Encryption authentication method and device and radio frequency identification system

Abstract

The invention relates to an encryption authentication method and device and a radio frequency identification system. The encryption authentication method is applied to a tag in a radio frequency identification system, the radio frequency identification system further comprises a reader and a server, and the encryption authentication method comprises the steps that a first message sequence is received from the reader; generating a second message sequence according to a tag key TS1 corresponding to the tag, a server pseudo name SID, a first tag pseudo name IDS and the first message sequence; sending the second message sequence to a reader, so that the reader sends the second message sequence to a server, and the server generates a third message sequence according to the second message sequence; and receiving a third message sequence from the reader, and determining an authentication result corresponding to the current session process based on the third message sequence. By adopting the method, the encryption authentication efficiency in the radio frequency identification system can be improved.

Description

Technical Field

[0001] The present application relates to the field of radio frequency identification technology, and in particular to an encryption authentication method, device and radio frequency identification system. Background Art

[0002] With the development of Radio Frequency Identification (RFID) technology, tags in RFID systems are easily targeted during communication. External attackers may disrupt the normal operation of tags by eavesdropping, replaying, tampering with data, etc. In order to ensure communication security, encryption authentication is required during the conversation between tags and readers in RFID systems.

[0003] In the prior art, encryption authentication is performed through advanced cryptographic protocols, elliptic curve cryptography-based protocols or asymmetric encryption algorithms. However, the encryption authentication methods in the prior art have certain requirements on the memory and computing power of the tag, which makes these methods impossible to be applied in some tags, leading to security risks such as desynchronization, secret disclosure (SD) and replay attack. Summary of the invention

[0004] Based on this, it is necessary to provide an encryption authentication method, device and radio frequency identification system that can improve the efficiency of encryption authentication in response to the above technical problems.

[0005] In a first aspect, the present application provides an encryption authentication method, which is applied to a tag in a radio frequency identification system, wherein the radio frequency identification system also includes a reader and a server, and the method includes:

[0006] receiving a first message sequence from a reader;

[0007] Generate a second message sequence according to a tag key corresponding to the tag, a server pseudonym, a first tag pseudonym, and a first message sequence;

[0008] Sending the second message sequence to the reader so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence;

[0009] A third message sequence is received from the reader, and an authentication result corresponding to the current session process is determined based on the third message sequence.

[0010] In one embodiment, generating a second message sequence according to a tag key corresponding to the tag, a server pseudonym, a first tag pseudonym, and a first message sequence includes:

[0011] Parsing the first message sequence to obtain random data;

[0012] Using random data and a server pseudonym, the tag key is encoded according to a preset first encoding rule to obtain an encryption key;

[0013] The server pseudonym and the first label pseudonym are respectively encoded based on a preset second encoding rule and an encryption key to obtain a second message sequence.

[0014] In one embodiment, receiving a third message sequence from a reader, and determining an authentication result corresponding to a current session process based on the third message sequence includes:

[0015] Using a preset third encoding rule, the random data, the label key, the first label pseudonym and the shared key are encoded to obtain a message to be verified, wherein the third encoding rule includes rotating, bitwise XORing, or bitwise ANDing one or more of the random data, the label key, the first label pseudonym and the shared key;

[0016] When the message to be verified matches the third message sequence, the authentication result is determined as authentication passed.

[0017] In one of the embodiments, when the authentication result is verification passed, the method further includes:

[0018] The first label pseudonym is updated using the label identification number, random data, label key and a preset first update rule to obtain a target label pseudonym.

[0019] In one of the embodiments, after receiving the first message sequence, the method further comprises:

[0020] Parse the second message to obtain the current timestamp;

[0021] Using the historical timestamp to compare the current timestamp, when the current timestamp is greater than the historical timestamp, executing the process of generating the second message sequence;

[0022] When the current timestamp is less than or equal to the historical timestamp, the encryption authentication method is terminated.

