Mutual authentication using pseudo-random numbers

Abstract

The authentication device of the authentication system includes: a physical layer circuit system; and a processing circuit system coupled to the physical layer circuit system. The processing circuit system is configured to: encode an authentication command to be sent to the credential device; decode a response communication received from the credential device, wherein the response communication includes a first random number; encrypt the first random number, a second random number, and authentication key material to be sent to the credential device; decrypt encrypted information received from the credential device, wherein the encrypted information includes the first random number, the second random number, and receiver key material; and calculate a session encryption key using the authentication key material and the receiver key material.

Description

[0001] Priority application

[0002] This application is a continuation-to-file of U.S. Patent Application Serial No. 17 / 025,111, filed on September 18, 2020, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The embodiments shown and described herein generally relate to an automated identity authentication system for authenticating users to access secure resources, and to secure messaging techniques for the identity authentication system. Background Technology

[0004] There are many applications that require fast and accurate authentication of human identity. Some examples include air travel and secure access to controlled areas. Additionally, remote authentication is now common practice for applications such as mobile online shopping or mobile banking. Device authentication can involve exchanging authentication information between a server performing the authentication and a credential device such as a smart card or mobile phone. Secure messaging is used to enable the transmission of sensitive information used in the authentication process. Attached Figure Description

[0005] Figure 1 This is a diagram illustrating a portion of an authentication system.

[0006] Figure 2 This is a flowchart illustrating an example of a device authentication method.

[0007] Figure 3 This is a block diagram illustrating a portion of a communication session used for device authentication.

[0008] Figure 4 This is a block diagram of a portion of an example of a verification device. Detailed Implementation

[0009] The goal is for automated authentication of personal identities based on verifiable identity information to be fast and secure. Authentication can involve the transmission of sensitive identification information between a authenticating device (e.g., a system server at the back end of the authentication system) and a credential device (e.g., a smart card or smartphone). Figure 1This is an illustration of an example of an authenticator device 105 and a credential device 110 communicating using secure messaging. In this example, the authenticator device 105 is a system server at the backend of an authentication system, and the credential device 110 is a smartphone; however, the authenticator device and the credential device can be any two devices using secure messaging. The credential device can store access credentials that provide controlled access to resources such as financial resources or secure physical spaces. Authentication messaging is used to verify whether the access credentials provide the desired access. Authentication messaging can be secure by encrypting messages in a communication session between the devices using one or more session keys 115. The keys can be shared according to a communication protocol.

[0010] To automate authentication between devices, messaging, including key exchange, can be scripted. This script can include a transaction initiated by the authenticating device to exchange keys. For key transactions to be scriptable, the key information should be predictable.

[0011] Figure 2 This is a flowchart of a method for device authentication between an initiating device and a receiving device. Method 200 can provide mutual authentication using scriptable secret messaging. The initiating device can be a validating device, and the receiving device can be a credential device. Alternatively, the credential device can be the initiating device, and the validating device can be the receiving device. At block 205, an authentication command is sent from the initiating device to the receiving device to trigger authentication of secure messaging between the devices.

[0012] At box 210, the first random number R B Generated by the receiving device and transmitted from the receiving device to the initiating device. At block 215, the receiving device also determines the receiving device key information or the receiving device key material F. B Use random number R B and static encryption key K ENC To calculate key materials, or

[0013] F B =KDF(K ENC ,R B ) ，

[0014] Here, KDF is a key derivation function executed using the processing circuitry of the receiving device. Using F... B Generate one or more keys. In some examples, the random number R... B It is a truly random number, and the static encryption key K is... ENC It can be a device-specific encryption key stored in both the receiving and initiating devices. KDF will use the key material F BBind to a specific context of the communication session. The context can be an application, key identifier, session ID, etc.

[0015] To enable scriptable secure messaging, the receiver's key material F B It is a predictable random number that can be determined by the initiating device. In response to receiving a random number R... B In the communication, the initiating device determines the receiving key material F. B The second random number R A and initiator device key material F A Initiator device key material F A It can be a random number. At box 220, the initiating device will input the random number R. B Random number R A and initiator device key material F A Transmitted to the receiving device.

