Communication methods, apparatuses, devices, media, and products

Abstract

The application discloses a communication method, device, equipment, medium and product. A first feature string calculated based on a user's biological feature and a user dynamic identity of the user are acquired. A session key is determined by performing calculation based on the first feature string and the user dynamic identity. The user performs encrypted communication with a server based on the session key. The embodiment of the application can improve the security of communication between the user and the server.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of information security, and particularly relates to a communication method, device, equipment, medium and product. BACKGROUND

[0002] With the rapid development of information technology and the popularity of network applications, users' demand for secure communication and privacy protection is increasing. In a multi-server architecture, identity authentication and key agreement between users and servers become a key problem to ensure communication security. With the continuous evolution of network attacks, the security of traditional identity authentication and key agreement methods is facing more and more serious challenges. SUMMARY

[0003] The embodiments of the present application provide a communication method, device, equipment, medium and product, which can improve the security of communication between users and servers.

[0004] In a first aspect, the embodiments of the present application provide a communication method, which comprises:

[0005] obtaining a first feature string calculated based on a user's biological characteristics and a user dynamic identity of the user;

[0006] calculating based on the first feature string and the user dynamic identity to determine a session key;

[0007] the user performs encrypted communication with a server side based on the session key.

[0008] In a second aspect, the embodiments of the present application provide a communication device, which comprises:

[0009] an obtaining module configured to obtain a first feature string calculated based on a user's biological characteristics and a user dynamic identity of the user;

[0010] a calculating module configured to calculate based on the first feature string and the user dynamic identity to determine a session key;

[0011] a communication module configured to enable the user to perform encrypted communication with a server side based on the session key.

[0012] In a third aspect, the embodiments of the present application provide an electronic device, which comprises:

[0013] a processor;

[0014] a memory for storing processor-executable instructions;

[0015] wherein the processor is configured to execute the instructions to implement the communication method as shown in any one of the embodiments of the first aspect.

[0016] Fourthly, embodiments of this application provide a computer storage medium on which a computer program is stored, and when executed by a processor, the computer program implements the communication method shown in any embodiment of the first aspect.

[0017] Fifthly, embodiments of this application also provide a computer program product comprising a computer program stored in a readable storage medium, wherein at least one processor of the device reads from the storage medium and executes the computer program, thereby enabling the device to implement the communication method as shown in any embodiment of the first aspect.

[0018] This application provides a communication method, apparatus, device, medium, and product. Compared with the prior art, this application has the following advantages:

[0019] This application discloses a communication method, apparatus, device, medium, and product that acquires a first feature string calculated based on a user's biometrics and the user's dynamic identity identifier; calculates and determines a session key based on the first feature string and the user's dynamic identity identifier; and the user conducts encrypted communication with a server based on the session key. This method uses both biometrics and dynamic identity identifiers to jointly calculate and determine the session key, improving the security of key generation. Furthermore, the encrypted communication between the user and the server, based on the determined session key, ensures the privacy and integrity of the communication content, enhancing the overall security of the communication system and effectively improving the security of communication between the user and the server. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a communication method provided in an embodiment of this application;

[0022] Figure 2 This is another flowchart illustrating a communication method provided in an embodiment of this application;

[0023] Figure 3 This is another flowchart illustrating a communication method provided in an embodiment of this application;

[0024] Figure 4 This is another flowchart illustrating a communication method provided in an embodiment of this application;

[0025] Figure 5This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0026] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0028] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0029] As discussed in the background section, existing technologies do not include timestamps when users transmit encrypted information to servers, and the servers do not verify the validity of these timestamps. If an attacker intercepts this information in a public channel, they can repeatedly send it to the server. Upon receiving malicious access requests, the server continuously verifies the user's legitimacy, allowing the attacker to launch attacks and continuously consume server resources, preventing other users from logging in. Alternatively, users can transmit their identity information and password in plaintext to a smart card. If an attacker steals the smart card, they can obtain the user's identity and password, and then forge their identity to access the server.

[0030] To address the problems existing in the prior art, embodiments of this application provide a communication method, apparatus, device, medium, and product.

[0031] This application provides a communication method, apparatus, device, medium, and product. The communication method provided in this application embodiment is described first. For example... Figure 1 As shown, the method specifically includes the following steps:

[0032] S100: Obtain the first feature string calculated based on the user's biometrics, and the user's dynamic identity identifier.

[0033] Alternatively, in one feasible implementation of this application, the user can provide biometric information through specialized biometric sensors (such as fingerprint recognition, facial recognition, iris scanning, etc.). These sensors are capable of capturing the unique biological characteristics of an individual's body. The sensors convert the collected biometric information into data that can be processed by a computer.