[0023] In a second aspect, the present application also provides an encryption authentication method, which is applied to a server in a radio frequency identification system, wherein the radio frequency identification system also includes a reader and a tag, and the method includes:

[0024] The second message sequence received from the reader is parsed and restored to obtain a tag key and a first tag pseudo name, wherein the second message sequence is generated by the tag according to the tag key, the server pseudo name, the first tag pseudo name and the first message sequence;

[0025] Using the pre-stored pseudonym information to match the second message sequence to obtain a second label pseudonym;

[0026] generating a third message sequence according to the second label pseudonym, the label key and the shared key;

[0027] The third message sequence is sent to the reader, so that the reader sends the third message sequence to the tag, so that the tag determines the authentication result corresponding to the current session process according to the third message sequence.

[0028] In one embodiment, generating a third message sequence according to the second tag pseudonym, the tag key and the shared key includes:

[0029] Encoding the second label pseudonym and the current timestamp based on a preset third encoding rule to obtain a fifth message;

[0030] Encode the random data, the shared key, the label key, and the second label pseudonym according to a preset fourth encoding rule to obtain a sixth message;

[0031] A third message sequence is generated according to the fifth message and the sixth message.

[0032] In a third aspect, the present application also provides an encryption authentication device, which is applied to a tag in a radio frequency identification system. The radio frequency identification system also includes a reader and a server. The device includes:

[0033] An information transceiver module, configured to receive a first message sequence from a reader;

[0034] An information generation module, configured to generate a second message sequence according to a tag key corresponding to the tag, a server pseudonym, a first tag pseudonym and a first message sequence;

[0035] The information transceiver module is also used to send the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence;

[0036] The information verification module is used to receive a third message sequence from the reader and determine an authentication result corresponding to the current session process based on the third message sequence.

[0037] In a fourth aspect, the present application further provides an encryption authentication device, which is applied to a server in a radio frequency identification system, wherein the radio frequency identification system further includes a reader and a tag, and the device includes:

[0038] An information processing module, configured to parse and restore a second message sequence received from the reader to obtain a tag key and a first tag pseudo name, wherein the second message sequence is generated by the tag according to the tag key, the server pseudo name, the first tag pseudo name and the first message sequence;

[0039] An information matching module, used to match the second message sequence with the pre-stored pseudonym information to obtain a second label pseudonym;

[0040] An information generation module, used to generate a third message sequence according to the second label pseudonym, the label key and the shared key;

[0041] The information sending module is used to send the third message sequence to the reader, so that the reader sends the third message sequence to the tag, so that the tag can determine the authentication result corresponding to the current session process according to the third message sequence.

[0042] In a fifth aspect, the present application also provides a radio frequency identification system, the system comprising:

[0043] Reader;

[0044] A tag, used to perform the encryption authentication method according to the first aspect;

[0045] The server is used to execute the encryption authentication method as described in the second aspect.

[0046] The above encryption authentication method, device and radio frequency identification system, in which one aspect provides an encryption authentication method, which is applied to a tag in a radio frequency identification system, and the radio frequency identification system also includes a reader and a server, and the method includes: receiving a first message sequence from a reader; generating a second message sequence according to a tag key TS1, a server pseudo name SID, a first tag pseudo name IDS and a first message sequence corresponding to the tag; sending the second message sequence to the reader so that the reader sends the second message sequence to the server for the server to generate a third message sequence according to the second message sequence; receiving the third message sequence from the reader, and determining the authentication result corresponding to the current session process based on the third message sequence. In this way, during the current session, the message transmitted by the tag, the reader and the server each time is unique, which can effectively prevent replay attacks by external attackers. In the step of determining the verification result, there is no static data or associated data in the verified message, which can effectively prevent attackers from tracking the session. The data and algorithms involved in the verification process are ultra-lightweight, which can avoid the problem of application difficulties caused by limited resources when the existing protocol is used on low-cost tags. The encryption authentication method provided in this embodiment can reduce the computing burden of the tag while ensuring security, and achieve efficient computing and communication capabilities under limited hardware conditions, thereby improving the encryption authentication efficiency in the radio frequency identification system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] FIG1 is a diagram of an application environment of an encryption authentication method according to an embodiment;

[0049] FIG2 is a schematic diagram of a flow chart of an encryption authentication method in one embodiment;

[0050] FIG3 is a schematic diagram of a flow chart of an encryption authentication method in another embodiment;

[0051] FIG4 is a block diagram of an encryption authentication device in one embodiment;

[0052] FIG5 is a structural block diagram of an encryption authentication device in another embodiment;

[0053] FIG6 is a schematic diagram of a system flow of a radio frequency identification system in one embodiment;

[0054] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] The encryption authentication method provided in the embodiment of the present application can be applied to the radio frequency identification system shown in Figure 1. The radio frequency identification system includes: a tag 102, a reader 104 and a server 106, and the tag 102, the reader 104 and the server 106 communicate with each other through radio frequency signals.

