Method, apparatus, storage medium and processor for communicating data

Abstract

This invention discloses a data communication method, apparatus, storage medium, and processor. The method includes: sending a client sequence code and a public key to a server, wherein the client sequence code enables the server to generate an authentication key based on a key derivation algorithm, and the public key enables the server to encrypt the authentication key to obtain an encrypted authentication key; decrypting the encrypted authentication key using a private key to obtain an authentication key; performing a challenge authentication encryption calculation on a client authentication challenge random number using the authentication key to obtain a first hash authentication message code; and comparing the first hash authentication message code with a second hash authentication message code to obtain a first authentication result. This invention solves the technical problem of difficulty in ensuring data communication security.

Description

Technical Field

[0001] This invention relates to the field of data communication, and more specifically, to a data communication method, apparatus, storage medium, and processor. Background Technology

[0002] Currently, data communication is mainly based on a client-server architecture. Data communication between the client and server requires encryption of the original communication text. However, conventional encryption methods cannot prevent message counterfeiting, which leads to technical problems that make it difficult to guarantee the security of data communication.

[0003] There is currently no effective solution to the aforementioned problem of ensuring data communication security. Summary of the Invention

[0004] This invention provides a data communication method, apparatus, storage medium, and processor to at least solve the technical problem of difficulty in ensuring data communication security.

[0005] According to one aspect of the present invention, a data communication method is provided. The method may include: sending a client sequence code and a public key to a server, wherein the client sequence code is used to enable the server to generate an authentication key based on a key derivation algorithm, and the public key is used to enable the server to encrypt the authentication key to obtain an encrypted authentication key, the encrypted authentication key being sent from the server to the client; decrypting the encrypted authentication key using a private key to obtain an authentication key; performing a challenge authentication encryption calculation on a client authentication challenge random number using the authentication key to obtain a first hash authentication message code; comparing the first hash authentication message code with a second hash authentication message code to obtain a first authentication result, wherein the second hash authentication message code is obtained by the server performing a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key; and communicating data between the client and the server based on the first authentication result.

[0006] Optionally, the first hash authentication message code is compared with the second hash authentication message code to obtain a first authentication result, including: in response to the first hash authentication message code and the second hash authentication message code being different, determining that the client authentication challenge random number authentication has failed; in response to the first hash authentication message code and the second hash authentication message code being the same, determining that the client authentication challenge random number authentication has succeeded.

[0007] Optionally, after determining that the authentication challenge random number for the client is successfully authenticated in response to the first hash authentication message code being the same as the second hash authentication message code, the data communication method further includes: performing challenge authentication encryption calculation on the server-side authentication challenge random number to obtain a third hash authentication message code; and performing symmetric encryption on the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0008] Optionally, the third hash authentication message code is symmetrically encrypted to obtain an encrypted third hash authentication message code, including: using the communication session key to symmetrically encrypt a true random number to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; and using the encrypted random number as a key to symmetrically encrypt the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0009] According to another aspect of the present invention, another data communication method is also provided. The method may include: receiving a client sequence code and a public key; generating an authentication key for the client sequence code based on a key derivation algorithm; encrypting the authentication key using the public key to obtain an encrypted authentication key, wherein the encrypted authentication key is used to keep confidential the authentication key required for performing challenge authentication encryption calculation on a client authentication challenge random number to obtain a first hash authentication message code; performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code, wherein the second hash authentication message code is used to compare with the first hash authentication message code to obtain a first authentication result.

[0010] Optionally, after performing challenge authentication encryption calculation on the client's authentication challenge random number using the authentication key to obtain the second hash authentication message code, the data communication method further includes: performing challenge authentication encryption calculation on the server's authentication challenge random number using the authentication key to obtain the fourth hash authentication message code; comparing the third hash authentication message code and the fourth hash authentication message code to obtain the second authentication result, wherein the third hash authentication message code is obtained by the client performing challenge authentication encryption calculation on the server's authentication challenge random number using the authentication key, and the second authentication result is used to indicate whether the third hash authentication message code and the fourth hash authentication message code are the same.

[0011] Optionally, before comparing the third hash authentication message code and the fourth hash authentication message code to obtain the second authentication result, the data communication method further includes: using a communication session key to symmetrically encrypt a true random number to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; using the encrypted random number as a key to symmetrically decrypt the encrypted third hash authentication message code to obtain the third hash authentication message code.

[0012] Optionally, the third hash authentication message code and the fourth hash authentication message code are compared to obtain a second authentication result, including: in response to the third hash authentication message code and the fourth hash authentication message code being different, determining that the authentication of the server authentication challenge random number has failed; in response to the third hash authentication message code and the fourth hash authentication message code being the same, determining that the authentication of the server authentication challenge random number has succeeded.

[0013] According to one aspect of the present invention, a data communication apparatus is provided, the apparatus comprising: a sending unit, configured to send a client sequence code and a public key to a server, wherein the client sequence code is used to enable the server to generate an authentication key based on a key derivation algorithm, and the public key is used to enable the server to encrypt the authentication key to obtain an encrypted authentication key, the encrypted authentication key being sent from the server to the client; a decryption unit, configured to decrypt the encrypted authentication key using a private key to obtain an authentication key; a first calculation unit, configured to perform challenge authentication encryption calculation on a client authentication challenge random number using the authentication key to obtain a first hash authentication message code; a first comparison unit, configured to compare the first hash authentication message code with a second hash authentication message code to obtain a first authentication result, wherein the second hash authentication message code is obtained by the server performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key; and a communication unit, configured to communicate data between the client and the server based on the first authentication result.