[0034] Subsequently, specialized algorithms can be used to process the biometric data, extract key features, and form the first feature string. This can include specific image processing, pattern recognition, or other biometric processing techniques. For example, a hash function can be applied to the extracted features, mapping them to a fixed-length string to form the final first feature string.

[0035] Then, dynamic identity parameters can be selected, which can be based on timestamps, random numbers, or other dynamically changing factors to ensure dynamism. The user's static identity identifier is then combined with the selected dynamic parameters, and algorithms such as hash functions are applied to generate the user's dynamic identity identifier.

[0036] In summary, stage S100 completes the acquisition of the user's biometric features from the biometric sensor and calculates the first feature string, while simultaneously generating the user's dynamic identity identifier. This information will play a crucial role in subsequent identity authentication and key negotiation processes, ensuring communication security and the uniqueness of the user's identity.

[0037] S200, calculate and determine the session key based on the first feature string and the user dynamic identity identifier.

[0038] Optionally, in one possible implementation of this application, the first feature string calculated in stage S100 and the user's dynamic identity identifier can be obtained first. The user's dynamic identity identifier may include a timestamp or other dynamically changing parameters.

[0039] The first characteristic string and the user's dynamic identity are then merged to form an input string. A specific hash function or encryption algorithm can then be applied to process the merged input string. This processing may involve multiple rounds of computation to ensure the irreversibility and security of the calculations. The output of the computation algorithm is the determined session key. This key can be a fixed-length binary string.

[0040] Optionally, in this embodiment of the application, in order to ensure the security of communication, a complex and secure algorithm can be selected, such as an asymmetric encryption algorithm based on elliptic curve cryptography or other secure hashing algorithms, to ensure that the generated session key is unique where possible, thereby improving security.

[0041] Finally, the generated session key can be stored in a secure location for use in subsequent communications. Alternatively, for instant messaging, the key can be directly passed to the server or service provider communicating with the user.

[0042] Through the above steps, stage S200 completes the calculation based on the first feature string and the user's dynamic identity, establishing the session key for encrypted communication. The security algorithms and parameter selections used in this process are crucial for ensuring communication security.

[0043] S300, the user conducts encrypted communication with the server based on the session key.

[0044] Optionally, in one feasible implementation of this application, preparations for communication are first performed. In phase S200, the user and server successfully calculate the session key and store it in their respective secure storage. Subsequently, the user prepares the communication content to be sent to the server and selects an encryption algorithm, such as a symmetric encryption algorithm; the communication content and the session key are input into the selected encryption algorithm to generate ciphertext.

[0045] Optionally, in this embodiment of the application, in order to increase the integrity of communication, the user may also generate authentication information, such as a message authentication code or a digital signature, to ensure that the message has not been tampered with.

[0046] The user can then send the encrypted communication content to the server via network protocols. The server receives the encrypted communication sent by the user and decrypts it using the same session key as the user, restoring the original communication content. It should be noted that if the user generates authentication information, the server can also verify this information to ensure the integrity and authenticity of the communication.

[0047] This process protects the communication between the user and the server, ensuring that only a server with the correct session key can decrypt and understand the communication. This method of encrypted communication helps ensure the confidentiality and security of communications.

[0048] This application discloses a communication method, apparatus, device, medium, and product that acquires a first feature string calculated based on a user's biometrics and the user's dynamic identity identifier; calculates and determines a session key based on the first feature string and the user's dynamic identity identifier; and the user conducts encrypted communication with a server based on the session key. This method uses both biometrics and dynamic identity identifiers to jointly calculate and determine the session key, improving the security of key generation. Furthermore, the encrypted communication between the user and the server, based on the determined session key, ensures the privacy and integrity of the communication content, enhancing the overall security of the communication system and effectively improving the security of communication between the user and the server.

[0049] In one embodiment, step 100 above may specifically be performed as follows:

[0050] S110, Obtain the login information input by the user, and the biometric features input by the user;

[0051] S120, the first feature string is obtained by calculating based on the biometrics using a sensor;

[0052] S130, the user generates a first random number in real time;

[0053] S140, the user's dynamic identity identifier is obtained by the user calculating based on the first random number and the login information.

[0054] Optionally, in one specific implementation of this application, the communication method consists of four phases: an initialization phase, a registration phase, a login and authentication phase, and a password modification phase. It also includes three participants: user Ui, server Sj, and registration center RC. The registration and authentication phases are as follows... Figure 2 As shown.

[0055] During the initialization phase, the registry center (RC) generates the following parameters to initialize the system: 1) The registry center (RC) selects an elliptic curve equation Ep(a,b) of order n. 2) The registry center (RC) selects a point Q based on the elliptic curve equation Ep(a,b) and a one-way hash function h(.). 3) The registry center (RC) publishes the information {E,Q,h(.)}.

