Access authentication method and device

Abstract

The invention discloses an access authentication method and device, relates to the technical field of access authentication, and is used for a scene in which a plurality of devices are mutually authenticated to realize cooperative work. The first device and the second device can perform corresponding encryption processing and decryption processing on the password information through the information of the distance between the two devices and the information of the state of the channel between the two devices to share the password information, the password information does not need to be shared in advance, the probability of password information leakage is reduced, and the user experience is improved. In addition, the randomness of the password information is improved, the password information with high randomness can negotiate a session key with high randomness for access authentication, and the communication security is improved.

Description

Technical Field

[0001] The present application relates to the field of access authentication technology, and in particular to an access authentication method and device. Background Art

[0002] With the development of Internet of Things technology, various wearable devices and smart devices around people are gradually increasing. For example, users may have smart phones, tablets, wearable devices, TVs, speakers, headphones, car computers, augmented reality (AR) devices, virtual reality (VR) devices and other devices at the same time. These devices provide users with intelligent services in home, office, transportation, entertainment, fitness and other scenarios to improve user experience. In order to provide users with convenient intelligent services, multiple devices need to be connected to a communication bus to exchange messages for collaborative work. For example, multiple devices are connected to the same wireless bus, which can be implemented through wireless fidelity (Wi-Fi), Bluetooth (BT) and other wireless technologies.

[0003] In order to improve the communication security between multiple devices, multiple devices need to authenticate each other when working together. For example, when a mobile phone projects the application interface it is running on a TV for display, the TV needs to authenticate the mobile phone. Currently, devices can perform access authentication based on passwords or biometrics, but the password-based access authentication method requires users to manually enter or visually compare passwords, and the probability of authentication failure is high. In addition, the low randomness of the password will lead to low randomness of the keys negotiated between devices, that is, low-entropy passwords cannot negotiate high-entropy keys, and the risk of key leakage is high. The authentication method based on biometrics involves user privacy, and the probability of user privacy leakage and deepfake is high.

[0004] Therefore, there is an urgent need for an access authentication method that can negotiate a high entropy key to improve communication security. Summary of the invention

[0005] The embodiments of the present application provide an access authentication method and device for negotiating a high entropy key to improve communication security.

[0006] In a first aspect, an embodiment of the present application provides an access authentication method, which can be executed by a first device or a chip in the first device. Taking the method being executed by the first device as an example, the method includes: the first device can determine first information and second information, the first information is used to indicate the distance between the first device and the second device, and the second information is used to indicate the state of a channel between the first device and the second device; the first device can encrypt password information according to the first information and the second information to obtain binary large object information, and send the binary large object information to the second device, and the binary large object information is used by the second device to decrypt the password information according to the first information and the second information to obtain the password information; the first device can negotiate with the second device to generate a session key according to the password information, and the session key is used for the second device to access the first device, and the first device performs access authentication on the second device.

[0007] In the above scheme, the first device and the second device can share the password information by performing corresponding encryption and decryption processing on the password information through the first information and the second information, without the need to share the password information in advance. This not only reduces the probability of password information leakage, but also improves the randomness of the password information. Password information with strong randomness can negotiate a session key with strong randomness, that is, high-entropy password information can negotiate a high-entropy session key, thereby improving communication security.

[0008] In a possible implementation, when the first device determines the first information, the first device may send a first sound wave signal, and the sampling points between adjacent synchronization sequences in the sound wave signal change according to a first rule; the first device may receive the first sound wave signal from the first device at a first moment, and receive the second sound wave signal from the second device at a second moment; the first device may determine the first distance between the first device and the second device according to the first moment, the second moment, the third moment and the fourth moment when there are N consecutive identical synchronization sequences between the second sound wave signal and the first sound wave signal, wherein N is a positive integer greater than a first threshold, the third moment is the moment when the second device receives the first sound wave signal from the first device, and the fourth moment is the moment when the second device receives the second sound wave signal from the second device.

[0009] Since the sampling points between adjacent synchronization sequences in the sound wave signal sent by the first device change according to a rule, the first device does not need to match all synchronization sequences when matching the sound wave signal, but only needs to match part of the synchronization sequence, thereby improving the matching efficiency. And since the time when the device receives the sound wave signal sent by itself is similar to the time when the device matches the sound wave signal, the first device can calculate the time when the first device and the second device match the sound wave signal by calculating the time when the first device receives the sound wave signal sent by the first device itself and the time when the second device receives the sound wave signal sent by the second device itself when performing sound wave ranging, thereby improving the ranging accuracy.

[0010] In a possible implementation, when the first device determines the first distance between the first device and the second device according to the first moment, the second moment, the third moment and the fourth moment, the first device may determine the starting positions of the first synchronization sequence and the second synchronization sequence according to the first rule, the first synchronization sequence being the first synchronization sequence in the first sound wave signal, and the second synchronization sequence being the first synchronization sequence in the second sound wave signal; the first device may determine the number of the first sampling sequence and the second sampling sequence according to the starting positions of the first synchronization sequence and the second synchronization sequence, the first sampling sequence being the synchronization sequence collected by the first device at the first moment according to the first sampling rate, and the second sampling sequence being the synchronization sequence collected by the first device at the second moment according to the first sampling rate; the first device may determine the first distance according to the number of the first sampling sequence, the second sampling sequence, the third sampling sequence and the fourth sampling sequence, the third sampling sequence being the sampling sequence collected by the second device at the third moment according to the first sampling rate, and the fourth sampling sequence being the sampling sequence collected by the second device at the fourth moment according to the first sampling rate.

[0011] The first device can use the sampling rate and sampling sequence to achieve time synchronization with the second device, thereby improving the ranging accuracy. In addition, the first device can also quickly determine the number of sampling sequences according to the change rule of the sampling points between adjacent synchronization sequences in the sound wave signal sent by the first device, thereby improving the ranging efficiency.

[0012] In a possible implementation, when the first device sends the first sound wave signal, the first device may send the third sound wave signal at the fifth moment and receive the fourth sound wave signal from the second device at the sixth moment; the first device may determine the second distance between the first device and the second device according to the fifth moment, the sixth moment, the seventh moment and the eighth moment when there are N consecutive identical synchronization sequences between the fourth sound wave signal and the third sound wave signal, wherein N is a positive integer greater than the first threshold, the seventh moment is the moment when the second device receives the third sound wave signal from the first device, and the eighth moment is the moment when the second device sends the fourth sound wave signal; the first device may send the first sound wave signal when the second distance is less than the second threshold.

[0013] Before the first device performs precise acoustic ranging, it can first perform rough acoustic ranging, that is, it does not calculate the time when the first device and the second device match the acoustic signal by calculating the time when the first device receives the acoustic signal sent by the first device itself and the time when the second device receives the acoustic signal sent by the second device itself. And the first device can also determine whether the second device is within the authentication range based on the result of the rough acoustic ranging. If it is within the authentication range, it will perform precise acoustic ranging to reduce the probability of invalid authentication.

[0014] In a possible implementation, the first device may also stop performing access authentication on the second device when the second distance is greater than or equal to the second threshold, or when the difference between the first distance and the second distance is greater than or equal to a third threshold.

[0015] The first device can determine whether the second device is within the authentication range based on the result of the rough acoustic ranging. If it is not within the authentication range, the first device stops access authentication for the second device to reduce the probability of invalid authentication. The first device can also determine whether the error is within the error range based on the results of the precise acoustic ranging and the rough acoustic ranging. If it is not within the error range, it means that the position of the second device has been tampered with and it may not be within the authentication range at present. The first device stops access authentication for the second device to reduce the probability of invalid authentication.