[0057] In an exemplary embodiment, as shown in FIG2 , an encryption authentication method is provided, which is described by taking the method applied to the tag in FIG1 as an example, and includes the following steps 202 to 206. Among them:

[0058] Step 202: Receive a first message sequence from a reader.

[0059] In a possible implementation, the reader generates a random data n1 and obtains the current timestamp T of the server. C , according to the random number n1 and the current timestamp T CGenerate a first message M1 and a second message M2, and use the first message M1 and the second message M2 as a first message sequence, which can be specifically expressed as:

[0060]

[0061]

[0062] Among them, the symbol " " represents bitwise exclusive OR, SID represents the server pseudo name, that is, the pseudo name shared by the server and the tag, which is a pseudo name assigned to the tag by the server and is pre-stored in the server and the tag respectively.

[0063] Optionally, the reader may generate coded data according to preset constraints, and generate a first message sequence for a server pseudonym or a shared pseudonym based on the coded data.

[0064] Step 204: According to the tag key T corresponding to the tag S1 , server pseudonym SID, first label pseudonym IDS and the first message sequence to generate a second message sequence.

[0065] Among them, the first label pseudonym It is the pseudonym shared by the tag and the server during the current session. It is the pseudonym ID generated by the tag during each session for communicating with the server.

[0066] In a possible implementation, step 204 may further include: parsing the first message sequence to obtain random data n1; using the random data n1 and the server pseudonym SID, encoding the label key TS1 according to a preset first encoding rule to obtain an encryption key T's1; encoding the server pseudonym SID and the first label pseudonym IDS based on a preset second encoding rule and the encryption key to obtain a second message sequence.

[0067] Exemplarily, the first encoding rule can be expressed as:

[0068] ,

[0069] Among them, the symbol " " means bitwise AND.

[0070] The second message sequence may include a third message M3 and a fourth message M4, and the second encoding rule may be expressed as:

[0071] ,

[0072] .

[0073] In a possible implementation, after receiving the first message sequence, the method further includes: parsing the second message M2 to obtain a current timestamp T C ; Use the historical timestamp Tt to calculate the current timestamp T C Compare and process, at the current timestamp T C When the current timestamp is greater than the historical timestamp Tt, the process of generating the second message sequence is performed; C If the value is less than or equal to the historical timestamp Tt, the encryption authentication method is terminated. The historical timestamp Tt refers to the timestamp corresponding to the last session stored in the tag.

[0074] Step 206: Send the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence.

[0075] Step 208: Receive a third message sequence from the reader, and determine an authentication result corresponding to the current session process based on the third message sequence.

[0076] In a possible implementation, step 208 may further include: using a preset third encoding rule to encode the random data n1, the tag key T S1 , first label pseudonym The shared key is used for encoding processing to obtain a message to be verified M6'; when the message to be verified M6' matches the third message sequence, the authentication result is determined as verification passed.

[0077] The third encoding rule includes the random data n1, the tag key T S1 , first label pseudonym and one or more of the shared keys are rotated, bitwise XORed, or bitwise ANDed.

[0078] In a possible implementation, the third message sequence includes a fifth message M5 and a sixth message M6, and the shared key includes a first shared key K1new and a second shared key K2new. The third encoding rule may include: the first shared key K1new is subjected to bitwise XOR processing with the random data n1 and then rotated left, and the number of rotated bits is the first label pseudonym The value of the first update key K1' is generated; the second shared key K2new and the tag key T S1 After bitwise XOR processing, rotate left, the number of rotations is the pseudonym of the first label The value of the fifth message M5 is used to generate the second updated key K2'; the fifth message M5 is bitwise XORed with the second updated key, and then bitwise ANDed with the first updated key K1' to obtain the message to be verified M6'. The process of obtaining the message to be verified M6' according to the third encoding rule can be expressed as:

[0079] ,

[0080] ,

[0081] .