[0016] Figure 3 This is a block diagram illustrating a portion of a communication session between an initiating device (device A) and a receiving device (device B). The communication session may include protocols for mutual authentication between the initiating and receiving devices. Figure 3 The example shows the receiving device transmitting a random number R. B Message 305. In response to receiving a random number R B The initiating device will include R in message 310. B Together with the second random number R A and initiator device key information F A Together, they are transmitted back to the receiving device. R B The data sent back to the receiving device confirms the authenticity of the initiator's communication. B R A and F A The value can be included in the Session Identifier (SID), R A R B Key identifier (I) B ), F A In the encryption concatenation with text, the encrypted information includes the key identifier I. B The text is optional. The text may include known information that can be examined by the initiating device. The encrypted information is decrypted by the processing circuitry of the receiving device.

[0017] Return to Figure 2 At box 225, the receiving device will generate a random number R. B Random number R A and receiving device key information F B Transmitted to the initiating device. Figure 3In the example, the initiating device transmits R in encrypted message 315. B R A and F B The encrypted message 315 includes SID, R B R A F B Encryption concatenation with optional text. Because the two random numbers are exchanged multiple times between the two devices, the key material F... A and F B Used for key creation. Key material F was exchanged separately. A and F B It also provides additional security. Figure 3 Following communication 315, both the receiving device and the initiating device possess key material F. A and F B The devices use key information F respectively. A and F B To calculate the encryption key (e.g., the session encryption key).

[0018] In one example, the session key (K) SESSION The calculation is as follows:

[0019] K SESSION =KDF(K STATIC ,F A ||F B ),

[0020] Among them, K STATIC It is a static device key, and F A ||F B It is a cascade of key information or key materials. F A and F B Other combinations can be used to calculate the session key. Because both devices use the same key material to calculate the encryption key, the calculated encryption key matches in both devices.

[0021] exist Figure 2 In box 230, when mutual authentication between the devices is complete, encrypted information is exchanged between them. The device's processing circuitry uses a calculated encryption key (e.g., K) SESSION Encrypt the information.

[0022] As explained earlier in this article, the random number R used to create the scriptable session encryption key... B It can be a truly random number. Optionally, the random number R... B It can be based on a counter, such as a pseudo-random counter, where

[0023] R B =PRF (counter),

[0024] Here, PRF is a pseudo-random function that uses the value of a counter as a seed to generate pseudo-random numbers. R is determined using the counter. B It should be bound to the context of the communication session. It should be noted that the value of the counter itself is not transmitted. This avoids public disclosure: the existence of a key, and that this key is calculated using pseudo-random numbers instead of truly random numbers.

[0025] Using counter-based random numbers offers the advantage that no two random numbers can have the same value. The disadvantage is that the counter needs to be updated. This can put stress on the receiver's non-volatile memory. The counter can be updated after each communication session. In a variant, after the first information exchange of the authentication session (e.g., on the random number R...),... B The counter should be updated after the first communication. Counter overflow should not be allowed to avoid using the same counter a second time. If counter overflow is allowed, the static key and counter should be updated before they are reused in the event of an overflow.

[0026] The systems, apparatus, and methods described herein provide communication of cryptographic keys based on scriptable transactions used for secure message passing between two devices. The scriptable communication provides the cryptographic keys based on random numbers. These random numbers can be truly random or based on a counter. The counter value does not need to be transmitted, which improves security and privacy. Furthermore, writes to non-volatile memory are reduced by eliminating the need to store the counter value.

[0027] Figure 4 This is a block diagram of various example components for supporting the device 400 (e.g., an embedded device) that supports the device architecture described and shown herein. Figure 4 The device 400 may be, for example, a validator device (or other initiator device) that authenticates credential information regarding the holder's permissions, status, rights, and / or privileges. The validator device may be a server at the back end of the authentication system. In a variant, the validator device may be a reader device of a physical access control system (PACS). The PACS reader device retrieves and authenticates access credentials when the credential device is used and sends the access credentials to the access controller. The access controller compares the access credentials with an access control list and, for example, grants or denies access based on this comparison, such as through an automatic lock on a control door. In a variant, the reader device performs the functions of the access controller.