[0016] In one possible implementation, the second information includes one or more of the following: an estimated value of a channel between the first device and the second device; an indication of a received signal strength of a wireless channel between the first device and the second device; an indication of a received signal strength of a Bluetooth channel between the first device and the second device.

[0017] When the first device and the second device share password information, multiple authentication factors can be considered, which improves the randomness of the password information. Password information with stronger randomness can negotiate a session key with stronger randomness, that is, high-entropy password information negotiates a high-entropy session key, thereby improving communication security.

[0018] In a possible implementation, when the first device encrypts the password information according to the first information and the second information to obtain binary large object information, the first device can quantize the first information and the second information to obtain a first sequence, which is a binary sequence; the first device can perform error correction code encoding on the password information to obtain a second sequence; the first device can perform an XOR operation on the first sequence and the second sequence to obtain the binary large object information.

[0019] The first device and the second device can share the password information by performing corresponding encryption and decryption processing on the password information through the first information and the second information, without the need to share the password information in advance. This not only reduces the probability of password information leakage, but also improves the randomness of the password information. Password information with strong randomness can negotiate a session key with strong randomness, that is, high-entropy password information can negotiate a high-entropy session key, thereby improving communication security.

[0020] In a possible implementation, when the first device negotiates with the second device to generate a session key based on the password information, the first device may send a first random number to the second device; the first device may receive a second random number and a first key material from the second device, the first key material being obtained by the second device performing hash processing on the first random number, the second random number, the password information, an identifier of the first device, and an identifier of the second device to obtain the second key material, and then performing hash processing on the second key material and a third random number to an elliptic curve; the first device may perform hash processing on the second key material and a fourth random number to an elliptic curve to obtain a third key material, and send the third key material to the second device; the first device may perform hash processing on the first random number, the second random number, the first key material, and the third key material to obtain the session key.

[0021] When the first device and the second device negotiate a session key based on the shared password information, due to the strong randomness of the password information, they can negotiate a session key with strong randomness, that is, high entropy password information negotiates a high entropy session key, thereby improving communication security.

[0022] In the second aspect, an embodiment of the present application also provides an access authentication method, which can be executed by a second device or a chip in the second device. Taking the method being executed by the second device as an example, the method includes: the second device can determine first information and second information, the first information is used to indicate the distance between the first device and the second device, and the second information is used to indicate the state of the channel between the first device and the second device; the second device can receive binary large object information from the first device, and decrypt the binary large object information according to the first information and the second information to obtain password information; the second device can negotiate with the first device to generate a session key according to the password information, and the session key is used for the second device to access the first device, and the first device performs access authentication on the second device.

[0023] In a possible implementation, when the second device determines the first information, the second device may send a fifth sound wave signal, and the sampling points between adjacent synchronization sequences in the sound wave signal change according to the first rule; the second device may receive the fifth sound wave signal from the second device at the ninth moment, and receive the sixth sound wave signal from the first device at the tenth moment; the second device may determine the first distance between the first device and the second device according to the ninth moment, the tenth moment, the eleventh moment and the twelfth moment when there are N consecutive identical synchronization sequences between the sixth sound wave signal and the fifth sound wave signal, wherein N is a positive integer greater than a first threshold value, the eleventh moment is the moment when the first device receives the fifth sound wave signal from the second device, and the twelfth moment is the moment when the first device receives the sixth sound wave signal from the first device.

[0024] In a possible implementation, when the second device determines the first distance between the first device and the second device according to the ninth moment, the tenth moment, the eleventh moment, and the twelfth moment, the second device may determine the starting positions of the third synchronization sequence and the fourth synchronization sequence according to the first rule, the third synchronization sequence being the first synchronization sequence in the fifth sound wave signal, and the fourth synchronization sequence being the first synchronization sequence in the sixth sound wave signal; the second device may determine the number of the fifth sampling sequence and the sixth sampling sequence according to the starting positions of the third synchronization sequence and the fourth synchronization sequence, the fifth sampling sequence being the synchronization sequence collected by the second device at the ninth moment according to the first sampling rate, and the sixth sampling sequence being the synchronization sequence collected by the second device at the tenth moment according to the first sampling rate; the second device may determine the first distance according to the number of the fifth sampling sequence, the sixth sampling sequence, the seventh sampling sequence, and the eighth sampling sequence, the seventh sampling sequence being the sampling sequence collected by the first device at the eleventh moment according to the first sampling rate, and the eighth sampling sequence being the sampling sequence collected by the first device at the twelfth moment according to the first sampling rate.

[0025] In a possible implementation, when the second device sends the fifth sound wave signal, the second device may send the seventh sound wave signal at the thirteenth moment and receive the eighth sound wave signal from the first device at the fourteenth moment; the second device may determine the second distance between the first device and the second device according to the thirteenth moment, the fourteenth moment, the fifteenth moment and the sixteenth moment when there are N consecutive identical synchronization sequences between the eighth sound wave signal and the seventh sound wave signal, wherein N is a positive integer greater than the first threshold, the fifteenth moment is the moment when the first device receives the seventh sound wave signal from the second device, and the sixteenth moment is the moment when the first device sends the eighth sound wave signal; the second device may send the fifth sound wave signal when the second distance is less than the second threshold.

[0026] In a possible implementation, the second device may also stop accessing the first device when the second distance is greater than or equal to the second threshold, or when the difference between the first distance and the second distance is greater than or equal to a third threshold.

[0027] In one possible implementation, the second information includes one or more of the following: an estimated value of a channel between the first device and the second device; an indication of a received signal strength of a wireless channel between the first device and the second device; an indication of a received signal strength of a Bluetooth channel between the first device and the second device.

[0028] In a possible implementation, when the second device decrypts the binary large object information according to the first information and the second information to obtain password information, the second device can quantize the first information and the second information to obtain a first sequence, which is a binary sequence; the second device can perform error correction code decoding on the binary large object information to obtain a third sequence; the second device can perform an XOR operation on the first sequence and the third sequence to obtain the password information.

[0029] In a possible implementation, when the second device negotiates with the first device to generate a session key based on the password information, the second device can receive a first random number from the first device; the second device can hash the first random number, the second random number, the password information, the identifier of the first device and the identifier of the second device to obtain a second key material, hash the second key material and the third random number to an elliptic curve to obtain a first key material, and send the second random number and the first key material to the second device; the second device can receive a third key material from the first device, and the third key material is obtained by the first device hashing the second key material and a fourth random number to an elliptic curve; the second device can hash the first random number, the second random number, the first key material and the third key material to obtain the session key.

[0030] In a third aspect, an embodiment of the present application further provides an access authentication device, comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the computer program is executed by the processor, the processor implements the above-mentioned first aspect or any possible design method of the above-mentioned first aspect, or implements the above-mentioned second aspect or any possible design method of the above-mentioned second aspect.

[0031] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the method of the first aspect or any possible design of the first aspect, or to execute the method of the second aspect or any possible design of the second aspect.

[0032] In a fifth aspect, an embodiment of the present application also provides a computer program product comprising computer executable instructions, which are used to enable a computer to execute the method of the first aspect or any possible design of the first aspect, or to execute the second aspect or any possible design of the second aspect.