[0082] In a possible implementation manner, when the authentication result is verification passed, the method further includes: using the tag identification number, random data n1, and tag key T S1 And the preset first update rule, the first label pseudonym Update and get the target label pseudo name.

[0083] Exemplarily, the first update rule can be expressed as:

[0084] .

[0085] The tag ID represents the unique identification number corresponding to the tag. Used to store in the tag as the historical tag pseudo name IDSh in the next session; target tag pseudo name Used as the first label pseudonym in the next session .

[0086] Optionally, the first updated key K1' in the current session is used as the first shared key K1 in the next session. new The second updated key K2' is used as the second shared key K2 in the next session new ; The encryption key T's1 is used as the tag key T in the next session S1 ; Current timestamp T C Used as the historical timestamp Tt in the next session.

[0087] In a possible implementation, after receiving the third message sequence, the method further includes: using the historical timestamp Tt to calculate the current timestamp Tt. C Compare and process, at the current timestamp T C When the timestamp is greater than the historical timestamp Tt, the authentication result corresponding to the current session process is determined based on the third message sequence; C When it is less than or equal to the historical timestamp Tt, the encryption authentication method is terminated.

[0088] In a possible implementation, when the sixth message M6 is not obtained in the third message sequence, or when the message M6' to be verified does not match the sixth message M6, the authentication result is determined as authentication failure, and the tag ignores the executed steps and keeps all values ​​unchanged.

[0089] The above encryption authentication method is applied to a tag in a radio frequency identification system, the radio frequency identification system also includes a reader and a server, and the method includes: receiving a first message sequence from the reader; according to a tag key T corresponding to the tag S1 , the server pseudonym SID, the first tag pseudonym IDS and the first message sequence, generate a second message sequence; send the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server can generate a third message sequence according to the second message sequence; receive the third message sequence from the reader, and determine the authentication result corresponding to the current session process based on the third message sequence. In this way, during the current session, the message transmitted by the tag, reader and server each time is unique, which can effectively prevent replay attacks by external attackers. In the step of determining the verification result, there is no static data or associated data in the verified message, which can effectively prevent attackers from tracking the session. The data and algorithms involved in the verification process are all ultra-lightweight, which can avoid the problem of application difficulties caused by limited resources when the existing protocol is used on low-cost tags. The encryption authentication method provided in this embodiment can reduce the computing burden of the tag on the basis of ensuring security, and achieve efficient computing and communication capabilities under limited hardware conditions, thereby improving the encryption authentication efficiency in the radio frequency identification system.

[0090] In an exemplary embodiment, as shown in FIG3 , an encryption authentication method is provided, which is described by taking the method applied to the server in FIG1 as an example, and includes the following steps 302 to 308. Among them:

[0091] Step 302: parse and restore the second message sequence received from the reader to obtain the tag key T S1 and the first label pseudonym .

[0092] The second message sequence is the tag according to the tag key T S1 , the server pseudonym SID, the first label pseudonym IDS and the first message sequence. In combination with the above embodiment, the second message sequence includes random data n1, a third message M3 and a fourth message M4.

[0093] Step 304: Use the pre-stored pseudonym information to match the second message sequence to obtain the second label pseudonym IDS st .

[0094] In a possible implementation, step 304 may further include:

[0095] The candidate labels in the pseudonym information are pseudonymed as IDS i With label key T S1 Perform bitwise XOR processing to obtain the to-be-matched message M4' corresponding to each candidate tag pseudo-name. The to-be-matched message M4' can be expressed as:

[0096] ,

[0097] The message to be matched M4' is matched with the fourth message M4 in the second message sequence. If they can be matched, the pseudonym identifier st is updated to "new", and the candidate label pseudonym IDSi corresponding to the message to be matched M4' is used as the second label pseudonym IDSst. At this time, the second label pseudonym IDSst can also be expressed as the second label pseudonym IDSnew; if they cannot be matched, the pseudonym identifier st is updated to "old", that is, the historical label pseudonym IDSh is used as the second label pseudonym IDSst. At this time, the second label pseudonym IDSst can also be expressed as the second label pseudonym IDSold. The historical label pseudonym IDSh can be the first label pseudonym received and stored by the server from the label during the previous session.