[0056] Here, Ep(a,b) represents the equation of the elliptic curve, where a and b are the coefficients of the curve. Point Q is a point on the elliptic curve. In elliptic curve cryptography, point Q is a fundamental point used to perform cryptographic operations related to the elliptic curve. Point Q can be a public or fixed point.

[0057] h(.) represents the one-way hash function chosen by the registry. A one-way hash function is a special type of cryptographic function that is one-way, meaning that it is easy to compute from input to output, but very difficult to compute in the reverse direction. Here, the one-way hash function is used for security purposes such as generating and verifying digital signatures and generating hash values.

[0058] In the published information {E, Q, h(.)}, E represents the set of parameters of the elliptic curve, including the curve equation, fundamental points, etc. This information is public and can be used by other system components for encrypted communication or to perform other security operations related to the elliptic curve. Q is a fundamental point on the elliptic curve, which can also be public. h(.) is a one-way hash function that can be used by other system components to generate hash values ​​or to perform other security operations.

[0059] During the server registration phase, for a server Sj (1≤j≤k) to become a legitimate server, it needs to register with the registry center RC. The specific steps are as follows: 1) Server Sj selects its private key Prisj, calculates the corresponding public key Pubsj = Prisj·Q, and then sends the registration request information {Pubsj, SIDj} to the registry center RC. 2) The registry center RC sends the pre-shared key PSK, which is needed in the subsequent authentication phase, to server Sj.

[0060] Here, Prisj is the private key chosen by server Sj, used for private key operations in elliptic curve cryptography. Pubsj is the corresponding public key calculated by server Sj. The public key is the private key multiplied by the base point Q, represented as Pubsj = Prisj·Q. This public key Pubsj is used for subsequent key negotiation and authentication processes.

[0061] SIDj is the server's identifier, used to uniquely identify the server within the system. This information is encapsulated in a request and sent to the registry center.

[0062] The PSK is a pre-shared key required by the registry center during subsequent authentication phases. This key can be generated by the registry center after server registration and shared between the registry center and the server to ensure the security of subsequent communications.

[0063] During user registration, user Ui selects an appropriate identity identifier IDi and password PWi, and then inputs their biometric feature BIOi into the sensor. The sensor generates two binary strings Ri and Pi by calculating Gen(BIOi) → (Ri, Pi), and stores Pi. Next, user Ui calculates Ai = h(IDi∥Ri) and Bi = h(PWi∥Ri), and sends the registration request information {Ai, Bi} to the registration center RC through a secure channel. Upon receiving the request information, the registration center RC calculates Ci = h(Ai∥PSK). Then, {Di, h(·)} is stored in the smart card and sent to user Ui. User Ui calculates Vi = h(Ai∥Bi∥Ri) and stores {Vi} in the smart card. Finally, the smart card contains the parameters {Di, Vi, h(·)}.

[0064] In these alternative embodiments, by selecting a registry center with an elliptic curve equation and elliptic curve-based points, and by employing a one-way hash function, the system provides a higher level of security during the initialization phase. This helps to resist various attacks, such as password cracking and data tampering.

[0065] During the registration phase, the server uses its private key and elliptic curve cryptography to calculate its public key and sends a registration request to the registry. The registry then sends the server the pre-shared key required for subsequent authentication phases. This ensures the security of the server registration and protects against unauthorized server registration.

[0066] During registration, users choose an identity and password, while a pair of binary strings is generated using biometric data from sensors. This method protects the user's true identity and increases the anonymity of user registration.

[0067] The parameters {Di,h(·)} calculated by the registration center are stored in the smart card, which is then sent to the user. This facilitates the secure storage of the user's registration information, and the parameters in the smart card, generated through calculation, enhance the confidentiality of the information.

[0068] Users store the calculated Vi in the smart card and use this information for authentication during the authentication phase. This improves the security of user authentication and prevents unauthorized users from accessing the system. Taken together, these effects enhance the overall security of the system during initialization and registration, helping to ensure the confidentiality of communications and the security of user identities.

[0069] In one embodiment, step 200 above may specifically be performed as follows:

[0070] S210, Based on the user's dynamic identity identifier, the legitimacy of the user's login environment is verified to obtain the verification result;

[0071] S220, if the verification result indicates that the user's login environment is legitimate, the session key is determined based on the first feature string and the user's dynamic identity identifier.

[0072] In these alternative embodiments, verifying the legitimacy of a user's dynamic identity ensures that the user's login environment is legitimate. This prevents unauthorized users or malicious attackers from attempting to communicate using false identities. Verifying the legitimacy of the user's login environment helps eliminate potential risks and ensures that only legitimate users can access the system.