[0028] Specific reference Figure 4Additional examples of the device 400 used to support the device architecture described and illustrated herein may typically include one or more of the following: memory 402, processing circuitry such as processor 404, one or more antennas 406, communication port or communication module 408, network interface device 410, user interface 412, and power supply 414 or power supply.

[0029] Memory 402 can be used in conjunction with the processing circuitry system and application programming or instruction execution, and is used for temporary or long-term storage of program instructions or instruction sets 416 and / or authorization data 418, such as credential data, credential authorization data, or access control data or instructions, as well as any data, data structures, and / or computer-executable instructions required or desired to support the aforementioned device architecture. For example, memory 402 may contain executable instructions 416 used by the processor 404 of the processing circuitry system to operate other components of device 400, compute encryption keys to transmit credential or authorization data 418, and / or perform any of the functions or operations described herein, such as... Figure 2 The method. Memory 402 may include a computer-readable medium, which may be any medium that can contain, store, transmit, or transfer data, program code, or instructions used by or in conjunction with device 400. Computer-readable media may be, for example, but not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or apparatuses. More specific examples of suitable computer-readable media include, but are not limited to, electrical connections or tangible storage media having one or more wirings, such as portable computer floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), dynamic RAM (DRAM), compact disk read-only memory (CD-ROM), or other optical or magnetic storage devices, generally any solid-state storage device. Computer-readable media includes computer-readable storage media but should not be confused with computer-readable storage media; it is intended to cover all physical, non-transitory, or similar embodiments of computer-readable media.

[0030] The processing circuitry of device 400 (e.g., via firmware) is configured to perform the functions of the verification device described herein, such as... Figure 2The example method demonstrates the functionality of the processing circuitry. The processing circuitry system may correspond to one or more computer processing devices or resources. For example, processor 404 may be provided as silicon, a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), any other type of integrated circuit (IC) chip, a collection of IC chips, etc. As a more specific example, processor 404 may be provided as a microprocessor, a central processing unit (CPU), or multiple microprocessors or CPUs configured to execute an instruction set 420 stored in internal memory and / or memory 402.

[0031] Antenna 406 may correspond to one or more antennas and may be configured to provide wireless communication between device 400 and another device. Antenna 406 may be operatively coupled to a physical layer circuitry including one or more physical (PHY) layers 424 to operate using one or more wireless communication protocols and operating frequencies, including but not limited to IEEE 802.15.1, Bluetooth, Bluetooth Low Energy (BLE), Near Field Communication (NFC), ZigBee, GSM, CDMA, Wi-Fi, RF, UWB, etc. In this example, antenna 406 may include one or more antennas coupled to one or more physical layers 424 to operate using ultra-wideband (UWB) for in-band activity / communication and Bluetooth (e.g., BLE) for out-of-band (OOB) activity / communication. However, any RFID or personal area network (PAN) technology such as IEEE 502.15.1, Near Field Communication (NFC), ZigBee, GSM, CDMA, Wi-Fi, etc., may be used alternatively or additionally for the OOB activities / communications described herein.

[0032] Device 400 may additionally include a communication module 408 and / or a network interface device 410. The communication module 408 may be configured to communicate with one or more different systems or devices, remotely or locally, according to any suitable communication protocol. The network interface device 410 includes hardware for facilitating communication with other devices over a communication network using any of a variety of transport protocols, such as Frame Relay, Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), etc. Example communication networks may include local area networks (LANs), wide area networks (WANs), packet data networks (e.g., the Internet), mobile phone networks (e.g., cellular networks), common-use telephone (POTS) networks, wireless data networks (e.g., the IEEE 802.11 family of standards known as Wi-Fi, the IEEE 802.16 family of standards known as WiMax), the IEEE 802.15.4 family of standards, and peer-to-peer (P2P) networks, etc. In some examples, network interface device 410 may include an Ethernet port or other physical jack, a Wi-Fi card, a network interface card (NIC), a cellular interface (e.g., antennas, filters, and associated circuitry), etc. In some examples, network interface device 410 may include multiple antennas to perform wireless communication using at least one of single-input multiple-output (SIMO), multiple-input multiple-output (MIMO), or multiple-input single-output (MISO) technologies. In some example implementations, one or more of antenna 406, communication module 408, and / or network interface device 410 or their sub-components may be integrated into a single module or device, functioning or operating as if they were a single module or device, or may include elements shared among them.