[0033] The beneficial effects of the above-mentioned second to fifth aspects and possible designs thereof can refer to the description of the beneficial effects of the method described in the above-mentioned first aspect and any possible design thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a schematic diagram of an existing sound wave signal;

[0035] Figure 2 It is a schematic diagram of the principle of an existing acoustic wave ranging;

[0036] Figure 3 A schematic diagram of a screen projection scenario provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of a multi-screen splicing scenario provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram of the structure of an access authentication system provided in an embodiment of the present application;

[0039] Figure 6 A flowchart of an access authentication method provided in an embodiment of the present application;

[0040] Figure 7 A schematic diagram of a sound wave signal provided in an embodiment of the present application;

[0041] Figure 8 A schematic diagram of the principle of precise acoustic ranging provided in an embodiment of the present application;

[0042] Fig. 9 A schematic diagram of the principle of a rough acoustic ranging provided in an embodiment of the present application;

[0043] Fig.10 A flowchart of another access authentication method provided in an embodiment of the present application;

[0044] Fig.11 A flowchart of another access authentication method provided in an embodiment of the present application;

[0045] Fig.12 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0046] Fig.13 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0047] Fig.14 A schematic diagram of a connection method between computing device clusters provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0049] Before introducing the specific solutions provided in the embodiments of the present application, some terms in the embodiments of the present application are explained to facilitate understanding by those skilled in the art, and the terms in the present application are not limited.

[0050] (1) In the embodiments of the present application, "multiple" refers to two or more than two. In view of this, in the embodiments of the present application, "multiple" can also be understood as "at least two". "At least one" can be understood as one or more, for example, one, two or more. For example, including at least one means including one, two or more, and there is no restriction on which ones are included. For example, including at least one of A, B and C, then the included ones may be A, B, C, A and B, A and C, B and C, or A, B and C. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previously and subsequently associated objects are in an "or" relationship.

[0051] Unless otherwise specified, the ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are used to distinguish multiple objects and are not used to limit the order, timing, priority or importance of the multiple objects.

[0052] (2) Fuzzy commitment is a new type of cryptographic primitive used for key negotiation between multiple devices. For example, device 1 can use error-correcting code encoding technology to encode a secret random number and a noisy signal to produce a commitment, and send the commitment to device 2. Device 2 can use error-correcting code decoding technology to decode the commitment and the noisy signal to produce a secret random number, so that device 1 and device 2 can negotiate a key based on the secret random number.

[0053] (3) Acoustic ranging, the working principle of which is that the specific acoustic signal emitted by the transmitting device of device 1 will be reflected back to the receiving device of device 2 when it encounters device 2. After matching the acoustic signal, device 1 can determine the distance between device 1 and device 2 by calculating the time difference between sending and receiving the acoustic signal. Among them, device 1 can calculate the time difference between sending and receiving the acoustic signal through sampling points to achieve time synchronization between device 1 and device 2. For example, device 1 transmits the acoustic signal at time T1 and receives the acoustic signal at time T1. Device 1 collects sample1 sampling points at time T1 and sample2 sampling points at time T2. The sampling rate is f, then T1 = sample1 / f, T2 = sample2 / f, and T2-T1 = (sample2-sample1) / f. When device 1 matches the acoustic signal, it first needs to match the acoustic signal to filter it to determine that the received acoustic signal is the acoustic signal emitted by device 1 itself. The simplest matched filtering method is to perform convolution calculation on the received sound wave signal and the inverse signal of the transmitted sound wave signal. The peak value of the wave after convolution is the position where the signal has the highest matching degree, and the starting position of the signal is inferred from this position.

[0054] For example, Figure 1 is a schematic diagram of an existing sound wave signal, such as Figure 1 As shown, the sound wave signal consists of a preamble, a sync, and a signal content. By finding all the syncs in the received sound wave signal and the transmitted sound wave signal through matched filtering, it can be confirmed that the received sound wave signal matches the transmitted sound wave signal.

[0055] For example, Figure 2 It is a schematic diagram of the principle of an existing acoustic wave ranging, such as Figure 2 As shown, the sound wave signal transmitting device and the sound wave signal receiving device of the device are both audio modules of the device. The audio module can call the speaker of the device by calling the interface to realize the audio playback function, thereby emitting a sound wave signal. The audio module can also call the microphone of the device by calling the interface to realize the audio recording function, thereby receiving a sound wave signal. After the signal matching device of the device performs matched filtering on the sound wave signal received and sent by the device, the matched filtering result is sent to the sound wave ranging device of the device to obtain the sound wave ranging result.

[0056] Since acoustic ranging uses a completely matching waveform to match the wave, it is impossible to match the acoustic signal when part of the acoustic signal is missing. In addition, in actual applications, differences in physical devices and noise interference in the environment will lead to a low matching rate of acoustic signals, and thus a low success rate of acoustic ranging.

[0057] (3) Access authentication: multiple devices need to authenticate each other when working together to ensure the security of communication between the multiple devices. For example, when a mobile phone projects the application interface it is running onto a TV for display, that is, when the mobile phone is connected to the TV, the TV needs to authenticate the access of the mobile phone. The mobile phone accessing the TV can be seamless, that is, the user experience is seamless, and all perception, authentication and other operations are completed by the mobile phone and the TV itself. The TV can perform channel perception based on the distance between the TV and the mobile phone, and use the perception results as shared secret information. By combining cryptographic authentication algorithms, secure access authentication can be achieved.

[0058] Currently, devices can perform access authentication based on passwords or biometrics. For example, Bluetooth access authentication based on personal identification number (PIN) comparison and wireless fidelity (WiFi) access authentication based on passwords require user participation or pre-sharing of secret information by devices. The password-based password authenticated key exchange (PAKE) protocol negotiates keys based on low-entropy passwords. Access authentication based on fuzzy information such as faces requires the use of error correction technology to extract unique information to negotiate keys.

[0059] It can be seen that the password-based access authentication method requires users to manually enter or compare passwords with the naked eye, and the probability of authentication failure is high. In addition, the low randomness of the password will lead to low randomness of the key negotiated between devices, that is, a low-entropy password cannot negotiate a high-entropy key, and the risk of key leakage is relatively high. The authentication method based on biometrics involves user privacy, and the probability of user privacy leakage and deepfake is relatively high.

[0060] In response to the problem described in the above content that multiple devices cannot negotiate a high entropy key during mutual authentication, resulting in low communication security, an embodiment of the present application provides an access authentication method.

[0061] This method can be applied to scenarios where multiple devices authenticate each other to achieve collaborative work. For example, taking this method applied to screen projection as an example, see Figure 3, is a schematic diagram of a screen projection scenario provided by an embodiment of the present application. In this scenario, device 1 can project the screen (for example, mirror projection or extended projection) to device 2 (i.e., one screen projects one screen), and device 2 needs to perform access authentication on device 1; device 1, device 2, device 3, and device 4 can project the screen to device 5 (i.e., multiple screens project one screen), and device 5 needs to perform access authentication on device 1, device 2, device 3, and device 4; device 5 can project the screen to device 1, device 2, device 3, and device 4 (i.e., one screen projects multiple screens), and device 1, device 2, device 3, and device 4 need to perform access authentication on device 5. Alternatively, taking the application of this method to a multi-screen splicing scenario as an example, see Figure 4 , which is a schematic diagram of a multi-screen splicing scenario provided in an embodiment of the present application. In this scenario, the screen of device 1 can be spliced ​​with the screens of device 2 and device 3 to obtain a screen that supports cross-screen writing and supports cross-screen display of a single object, or a screen that supports cross-screen writing but does not support cross-screen display of a single object. At this time, device 1 needs to perform access authentication on device 2, and device 2 needs to perform access authentication on device 3.