[0014] According to another aspect of the present invention, a data communication device is also provided, which may include: a receiving unit for receiving a client sequence code and a public key; a generating unit for generating an authentication key for the client sequence code based on a key derivation algorithm; an encryption unit for encrypting the authentication key using the public key to obtain an encrypted authentication key, wherein the encrypted authentication key is used to keep confidential the authentication key required for performing challenge authentication encryption calculation on a client authentication challenge random number to obtain a first hash authentication message code; and a second calculation unit for performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code, wherein the second hash authentication message code is used to compare with a first hash authentication message code to obtain a first authentication result.

[0015] According to another aspect of the present invention, a computer-readable storage medium is also provided. The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform a data communication method according to the embodiments of the present invention.

[0016] According to another aspect of the present invention, a processor is also provided. The processor is used to run a program, wherein the program, when run by the processor, executes the data communication method of the embodiments of the present invention.

[0017] In this embodiment of the invention, the client first sends its client sequence code and public key to the server. The server then generates an authentication key based on the client sequence code using a key derivation algorithm. The server encrypts the generated authentication key using its public key to obtain an encrypted authentication key. The client then decrypts the encrypted authentication key using its private key to obtain the authentication key. The client then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a first hash authentication message code. The server then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code. Finally, the first hash authentication message code and the second hash authentication message code are compared to obtain a first authentication result. This determines whether the client authentication challenge random number has been successfully authenticated. This achieves the goal of using different keys to encrypt the original transmitted data during the authentication process or communication process, thereby solving the technical problem of difficulty in ensuring data communication security and achieving the technical effect of ensuring data communication security. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0019] Figure 1 This is a flowchart of a data communication method according to an embodiment of the present invention;

[0020] Figure 2 This is a flowchart of another data communication method according to an embodiment of the present invention;

[0021] Figure 3 This is a flowchart of a method for obtaining true random numbers according to an embodiment of the present invention;

[0022] Figure 4 This is a flowchart of a data encryption / decryption method according to an embodiment of the present invention;

[0023] Figure 5 This is a flowchart of a challenge authentication encryption calculation method according to an embodiment of the present invention;

[0024] Figure 6 This is a flowchart of a two-way authentication anti-counterfeiting method according to an embodiment of the present invention;

[0025] Figure 7 This is a schematic diagram of a data communication device according to an embodiment of the present invention;

[0026] Figure 8 This is a schematic diagram of another data communication device according to an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] Example 1

[0030] According to an embodiment of the present invention, a data communication method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] The following describes the data communication method of this embodiment of the invention from the client side.

[0032] Figure 1 This is a flowchart of a data communication method according to an embodiment of the present invention, such as... Figure 1 As shown, the method may include the following steps:

[0033] Step S101: Send the client sequence code and public key to the server.

[0034] In the technical solution provided by step S101 of the present invention, the client sends a client sequence code and a public key to the server. The client sequence code can be used to enable the server to generate a communication session key and an authentication key based on a key derivation algorithm. The public key can be used to enable the server to encrypt the communication session key to obtain an encrypted communication session key and to enable the server to encrypt the authentication key to obtain an encrypted authentication key. The encrypted authentication key can be sent to the client by the server.

[0035] Step S102: Decrypt the encrypted authentication key using the private key to obtain the authentication key.

[0036] In the technical solution provided in step S102 of the present invention, after the client sends the client sequence code and public key to the server, the client decrypts the encryption authentication key using its own private key to obtain the authentication key, and the client also decrypts the encryption communication session key using its own private key to obtain the communication session key.

[0037] Optionally, the client can perform the following steps: Step 1, execute the communication data encryption sub-process to perform symmetric encryption on the client sequence code to obtain the encrypted client sequence code; Step 2, obtain the current system time and execute the communication data encryption sub-process to perform encrypted calculation on the current system time to obtain the encrypted time; Step 3, obtain the client authentication challenge random number and execute the communication data encryption sub-process to obtain the encrypted client authentication challenge random number; Step 4, combine the encrypted client sequence code, the encrypted time, and the encrypted client authentication challenge random number, and send the combined encrypted data to the server.

[0038] Optionally, the client authentication challenge random number can be a 32-byte long challenge random number.

[0039] Step S103: Perform challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain the first hash authentication message code.

[0040] In the technical solution provided by step S103 of the present invention, after the client decrypts and obtains the authentication key, the client executes the communication data decryption sub-process, uses the communication session key to perform symmetric encryption calculation on the true random number to obtain an encrypted random number, and uses the encrypted random number as the key to perform symmetric decryption on the encrypted second hash authentication message code to obtain the second hash authentication message code. Then, the client uses the authentication key to perform hash encryption calculation on the client sequence code to obtain the hash authentication message code corresponding to the client sequence code, and uses the hash authentication message code corresponding to the client sequence code as the key to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain the hash message authentication code of the challenge random number, that is, to obtain the first hash authentication message code, thereby ensuring that the client authentication challenge random number is authenticated.

[0041] Step S104: Compare the first hash authentication message code with the second hash authentication message code to obtain the first authentication result.

[0042] In the technical solution provided by step S104 of the present invention, after obtaining the first hash authentication message code through challenge authentication encryption calculation, the first hash authentication message code is compared with the second hash authentication message code to obtain the first authentication result. The second hash authentication message code can be obtained by the server performing challenge authentication encryption calculation on the client authentication challenge random number through the authentication key. The first authentication result can be used to indicate whether the first hash authentication message code and the second hash authentication message code are the same.

[0043] Step S105: Based on the first authentication result, data communication is performed between the client and the server.

[0044] In the technical solution provided by step S105 of the present invention, after obtaining the first authentication result, the obtained first authentication result is judged. If the first authentication result is that the first hash authentication message code is the same as the second hash authentication message code, then the communication between the client and the server continues. That is, the client continues to perform challenge authentication encryption calculation on the server's authentication challenge random number. If the first authentication result is that the first hash authentication message code is different from the second hash authentication message code, then the current communication process between the client and the server ends, an error code is reported, and then another communication process between the client and the server is restarted. That is, the client sends the client sequence code and public key to the server again to perform data encryption authentication.