[0033] User interface 412 may include one or more input devices and / or display devices. Examples of suitable user input devices that may be included in user interface 412 include, but are not limited to, one or more buttons, keyboards, mice, touch-sensitive surfaces, styluses, cameras, microphones, etc. Examples of suitable user output devices that may be included in user interface 412 include, but are not limited to, one or more LEDs, LCD panels, displays, touchscreens, one or more lights, speakers, etc. It should be understood that user interface 412 may also include combined user input and user output devices, such as touch-sensitive displays. User interface 412 may include a separate alarm circuit 426 to indicate alarm conditions such as relay attacks or other security vulnerabilities. Alarm circuit 426 may provide an audio signal to a speaker, or may activate lights or display the alarm condition using a display device.

[0034] The power source 414 can be any suitable internal power source, such as a battery, a capacitive power source, or a similar type of charge storage device, and / or may include one or more power conversion circuits adapted to convert external power into suitable power for the components of the device 400 (e.g., converting externally supplied AC power into DC power).

[0035] The device 400 may also include one or more interconnects or buses 422 operable to transmit communication between various hardware components of the device. The system bus 422 may be any of several commercially available bus structures or bus architectures.

[0036] Additional public information and examples

[0037] Example 1 may include a subject (e.g., a method for device authentication) that includes: transmitting a first random number from a receiving device to an initiating device; having the receiving device use the first random number to determine first key information; transmitting the first random number, a second random number, and the second key information from the initiating device to the receiving device; transmitting the first random number, the second random number, and the first key information from the receiving device to the initiating device; and encrypting the information transmitted between the initiating device and the receiving device using an encryption key determined using the first key information and the second key information.

[0038] In Example 2, the subject of Example 1 may optionally include a first random number, which is a pseudo-random number determined using a counter value, and the first random number is bound to a specific communication context between the initiating device and the receiving device.

[0039] In Example 3, the subject of Example 2 may optionally include updating the counter value for each communication session between the initiating device and the receiving device.

[0040] In Example 4, the subject of Example 2 may optionally include updating the counter value after the first random number is transmitted between the receiving device and the initiating device.

[0041] In Example 5, the subject of one or any combination of Examples 1 to 4 may optionally include using a static key and a first random number to determine the first key information.

[0042] In Example 6, the subject matter of one or any combination of Examples 1 to 5 may optionally include using a static key, first key information and second key information stored in each of the initiating device and the receiving device to determine the encryption key.

[0043] In Example 7, the subject matter of one or any combination of Examples 1 to 6 may optionally include using a validator device as an initiator device and a credential device as a receiver device.

[0044] In Example 8, the subject matter of one or any combination of Examples 1 to 6 may optionally include using a smartphone as the receiving device and using a server or access control device as the initiating device.

[0045] In Example 9, the subject matter of one or any combination of Examples 1 to 6 may optionally include a receiving device as a smart card and an initiating device as a server or access control device.

[0046] Example 10 may include a subject (e.g., a validator device of an authentication system), or may optionally be combined with one or any combination of Examples 1 to 9 to include a subject comprising: a physical layer circuitry system; and a processing circuitry system operatively coupled to the physical layer circuitry system. The processing circuitry system is configured to: encode an authentication command for transmission to a credential device; decode a response communication received from the credential device, wherein the response communication includes a first random number; use the first random number to determine receiver device key material; encrypt the first random number, a second random number, and validator device key material for transmission to the credential device; decrypt encrypted information received from the credential device, wherein the encrypted information includes the first random number, the second random number, and receiver device key material; and use the validator key material and the receiver key material to compute a session encryption key.