[0062] The method can be applied to an access authentication system, which includes at least two devices. Figure 5 , is a schematic diagram of the structure of an access authentication system provided in an embodiment of the present application, such as Figure 5 As shown, the access authentication system may include a first device 100 and a second device 200. The first device 100 may determine first information and second information, the first information is used to indicate the distance between the first device 100 and the second device 200, the second information is used to indicate the state of the channel between the first device 100 and the second device 200, encrypt the password information according to the first information and the second information to obtain binary large object information, and send the binary large object information to the second device 200. The second device 200 may determine the first information and the second information, receive the binary large object information from the first device 100, and decrypt the binary large object information according to the first information and the second information to obtain the password information. The first device 100 and the second device 200 may negotiate to generate a session key according to the password information, the session key is used for the second device 200 to access the first device 100, and the first device 100 performs access authentication on the second device 200. The first device 100 and the second device 200 share password information by performing corresponding encryption and decryption processing on the password information by the first information and the second information. There is no need to share the password information in advance, which not only reduces the probability of password information leakage, but also improves the randomness of the password information. Password information with strong randomness can negotiate a session key with strong randomness, that is, high entropy password information can negotiate a high entropy session key, thereby improving communication security.

[0063] It should be understood that Figure 5 For ease of understanding only, an access authentication system is shown by way of example, but this should not constitute any limitation to the present application. The access authentication system may also include a greater number of first devices 100, and may also include a greater number of second devices 200; the second devices 200 interacting with different first devices 100 may be the same second device 200, or may also be different second devices 200; the number of second devices 200 interacting with different first devices 100 may be the same or different, and the embodiments of the present application do not limit this.

[0064] The first device 100 and the second device 200 may be terminal devices or servers. For example, the first device 100 and the second device 200 may be terminal devices such as mobile phones, tablet computers, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), wearable devices, etc. Alternatively, the first device 100 and the second device 200 may also be a single server or a server cluster consisting of multiple servers. The server may specifically be a cloud server, also known as a cloud, cloud, cloud server or cloud controller. A cloud server is a general term for devices or devices with data processing capabilities, such as physical devices such as a host or processor, virtual devices such as a virtual machine or container, and chips or integrated circuits. The embodiments of the present application do not impose any restrictions on the specific types of the first device 100 and the second device 200.

[0065] The first device 100 can be directly connected to the second device 200 via a wired or wireless manner (such as Wi-Fi, Bluetooth (BT), or can be indirectly connected to the second device 200 via one or more other devices, and the embodiment of the present application does not make specific restrictions on this.

[0066] The above content describes the possible application scenarios and applicable system architecture of the access authentication method provided in the embodiment of the present application. Figure 5 The structure of the access authentication system shown further introduces the access authentication method provided in the embodiment of the present application.

[0067] For example, Figure 6 The following is a flow chart of an access authentication method provided in an embodiment of the present application. The specific flow of the access authentication method is described as follows. Figure 3 The screen projection scene shown or Figure 4 As an example, the multi-screen splicing scene shown in FIG. Figure 5 The access authentication system shown in the figure is executed as an example. For example, the first device described below may be Figure 5 The first device 100 shown in FIG. 1 and the second device described below may be Figure 5 The second device 200 is shown. In the embodiment of the present application, the first device and the second device are taken as examples to introduce the execution subject of the method, or the execution subject of the method may also be other devices or systems, such as chips, chip systems or processors applied to the first device and the second device.

[0068] S601. A first device and a second device determine first information and second information.

[0069] In an embodiment of the present application, the first information may be used to indicate the distance between the first device and the second device. The second information may be used to indicate the state of the channel between the first device and the second device. For example, the second information may include one or more of the following: an estimated value of the channel between the first device and the second device; a received signal strength indicator (RSSI) of the wireless channel between the first device and the second device; and an RSSI of the Bluetooth channel between the first device and the second device.

[0070] In a specific implementation, the first device and the second device can enable the sound wave sensing function, such as emitting sound wave signals by calling a speaker to play audio, and receiving sound wave signals by calling a microphone to record audio, and then perform sound wave ranging based on the received and sent sound wave signals to determine the first information.

[0071] In one implementation, the first device may perform the following steps to perform precise acoustic ranging to determine a first distance between the first device and the second device:

[0072] Step A1: The first device may send a first sound wave signal.

[0073] Among them, the sampling points between adjacent synchronization sequences in a sound wave signal can change according to the first rule. Each synchronization sequence in a sound wave signal is the same size. The sampling points between adjacent synchronization sequences in a sound wave signal can be the sampling points between the starting position of the previous synchronization sequence and the starting position of the next synchronization sequence, or it can also be the sampling points between the starting position of the previous synchronization sequence and the ending position of the next synchronization sequence, or it can also be the sampling points between the ending position of the previous synchronization sequence and the starting position of the next synchronization sequence, or it can also be the sampling points between the ending position of the previous synchronization sequence and the ending position of the next synchronization sequence, and the embodiment of the present application does not specifically limit this. The first rule can include geometric increase, geometric decrease, arithmetic increase, arithmetic decrease, etc., and the embodiment of the present application does not specifically limit this.

[0074] For example, Figure 7 A schematic diagram of a sound wave signal provided in an embodiment of the present application, such as Figure 7 As shown, the acoustic wave signal is composed of a preamble sequence, a synchronization sequence, and a signal content. The sampling point between synchronization sequence 1 and synchronization sequence 2 is sampling point 1, the sampling point between synchronization sequence 2 and synchronization sequence 3 is sampling point 2, the sampling point between synchronization sequence 3 and synchronization sequence 4 is sampling point 3, and the sampling point between synchronization sequence 4 and synchronization sequence 5 is sampling point 4. Sampling point 1, sampling point 2, sampling point 3, and sampling point 4 can be 2, 4, 8, and 16, respectively, that is, the ratio is 2, and the sampling points between adjacent synchronization sequences increase in geometric proportion. Alternatively, sampling point 1, sampling point 2, sampling point 3, and sampling point 4 can be 1, 4, 7, and 10, respectively, that is, the difference is 3, and the sampling points between adjacent synchronization sequences increase in geometric proportion.

[0075] Step A2: The first device may receive a first sound wave signal from the first device at a first moment, and receive a second sound wave signal from the second device at a second moment.

[0076] Step A3: The first device may determine the first distance between the first device and the second device according to the first moment, the second moment, the third moment, and the fourth moment when there are N consecutive identical synchronization sequences between the second sound wave signal and the first sound wave signal. Wherein, N is a positive integer greater than the first threshold, the third moment is the moment when the second device receives the first sound wave signal from the first device, and the fourth moment is the moment when the second device receives the second sound wave signal from the second device.

[0077] For example, the first device uses Formula 1 to determine the first distance between the first device and the second device. Formula 1 is specifically: c is the speed of sound, T1 is the first moment, T2 is the second moment, T3 is the third moment, and T4 is the fourth moment.

[0078] In a specific implementation, the first device can determine the starting positions of the first synchronization sequence and the second synchronization sequence according to the first rule. The first synchronization sequence is the first synchronization sequence in the first sound wave signal, and the second synchronization sequence is the first synchronization sequence in the second sound wave signal. The first device can determine the number of the first sampling sequence and the second sampling sequence according to the starting positions of the first synchronization sequence and the second synchronization sequence. The first sampling sequence is the synchronization sequence collected by the first device at the first moment according to the first sampling rate, and the second sampling sequence is the synchronization sequence collected by the first device at the second moment according to the first sampling rate. The first device can determine the first distance between the first device and the second device according to the number of the first sampling sequence, the second sampling sequence, the third sampling sequence and the fourth sampling sequence. The third sampling sequence is the sampling sequence collected by the second device at the third moment according to the first sampling rate, and the fourth sampling sequence is the sampling sequence collected by the second device at the fourth moment according to the first sampling rate.