[0073] If the verification result indicates that the user's login environment is legitimate, a session key is calculated based on the first characteristic string and the user's dynamic identity. This ensures security during communication because the session key is calculated based on the user's biometrics and dynamic identity, making it difficult for attackers to crack or forge. Therefore, the benefits include enhanced security and protection against potential attack threats.

[0074] In one embodiment, step 210 above may specifically be performed as follows:

[0075] S211, the user's login identity is verified using the smart card based on the user's dynamic identity identifier to obtain a first result;

[0076] S212, if the first result indicates that the user's login authentication is successful, the smart card is verified by the server to obtain a second result;

[0077] S213, if the second result indicates that the smart card verification is successful, the server is verified through the smart card to obtain a third result, which is used to indicate whether the server verification is successful;

[0078] S214, Based on the third result, determine the verification result.

[0079] In one embodiment, the login information includes the user's first identity identifier and the user's first password, and the user's dynamic identity identifier includes a first dynamic identifier and a second dynamic identifier; step 211 above can specifically be performed as follows:

[0080] S2111, the first feature string and the second feature string are obtained by calculation based on the biometrics using the sensor;

[0081] S2112, the user generates the first dynamic identifier based on the first identity identifier and the first random number;

[0082] S2113, the user generates the second dynamic identifier based on the first password, the first random number, and the second feature string;

[0083] S2114, The user generates a first verification indicator based on the first dynamic identifier and the second dynamic identifier;

[0084] S2115, the first verification indicator is matched with the preset indicator by the smart card to obtain the first result.

[0085] Optionally, in one specific implementation of this application, during the server registration phase, elliptic curve cryptography is primarily used to generate an asymmetric key pair to encrypt and authenticate the three sessions between the user and the server. The specific key negotiation protocol process is detailed in [link to relevant documentation]. Figure 3 and Figure 4 .

[0086] After the initialization and registration phases, user Ui selects an appropriate identity identifier IDi and password PWi (i.e., the login information mentioned above). Then, user Ui inputs their biometric feature BIOi into the sensor. The sensor generates two binary strings Ri (i.e., the second feature string) and Pi (i.e., the first feature string) by calculating Gen(BIOi) → (Ri, Pi), and stores Pi. Next, user Ui generates a random number bi (i.e., the first random number) and calculates: AIDi = h(IDi∥bi) (i.e., the first dynamic identifier), RPWi = h(PWi∥Ri∥bi) (i.e., the second dynamic identifier), Vi' = h(AIDi∥RPWi) (i.e., the first verification indicator), and verifies whether the calculated result of Vi' is equal to the value of Vi. If they are equal, the smart card passes the user Ui's legitimacy verification.

[0087] In these alternative embodiments, by generating a dynamic identity identifier AIDi = h(IDi*bi) using a random number bi, the user actually transmits a hashed dynamic value when transmitting the identity identifier. This enhances user anonymity, making it more difficult to trace the user's true identity and improving the level of privacy protection.

[0088] The biometric BIOi is processed by the sensor into two binary strings, Ri and Pi. This processing method helps protect the user's biometric information because the processed strings are actually transmitted, not the original biometric data.

[0089] Furthermore, users generate Vi' by combining a dynamic identity and a password, providing multi-layered authentication. Attackers need to obtain the user's identity, password, and biometric processing results simultaneously to successfully impersonate the user. This enhances system security.

[0090] The introduction of a random number bi makes the identity identifier AIDi dynamically change during different authentication processes, making it difficult for attackers to record and replay. This increases the system's resistance to replay attacks.

[0091] Different users generate different dynamic identifiers and random numbers, preventing attackers from launching denial-of-service (DoS) attacks by intercepting and repeatedly sending the same information. By combining biometrics and password to generate RPWi (RPWi = h(PWi∥Ri∥bi), the theft of passwords intercepted during transmission is effectively prevented. Even if an attacker obtains RPWi, they cannot recover the original password PWi.

[0092] In summary, this process cleverly combines identity verification, passwords, biometrics, random numbers, and dynamically generated authentication information to provide a high level of anonymity, security, and resistance to attacks, effectively ensuring the secure communication between users and the system.

[0093] In one embodiment, step 212 above can specifically be performed as follows:

[0094] S2121, if the first verification indicator matches the preset indicator, determine that the first result is that the user's login authentication is successful;

[0095] S2122, Generate a second random number and a first timestamp using the smart card;

[0096] S2123, Based on the second random number, the first timestamp, and the first dynamic identifier, generate a second verification indicator;

[0097] S2124, The server matches the first timestamp with the current timestamp to obtain a fourth result;

[0098] S2125, if the fourth result indicates that the first timestamp matches the current timestamp, the server generates a third verification indicator based on a pre-set shared key;

[0099] S2126, The server matches the third verification indicator and the second verification indicator to obtain the second result.

