypt the ciphertext using its public key to recover the data.

[0053] For example, electronic device 20 can perform encryption and decryption using a public key, while authentication device 30 can perform encryption and decryption using a private key.

[0054] One-way encryption algorithms can perform encryption but not decryption. Specifically, the same data is encrypted into the same ciphertext, but the ciphertext cannot be recovered back to the original data. For example, data can be authenticated through a verification process where the same data is encrypted separately using the same one-way encryption algorithm and the encrypted values ​​are compared. One-way encryption algorithms typically use hash schemes such as SHA-256 or SHA-3.

[0055] Random number generation algorithms can generate pseudo-random numbers. A true random number represents a value randomly selected within a defined range; its generation method is undefined, and the next value to be generated is completely unpredictable. A pseudo-random number, on the other hand, represents a number generated using a predetermined mechanism (a pseudo-random number generator) with an initially provided input value (initial value). These are not truly random numbers, but rather arbitrary numbers that can be considered random if there are no issues with their use.

[0056] For example, pseudo-random numbers can be generated by a computer using a random number generation algorithm. When the generation conditions or input values ​​are the same, the resulting pseudo-random number will always be the same. When the seed value used as the input value is changed to a different value, the resulting pseudo-random number also changes, and the pseudo-random number retains the meaning of a random number. The seed value can be the current time, which changes at each moment. In the following text, pseudo-random numbers will be described as random numbers.

[0057] According to the implementation, the device control unit 25 can generate a first random number by setting an initial vector and first identification information, which are used as initial values ​​when running a random number generation algorithm, as a seed value and using the current time. The device control unit 25 can calculate the current time based on a reference time, which is the time when the electronic device 20 first operates, and the number of count points at a predetermined interval.

[0058] According to the implementation, the device control unit 25 performs cross-authentication with the authentication device 30 using the first authentication information stored in the first area of ​​the device storage unit 23. When the cross-authentication is successful, the device control unit 25 can send the data stored in the second area of ​​the device storage unit 23 to the authentication device 30. That is, the device control unit 25 can perform cross-authentication with the authentication device 30 and can send data to the authentication device 30.

[0059] According to another embodiment, the device control unit 25 performs cross-authentication with the authentication device 30 using first authentication information stored in the first area of ​​the device storage unit 23. When cross-authentication is successful, the device control unit 25 can send the cross-authentication result to the battery management system (BMS) 10. The battery management system (BMS) 10 can then send data to the authentication device 30. In other words, the device control unit 25 can perform cross-authentication with the authentication device 30, and the battery management system (BMS) 10 can send data to the authentication device 30.

[0060] Figure 3 It shows Figure 1 Configuration of the authentication device.

[0061] Reference Figure 3 The authentication device 30 includes an authentication communication unit 31, an authentication storage unit 33, and an authentication control unit 35.

[0062] The authentication communication unit 31 can send / receive data to / from the electronic device 20 via a radio network. For example, the authentication communication unit 31 may include a radio internet module such as a wireless LAN (WLAN), Wi-Fi, wireless broadband (WiBro), global microwave interconnection access (WiMAX), or high-speed downlink data group access (HSDPA).

[0063] The authentication storage unit 33 may store second authentication information for cross-authentication. The authentication storage unit 33 may include at least one type of storage medium, such as flash memory, hard disk, micro multimedia card, card type memory (e.g., SD or XD memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disk, and optical disk.

[0064] According to the implementation, the server or data center may include data sent from the electronic device 20 after successful cross-certification via the authentication device 30. For example, the server or data center may store in a database (DB) large-capacity battery data sent at predetermined intervals or in real time from multiple battery management systems (BMS) installed on multiple electric vehicles (EVs).

[0065] The second authentication information may include second identification information for identifying the device sending and receiving data, a two-way encryption algorithm, a one-way encryption algorithm, a random number generation algorithm, and an initial vector input when the random number generation algorithm is run. According to an embodiment, the second authentication information may include the same information as the first authentication information stored in the electronic device 20.

[0066] According to the implementation, the second identification information may include the serial number of the electronic device 20 and the serial number of the authentication device 30. That is, the second identification information may include identification information regarding the first and second parties used to perform cross-certification. For example, the second identification information may include the same identification information as the first identification information.

[0067] The authentication control unit 35 performs cross-authentication with the electronic device 20 using the second authentication information stored in the authentication storage unit 33. When cross-authentication is successful, the authentication control unit 35 can send the cross-authentication result to a central control unit (not shown) in a server or data center. The central control unit (not shown) can maintain network access to the electronic device 20 and can store the data sent from the electronic device 20 in a database (DB).