[0098] Step 306: According to the second label pseudonym , tag key T S1 and the shared key to generate a third message sequence.

[0099] In a possible implementation, the third message sequence includes a fifth message M5 and a sixth message M6, and step 306 may further include: encoding the second tag pseudonym based on a preset third encoding rule. and the current timestamp T C Encode the random data n1, the shared key, and the tag key T according to the preset fourth encoding rule. S1 The sixth message M6 is obtained by encoding the second label pseudonym IDSst; and a third message sequence is generated according to the fifth message and the sixth message.

[0100] Exemplarily, the fifth message M5 obtained by the third encoding rule can be expressed as:

[0101] .

[0102] According to the preset fourth encoding rule, the random data n1, the shared keys K1 and K2, and the tag key T S1 The second label pseudonym IDSst is encoded to obtain a sixth message M6.

[0103] In a possible implementation, the fourth encoding rule may include: the first shared key and the random data are subjected to bitwise XOR processing and then rotated left, and the number of rotated bits is the second label pseudonym The value of the first update key is generated; the second shared key and the label key T S1 After bitwise XOR processing, rotate left, the number of rotations is the second label pseudonym The value of is used to generate a second update key; the fifth message M5 is bitwise XORed with the second update key, and then is bitwise ANDed with the first update key to obtain a sixth message M6.

[0104] Among them, the first shared key and the second shared key on the server side are secret keys shared by the tag and the server. When the value of the pseudonym identifier st is different, the values ​​of the first shared key and the second shared key are different, that is, the first shared key K1st can select K1new or K1old according to the value of the pseudonym identifier st, and the second shared key K2st can select K2new or K2old according to the value of the pseudonym identifier st.

[0105] The process of obtaining the sixth message M6 according to the fourth coding rule can be expressed as:

[0106] ,

[0107] ,

[0108] .

[0109] Step 308: Send the third message sequence to the reader, so that the reader sends the third message sequence to the tag, so that the tag can determine the authentication result corresponding to the current session process according to the third message sequence.

[0110] In a possible implementation, after step 306, the method further includes:

[0111] When the pseudonym identifier st is "new", the second tag pseudonym IDSst, the tag unique identification number ID, the random data n1 and the tag key T are updated according to the preset server update rule. S1 The encoding process is performed to obtain the third label pseudo name IDSt. The third label pseudo name IDSt obtained according to the server update rule can be expressed as:

[0112] .

[0113] In the next session between the server and the tag, when the pseudonym identifier st is "new", the third tag pseudonym IDSt is used as the second tag pseudonym IDSst; the first updated key K1' is used as the first shared key K1new in the next session, and the second updated key K2' is used as the second shared key K2new. In the case where the pseudonym identifier st is "old", the second tag pseudonym IDSst in the current session continues to be used as the second tag pseudonym IDSst in the next session, the first shared key K1new in the current session is used as the first shared key K1old in the next session, and the second shared key K2new in the current session is used as the second shared key K2old in the next session.

[0114] In a possible implementation, during the current session, if the pseudonym identifier st is "old", no update is performed.

[0115] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0116] Based on the same inventive concept, the embodiment of the present application also provides an encryption authentication device for implementing the encryption authentication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more encryption authentication device embodiments provided below can refer to the limitations on the encryption authentication method above, and will not be repeated here.

[0117] In an exemplary embodiment, as shown in FIG. 4 , an encryption authentication device is provided, which is applied to a tag in a radio frequency identification system. The radio frequency identification system also includes a reader and a server. The device includes: an information transceiver module 402, an information generation module 404, and an information verification module 406, wherein:

[0118] The information transceiver module 402 is used to receive a first message sequence from a reader;

[0119] Information generation module 404, used to generate a tag key T corresponding to the tagS1 , the server pseudonym SID, the first label pseudonym IDS and the first message sequence to generate a second message sequence;

[0120] The information transceiver module 402 is further used to send the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence;

[0121] The information verification module 406 is used to receive the third message sequence from the reader, and determine the authentication result corresponding to the current session process based on the third message sequence.