[0100] Optionally, in one specific implementation of this application, reference continues to be made to... Figure 3 and Figure 4If the calculated result of the smart card verification Vi' is equal to the value of Vi, that is, if the first verification indicator matches the preset indicator, the smart card passes the user Ui legitimacy verification. Subsequently, the smart card generates a random number N1 (i.e., the second random number) and calculates: Di = N1·G, M1 = EPUbsj(AIDi∥Ti), M2 = h(AIDi∥Bij∥Di∥Ti) (i.e., the second verification indicator), where Ti is the first timestamp mentioned above. The smart card sends the login information {Fij, M1, M2, Ti} to the server Sj. After receiving the information, the server Sj first determines whether Ti - Tj ≤ △T is true, where Tj is the current timestamp and △T is the set valid time interval. If the determination is false, the server Sj terminates the protocol. If the determination is true (i.e., the fourth result indicates that the first timestamp matches the current timestamp), the server Sj calculates: AIDi∥Ti = DPrisj(M1), Bij = h(AIDi∥h(PSK∥SIDj)). M2' = h(AIDi∥Bij∥Di∥Ti) (i.e., the third verification index). Next, server Sj determines whether the calculation result of M2' is equal to the value of M2. If they are not equal, server Sj terminates the protocol.

[0101] Cij is one of the parameters transmitted between the smart card and the server. Specifically, Cij is generated during the server registration phase and is used as part of the login information. Cij = h(Ai∥PSK), this value is sent to the registry center through a secure channel during the login phase and subsequently transmitted to the server. Its calculation involves the user's identity identifier Ai and the pre-shared key PSK obtained during the registration phase. The introduction of Cij facilitates authentication and key negotiation during login.

[0102] G represents a generating point in an elliptic curve group. In elliptic curve cryptography, the base point (or generating point) on an elliptic curve is used to create the elliptic curve group. The properties of this base point make it easy to perform mathematical operations and play an important role in protocols such as key exchange and digital signatures. G is a point on an elliptic curve, and it is related to the parameters of the curve. The value of G will differ in different elliptic curve equations. For example, on a specific elliptic curve Ep(a,b), G is a specific point on that curve.

[0103] EPubsj represents elliptic curve cryptography on Pubsj, and DPrisj represents a digital signature operation on Prisj. This is a process of digitally signing certain data using Prisj. Digital signatures are typically used to verify the integrity and authenticity of data. Specifically, DPrisj(M1) represents the operation of digitally signing message M1 using the private key Prisj of server Sj. This digital signature can be sent along with the message, and the recipient can use the public key of service Sj to verify the signature, ensuring that the message has not been tampered with and was indeed generated by Sj.

[0104] In these alternative embodiments, by determining (Ti-Tj≤△T), server Sj can ensure that the received login information is valid within a specified time interval, preventing replay attacks. This helps ensure that communication between the user and the server occurs within a reasonable timeframe, improving the timeliness of the protocol.

[0105] The authenticity of the dynamic identity AIDi∥Ti is verified by decrypting M1 using the digital signature DPrisj. This means that server Sj can be confident that the login request comes from the legitimate user Ui, preventing identity forgery and spoofing. By comparing the values ​​of M2' and M2, server Sj can verify the integrity of the login information. This helps ensure that information has not been tampered with or corrupted during transmission, improving the integrity of communication.

[0106] Overall, these effects help enhance the security of the protocol and protect against various potential attacks and security threats. In particular, timeliness verification and authentication are important means of defending against replay attacks and identity forgery, while key negotiation and integrity verification help ensure the confidentiality and integrity of communications.

[0107] In one embodiment, step 213 above can specifically be performed as follows:

[0108] S2131, if the third verification indicator matches the second verification indicator, the smart card verification is determined to be successful;

[0109] S2132, A third random number is generated by the server;

[0110] S2133, The server generates a fourth verification indicator based on the third random number;

[0111] S2134, Calculate the fifth verification indicator based on the user's dynamic identity identifier using the smart card;

[0112] S2135, the fourth verification indicator and the fifth verification indicator are matched using the smart card to obtain the third result, which is used to indicate whether the fourth verification indicator and the fifth verification indicator match.

[0113] Optionally, in one specific implementation of this application, reference continues to be made to... Figure 3 and Figure 4 If the server Sj determines that the calculated result of M2' is equal to the value of M2, that is, if the third verification indicator matches the second verification indicator, the smart card verification is confirmed to be successful. Subsequently, the server generates a random number N2 (the third random number), calculates: Dj = N2·G, Pj = N2·Di, SKij = h(AIDi∥SIDj∥Pj∥Dj), M3 = h(SKij∥AIDi∥Dj) (the fourth verification indicator), and transmits the information {M3,Dj} to the smart card. After receiving the information, the smart card calculates: Pi = N1·Dj, SKij = h(AIDi∥SIDj∥Pi∥Dj), M3' = h(SKij∥AIDi∥Dj) (the fifth verification indicator), and checks whether the calculated result of M3' is equal to the value of M3. If they are not equal, the smart card terminates the protocol.