[0045] In steps S101 to S105 of this application, the client first sends its client sequence code and public key to the server. The server then generates an authentication key based on the client sequence code using a key derivation algorithm. The server encrypts the generated authentication key using its public key to obtain an encrypted authentication key. The client then decrypts the encrypted authentication key using its private key to obtain the authentication key. The client then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a first hash authentication message code. The server then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code. Finally, the first hash authentication message code and the second hash authentication message code are compared to obtain a first authentication result. Based on the first authentication result, data communication is conducted between the client and the server. This determines whether the client authentication challenge random number has been successfully authenticated. This achieves the goal of using different keys to encrypt the original transmitted data during the authentication process or communication process, thereby solving the technical problem of difficulty in ensuring data communication security and achieving the technical effect of ensuring data communication security.

[0046] The method described in this embodiment will be further described below.

[0047] As an optional embodiment, step S104, comparing the first hash authentication message code with the second hash authentication message code to obtain a first authentication result, includes: in response to the first hash authentication message code and the second hash authentication message code being different, determining that the client authentication challenge random number authentication has failed; in response to the first hash authentication message code and the second hash authentication message code being the same, determining that the client authentication challenge random number authentication has succeeded.

[0048] In this embodiment, after comparing the first hash authentication message code with the second hash authentication message code, it is determined whether the first hash authentication message code and the second hash authentication message code are the same. If the first hash authentication message code and the second hash authentication message code are different, in response to this situation, it is determined that the client authentication challenge random number authentication has failed, that is, the obtained first authentication result is failed, and an error code is reported, ending the authentication process and communication process. If the first hash authentication message code and the second hash authentication message code are the same, in response to this situation, it is determined that the client authentication challenge random number authentication has succeeded, that is, the obtained first authentication result is successful, and the authentication process and communication process continue.

[0049] As an optional embodiment, after determining that the authentication challenge random number for the client is successfully authenticated in response to the first hash authentication message code and the second hash authentication message code being the same, the data communication method further includes: performing challenge authentication encryption calculation on the server-side authentication challenge random number to obtain a third hash authentication message code; and performing symmetric encryption on the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0050] In this embodiment, after confirming the successful authentication of the client's authentication challenge random number, the client executes a communication data decryption sub-process to obtain the server's authentication challenge random number. Then, the client uses the authentication key to perform hash encryption calculation on the client's sequence code to obtain a hash authentication message code corresponding to the client's sequence code. The client then uses the hash authentication message code corresponding to the client's sequence code as a key to perform challenge authentication encryption calculation on the server's authentication challenge random number to obtain a third hash authentication message code. Subsequently, the communication data encryption sub-process is executed to perform symmetric encryption on the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0051] As an optional implementation, the third hash authentication message code is symmetrically encrypted to obtain an encrypted third hash authentication message code, including: using a communication session key to symmetrically encrypt a true random number to obtain an encrypted random number; and using the encrypted random number as a key to symmetrically encrypt the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0052] In this embodiment, after obtaining the third hash authentication message code through challenge authentication encryption calculation, the client uses the communication session key to symmetrically encrypt the true random number to obtain an encrypted random number. Then, the encrypted random number is used as the key to symmetrically encrypt the third hash authentication message code to obtain an encrypted third hash authentication message code. The communication session key can be generated by the server based on the key derivation algorithm for the client sequence code.

[0053] Optionally, a true random number can be obtained by executing a sub-process to obtain a true random number based on a communication random value, wherein the length of the communication random value can be set to 32 bytes.

[0054] Optionally, the first 16 bytes of the communication random value are inserted into the header of the encrypted third hash authentication message code, and the last 16 bytes of the communication random value are inserted into the tail of the encrypted third hash authentication message code to complete the assembly of the transmitted data and obtain the current transmitted data.

[0055] The following describes the data communication method of this embodiment of the invention from the server side. Figure 2 This is a flowchart of another data communication method according to an embodiment of the present invention, such as... Figure 2 As shown, the method may include the following steps:

[0056] Step S201: Receive the client's sequence code and public key;

[0057] In the technical solution provided by step S201 of the present invention, the server receives a client sequence code and a public key from the client. The client sequence code can be a communication session key and an authentication key generated by the server based on a key derivation algorithm. The public key can be used to enable the server to encrypt the communication session key to obtain an encrypted communication session key, and to enable the server to encrypt the authentication key to obtain an encrypted authentication key.

[0058] Step S202: Generate an authentication key based on the client sequence code using the key derivation algorithm;

[0059] In the technical solution provided in step S202 of the present invention, the server generates a communication session key and an authentication key based on the client sequence code using a key derivation algorithm.

[0060] Step S203: Encrypt the authentication key using the public key to obtain the encrypted authentication key;

[0061] In the technical solution provided in step S203 of the present invention, the server encrypts the communication session key with the public key to obtain the encrypted communication session key, and encrypts the authentication key with the public key to obtain the encrypted authentication key. The encrypted communication session key can be used to keep confidential the communication session key required in the encryption and decryption process, and the encrypted authentication key can be used to keep confidential the authentication key required to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain the first hash authentication message code.

[0062] Step S204: Perform challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain the second hash authentication message code.

[0063] In the technical solution provided by step S204 of the present invention, after decrypting the encryption authentication key to obtain the authentication key, the server uses the authentication key to perform hash encryption calculation on the client sequence code to obtain a hash authentication message code corresponding to the client sequence code. The hash authentication message code corresponding to the client sequence code is used as the key to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain the hash message authentication code of the challenge random number, that is, to obtain the second hash authentication message code. The second hash authentication message code can be used to compare with the first hash authentication message code to obtain the first authentication result, thereby determining whether the client authentication challenge random number is successfully authenticated, and further determining whether to continue to execute the remaining authentication process and communication process.