[0122] In one embodiment, the information generation module 404 is further used to parse the first message sequence to obtain random data; use the random data n1 and the server pseudonym SID to encode the tag key T according to the preset first encoding rule. S1 Encoding is performed to obtain an encryption key T's1; based on a preset second encoding rule and the encryption key, encoding is performed on the server pseudonym SID and the first label pseudonym IDS to obtain a second message sequence.

[0123] In one embodiment, the information verification module 406 is further configured to use a preset third encoding rule to encode the random data n1, the tag key T S1 , first label pseudonym The third encoding rule includes encoding the random data n1, the tag key T S1 , first label pseudonym And one or more of the shared keys are rotated, bitwise XORed, or bitwise ANDed; when the message M6' to be verified matches the third message sequence, the authentication result is determined as authentication passed.

[0124] In one embodiment, the device further includes an information update module for updating the tag using the tag identification number, random data n1, tag key T S1 And the preset first update rule, the first label pseudonym Update and get the target label pseudo name.

[0125] In one embodiment, the device further includes an information determination module for parsing the second message M2 to obtain a current timestamp T C ; Use historical timestamps to compare the current timestamp T C Compare and process, at the current timestamp T C In the case of a large historical timestamp, the process of generating the second message sequence is executed; at the current timestamp T C If it is less than or equal to the historical timestamp, the encryption authentication method is terminated.

[0126] In an exemplary embodiment, as shown in FIG5 , an encryption authentication device is provided, which is applied to a server in a radio frequency identification system, the radio frequency identification system also includes a reader and a tag, and the device includes: an information processing module 502, an information matching module 504, an information generating module 506 and an information sending module 508, wherein:

[0127] The information processing module 502 is used to parse and restore the second message sequence received from the reader to obtain the tag key TS1 and the first tag pseudonym , the second message sequence is generated by the tag according to the tag key TS1, the server pseudonym SID, the first tag pseudonym IDS and the first message sequence;

[0128] The information matching module 504 is used to match the second message sequence with the pre-stored pseudonym information to obtain the second label pseudonym IDSst;

[0129] Information generating module 506, used to generate a pseudonym based on the second label , tag key TS1 and shared key, generating a third message sequence;

[0130] The information sending module 508 is used to send the third message sequence to the reader, so that the reader sends the third message sequence to the tag, so that the tag can determine the authentication result corresponding to the current session process according to the third message sequence.

[0131] In one embodiment, the information generation module 506 is further configured to generate a pseudonym for the second label based on a preset third encoding rule. and the current timestamp TC are encoded to obtain the fifth message M5; the random data n1, the shared key, the label key TS1 and the second label pseudonym IDSst are encoded according to the preset fourth encoding rule to obtain the sixth message M6; according to the fifth message and the sixth message, a third message sequence is generated.

[0132] Each module in the above encryption authentication device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0133] In an exemplary embodiment, as shown in FIG. 6 , a radio frequency identification system is provided, the system comprising: a reader; a tag for executing the encryption authentication method applied to the tag in the above embodiment; and a server for executing the encryption authentication method applied to the server in the above embodiment.

[0134] Informal and formal analysis results using official tools for security protocol verification (Scythe and AVISPA) show that the use of the encryption authentication method in this application in the radio frequency identification system can prevent attacks, especially replay attacks. Experimental analysis shows that the overhead of encryption authentication is lower than that of the existing technology. Specifically, the total execution time of the encryption authentication method in this application is 0.031 milliseconds, which achieves an average performance improvement of 78.51% compared to the existing technology. In addition, this application also compares the performance, privacy and security requirements of various recent protocols. The results show that this application is superior to the existing technology in terms of storage space requirements, and its cryptographic requirements are extremely lightweight and efficient. At the same time, the number of communication messages in the authentication process of this application is also lower than that of the existing technology, and effectively meets privacy and security requirements.

[0135] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store a second message sequence and a third message sequence. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an encryption authentication method is implemented.

[0136] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0138] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0139] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0140] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0141] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0142] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0143] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An encryption authentication method, characterized in that: A tag used in a radio frequency identification system, wherein the radio frequency identification system further includes a reader and a server, and the method includes: receiving a first message sequence from the reader; Generate a second message sequence according to the label key corresponding to the label, the server pseudonym, the first label pseudonym and the first message sequence; sending the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence; The third message sequence is received from the reader, and an authentication result corresponding to the current session process is determined based on the third message sequence.