[0114] If they are equal, the smart card calculates: M4 = h(SKij∥AIDi∥Di) and sends the message {M4} to the server Sj. After receiving the information, the server Sj calculates M4' = h(SKij∥AIDi∥Di) and determines the validity of user Ui by comparing the calculated result of M4' with the value of M4.

[0115] If the keys are equal, the user is legitimate and can communicate with server Sj using the session key SKij = h(AIDi∥SIDj∥Pi∥Dj) = h(AIDi∥SIDj∥Pj∥Dj). Otherwise, server Sj considers user Ui to be an illegitimate user, and authentication fails.

[0116] In these alternative embodiments, mutual authentication between server Sj and the smart card ensures bidirectional authentication of communication, guaranteeing that both parties are legitimate communication entities. With the introduction of N2, server Sj can update Dj and Pj, thereby updating the session key SKij. This facilitates periodic updates of the session key, increasing system security and preventing potential risks associated with prolonged use of the same key.

[0117] If the smart card detects an anomaly during verification (such as M3 not being equal to M3), the current protocol can be terminated. This helps prevent potential attacks and anomalies, protecting the system from potential threats. Overall, these effects help ensure the security of communications, including the verification of identity legitimacy, secure key updates, and secure handling of anomalies. This is a comprehensive security mechanism designed to provide more reliable authentication and communication security.

[0118] In one embodiment, the communication method may further include a password change phase. Specifically, in the password change phase, user Ui inserts a smart card into a card reader and enters their identity identifier IDi and password PWi. Then, user Ui inputs their biometric feature BIOi* into a sensor, which parses Rep(BIOi*,Pi)→Ri. The smart card calculates: AIDi=h(IDi∥bi), RPWi=h(PWi∥Ri∥bi), and checks whether Vi=h(AIDi∥RPWi) is true. If true, the smart card requests the user to enter a new password PWinew. Otherwise, the smart card terminates the password update. The smart card generates a new random number binew and calculates: AIDinew=h(IDi∥binew), RPWinew=h(PWinew∥Ri∥binew), Bijnew=h(AIDinew∥h(PSK∥SIDj)). Vinew = h(AIDinew∥RPWinew), and replace Ci and Vi with Cinew and Vinew respectively.

[0119] In this embodiment, the user's real identity is not exposed during the registration and login phases. When logging in, the user transmits a dynamic identity AIDi = h(IDi∥bi), where bi is a random number generated by the user. Similarly, during the registration phase, after receiving a login request from user Ui, server Sj can only recover AIDi, not the user Ui's real identity IDi. Therefore, this application achieves anonymity for the user's real identity for server Sj. Furthermore, all information transmitted between the user and the server is dynamic, as it contains random numbers N1 and N2. Therefore, attackers cannot track users through the information transmitted between them. This should be protected. Moreover, in the user-server authentication phase of this application, the user's input account, biometric features, and timestamp are encrypted using an elliptic curve cryptography method to generate a unique random string M1.

[0120] In these alternative embodiments, attackers cannot obtain the key between the user and the server, thus preventing them from breaking the secret session between the user and the server. The session key established between user Ui and server Sj is SKij = h(AIDi∥SIDj∥Pi∥Dj) = h(AIDi∥SIDj∥Pj∥Dj). Although attackers can obtain parameter Dj in the public channel, they cannot obtain parameters AIDi, Pj, and Pi. Only the server can decrypt M1 = EPUbsj(AIDi∥Ti) using its private key Prisj to obtain AIDi. Furthermore, in Pi = N1·Dj and Pj = N2·Di, N1 and N2 are random numbers generated by the user and the server, which attackers cannot obtain. Therefore, they cannot calculate Pi and Pj, and thus no attacker can recover the session key established between the user and the server.

[0121] Figure 5 A schematic diagram of the structure of a communication device provided in another embodiment of this application is shown. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0122] Reference Figure 5 The communication device may include:

[0123] The acquisition module 501 is used to acquire the first feature string calculated based on the user's biometrics, and the user's dynamic identity identifier;

[0124] Calculation module 502 is used to calculate and determine the session key based on the first feature string and the user dynamic identity identifier;

[0125] The communication module 503 is used for the user to conduct encrypted communication with the server based on the session key.

[0126] In one embodiment, the acquisition module 501 may include:

[0127] The first acquisition submodule is used to acquire the login information input by the user, as well as the biometric features input by the user;

[0128] The first calculation submodule is used to calculate based on the biometrics using sensors to obtain the first feature string;

[0129] The first generation submodule is used to generate a first random number in real time by the user;

[0130] The second calculation submodule is used to calculate the user's dynamic identity identifier based on the first random number and the login information.