[0068] Figure 4 A flowchart of an authentication method according to an implementation method is shown.

[0069] Electronic device 20 and authentication device 30 perform cross-authentication. Here, unlike a single authentication method where one party requests authentication and the other party verifies it and determines whether to approve or reject authentication, cross-authentication means that electronic device 20 and authentication device 30 determine an authentication method based on the authentication request from the other party. According to an embodiment, electronic device 20 and authentication device 30 may store the same authentication information and encryption algorithm, and may perform cross-authentication based on them.

[0070] Reference Figure 4 When the electronic device 20 encrypts the first identification information with the first key of the two-way encryption algorithm and sends the encrypted first identification information to the authentication device 30 to request the first authentication, the authentication device 30 determines whether to approve the first authentication (S110).

[0071] Electronic device 20 can encrypt the first identification information using a private key and send it to authentication device 30. The first identification information may include the serial number of electronic device 20 and the serial number of authentication device 30. Electronic device 20 can also encrypt the first identification information using a public key and send it to authentication device 30.

[0072] For example, when electronic device 20 uses its private key as the first key, authentication device 30 can use its public key as the second key. When electronic device 20 uses its public key as the first key, authentication device 30 can use its private key as the second key. Then, electronic device 20 and authentication device 30 can each decrypt the received encrypted information using their own keys.

[0073] The authentication device 30 compares the first identification information with the stored second identification information and determines whether to approve or reject the first authentication (S120).

[0074] The authentication device 30 decrypts the encrypted first identification information using a second key of a two-way encryption algorithm. According to an embodiment, the authentication device 30 compares the serial number of the electronic device 20 and the serial number of the authentication device 30 in the first identification information with the stored second identification information (i.e., the stored serial number of the electronic device 20 and the serial number of the authentication device 30) to determine whether they correspond to each other.

[0075] When the comparison results show that they correspond to each other, the first authentication is approved (S120, yes). The authentication device 30 encrypts the second identification information using a one-way encryption algorithm to generate authentication ciphertext and sends the authentication ciphertext to the electronic device 20 to request the second authentication (S130).

[0076] According to the implementation method, the authentication device 30 can encrypt the authentication ciphertext using the second key of the two-way encryption algorithm and send it to the electronic device 20. That is, the authentication device 30 can first encrypt the second identification information using a one-way encryption algorithm, and then encrypt the authentication ciphertext generated by the first encryption using the second key of the two-way encryption algorithm, and send the result to the electronic device 20.

[0077] The authentication device 30 can encrypt data using a second key of a two-way encryption algorithm and can transmit the data to the electronic device 20 at the final stage of data transmission. The authentication device 30 can also decrypt data encrypted with the first key of the two-way encryption algorithm using the second key of the two-way encryption algorithm.

[0078] Electronic device 20 decrypts the received authentication ciphertext, encrypted with the second key, using a first key. Electronic device 20 then encrypts the first identification information using a one-way encryption algorithm to generate device ciphertext. When electronic device 20 and authentication device 30 use the same one-way encryption algorithm, and the first and second identification information are identical, the authentication ciphertext and device ciphertext have the same value due to the characteristics of the one-way encryption algorithm.

[0079] Electronic device 20 compares the authentication ciphertext with the device ciphertext to verify the authentication ciphertext. When the comparison results show that they correspond to each other, electronic device 20 inputs an initial vector and first identification information into a random number generation algorithm to generate a first random number, and encrypts the generated first random number with a first key. The first identification information input as a seed value is the serial number of electronic device 20 or the serial number of authentication device 30, and may be a predefined serial number of authentication device 30.

[0080] In response to a second authentication request, electronic device 20 sends a first random number encrypted with a first key to authentication device 30. Authentication device 30 inputs a stored initialization vector and second identification information into a random number generation algorithm to generate a second random number. The second identification information input as a seed value is either the serial number of electronic device 20 or the serial number of authentication device 30, and may be a predefined serial number of electronic device 20.

[0081] The authentication device 30 decrypts the first random number with the second key and compares it with the second random number to determine whether they correspond to each other (S140).

[0082] In other words, the authentication device 30 can request a second authentication from the electronic device 20 and can determine whether to approve the second authentication based on the response to the request.

[0083] When the results are found to correspond to each other (S140, Yes), the authentication device 30 approves the second authentication (S150). Network access between the electronic device 20 and the authentication device 30 is maintained, and when the electronic device 20 sends data, the authentication device 30 can receive and store the data.

[0084] When the determination results show that they do not correspond to each other (S140, No), the authentication device 30 rejects the second authentication and blocks the network access of the electronic device 20 and the authentication device 30 (S160).