[0047] In Example 11, the subject of Example 10 may optionally include a processing circuit system configured to use a static key and a first random number to calculate key material for the receiving device.

[0048] In Example 12, one or both of the subjects in Examples 10 and 11 may optionally include a processing circuit system configured to calculate a session key using a static key, a validator device key material, and a receiver device key material.

[0049] In Example 13, the subject matter of one or any combination of Examples 10 to 12 may optionally include a processing circuit system configured to compute a first random number by applying a counter value to a pseudo-random number function.

[0050] In Example 14, the subject of Example 13 may optionally include a processing circuit system configured to change the counter value used to calculate random numbers for each communication session with the credential device.

[0051] In Example 15, the subject of Example 13 may optionally include a processing circuit system configured to change the counter value used to calculate the first random number after exchanging information with the credential device.

[0052] Example 16 includes a subject (e.g., a receiving device of an authentication system), or may optionally be combined with one or any combination of Examples 1 to 15 to include a subject comprising: a physical layer circuitry system; and a processing circuitry system operatively coupled to the physical layer circuitry system. The processing circuitry system is configured to: decode an authentication command received from an authenticator device; encode a response to be sent to the authenticator device, wherein the response includes a first random number; decrypt encrypted information received from the authenticator device, wherein the encrypted information includes a first random number, a second random number, and authenticator device key material; encrypt the first random number, the second random number, and the receiving device key material to be sent to the authenticator device; and calculate a session encryption key using the authenticator device key material and the receiving device key material.

[0053] In Example 17, the subject of Example 16 may optionally include a processing circuit system configured to use a static key and a second random number to calculate key material for the receiving device.

[0054] In Example 18, one or both of the subjects in Examples 16 and 17 may optionally include a processing circuit system configured to calculate a session key using a static key, a validator device key material, and a receiver device key material.

[0055] In Example 19, the subject matter of one or any combination of Examples 16 to 18 may optionally include a processing circuit system configured to compute a first random number by applying a counter value to a pseudo-random number function.

[0056] In Example 20, one or any combination of the subjects in Example 19 may optionally include a processing circuit system configured to change the counter value used to calculate random numbers for each communication session with the authenticator device.

[0057] These examples can be combined in any arrangement or combination. The detailed description above includes reference to the accompanying drawings, which form part of the detailed description. The drawings illustrate, by way of example, specific embodiments in which the invention can be practiced. The above description is intended to be illustrative and not restrictive. For example, the above examples (or one or more aspects thereof) can be used in combination with each other. For example, other embodiments can be used by those skilled in the art after consulting the above description. An abstract is provided to enable the reader to quickly determine the nature of the technical disclosure. The abstract is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In the detailed description above, various features may be combined together to simplify this disclosure. This should not be construed as meaning that unclaimed features are necessary for any claim. Rather, the subject matter may lie in fewer than all features of a particular disclosed embodiment. Therefore, the appended claims are thus incorporated into the detailed description, wherein each claim is itself an independent embodiment, and it is contemplated that such embodiments may be combined with each other in various combinations or substitutions. The scope should be determined with reference to the appended claims together with the full scope of their equivalents.

Claims

1. A method for device authentication, the method comprising: The authentication command is sent from the authentication initiator device to the receiver device to be authenticated; In response to the authentication command, a first random number is transmitted from the receiving device to the authentication initiating device; The receiving device uses the first random number transmitted by the receiving device in response to the authentication command to determine the first key information; The first random number, the second random number, and the second key information are transmitted from the authentication initiator device to the receiver device. The first random number, the second random number, and the first key information are transmitted from the receiving device to the authentication initiating device, wherein the first key information is a predictable random number that can be determined by the authentication initiating device. as well as The information transmitted between the authentication initiator device and the receiver device is encrypted using an encryption key determined by the first key information and the second key information.