[0064] In steps S201 to S204 of this application, the client sequence code and public key are received; an authentication key is generated for the client sequence code based on a key derivation algorithm; the authentication key is encrypted using the public key to obtain an encrypted authentication key, wherein the encrypted authentication key is used to keep secret the authentication key required for performing challenge authentication encryption calculation on the client authentication challenge random number to obtain the first hash authentication message code; the client authentication challenge random number is challenge authentication encryption calculation using the authentication key to obtain a second hash authentication message code, wherein the second hash authentication message code is used to compare with the first hash authentication message code to obtain the first authentication result. In other words, in this embodiment of the invention, the client first receives the client sequence code and public key sent by the client. Then, the server generates an authentication key based on the client sequence code using a key derivation algorithm. The server then encrypts the generated authentication key using the public key to obtain an encrypted authentication key. Subsequently, the client decrypts the encrypted authentication key using its private key to obtain the authentication key. The client then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a first hash authentication message code. The server then performs a challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code. Finally, the first hash authentication message code and the second hash authentication message code are compared to obtain a first authentication result. This determines whether the client authentication challenge random number has been successfully authenticated. This achieves the goal of using different keys to encrypt the original transmitted data during the authentication process or communication process, thereby solving the technical problem of difficulty in ensuring data communication security and achieving the technical effect of ensuring data communication security.

[0065] The method described in this embodiment will be further described below.

[0066] As an optional embodiment, after performing challenge authentication encryption calculation on the client's authentication challenge random number using the authentication key to obtain the second hash authentication message code, the data communication method further includes: performing challenge authentication encryption calculation on the server's authentication challenge random number using the authentication key to obtain the fourth hash authentication message code; comparing the third hash authentication message code and the fourth hash authentication message code to obtain the second authentication result, wherein the third hash authentication message code is obtained by the client performing challenge authentication encryption calculation on the server's authentication challenge random number using the authentication key, and the second authentication result is used to indicate whether the third hash authentication message code and the fourth hash authentication message code are the same.

[0067] In this embodiment, after obtaining the second hash authentication message code through challenge authentication encryption calculation, the server uses the authentication key to perform hash encryption calculation on the client sequence code to obtain a hash authentication message code corresponding to the client sequence code. Then, the server uses the hash authentication message code corresponding to the client sequence code as a key to perform challenge authentication encryption calculation on the server authentication challenge random number to obtain a fourth hash authentication message code. Finally, the third hash authentication message code and the fourth hash authentication message code are compared to obtain the second authentication result. The third hash authentication message code can be obtained by the client using the authentication key to perform challenge authentication encryption calculation on the server authentication challenge random number. The second authentication result can be used to indicate whether the third hash authentication message code and the fourth hash authentication message code are the same.

[0068] Optionally, the server-side authentication challenge random number can be a 32-byte long challenge random number.

[0069] As an optional embodiment, before comparing the third hash authentication message code and the fourth hash authentication message code to obtain the second authentication result, the data communication method further includes: using a communication session key to symmetrically encrypt a true random number to obtain an encrypted random number; using the encrypted random number as a key to symmetrically decrypt the encrypted third hash authentication message code to obtain the third hash authentication message code.

[0070] In this embodiment, before obtaining the second authentication result, the server acquires the assembled transmission data and disassembles the acquired transmission data according to the data assembly protocol. The first 16 bytes and the last 16 bytes of the transmission data are concatenated to obtain a communication random value. The remaining data is the encrypted third hash authentication message code. Then, the server uses the communication session key to symmetrically encrypt the true random number to obtain an encrypted random number. Then, the encrypted random number is used as the key to symmetrically decrypt the encrypted third hash authentication message code to obtain the third hash authentication message code. The communication session key can be generated by the server based on the key derivation algorithm for the client sequence code.

[0071] Optionally, a true random number can be obtained by executing a sub-process to obtain a true random number based on a communication random value, wherein the length of the communication random value can be set to 32 bytes.

[0072] As an optional embodiment, the third hash authentication message code and the fourth hash authentication message code are compared to obtain a second authentication result, including: in response to the third hash authentication message code and the fourth hash authentication message code being different, determining that the authentication of the server-side authentication challenge random number fails; in response to the third hash authentication message code and the fourth hash authentication message code being the same, determining that the authentication of the server-side authentication challenge random number succeeds.

[0073] In this embodiment, after comparing the third hash authentication message code and the fourth hash authentication message code, it is determined whether the third hash authentication message code and the fourth hash authentication message code are the same. If the third hash authentication message code and the fourth hash authentication message code are different, in response to this situation, it is determined that the authentication challenge random number authentication to the server has failed, that is, the obtained second authentication result is failed, and an error code is sent to the client, ending the authentication process and communication process. If the third hash authentication message code and the fourth hash authentication message code are the same, in response to this situation, it is determined that the authentication challenge random number authentication to the server has succeeded, that is, the obtained second authentication result is successful, and an authentication success status code is sent to the client. The client and the server can then transmit communication data in encrypted form.

[0074] In this embodiment of the invention, the client first sends its client sequence code and public key to the server. The server then generates an authentication key based on the client sequence code using a key derivation algorithm. The server encrypts the generated authentication key using its public key to obtain an encrypted authentication key. The client then decrypts the encrypted authentication key using its private key to obtain the authentication key. The client then performs an encrypted authentication challenge calculation on the client authentication challenge random number using the authentication key to obtain a first hash authentication message code. The server then performs the same encrypted authentication challenge calculation on the client authentication challenge random number using the authentication key to obtain a second hash authentication message code. Finally, the first and second hash authentication message codes are compared to obtain a first authentication result. Based on this first authentication result, data communication is established between the client and the server. This determines whether the client authentication challenge random number has been successfully authenticated, thus solving the technical problem of ensuring data communication security and achieving the technical effect of ensuring data communication security.