[0085] Figure 5 It shows the method for execution Figure 4 The operation flowchart of the electronic device and authentication device for the authentication method.

[0086] Figure 5 It shows Figure 4 Detailed diagram. Now refer to Figures 1 to 5 Describe the cross-certification method.

[0087] Reference Figure 5 The electronic device 20 encrypts the first identification information with the first key of the two-way encryption algorithm and sends it to the authentication device 30 to request the first authentication (S201 and S202).

[0088] The electronic device 20 can encrypt the first identification information using a private key and send it to the authentication device 30. The first identification information may include the serial number of the electronic device 20 and the serial number of the authentication device 30.

[0089] The authentication device 30 compares the first identification information with the stored second identification information to verify the first identification information (S203).

[0090] The authentication device 30 decrypts the encrypted first identification information using a second key of a two-way encryption algorithm. For example, the authentication device 30 can decrypt the first identification information using a public key.

[0091] According to the implementation, the authentication device 30 can compare the serial number of the electronic device 20 and the serial number of the authentication device 30 contained in the first identification information with the stored second identification information (i.e., the stored serial number of the electronic device 20 and the serial number of the authentication device 30) and determine whether they correspond to each other.

[0092] When the comparison results show that they correspond to each other and pass the verification (S204, Yes), the authentication device 30 approves the first authentication (S205).

[0093] The authentication device 30 encrypts the second identification information using a one-way encryption algorithm to generate authentication ciphertext, encrypts the authentication ciphertext using a second key, and sends the encrypted authentication ciphertext to the electronic device 20 to request second authentication (S206 and S207).

[0094] According to the implementation method, the authentication device 30 can encrypt the authentication ciphertext using the second key of the two-way encryption algorithm, and can send the encrypted authentication ciphertext to the electronic device 20. That is, the authentication device 30 can first encrypt the second identification information using a one-way encryption algorithm, and then secondly encrypt the authentication ciphertext generated by the first encryption using the second key of the two-way encryption algorithm, and can send the result to the electronic device 20.

[0095] The authentication device 30 can encrypt data using a second key of a two-way encryption algorithm and can send it to the electronic device 20 at the final stage of data transmission. The authentication device 30 can also decrypt data received using a first key of a two-way encryption algorithm using the second key of the two-way encryption algorithm.

[0096] The electronic device 20 encrypts the first identification information using a one-way encryption algorithm to generate device ciphertext, and compares the received authentication ciphertext with the device ciphertext to verify the authentication ciphertext (S208).

[0097] When the electronic device 20 and the authentication device 30 use the same one-way encryption algorithm, and the first identification information and the second identification information are the same, the authentication ciphertext and the device ciphertext have the same value due to the characteristics of the one-way encryption algorithm.

[0098] The electronic device 20 decrypts the received authentication ciphertext, which is encrypted with the second key, using the first key. The electronic device 20 compares the authentication ciphertext with the device ciphertext to verify the authentication ciphertext.

[0099] When the comparison results show that they correspond to each other and pass verification (S209, Yes), the electronic device 20 inputs the first identification information and the initial vector into the random number generation algorithm to generate a first random number (S210). The first identification information input as a seed value is the serial number of the electronic device 20 or the serial number of the authentication device 30, and it can be a predefined serial number of the authentication device 30.

[0100] In response to the second authentication request, the electronic device 20 encrypts the first random number with the first key and sends the encrypted first random number to the authentication device 30 (S211).

[0101] When the comparison results show that they do not correspond to each other and the verification fails (S209, No), the electronic device 20 blocks network access to the authentication device 30 (S216). For example, the electronic device 20 may determine that the authentication device 30 is unreliable, and it may not send various types of data, such as battery data, to the authentication device 30.

[0102] The authentication device 30 inputs the second identification information and the initial vector into a random number generation algorithm to generate a second random number (S212). The second identification information input as a seed value is the serial number of the electronic device 20 or the serial number of the authentication device 30, and it can be a predefined serial number of the electronic device 20.

[0103] The authentication device 30 decrypts the first random number using the second key and compares the decrypted first random number with the second random number to determine whether they correspond to each other (S213).

[0104] When the results are found to correspond to each other (S213, yes), the authentication device 30 approves the second authentication (S214).

[0105] According to the implementation, the authentication device 30 can request a second authentication from the electronic device 20, and can determine whether to approve the second authentication based on the response to the request. When the second authentication is approved, network access between the electronic device 20 and the authentication device 30 is maintained, and when the electronic device 20 sends data, the authentication device 30 can receive the data and store it.