[0079] For example, the first device uses Formula 2 to determine the first distance between the first device and the second device. Formula 2 is specifically: S1 is the number of the first sampling sequences, S2 is the number of the second sampling sequences, S3 is the number of the third sampling sequences, S4 is the number of the fourth sampling sequences, and f is the first sampling rate.

[0080] For example, Figure 8 A schematic diagram of the principle of accurate acoustic ranging provided in an embodiment of the present application, based on Figure 8 Based on the principle of accurate acoustic wave ranging shown in FIG, the above formulas 1 and 2 can be derived. Figure 8 As shown, device A is at T A1 Play a piece of audio at time T B1 The audio played by device A is received at time T. A2 Device B receives the audio played by itself at the time. After receiving the audio played by device A, device B records the audio and B2 Device A plays the audio again at time T A3 Device B receives the audio played by device B at time T B3 The device A receives the audio it plays at any given moment. Assume that the time it takes for device A to process the audio is T AM , the time for device B to process audio is T BM , the device plays audio and it is directly captured by its own microphone. Therefore, the time it takes for the device to receive its own audio is approximately the time it takes for the device to process the audio, that is, T AM ≈T A2 -T A1 , and T BM ≈T B3 -TB2 .

[0081] Let the first distance between device A and device B be F, then:

[0082] F AB =c*(T B1 -T A1 -T BM )=c*(T B1 -T A1 -(T B3 -T B2 ))

[0083] F BA =c*(T A3 -T B2 -T AM )=c*(T A3 -T B2 -(T A2 -T A1 ))

[0084]

[0085] At the same time, the sampling rate and sampling sequence can be used to synchronize the time between the two devices: A2 Total samples collected at the time A2 sampling sequence, sampling rate is f, then T A2 =sample A2 / f, similarly, T A3 =sample A3 / f,T B1 =sample B1 / f,T B3 =sample B3 / f, remember sample A =sample A3 -sample A2 , sample B =sample B3 -sample B1 , then F A =c*(sample A -sample B ) / (2*f).

[0086] In another implementation, when executing step A1 to send the first sound wave signal, the first device may also execute the following steps to perform rough sound wave ranging to determine a second distance between the first device and the second device, and determine whether to send the first sound wave signal according to the second distance:

[0087] Step B1: The first device may send a third sound wave signal at a fifth moment, and receive a fourth sound wave signal from the second device at a sixth moment.

[0088] Step B2: When there are N consecutive identical synchronization sequences between the fourth sound wave signal and the third sound wave signal, the first device can determine the second distance between the first device and the second device according to the fifth moment, the sixth moment, the seventh moment and the eighth moment. Wherein, N is a positive integer greater than the first threshold, the seventh moment is the moment when the second device receives the third sound wave signal from the first device, and the eighth moment is the moment when the second device sends the fourth sound wave signal.

[0089] For example, the first device uses Formula 3 to determine the second distance between the first device and the second device. Formula 3 is specifically: c is the speed of sound, T5 is the fifth moment, T6 is the sixth moment, T7 is the seventh moment, and T8 is the eighth moment.

[0090] Step B3: The first device may send a first sound wave signal when the second distance is less than a second threshold.

[0091] For example, Fig. 9 A schematic diagram of the principle of a rough acoustic ranging provided in an embodiment of the present application, based on Fig. 9 The principle of rough acoustic wave ranging shown in FIG. 1 can be used to derive the above formulas 3 and 4. Fig. 9 As shown in the figure, device A plays an audio at time T0, and device B receives the audio played by device A at time T1. After receiving the audio played by device A, device B records the audio and plays it again at time T2. Device A receives the audio played by device B at time T3. The time it takes for the device to process the audio is T2-T1. Let the second distance between device A and device B be D, then:

[0092]

[0093] At the same time, the sampling rate and sampling sequence can be used to synchronize the time between the two devices: let T0 collect a total of sample0 sampling sequences, the sampling rate is f, then T0 = sample0 / f, similarly, T1 = sample1 / f, T2 = sample2 / f, T3 = sample3 / f, let sample A =sample3-sample0,sample B = sample2-sample1, then D A =c*(sample A -2*sample B ) / (2*f).

[0094] In another implementation, the first device may also stop performing access authentication on the second device when the second distance is greater than or equal to the second threshold. That is, the first device may determine the authentication range of the second device, and when the second device is within the authentication range of the first device, continue to perform access authentication on the second device; when the second device is not within the authentication range of the first device, stop performing access authentication on the second device.

[0095] Alternatively, the first device may also stop performing access authentication on the second device when the difference between the first distance and the second distance is greater than or equal to the third threshold. That is, the first device may determine the location tampering of the second device. When the error between the first distance obtained by precise acoustic wave ranging and the second distance obtained by rough acoustic wave ranging is within the error range, it is determined that the current location of the second device is the location when the authentication range is determined, and its location has not been tampered with, and the access authentication of the second device continues; when the error between the first distance obtained by precise acoustic wave ranging and the second distance obtained by rough acoustic wave ranging is not within the error range, it is determined that the current location of the second device is not the location when the authentication range is determined, and its location has been tampered with, and the access to the second device is stopped.

[0096] Similarly, in one implementation, the second device may perform the following steps to perform precise acoustic ranging to determine a first distance between the first device and the second device:

[0097] Step C1: The second device may send a fifth sound wave signal.

[0098] Step C2: the second device may receive the fifth sound wave signal from the second device at the ninth moment, and receive the sixth sound wave signal from the first device at the tenth moment.

[0099] Step C3: When there are N consecutive identical synchronization sequences between the sixth sound wave signal and the fifth sound wave signal, the second device can determine the first distance between the first device and the second device according to the ninth moment, the tenth moment, the eleventh moment and the twelfth moment, wherein N is a positive integer greater than the first threshold, the eleventh moment is the moment when the first device receives the fifth sound wave signal from the second device, and the twelfth moment is the moment when the first device receives the sixth sound wave signal from the first device.

[0100] In a specific implementation, the second device can determine the starting positions of the third synchronization sequence and the fourth synchronization sequence according to the first rule. The third synchronization sequence is the first synchronization sequence in the fifth sound wave signal, and the fourth synchronization sequence is the first synchronization sequence in the sixth sound wave signal. The second device can determine the number of the fifth sampling sequence and the sixth sampling sequence according to the starting positions of the third synchronization sequence and the fourth synchronization sequence. The fifth sampling sequence is the synchronization sequence collected by the second device at the ninth moment according to the first sampling rate, and the sixth sampling sequence is the synchronization sequence collected by the second device at the tenth moment according to the first sampling rate. The second device can determine the first distance between the first device and the second device according to the number of the fifth sampling sequence, the sixth sampling sequence, the seventh sampling sequence, and the eighth sampling sequence. The seventh sampling sequence is the sampling sequence collected by the first device at the eleventh moment according to the first sampling rate, and the eighth sampling sequence is the sampling sequence collected by the first device at the twelfth moment according to the first sampling rate.