[0075] Example 2

[0076] The technical solutions of the embodiments of the present invention will be illustrated below with reference to preferred embodiments.

[0077] With economic development and continuous improvement in communication levels, current data communication is mainly based on a client-server architecture. Data communication between clients and servers requires encryption of the original communication text. However, conventional encryption methods cannot prevent message counterfeiting, leading to technical problems that make it difficult to guarantee data communication security.

[0078] Therefore, to overcome the above problems, a related technology discloses a Bluetooth encrypted communication method based on a dynamic key. This method includes: receiving an encrypted communication request sent by a second terminal; wherein the second terminal and the first terminal are pre-bound via a server; when the encrypted communication request passes verification, sending an encrypted communication confirmation message generated based on the encrypted communication request to the second terminal; when the second terminal passes verification of the encrypted communication confirmation message, using a shared dynamic key to perform encrypted communication with the second terminal; wherein the shared dynamic key is a dynamic key shared between the second terminal and the first terminal; the shared dynamic key is generated based on a server signature pre-issued by the server. However, this method, where two Bluetooth terminals are pre-bound via a server and then use a shared dynamic key pre-issued by the server to complete encrypted communication between the Bluetooth terminals, does not guarantee that a random key is generated to encrypt and decrypt the original data during each authentication or communication process, ensuring one key per communication interaction, or that a key is derived from the client's unique identification serial number to create a session key and an authentication key, ensuring one key per device. Therefore, it cannot guarantee data communication security.

[0079] However, embodiments of the present invention propose a data communication method. This method creates a communication session key and an authentication key for the client sequence code, then encrypts a random value using the communication session key to obtain ciphertext, and uses the ciphertext as a new key to encrypt the original transmitted data. Finally, a challenge authentication encryption calculation is performed based on the authentication key, thereby solving the technical problem of difficulty in ensuring data communication security and achieving a technical effect that guarantees data communication security.

[0080] Figure 3 This is a flowchart of a method for obtaining truly random numbers according to an embodiment of the present invention, such as... Figure 3 As shown, the method may include the following steps:

[0081] In step S301, the system obtains a random number sequence Rand_1 with a length of 32 bytes and obtains the current count count.

[0082] After obtaining the current count, proceed to step S302 to calculate the remainder of the count modulo 3, denoted as x.

[0083] After obtaining the remainder of the count modulo 3, proceed to step S303, where the x-th sequence in the random number sequence group is replaced with Rand_1.

[0084] After replacing the xth sequence with Rand_1, proceed to step S304, parse and obtain the 8th byte of the random number sequence Rand_1, Rand_1[7] = 0 × b4, and calculate the remainder of Rand_1[7] modulo 3, denoted as y.

[0085] After calculating the remainder of Rand_1[7] modulo 3, proceed to step S305 to determine if y = 0, y = 1, or y = 2: if y = 0, proceed to step S306 to calculate the bitwise XOR result of the first random number Rand_array[0] and the second random number Rand_array[1] in the random number sequence group, and obtain a brand new 32-byte random number sequence, denoted as Rand_true; if y = 1, proceed to step S307 to calculate the first random number Rand_ar The bitwise XOR result of ray[0], the second random number Rand_array[1] and the third random number Rand_array[2] is used to obtain a new 32-byte random number sequence, denoted as Rand_true; if y = 2, then proceed to step S308, calculate the bitwise XOR result of the first random number Rand_array[0] and the third random number Rand_array[2] in the random number sequence group, and obtain a brand new 32-byte random number sequence, denoted as Rand_true.

[0086] Figure 4 This is a flowchart of a data encryption / decryption method according to an embodiment of the present invention, such as... Figure 4 As shown, the method may include the following steps:

[0087] Step S401: Obtain the data to be transmitted, denoted as data_raw.

[0088] After acquiring the data to be transmitted, proceed to step S402, where the system acquires a set of random numbers with a length of 32 bytes, denoted as Rand_1.

[0089] After obtaining the random number Rand_1, proceed to step S403, where a true random number acquisition sub-process is executed based on Rand_1 to obtain the true random number Rand_true.

[0090] After obtaining the true random number Rand_true, proceed to step S404, and use the communication session key Key_session to perform cipher block chaining (Advanced Encryption Standard_Cipher Block Chaining, abbreviated as AES_CBC) encryption calculation on the true random number Rand_true to obtain the encrypted random number Rand_enc.

[0091] After obtaining the encrypted random number Rand_enc, proceed to step S405, where Rand_enc is used as the key to perform AES_CBC encryption on the original communication data data_raw to obtain the ciphertext, denoted as data_enc.

[0092] After obtaining the encrypted data, proceed to step S406 to assemble the actual communication data. Fill the first 16 bytes of Rand_1 into the header of data_enc and the last 16 bytes into the tail of data_enc to obtain the communication data data_trans.

[0093] After obtaining the communication data data_trans, proceed to step S407 to obtain the communication data data_trans and decompose it according to the protocol to obtain Rand_1 and data_enc.

[0094] After obtaining Rand_1 and data_enc, proceed to step S408. Based on the decomposed Rand_1, execute the true random number acquisition sub-process to obtain the true random number Rand_true.

[0095] After obtaining the true random number Rand_true, proceed to step S409, and use the communication session key Key_session to perform AES_CBC encryption calculation on the true random number Rand_true to obtain the encrypted random number Rand_enc.

[0096] After obtaining the encrypted random number Rand_enc, proceed to step S410, where Rand_enc is used as the key to perform AES_CBC decryption calculation on the decomposed data_enc to obtain the original plaintext of the transmitted data, i.e., data_raw.

[0097] After obtaining the original plaintext of the transmitted data, proceed to step S411 to process the data according to the respective services.

[0098] Figure 5 This is a flowchart of a challenge authentication cryptographic computation method according to an embodiment of the present invention, such as... Figure 5 As shown, the method may include the following steps:

[0099] Step S501: Obtain a set of 32-byte challenge random numbers, denoted as Rand_challenge.