[0131] In one embodiment, the computing module 502 may include:

[0132] The first verification submodule is used to verify the legitimacy of the user's login environment based on the user's dynamic identity identifier, and obtain the verification result;

[0133] The third calculation submodule is used to calculate and determine the session key based on the first feature string and the user's dynamic identity identifier when the verification result indicates that the user's login environment is legitimate.

[0134] In one embodiment, the first verification submodule may include:

[0135] The first verification unit is used to verify the user's login identity based on the user's dynamic identity identifier using a smart card, and obtain a first result;

[0136] The second verification unit is used to verify the smart card through the server when the first result indicates that the user's login authentication is successful, and obtain a second result.

[0137] The third verification unit is used to verify the server through the smart card when the second result indicates that the smart card verification is successful, and to obtain a third result, which is used to indicate whether the server verification is successful.

[0138] The first determining unit is used to determine the verification result based on the third result.

[0139] In one embodiment, the login information includes the user's first identity identifier and the user's first password, and the user's dynamic identity identifier includes a first dynamic identifier and a second dynamic identifier; the first verification unit may include:

[0140] The first calculation subunit is used to calculate based on the biometrics using the sensor to obtain the first feature string and the second feature string;

[0141] The first generation subunit is used to generate the first dynamic identifier based on the first identity identifier and the first random number by the user;

[0142] The second generation subunit is used to generate the second dynamic identifier based on the first password, the first random number, and the second feature string by the user;

[0143] The third generation subunit is used to generate a first verification indicator based on the first dynamic identifier and the second dynamic identifier by the user;

[0144] The first matching subunit is used to match the first verification indicator with the preset indicator through the smart card to obtain the first result.

[0145] In one embodiment, the second verification unit may include:

[0146] The first determining subunit is configured to determine that the first result is that the user's login authentication is successful when the first verification indicator matches the preset indicator;

[0147] The fourth generation subunit is used to generate a second random number and a first timestamp through the smart card;

[0148] The fifth generation subunit is used to generate a second verification indicator based on the second random number, the first timestamp, and the first dynamic identifier;

[0149] The second matching subunit is used to match the first timestamp with the current timestamp through the server to obtain a fourth result;

[0150] The sixth generation subunit is used to generate a third verification indicator by the server based on a preset shared key when the fourth result indicates that the first timestamp matches the current timestamp;

[0151] The third matching subunit is used to match the third verification indicator and the second verification indicator through the server to obtain the second result.

[0152] In one embodiment, the third verification unit may include:

[0153] The second determining subunit is used to determine that the smart card verification is successful when the third verification indicator matches the second verification indicator;

[0154] The seventh generation subunit is used to generate a third random number through the server;

[0155] The eighth generation subunit is used to generate a fourth verification indicator based on the third random number through the server;

[0156] The second calculation subunit is used to calculate the fifth verification indicator based on the user's dynamic identity identifier using the smart card;

[0157] The fourth matching subunit is used to match the fourth verification indicator and the fifth verification indicator through the smart card to obtain the third result, which is used to indicate whether the fourth verification indicator and the fifth verification indicator match.

[0158] Based on the key negotiation method and identity authentication method provided in the above embodiments, this application also provides an electronic device 600, such as... Figure 6 As shown:

[0159] It includes a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the computer program is executed by the processor 601, it implements the various processes of the above-described key negotiation method and identity authentication method embodiments and achieves the same technical effect.

[0160] Specifically, the processor 601 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0161] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory.

[0162] In certain embodiments, the memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Thus, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this application.

[0163] The processor 601 reads and executes computer program instructions stored in the memory 602 to implement any of the key negotiation method and authentication method in the above embodiments.

[0164] In one example, the electronic device may also include a communication interface 603 and a bus 610. As an example, such as... Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 610 and complete communication with each other.