[0101] In another implementation, when executing step C1 to send the fifth sound wave signal, the second device may also perform the following steps to perform rough sound wave ranging to determine the second distance between the first device and the second device, and determine whether to send the fifth sound wave signal according to the second distance:

[0102] Step D1: the second device may send the seventh sound wave signal at the thirteenth moment, and receive the eighth sound wave signal from the first device at the fourteenth moment.

[0103] Step D2: When there are N consecutive identical synchronization sequences between the eighth sound wave signal and the seventh sound wave signal, the second device can determine the second distance between the first device and the second device according to the thirteenth moment, the fourteenth moment, the fifteenth moment, and the sixteenth moment. Wherein, N is a positive integer greater than the first threshold, the fifteenth moment is the moment when the first device receives the seventh sound wave signal from the second device, and the sixteenth moment is the moment when the first device sends the eighth sound wave signal.

[0104] Step D3: The second device may send a fifth sound wave signal when the second distance is less than the second threshold.

[0105] In another implementation, the second device may stop accessing the first device when the second distance is greater than or equal to a second threshold, or stop accessing the first device when the difference between the first distance and the second distance is greater than or equal to a third threshold.

[0106] In a specific implementation, the first device and the second device may perform the following steps to determine the second information:

[0107] Step E1: The first device and the second device determine an estimated value of a channel between the first device and the second device.

[0108] In a specific implementation, the first device sends a pilot sequence P = {p1, p2, ..., p L}, L = X + Y, Y = 10, X = 16, the pilot sequence received by the second device is y B , then the second device can calculate the estimated value of the channel between the first device and the second device as Among them, M H represents the conjugate transpose of the matrix M, (M H M) -1 Represents the matrix M H The inverse of M.

[0109]

[0110] The second device also sends a pilot sequence P = {p1, p2, ..., p L}, L = X + Y, Y = 10, X = 16, the pilot sequence received by the second device is y A , then the first device can calculate the estimated value of the channel between the first device and the second device as

[0111] Step E2: The first device and the second device determine the RSSI of the wireless channel between the first device and the second device.

[0112] In a specific implementation, the first device scans the WiFi channels, records the 10 service set identifiers (SSIDs) with the strongest signal strength, and records the corresponding WiFi RSSI A ={w A1 ,…,w A10 The second device also scans the WiFi channel and records the corresponding WiFi RSSI B ={w B1 ,…,w B10}.

[0113] Step E3: The first device and the second device determine the RSSI of the Bluetooth channel between the first device and the second device.

[0114] In a specific implementation, the first device scans the Bluetooth devices in the environment, records the 10 Bluetooth beacons with the strongest signal strength, and records the corresponding Bluetooth RSSI A ={bt A1 ,…,bt A10}. The second device also scans the Bluetooth devices in the environment and records the corresponding Bluetooth RSSI B ={bt B1 ,…,bt B10}.

[0115] S602: The first device encrypts the password information according to the first information and the second information to obtain binary large object information, and sends the binary large object information to the second device. Correspondingly, the second device receives the binary large object information from the first device, and decrypts the binary large object information according to the first information and the second information to obtain the password information.

[0116] In the embodiment of the present application, the password information may be randomly generated by the first device.

[0117] In a specific implementation, the first device may perform the following steps to encrypt the password information according to the first information and the second information to obtain binary large object (blob) information:

[0118] Step F1: The first device may quantize the first information and the second information to obtain a first sequence. The sequence is a binary sequence. For example, Quantify(PS A ), where Quantify(*) is the quantization function, “||” indicates cascade, F1 is the first distance between the first device and the second device determined by the first device, An estimated value of a channel between the first device and the second device determined by the first device, WiFi RSSI A RSSI of a wireless channel between the first device and the second device determined by the first device, BluetoothRSSI A An RSSI of a Bluetooth channel between the first device and the second device determined for the first device.

[0119] Step F2: The first device may perform error correction coding on the password information to obtain a second sequence. For example, encode(password), encode(*) is an error correction coding function, and password is a password randomly generated by the first device.

[0120] Step F3: The first device may perform an XOR operation on the first sequence and the second sequence to obtain binary large object (blob) information. For example,

[0121] In a specific implementation, the second device may perform the following steps to decrypt the binary large object information according to the first information and the second information to obtain the password information:

[0122] Step G1: The second device may quantize the first information and the second information to obtain a first sequence. The sequence is a binary sequence. For example, Quantify(PSB ),in, F2 is a first distance between the first device and the second device determined by the second device, An estimated value of the channel between the first device and the second device determined by the second device, WiFiRSSI B RSSI of the wireless channel between the first device and the second device determined by the second device, BluetoothRSSI B An RSSI of a Bluetooth channel between the first device and the second device determined for the second device.

[0123] Step G2: The second device may perform error correction code decoding processing on the binary large object information to obtain a third sequence. For example, decode(blob), decode(*) is an error correction code decoding function.

[0124] Step G3: The second device may perform an XOR operation on the first sequence and the third sequence to obtain password information. For example,

[0125] S603: The first device and the second device negotiate to generate a session key according to the password information.

[0126] In the embodiment of the present application, the session key can be used for the second device to access the first device, and the first device to authenticate the access of the second device. For example, the second device sends message 1 to the first device, and message 1 is obtained by the second device using the session key to encrypt message 2. The first device receives message 1 from the second device. When the first device can use the session key to decrypt message 1 to obtain message 2, the first device successfully authenticates the access of the second device, and the second device successfully accesses the first device.

[0127] In a specific implementation, the first device and the second device may perform the following steps: the first device and the second device negotiate to generate a session key according to the password information:

[0128] Step H1: The first device may send a first random number to the second device. Correspondingly, the second device may receive the first random number from the first device. For example, the first device selects the first random number SID A Sent to the second device, SID A The session identifier (SID) of a session between the first device and the second device determined by the first device.

[0129] Step H2: The second device may send the second random number and the first key material to the second device. Correspondingly, the first device may receive the second random number and the first key material from the second device. The second device may perform a hash process on the first random number, the second random number, the password information, the identifier of the first device, and the identifier of the second device to obtain the second key material, and perform a hash process on the second key material and the third random number to obtain the first key material. For example, the second device selects the second random number SID B and the third random number y, SID B The second device calculates the second key material T=H(SID A ||SID B ||password||A||B), A is the identifier of the first device, B is the identifier of the second device, and H(*) is a hash function (such as SHA256. The second device calculates the first key material f(T) y , f(*) is the hash to elliptic curve function. The second device converts the SID B and f(T) y Sent to the first device.

[0130] Step H3: The first device may send the third key material to the second device. Correspondingly, the second device may receive the third key material from the first device. The first device may perform hashing of the second key material and the fourth random number to an elliptic curve to obtain the third key material. For example, the first device calculates the second key material T. The first device selects the fourth random number x. The first device calculates the third key material f(T) x The first device will f(T) x Send to the second device.

[0131] Step H4: The first device and the second device may perform hash processing on the first random number, the second random number, the first key material, and the third key material to obtain a session key. For example, the first device and the second device calculate the session key K=H(SID A ||SID B ||f(T) xy ).

[0132] For ease of understanding, the following is a specific example. Figure 6-Figure 9 The access authentication method shown is further introduced.

[0133] See also Fig.10 , Fig.10 A schematic diagram of a process of another access authentication method provided in an embodiment of the present application, the process comprising:

[0134] 1. Rough acoustic ranging:

[0135] In this process, the first device and the second device turn on the sound wave sensing function, and perform rough sound wave ranging according to the sound wave signals received and sent to obtain the rough distance between the first device and the second device. For example, the first device obtains the rough distance Da, and the second device obtains the rough distance Db. The first device and the second device both determine whether the rough distance they obtain is within the authentication range. If it is within the authentication range, the authentication process continues. If it is not within the authentication range, the authentication process is terminated.