[0100] After obtaining the challenge random number, proceed to step S502, using the authentication key Key_authentication to perform a secure hash algorithm (Hash-basedMessageAuthenticationCode_SafetyHashAlgorithm 256, or HMAC_SHA256) encryption calculation on the serial number (SerialNumber, or SN) of the device to be authenticated, to obtain the hash message authentication code HMAC_SN of the SN number.

[0101] After obtaining the hash message authentication code HMAC_SN of the SN number, proceed to step S503, use HMAC_SN as the key, calculate the hash-based message authentication code on the challenge random number Rand_challenge, and obtain the challenge random number authentication code HMAC_challenge.

[0102] Figure 6 This is a flowchart of a two-way authentication anti-counterfeiting method according to an embodiment of the present invention, such as... Figure 6 As shown, the method may include the following steps:

[0103] In step S601, the client presets a random array Rand_array and sends the RSA public key and its own SN code.

[0104] After sending the RSA public key and its own SN code, proceed to step S602. The server presets a random array Rand_array, receives the RSA public key and the client's SN code, and generates a communication data encryption / decryption key and an authentication key for the SN code through a key derivation algorithm.

[0105] After generating the communication data encryption / decryption key and authentication key, step S603 is executed, whereby the server encrypts the two keys using the RSA public key and sends them to the client.

[0106] After the encrypted communication data encryption / decryption key and authentication key are sent to the client, step S604 is performed, where the client uses the RSA private key to decrypt and obtain the communication data encryption / decryption key and authentication key.

[0107] After the client uses the RSA private key to decrypt and obtain the communication data encryption / decryption key and authentication key, step S605 is performed to encrypt the communication data using the client's SN code, resulting in the ciphertext SN_enc of the SN code.

[0108] After obtaining the ciphertext of the SN code, proceed to step S606, where the client obtains the current system time (time), encrypts the communication data, and obtains the corresponding ciphertext time_enc.

[0109] After encrypting the communication data for the current system time to obtain the corresponding ciphertext, proceed to step S607, where the client obtains the authentication challenge random number Rand_Cli, encrypts the communication data, and obtains the corresponding ciphertext Rand_Cli_enc.

[0110] After encrypting the communication data of the authentication challenge random number to obtain the corresponding ciphertext, the process proceeds to step S608, where the client assembles the three encrypted ciphertexts and sends them to the server.

[0111] After assembling the three encrypted ciphertexts and sending them to the server, step S609 is entered. The server obtains the three ciphertexts according to the parsing protocol and executes the communication data decryption sub-process in sequence to obtain the SN code, the current system time (time), and the authentication challenge random number (Rand_Cli).

[0112] After obtaining the SN code, the current system time, and the authentication challenge random number, proceed to step S610 to verify whether the SN code has been registered. If the SN code is not registered, proceed to step S611, where the server sends an error code to the client to end the authentication process. If the SN code has been registered, proceed to step S612, where the server records the authentication log according to the time.

[0113] After the server records the authentication logs according to the time, it proceeds to step S613, where the server uses the authentication key to perform authentication encryption calculation on Rand_Cli to obtain the corresponding hash authentication message code HMAC_Cli_by_Srv.

[0114] After obtaining the corresponding hash authentication message code, proceed to step S614, where the server obtains another set of challenge random numbers Rand_Srv.

[0115] After obtaining another set of challenge random numbers on the server side, step S615 is entered. The server side performs a communication data encryption sub-process on HMAC_Cli_by_Srv and Rand_Srv respectively to obtain HMAC_Cli_by_Srv_enc and Rand_Srv_enc, and then combines and sends them to the client.

[0116] After the combined ciphertext is sent to the client, step S616 is executed, where the client performs the communication data decryption sub-process to obtain the plaintext: HMAC_Cli_by_Srv and Rand_Srv.

[0117] After executing the communication data decryption sub-process and obtaining the plaintext, the process proceeds to step S617, where the client performs challenge authentication encryption calculation on its own challenge random number Rand_Cli to obtain HMAC_Cli_by_Cli.

[0118] After the client performs challenge authentication encryption calculation on its own challenge random number to obtain another hash authentication message code, it proceeds to step S618 to check whether the two hash authentication message codes are the same. If the two hash authentication message codes are different, it proceeds to step S619, authentication fails, an error code is reported, and the authentication and communication process ends. If the two hash authentication message codes are the same, it proceeds to step S620, where the client performs challenge authentication encryption calculation on the server's challenge random number Rand_Srv to obtain HMAC_Srv_by_Cli.

[0119] After obtaining the hash authentication message code HMAC_Srv_by_Cli corresponding to the server's challenge random number, the process proceeds to step S621, where the client encrypts the communication data of HMAC_Srv_by_Cli to obtain the corresponding ciphertext and transmits it to the server.

[0120] After the data is transmitted to the server, step S622 is performed. The server decrypts the communication data to obtain HMAC_Srv_by_Cli, and performs challenge authentication encryption calculation on the server's challenge random number Rand_Srv to obtain HMAC_Srv_by_Srv.

[0121] After performing challenge authentication encryption calculation on the server-side challenge random number to obtain HMAC_Srv_by_Srv, proceed to step S623 to check if the two hash authentication message codes are the same. If the two hash authentication message codes are different, proceed to step S624, where the server sends an error code to the client and ends the authentication process. If the two hash authentication message codes are the same, proceed to step S625, where the server sends an authentication success status code to the client, and the server and client can transmit data encryptedly.