2. The method according to claim 1, characterized in that The step of generating a second message sequence according to the tag key, the server pseudonym, the first tag pseudonym and the first message sequence corresponding to the tag includes: Parsing the first message sequence to obtain random data; Using the random data and the server pseudonym, the label key is encoded according to a preset first encoding rule to obtain an encryption key; The server pseudonym and the first label pseudonym are respectively encoded based on a preset second encoding rule and the encryption key to obtain the second message sequence.

3. The method according to claim 2, characterized in that The receiving the third message sequence from the reader, and determining the authentication result corresponding to the current session process based on the third message sequence, includes: Using a preset third encoding rule, the random data, the label key, the first label pseudonym and the shared key are encoded to obtain a message to be verified, wherein the third encoding rule includes rotating, bitwise XORing, or bitwise ANDing one or more of the random data, the label key, the first label pseudonym and the shared key; In a case where the message to be verified matches the third message sequence, the authentication result is determined as authentication passed.

4. The method according to claim 3, characterized in that When the authentication result is verification passed, the method further includes: The first label pseudonym is updated using the label identification number, the random data, the label key and a preset first update rule to obtain a target label pseudonym.

5. The method according to claim 1, characterized in that: After receiving the first message sequence, the method further comprises: Parse the second message to obtain the current timestamp; Compare the current timestamp with the historical timestamp, and if the current timestamp is greater than the historical timestamp, execute the process of generating the second message sequence; When the current timestamp is less than or equal to the historical timestamp, the encryption authentication method is terminated.

6. An encryption authentication method, characterized in that: A server applied to a radio frequency identification system, wherein the radio frequency identification system further comprises a reader and a tag, and the method comprises: Parsing and restoring the second message sequence received from the reader to obtain a tag key and a first tag pseudo name, wherein the second message sequence is generated by the tag according to the tag key, the server pseudo name, the first tag pseudo name and the first message sequence; Using the pre-stored pseudonym information to perform matching processing on the second message sequence to obtain a second label pseudonym; generating a third message sequence according to the second label pseudonym, the label key and the shared key; The third message sequence is sent to the reader, so that the reader sends the third message sequence to the tag, so that the tag determines the authentication result corresponding to the current session process according to the third message sequence.

7. The method according to claim 6, characterized in that The step of generating a third message sequence according to the second label pseudonym, the label key and the shared key comprises: Encoding the second label pseudonym and the current timestamp based on a preset third encoding rule to obtain a fifth message; Encode the random data, the shared key, the label key and the second label pseudonym according to a preset fourth encoding rule to obtain a sixth message; The third message sequence is generated according to the fifth message and the sixth message.

8. An encryption authentication device, characterized in that: A tag used in a radio frequency identification system, wherein the radio frequency identification system further includes a reader and a server, and the device includes: An information transceiver module, configured to receive a first message sequence from the reader; An information generation module, configured to generate a second message sequence according to a label key corresponding to the label, a server pseudonym, a first label pseudonym and the first message sequence; The information transceiver module is further used to send the second message sequence to the reader, so that the reader sends the second message sequence to the server, so that the server generates a third message sequence according to the second message sequence; The information verification module is used to receive the third message sequence from the reader and determine the authentication result corresponding to the current session process based on the third message sequence.

9. An encryption authentication device, characterized in that: A server used in a radio frequency identification system, wherein the radio frequency identification system further comprises a reader and a tag, and the device comprises: an information processing module, configured to parse and restore a second message sequence received from the reader to obtain a tag key and a first tag pseudo name, wherein the second message sequence is generated by the tag according to the tag key, the server pseudo name, the first tag pseudo name and the first message sequence; An information matching module, used to match the second message sequence with the pre-stored pseudonym information to obtain a second label pseudonym; An information generation module, configured to generate a third message sequence according to the second label pseudonym, the label key and the shared key; The information sending module is used to send the third message sequence to the reader, so that the reader sends the third message sequence to the tag, so that the tag can determine the authentication result corresponding to the current session process according to the third message sequence.

10. A radio frequency identification system, characterized in that: The system comprises: Reader; A tag, used to execute the encryption authentication method according to any one of claims 1 to 5; A server, used to execute the encryption authentication method described in any one of claims 6-7.

Images