[0136] 2. Accurate acoustic ranging and channel perception:

[0137] In this process, the first device and the second device turn on the sound wave sensing function, and perform accurate sound wave ranging according to the sound wave signals sent and received to obtain the accurate distance between the first device and the second device. For example, the first device obtains the accurate distance Fa, and the second device obtains the accurate distance Fb. The first device and the second device both determine whether the error between the rough distance and the accurate distance obtained is within the error range. If it is within the error range, the authentication process continues. If it is not within the error range, the authentication process is terminated. The first device and the second device sense the state of the channel between the first device and the second device. For example, the first device obtains the estimated value Ea of the channel, the RSSI value Ra1 of the wireless channel, and the RSSI value Ra2 of the Bluetooth channel, and the second device obtains the estimated value Eb of the channel, the RSSI value Rb1 of the wireless channel, and the RSSI value Rb2 of the Bluetooth channel.

[0138] 3. Shared password:

[0139] In this process, the first device randomly generates a password password, encrypts the password password using the precise distance Fa, the estimated value of the channel Ea, the RSSI value Ra1 of the wireless channel, and the RSSI value Ra2 of the Bluetooth channel to obtain a binary large object blob, and sends the binary large object blob to the second device. The second device decrypts the binary large object blob using the precise distance Fb, the estimated value of the channel Eb, the RSSI value Rb1 of the wireless channel, and the RSSI value Rb2 of the Bluetooth channel to obtain the password password.

[0140] 4. Key negotiation:

[0141] In this process, the first device and the second device negotiate to generate a session key key according to the shared password password, and then establish a secure channel between the first device and the second device to improve the communication security between the first device and the second device.

[0142] See also Fig.11 , Fig.11A schematic diagram of a process flow of another access authentication method provided in an embodiment of the present application, the process comprising:

[0143] Step 1: The first device and the second device perform rough acoustic ranging to obtain a rough distance;

[0144] Step 2: The first device and the second device determine the authentication range based on the rough distance. If they are within the authentication range, the authentication process continues; if they are not within the authentication range, the authentication process is terminated.

[0145] Step 3: The first device and the second device perform accurate acoustic wave ranging to obtain an accurate distance;

[0146] Step 4: The first device and the second device determine the error range based on the rough distance and the precise distance. If the error range is within the error range, the authentication process continues; if the error range is not within the error range, the authentication process is terminated.

[0147] Step 5: The first device and the second device sense the state of the channel between the two devices, such as measuring the estimated value of the channel, the RSSI value of the wireless channel, and the RSSI value of the Bluetooth channel;

[0148] Step 6: The first device and the second device quantize the rough distance, the estimated value of the channel, the RSSI value of the wireless channel, and the RSSI value of the Bluetooth channel to obtain a binary sequence;

[0149] Step 7: The first device and the second device perform corresponding encryption and decryption processing on the password according to the binary sequence to share the password.

[0150] Step 8: The first device and the second device negotiate a session key based on the shared password, and establish a secure channel between the two devices based on the session key.

[0151] Based on the above embodiments, the present application also provides a computing device, such as Fig.12 As shown, it is a schematic diagram of the structure of a computing device provided in an embodiment of the present application, and the computing device 1200 includes: a bus 1202, a processor 1204, a memory 1206, and a communication interface 1208. The processor 1204, the memory 1206, and the communication interface 1208 communicate with each other through the bus 1202. The computing device 1200 can be an electronic device. It should be understood that the present application does not limit the number of processors and memories in the computing device 1200.

[0152] The bus 1202 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 The bus 1202 may include a path for transmitting information between various components of the computing device 1200 (eg, the memory 1206, the processor 1204, and the communication interface 1208).

[0153] The processor 1204 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0154] The memory 1206 may include a volatile memory, such as a random access memory (RAM). The memory 1206 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0155] The memory 1206 stores executable program codes, and the processor 1204 executes the executable program codes to implement the functions of the communication module and the processing module respectively, thereby implementing the access authentication method in the above method embodiment. That is, the memory 1206 stores instructions for executing the access authentication method in the above method embodiment.

[0156] The communication interface 1208 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1200 and other devices or communication networks.

[0157] Based on the above embodiments, the embodiments of the present application further provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device may be an electronic device.

[0158] like Fig.13 As shown, the computing device cluster includes at least one computing device 1200. The memory 1206 in one or more computing devices 1200 in the computing device cluster may store the same instructions for executing the access authentication method in the above method embodiment.

[0159] In some possible implementations, the memory 1206 of one or more computing devices 1200 in the computing device cluster may also store partial instructions for executing the access authentication method in the above method embodiment. In other words, the combination of one or more computing devices 1200 may jointly execute instructions for executing the access authentication method in the above method embodiment.

[0160] It is understandable that the memory 1206 in different computing devices 1200 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the electronic device. That is, the instructions stored in the memory 1206 in different computing devices 1200 can implement the functions of one or more modules in the communication module and the processing module.

[0161] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.14 A possible implementation is shown. Fig.14 As shown, two computing devices 1200A and 1200B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1206 in the computing device 1200A stores instructions for executing the functions of the communication module. At the same time, the memory 1206 in the computing device 1200B stores instructions for executing the functions of the processing module.

[0162] It should be understood that Fig.14 The functions of the computing device 1200A shown in FIG. 1200A may also be completed by multiple computing devices 1200. Similarly, the functions of the computing device 1200B may also be completed by multiple computing devices 1200.

[0163] Based on the above embodiments, the embodiments of the present application also provide a computer-readable storage medium, which can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc. The computer-readable storage medium includes instructions that instruct the computing device to execute the access authentication method in the above method embodiment.

[0164] Based on the above embodiments, the embodiments of the present application further provide a computer program product including instructions, and the computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the access authentication method in the above method embodiment.

[0165] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0166] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0169] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An access authentication method, characterized in that: Applied to a first device, the method includes: Determine first information and second information, wherein the first information is used to indicate a distance between the first device and the second device, and the second information is used to indicate a state of a channel between the first device and the second device; encrypting the password information according to the first information and the second information to obtain binary large object information, and sending the binary large object information to the second device, where the binary large object information is used by the second device to decrypt the password information according to the first information and the second information; A session key is generated through negotiation with the second device according to the password information. The session key is used for the second device to access the first device and for the first device to perform access authentication on the second device.

2. The method according to claim 1, characterized in that Determine the first information, including: Sending a first sound wave signal, wherein sampling points between adjacent synchronization sequences in the sound wave signal change according to a first rule; receiving the first sound wave signal from the first device at a first moment, and receiving the second sound wave signal from the second device at a second moment; When there are N consecutive identical synchronization sequences between the second sound wave signal and the first sound wave signal, the first distance between the first device and the second device is determined according to the first moment, the second moment, the third moment and the fourth moment, where N is a positive integer greater than a first threshold, the third moment is the moment when the second device receives the first sound wave signal from the first device, and the fourth moment is the moment when the second device receives the second sound wave signal from the second device.