[0122] In this embodiment, the client first sends its public key and client serial number (SN) to the server. Then, the server generates a communication data encryption / decryption key and an authentication key based on the client SN using a key derivation algorithm. The server then uses its public key to encrypt the communication data encryption / decryption key and the authentication key and sends them to the client. Subsequently, the client uses its private key to decrypt and obtain the communication data encryption / decryption key and the authentication key. The client SN, the current system time, and the client-obtained authentication challenge random number are then encrypted and transmitted as communication data. Finally, the authentication challenge random number is used for authentication encryption calculation, and the hash authentication message codes are checked for consistency. This solves the technical problem of ensuring data communication security and achieves the technical effect of ensuring data communication security.

[0123] Example 3

[0124] According to an embodiment of the present invention, a data communication device is also provided. It should be noted that this data communication device can be used to execute a data communication method as described in Embodiment 1.

[0125] Figure 7 This is a schematic diagram of a data communication device according to an embodiment of the present invention. Figure 7 As shown, the data communication device 700 may include: a sending unit 701, a decryption unit 702, a first calculation unit 703, a comparison unit 704, and a communication unit 705.

[0126] The sending unit 701 is used to send a client sequence code and a public key to the server. The client sequence code is used to enable the server to generate an authentication key based on a key derivation algorithm. The public key is used to enable the server to encrypt the authentication key to obtain an encrypted authentication key. The encrypted authentication key is sent to the client by the server.

[0127] The decryption unit 702 is used to decrypt the encrypted authentication key using the private key to obtain the authentication key.

[0128] The first calculation unit 703 is used to perform challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain the first hash authentication message code.

[0129] The comparison unit 704 is used to compare the first hash authentication message code with the second hash authentication message code to obtain the first authentication result. The second hash authentication message code is obtained by the server using the authentication key to perform challenge authentication encryption calculation on the client's authentication challenge random number.

[0130] The communication unit 705 is used to communicate data between the client and the server based on the first authentication result.

[0131] Optionally, the comparison unit 704 may include: a first response module, configured to determine that the client authentication challenge random number authentication has failed in response to the first hash authentication message code and the second hash authentication message code being different; and a second response module, configured to determine that the client authentication challenge random number authentication has succeeded in response to the first hash authentication message code and the second hash authentication message code being the same.

[0132] Optionally, the data communication device 700 may further include: a third calculation unit for performing challenge authentication encryption calculation on the server authentication challenge random number to obtain a third hash authentication message code; and a first symmetric encryption unit for performing symmetric encryption on the third hash authentication message code to obtain an encrypted third hash authentication message code.

[0133] Optionally, the first symmetric encryption unit may include: a first symmetric encryption module, used to symmetrically encrypt a true random number using a communication session key to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; and a second symmetric encryption module, used to symmetrically encrypt a third hash authentication message code using the encrypted random number as a key to obtain an encrypted third hash authentication message code.

[0134] Figure 8 This is a schematic diagram of another data communication device according to an embodiment of the present invention. Figure 8 As shown, a data communication device 800 may include: a receiving unit 801, a generating unit 802, an encryption unit 803, and a second calculation unit 804.

[0135] Optionally, the data communication device 800 may further include: a fourth calculation unit, used to perform challenge authentication encryption calculation on the server authentication challenge random number using the authentication key to obtain a fourth hash authentication message code; and another comparison unit, used to compare the third hash authentication message code and the fourth hash authentication message code to obtain a second authentication result, wherein the third hash authentication message code is obtained by the client performing challenge authentication encryption calculation on the server authentication challenge random number using the authentication key, and the second authentication result is used to indicate whether the third hash authentication message code and the fourth hash authentication message code are the same.

[0136] Optionally, the data communication device 800 may further include: a second symmetric encryption unit, used to symmetrically encrypt a true random number using a communication session key to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; and a symmetric decryption unit, using the encrypted random number as a key to symmetrically decrypt the encrypted third hash authentication message code to obtain the third hash authentication message code.

[0137] Optionally, the other comparison unit mentioned above may include: a third response module, used to determine that the authentication of the server authentication challenge random number fails in response to the third hash authentication message code and the fourth hash authentication message code being different; and a fourth response module, used to determine that the authentication of the server authentication challenge random number succeeds in response to the third hash authentication message code and the fourth hash authentication message code being the same.

[0138] In this embodiment, a sending unit is used to send a client sequence code and a public key to the server. The client sequence code enables the server to generate an authentication key based on a key derivation algorithm, and the public key enables the server to encrypt the authentication key to obtain an encrypted authentication key, which is sent from the server to the client. A decryption unit is used to decrypt the encrypted authentication key using a private key to obtain an authentication key. A first calculation unit is used to perform challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain a first hash authentication message code. A comparison unit is used to compare the first hash authentication message code with a second hash authentication message code to obtain a first authentication result. The second hash authentication message code is obtained by the server performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key. A communication unit is used to communicate data between the client and the server based on the first authentication result. This solves the technical problem of difficulty in ensuring data communication security and achieves the technical effect of ensuring data communication security.

[0139] Example 4

[0140] According to embodiments of the present invention, a computer-readable storage medium is also provided. The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the data communication method of Embodiment 1.

[0141] Example 5

[0142] According to an embodiment of the present invention, a processor is also provided. The processor is used to run a program, wherein the program, when run by the processor, executes the data communication method of Embodiment 1.