[0165] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0166] Bus 610 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0167] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described key negotiation method and authentication method embodiments, achieving the same technical effects. To avoid repetition, these will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0168] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0169] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0170] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0171] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus, and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0172] The above are merely specific embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A communication method, characterized in that, The method includes: Obtain the first feature string calculated based on the user's biometrics, and the user's dynamic identity identifier; The session key is determined by calculating based on the first feature string and the user's dynamic identity identifier; The user communicates with the server using the session key in encrypted form. The acquisition of the first feature string calculated based on the user's biometrics, and the user's dynamic identity identifier, includes: Obtain the login information input by the user, as well as the biometric features input by the user; The first feature string is obtained by calculating based on the biometrics using sensors; The user generates a first random number in real time. The user's dynamic identity identifier is obtained by calculating based on the first random number and the login information. The step of calculating and determining the session key based on the first feature string and the user dynamic identity identifier includes: The user's login environment is validated based on the user's dynamic identity identifier to obtain the validation result; If the verification result indicates that the user's login environment is legitimate, the session key is determined based on the first feature string and the user's dynamic identity identifier. The step of verifying the legitimacy of the user's login environment based on the user's dynamic identity identifier, and obtaining the verification result, includes: The user's login identity is verified using the smart card based on the user's dynamic identity identifier, resulting in a first result; If the first result indicates that the user's login authentication is successful, the smart card is verified by the server to obtain a second result; If the second result indicates that the smart card verification is successful, the server is verified through the smart card to obtain a third result, which is used to indicate whether the server verification is successful. Based on the third result, the verification result is determined; The login information includes the user's first identity identifier and the user's first password, and the user's dynamic identity identifier includes a first dynamic identifier and a second dynamic identifier; The step of verifying the user's login identity using a smart card based on the user's dynamic identity identifier to obtain a first result includes: The first feature string and the second feature string are obtained by calculating based on the biometrics using the sensor; The first dynamic identifier is generated by the user based on the first identity identifier and the first random number; The user generates the second dynamic identifier based on the first password, the first random number, and the second feature string; The user generates a first verification indicator based on the first dynamic identifier and the second dynamic identifier; The first verification indicator is matched with the preset indicator by the smart card to obtain the first result.

2. The method according to claim 1, characterized in that, If the first result indicates that the user's login authentication is successful, the second result is obtained by verifying the intelligence through the server, including: If the first verification indicator matches the preset indicator, the first result is determined to be that the user's login authentication is successful; A second random number and a first timestamp are generated using the smart card; A second verification indicator is generated based on the second random number, the first timestamp, and the first dynamic identifier; The server matches the first timestamp with the current timestamp to obtain a fourth result; If the fourth result indicates that the first timestamp matches the current timestamp, a third verification indicator is generated by the server based on a pre-set shared key. The second result is obtained by matching the third verification indicator and the second verification indicator on the server side.

3. The method according to claim 2, characterized in that, If the second result indicates that the smart card verification is successful, the third result is obtained by verifying the server using the smart card, including: If the third verification indicator matches the second verification indicator, the smart card verification is deemed successful. A third random number is generated by the server. The server generates a fourth verification indicator based on the third random number. The fifth verification indicator is calculated using the smart card based on the user's dynamic identity identifier; The fourth verification indicator and the fifth verification indicator are matched using the smart card to obtain the third result, which is used to indicate whether the fourth verification indicator and the fifth verification indicator match.

4. A communication device, characterized in that, The device includes: The acquisition module is used to acquire the first feature string calculated based on the user's biometrics, as well as the user's dynamic identity identifier; The calculation module is used to calculate and determine the session key based on the first feature string and the user dynamic identity identifier; A communication module is used for the user to conduct encrypted communication with the server based on the session key; The acquisition of the first feature string calculated based on the user's biometrics, and the user's dynamic identity identifier, includes: Obtain the login information input by the user, as well as the biometric features input by the user; The first feature string is obtained by calculating based on the biometrics using sensors; The user generates a first random number in real time. The user's dynamic identity identifier is obtained by calculating based on the first random number and the login information. The step of calculating and determining the session key based on the first feature string and the user dynamic identity identifier includes: The user's login environment is validated based on the user's dynamic identity identifier to obtain the validation result; If the verification result indicates that the user's login environment is legitimate, the session key is determined based on the first feature string and the user's dynamic identity identifier. The step of verifying the legitimacy of the user's login environment based on the user's dynamic identity identifier, and obtaining the verification result, includes: The user's login identity is verified using the smart card based on the user's dynamic identity identifier, resulting in a first result; If the first result indicates that the user's login authentication is successful, the smart card is verified by the server to obtain a second result; If the second result indicates that the smart card verification is successful, the server is verified through the smart card to obtain a third result, which is used to indicate whether the server verification is successful. Based on the third result, the verification result is determined; The login information includes the user's first identity identifier and the user's first password, and the user's dynamic identity identifier includes a first dynamic identifier and a second dynamic identifier; The step of verifying the user's login identity using a smart card based on the user's dynamic identity identifier to obtain a first result includes: The first feature string and the second feature string are obtained by calculating based on the biometrics using the sensor; The first dynamic identifier is generated by the user based on the first identity identifier and the first random number; The user generates the second dynamic identifier based on the first password, the first random number, and the second feature string; The user generates a first verification indicator based on the first dynamic identifier and the second dynamic identifier; The first verification indicator is matched with the preset indicator by the smart card to obtain the first result.

5. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the communication method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the communication method as described in any one of claims 1-3.

7. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the communication method as described in any one of claims 1-3.

Images