3. The method according to claim 2, characterized in that Determining a first distance between the first device and the second device according to the first moment, the second moment, the third moment, and the fourth moment includes: According to the first rule, determining the starting positions of a first synchronization sequence and a second synchronization sequence, wherein the first synchronization sequence is the first synchronization sequence in the first sound wave signal, and the second synchronization sequence is the first synchronization sequence in the second sound wave signal; Determine the number of first sampling sequences and second sampling sequences according to the starting positions of the first synchronization sequence and the second synchronization sequence, the first sampling sequence is a synchronization sequence collected by the first device at the first moment according to the first sampling rate, and the second sampling sequence is a synchronization sequence collected by the first device at the second moment according to the first sampling rate; The first distance is determined according to the number of the first sampling sequence, the second sampling sequence, the third sampling sequence and the fourth sampling sequence, the third sampling sequence is a sampling sequence collected by the second device at the third moment according to the first sampling rate, and the fourth sampling sequence is a sampling sequence collected by the second device at the fourth moment according to the first sampling rate.

4. The method according to claim 2 or 3, characterized in that Sending a first sound wave signal, including: sending a third sound wave signal at a fifth moment, and receiving a fourth sound wave signal from the second device at a sixth moment; When there are N consecutive identical synchronization sequences between the fourth sound wave signal and the third sound wave signal, determining a second distance between the first device and the second device according to the fifth moment, the sixth moment, the seventh moment, and the eighth moment, where N is a positive integer greater than the first threshold, the seventh moment is the moment when the second device receives the third sound wave signal from the first device, and the eighth moment is the moment when the second device sends the fourth sound wave signal; When the second distance is less than a second threshold, the first sound wave signal is sent.

5. The method according to claim 4, characterized in that The method further comprises: When the second distance is greater than or equal to the second threshold, or when the difference between the first distance and the second distance is greater than or equal to a third threshold, stop performing access authentication on the second device.

6. The method according to claim 1, characterized in that The second information includes one or more of the following: an estimated value of a channel between the first device and the second device; a received signal strength indication of a wireless channel between the first device and the second device; A received signal strength indicator of a Bluetooth channel between the first device and the second device.

7. The method according to claim 1 or 6, characterized in that The password information is encrypted according to the first information and the second information to obtain binary large object information, including: Quantizing the first information and the second information to obtain a first sequence, where the sequence is a binary sequence; Performing error correction coding on the password information to obtain a second sequence; An XOR operation is performed on the first sequence and the second sequence to obtain the binary large object information.

8. The method according to claim 1, characterized in that The step of generating a session key through negotiation with the second device according to the password information includes: Sending a first random number to the second device; receiving a second random number and a first key material from the second device, where the first key material is obtained by performing a hashing process on the first random number, the second random number, the password information, the identifier of the first device, and the identifier of the second device to obtain the second key material, and then performing a hashing process on the second key material and a third random number using an elliptic curve; Performing hashing on the second key material and the fourth random number to obtain a third key material, and sending the third key material to the second device; The session key is obtained by performing hash processing on the first random number, the second random number, the first key material, and the third key material.

9. An access authentication method, characterized in that: Applied to the second device, the method includes: Determine first information and second information, wherein the first information is used to indicate a distance between the first device and the second device, and the second information is used to indicate a state of a channel between the first device and the second device; receiving binary large object information from the first device, and decrypting the binary large object information according to the first information and the second information to obtain password information; A session key is generated through negotiation with the first device according to the password information. The session key is used for the second device to access the first device and for the first device to perform access authentication on the second device.

10. The method according to claim 9, characterized in that Determine the first information, including: sending a fifth sound wave signal, wherein sampling points between adjacent synchronization sequences in the sound wave signal are changed according to a first rule; receiving the fifth sound wave signal from the second device at a ninth moment, and receiving the sixth sound wave signal from the first device at a tenth moment; When there are N consecutive identical synchronization sequences between the sixth sound wave signal and the fifth sound wave signal, the first distance between the first device and the second device is determined according to the ninth moment, the tenth moment, the eleventh moment and the twelfth moment, where N is a positive integer greater than a first threshold, the eleventh moment is the moment when the first device receives the fifth sound wave signal from the second device, and the twelfth moment is the moment when the first device receives the sixth sound wave signal from the first device.

11. The method according to claim 10, characterized in that Determining a first distance between the first device and the second device according to the ninth moment, the tenth moment, the eleventh moment, and the twelfth moment includes: According to the first rule, determining the starting positions of a third synchronization sequence and a fourth synchronization sequence, wherein the third synchronization sequence is the first synchronization sequence in the fifth sound wave signal, and the fourth synchronization sequence is the first synchronization sequence in the sixth sound wave signal; Determine, according to the starting positions of the third synchronization sequence and the fourth synchronization sequence, the number of a fifth sampling sequence and a sixth sampling sequence, the fifth sampling sequence being a synchronization sequence collected by the second device at the ninth moment according to the first sampling rate, and the sixth sampling sequence being a synchronization sequence collected by the second device at the tenth moment according to the first sampling rate; The first distance is determined according to the number of the fifth sampling sequence, the sixth sampling sequence, the seventh sampling sequence and the eighth sampling sequence, the seventh sampling sequence is a sampling sequence collected by the first device at the eleventh moment according to the first sampling rate, and the eighth sampling sequence is a sampling sequence collected by the first device at the twelfth moment according to the first sampling rate.

12. The method according to claim 10 or 11, characterized in that Send the fifth sound wave signal, including: sending a seventh sound wave signal at the thirteenth moment, and receiving an eighth sound wave signal from the first device at the fourteenth moment; When there are N consecutive identical synchronization sequences between the eighth sound wave signal and the seventh sound wave signal, determining a second distance between the first device and the second device according to the thirteenth moment, the fourteenth moment, the fifteenth moment, and the sixteenth moment, where N is a positive integer greater than the first threshold, the fifteenth moment is the moment when the first device receives the seventh sound wave signal from the second device, and the sixteenth moment is the moment when the first device sends the eighth sound wave signal; When the second distance is less than a second threshold, the fifth sound wave signal is sent.

13. The method according to claim 12, characterized in that The method further comprises: When the second distance is greater than or equal to the second threshold, or when the difference between the first distance and the second distance is greater than or equal to a third threshold, stop accessing the first device.

14. The method according to claim 9, characterized in that The second information includes one or more of the following: an estimated value of a channel between the first device and the second device; a received signal strength indication of a wireless channel between the first device and the second device; A received signal strength indicator of a Bluetooth channel between the first device and the second device.

15. The method according to claim 9 or 14, characterized in that Decrypting the binary large object information according to the first information and the second information to obtain password information includes: Quantizing the first information and the second information to obtain a first sequence, where the sequence is a binary sequence; Performing error correction code decoding processing on the binary large object information to obtain a third sequence; An XOR operation is performed on the first sequence and the third sequence to obtain the password information.

16. The method according to claim 9, characterized in that The step of generating a session key through negotiation with the first device according to the password information includes: receiving a first random number from the first device; Performing hash processing on the first random number, the second random number, the password information, the identifier of the first device, and the identifier of the second device to obtain a second key material, performing hashing on the second key material and the third random number to obtain a first key material using an elliptic curve, and sending the second random number and the first key material to the second device; receiving a third key material from the first device, where the third key material is obtained by the first device performing hashing of the second key material and a fourth random number to an elliptic curve; The session key is obtained by performing a hash operation on the first random number, the second random number, the first key material, and the third key material.

17. An access authentication device, characterized in that: The access authentication device comprises a processor and a memory, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the access authentication device executes the method according to any one of claims 1-8 or claims 9-16.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 8 or claims 9 to 16.

19. A computer program product, characterized in that The method comprises a computer program, which, when executed on a computer, causes the computer to execute the method according to any one of claims 1 to 8 or claims 9 to 16.

Images