2. The method according to claim 1, wherein, The first random number is a pseudo-random number determined using a counter value, and the first random number is bound to a specific communication context between the authentication initiator device and the receiver device.

3. The method of claim 2, further comprising updating the counter value for each communication session between the authentication initiator device and the receiver device.

4. The method according to claim 2 or 3, comprising updating the counter value after the first random number is transmitted between the receiving device and the authentication initiating device.

5. The method according to any one of claims 1 to 3, wherein, Determining the first key information includes using a static key and the first random number to determine the first key information.

6. The method according to any one of claims 1 to 3, comprising determining the encryption key using a static key, the first key information, and the second key information stored in each of the authentication initiator device and the receiver device.

7. The method according to any one of claims 1 to 3, wherein, The authentication initiator device is a verification device, and the receiver device is a credential device.

8. The method according to claim 7, wherein, The receiving device is a smartphone, and the authentication initiating device is a server or access control device.

9. The method according to claim 7, wherein, The receiving device is a smart card, and the authentication initiating device is a server or access control device.

10. A verification device for an authentication system, the device comprising: Physical layer circuit system; as well as A processing circuit system, operatively coupled to the physical layer circuit system, and configured to: Encode the authentication command used to be sent to the credential device to authenticate the credential device; Decode the response communication received from the credential device in response to the authentication command, wherein the response communication includes a first random number determined by the credential device; The first random number is used to determine the key material of the receiving device; The first random number, the second random number, and the key material of the verification device used to send to the credential device are encrypted; The encrypted information received from the credential device is decrypted, wherein the encrypted information includes a first random number, a second random number, and key material from the receiving device, wherein the key material from the receiving device is a predictable random number that can be determined by the verifying device; and The session encryption key is calculated using the key material of the authenticator device and the key material of the receiver device.

11. The apparatus according to claim 10, wherein, The processing circuitry is configured to use a static key and the first random number to calculate the key material for the receiving device.

12. The apparatus according to claim 10 or 11, wherein, The processing circuitry is configured to calculate the session encryption key using a static key, the key material of the authenticator device, and the key material of the receiver device.

13. The apparatus according to claim 10 or 11, wherein, The processing circuitry is configured to calculate the first random number by applying a counter value to a pseudo-random number function.

14. The apparatus according to claim 13, wherein, The processing circuitry is configured to change the counter value used to calculate the first random number for each communication session with the credential device.

15. The apparatus according to claim 13, wherein, The processing circuitry is configured to change the counter value used to calculate the first random number after exchanging information with the credential device.

16. A receiver device for an authentication system, the device comprising: Physical layer circuit system; as well as A processing circuit system, operatively coupled to the physical layer circuit system, and configured to: Decode the authentication command received from the authenticating device for authenticating the receiving device; The response sent to the authenticating device in response to the authentication command is encoded, wherein the response includes a first random number determined by the receiving device in response to the authentication command; The encrypted information received from the verification device is decrypted, wherein the encrypted information includes the first random number, the second random number, and the verification device key material; The first random number, the second random number, and the key material of the receiving device are encrypted for transmission to the verifier device, wherein the key material of the receiving device is a predictable random number that can be determined by the verifier device; and The session encryption key is calculated using the key material of the authenticator device and the key material of the receiver device.

17. The apparatus according to claim 16, wherein, The processing circuitry is configured to use a static key and the first random number to calculate the key material for the receiving device.

18. The apparatus according to claim 16 or 17, wherein, The processing circuitry is configured to calculate the session encryption key using a static key, the key material of the authenticator device, and the key material of the receiver device.

19. The apparatus according to claim 16 or 17, wherein, The processing circuitry is configured to calculate the first random number by applying a counter value to a pseudo-random number function.

20. The apparatus according to claim 19, wherein, The processing circuitry is configured to change the counter value used to calculate the first random number for each communication session with the verification device.

21. The apparatus according to claim 19, wherein, The processing circuitry is configured to change the counter value used to calculate the first random number after exchanging information with the verification device.

Images