[0143] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0144] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0149] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data communication method, characterized in that, Applied to the client side, including: Send a client sequence code and a public key to the server. The client sequence code is used to enable the server to generate an authentication key based on a key derivation algorithm. The public key is used to enable the server to encrypt the authentication key to obtain an encrypted authentication key. The encrypted authentication key is sent to the client by the server. The authentication key is obtained by decrypting the encrypted authentication key using the private key, and the communication session key is obtained by decrypting the encrypted communication session key using the private key; the client sequence code is symmetrically encrypted to obtain the encrypted client sequence code; the current system time is obtained and encrypted calculation is performed on the current system time to obtain the encrypted time; a client authentication challenge random number is obtained; the client authentication challenge random number is encrypted to obtain the encrypted client authentication challenge random number; the encrypted client sequence code, the encrypted time, and the encrypted client authentication challenge random number are combined to obtain encrypted data, and the encrypted data is sent to the server; The authentication key is used to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain the first hash authentication message code; The first hash authentication message code is compared with the second hash authentication message code to obtain the first authentication result, wherein the second hash authentication message code is obtained by the server performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key; Based on the first authentication result, communicate the data with the server. The first authentication message code is compared with the second authentication message code to obtain a first authentication result, including: in response to the first authentication message code and the second authentication message code being different, determining that the client authentication challenge random number authentication has failed, reporting an error code, and ending the authentication process and the communication process; in response to the first authentication message code and the second authentication message code being the same, determining that the client authentication challenge random number authentication has succeeded, and continuing to execute the authentication process and the communication process.

2. The method according to claim 1, characterized in that, After determining that the client authentication challenge random number authentication is successful in response to the first hash authentication message code and the second hash authentication message code being the same, the method further includes: The server-side authentication challenge random number is used to perform challenge authentication encryption calculation to obtain the third hash authentication message code; The third hash authentication message code is symmetrically encrypted to obtain the encrypted third hash authentication message code.

3. The method according to claim 2, characterized in that, The third hash authentication message code is symmetrically encrypted to obtain an encrypted third hash authentication message code, including: The true random number is symmetrically encrypted using the communication session key to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; The encrypted random number is used as the key to perform symmetric encryption on the third hash authentication message code, resulting in an encrypted third hash authentication message code.

4. A data communication method, characterized in that, Applied to the server side, including: Receive the client's sequence code and public key; An authentication key is generated based on the key derivation algorithm for the client sequence code; The authentication key is encrypted using the public key to obtain an encrypted authentication key, and the communication session key is encrypted using the public key to obtain an encrypted communication session key. The encrypted authentication key is used to keep confidential the authentication key required to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain the first hash authentication message code. The authentication key is used to perform challenge authentication encryption calculation on the client authentication challenge random number to obtain a second hash authentication message code, wherein the second hash authentication message code is used to compare with the first hash authentication message code to obtain a first authentication result; The method further includes: the server receiving encrypted data, wherein the encrypted data is a combination of an encrypted client serial number, the current system time of the encrypted client, and a random number of the encrypted client authentication challenge; in response to the server receiving the encrypted data, verifying whether the client serial number has been registered; if the client serial number has not been registered, the server sends an error code to the client and ends the authentication; if the client serial number has been registered, the server records the authentication log according to the current system time.

5. The method according to claim 4, characterized in that, After performing challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain the second hash authentication message code, the method further includes: The authentication key is used to perform challenge authentication encryption calculation on the server authentication challenge random number to obtain the fourth hash authentication message code; The third hash authentication message code and the fourth hash authentication message code are compared to obtain a second authentication result. The third hash authentication message code is obtained by the client through the authentication key to perform challenge authentication encryption calculation on the server authentication challenge random number. The second authentication result is used to indicate whether the third hash authentication message code and the fourth hash authentication message code are the same.

6. The method according to claim 5, characterized in that, Before comparing the third hash authentication message code and the fourth hash authentication message code to obtain the second authentication result, the method further includes: The true random number is symmetrically encrypted using the communication session key to obtain an encrypted random number, wherein the communication session key is generated by the server based on a key derivation algorithm for the client sequence code; The encrypted random number is used as the key to symmetrically decrypt the encrypted third hash authentication message code, thus obtaining the third hash authentication message code.

7. The method according to claim 5, characterized in that, The third hash authentication message code and the fourth hash authentication message code are compared to obtain the second authentication result, including: In response to the difference between the third hash authentication message code and the fourth hash authentication message code, it is determined that the server authentication challenge random number authentication has failed. If the third hash authentication message code and the fourth hash authentication message code are the same, it is determined that the authentication of the server authentication challenge random number is successful.

8. A data communication device, characterized in that, Applied to the client side, including: A sending unit is used to send a client sequence code and a public key to a server. The client sequence code is used to enable the server to generate an authentication key based on a key derivation algorithm. The public key is used to enable the server to encrypt the authentication key to obtain an encrypted authentication key. The encrypted authentication key is sent to the client by the server. The decryption unit is used to decrypt the encrypted authentication key using a private key to obtain the authentication key, and to decrypt the encrypted communication session key using the private key to obtain the communication session key; The first calculation unit is used to perform challenge authentication encryption calculation on the client authentication challenge random number using the authentication key to obtain the first hash authentication message code; The comparison unit is used to compare the first hash authentication message code with the second hash authentication message code to obtain a first authentication result, wherein the second hash authentication message code is obtained by the server using the authentication key to perform challenge authentication encryption calculation on the client authentication challenge random number; A communication unit is used to communicate the data with the server based on the first authentication result; The comparison unit is further configured to perform the following steps: in response to the first hash authentication message code and the second hash authentication message code being different, determine that the authentication of the client authentication challenge random number has failed, report an error code, and end the authentication process and the communication process; in response to the first hash authentication message code and the second hash authentication message code being the same, determine that the authentication of the client authentication challenge random number has succeeded, and continue to execute the authentication process and the communication process. The communication device for the data is further configured to perform the following steps: symmetrically encrypting the client sequence code to obtain an encrypted client sequence code; obtaining the current system time and performing encrypted calculations on the current system time to obtain an encrypted time; obtaining a client authentication challenge random number; encrypting the client authentication challenge random number to obtain an encrypted client authentication challenge random number; combining the encrypted client sequence code, the encrypted time, and the encrypted client authentication challenge random number to obtain encrypted data; and sending the encrypted data to the server.

9. A processor, characterized in that, The processor is used to run a program, wherein the program, when run by the processor, executes the data communication method of any one of claims 1 to 7.

Images