[0106] When the first identification information and the second identification information do not correspond to each other according to the comparison result and the verification fails (S204, No), or when they do not correspond to each other according to the determination result (S213, No), the authentication device 30 determines whether to reject the first authentication or the second authentication, and blocks the network access of the electronic device 20 and the authentication device 30 (S215).

[0107] Although the invention has been described in conjunction with what is now considered to be actual implementation, it should be understood that the invention is not limited to the disclosed embodiments, but rather is intended to cover various modifications and equivalent arrangements within the spirit and scope of the appended claims.

Claims

1. An authentication device, the authentication device comprising: An authentication communication unit is configured to receive first identification information from an electronic device requesting first authentication; An authentication storage unit is used to store second identification information, a one-way encryption algorithm, a random number generation algorithm, and an initial vector input when running the random number generation algorithm; as well as An authentication control unit is configured to compare the first identification information with the second identification information to verify the first identification information, and to determine whether to approve the first authentication based on the verification result. When the first authentication is approved, the authentication control unit uses the one-way encryption algorithm to encrypt the second identification information for the first time to generate authentication ciphertext, uses the second key of the two-way encryption algorithm to encrypt the authentication ciphertext generated from the first encryption for the second time, and sends the encrypted authentication ciphertext to the electronic device to request the second authentication. The electronic device encrypts the first identification information using the one-way encryption algorithm to generate device ciphertext, and compares the received authentication ciphertext with the device ciphertext to verify the authentication ciphertext. When the authentication ciphertext and the device ciphertext correspond to each other, the electronic device inputs the initial vector and the first identification information into the random number generation algorithm to generate a first random number. When the first random number is received from the electronic device in response to the second authentication request, the authentication control unit inputs the second identification information and the initial vector into the random number generation algorithm to generate a second random number. The authentication control unit compares the first random number with the second random number to verify the first random number, and determines whether to approve the second authentication based on the verification result. Specifically, the authentication control unit uses the second key of the two-way encryption algorithm to decrypt the data received and encrypted with the first key of the two-way encryption algorithm, and then sends the data encrypted with the second key to the electronic device. The first identification information and the second identification information respectively include the serial number of the electronic device and the serial number of the authentication device.

2. The authentication device according to claim 1, wherein, The first key is a private key, and The second key is the public key.

3. The authentication device according to claim 1, wherein, When the first identification information and the second identification information do not correspond to each other, or when the first random number and the second random number do not correspond to each other, the authentication control unit blocks network access to the electronic device.

4. A cross-authentication method in an authentication method in which an authentication device performs cross-authentication with an electronic device including the same authentication information, the cross-authentication method comprising the following steps: Receive first identification information from the electronic device requesting first authentication; The first identification information is compared with the stored second identification information to verify the first identification information; When the comparison results show that the first identification information corresponds to the stored second identification information and passes verification, the authentication device approves the first authentication. The second identification information is first encrypted using a one-way encryption algorithm to generate authentication ciphertext; The authentication ciphertext generated from the first encryption is encrypted a second time using a second key of a two-way encryption algorithm, and the encrypted authentication ciphertext is sent to the electronic device to request a second authentication; A first random number is received from the electronic device in response to a request for second authentication; The initial vector and the second identifier information input when running the random number generation algorithm are input into the random number generation algorithm to generate a second random number; Compare the first random number with the second random number; as well as When the comparison reveals a correspondence between the first random number and the second random number, approval for the second certification is granted. The electronic device encrypts the first identification information using the one-way encryption algorithm to generate device ciphertext, and compares the received authentication ciphertext with the device ciphertext to verify the authentication ciphertext. When the authentication ciphertext and the device ciphertext correspond to each other, the electronic device inputs the initial vector and the first identification information into the random number generation algorithm to generate the first random number. The authentication device uses the second key of the two-way encryption algorithm to decrypt the data received and encrypted with the first key of the two-way encryption algorithm, and then sends the data encrypted with the second key to the electronic device. The first identification information and the second identification information respectively include the serial number of the electronic device and the serial number of the authentication device.

5. The cross-certification method according to claim 4, wherein, The electronic device encrypts the first identification information using the first key of the two-way encryption algorithm, and sends the encrypted first identification information to the authentication device to request the first authentication.

6. The cross-certification method according to claim 4, wherein, The first key is a private key, and The second key is the public key.

7. The cross-certification method according to claim 4, further comprising the following steps: After the step of comparing the first identification information with the second identification information When the comparison results show that the first identification information and the second identification information do not correspond to each other, network access to the electronic device is blocked.

8. The cross-certification method according to claim 4, further comprising the following steps: After the step of comparing the first random number with the second random number When it is found that the first random number and the second random number do not correspond to each other, network access to the electronic device is blocked.

Images