Security authentication method, device, equipment, medium and program product

Abstract

The present invention relates to the technical field of wireless communications, and provides a security authentication method, apparatus, device, medium and program product, the method comprising: generating a security authentication factor, and configuring the security authentication factor at a sender and a receiver of a wireless communication system; the sender calculates a security authentication code in broadcasted message information by using the security authentication factor, and broadcasts the message information; and the receiver receives the message information and performs security authentication based on consistency comparison between the security authentication factor and the security authentication code. The method solves the problem of legality security authentication of an information broadcast source in a one-way wireless communication system, ensures that an information receiver does not further cause system risks due to attacks such as counterfeiting, tampering or replaying of information in a transmission process, and ensures that the received information content is safe, effective and available; and the conditions of error information induction, error command execution and the like are avoided, so that the system application security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a security authentication method, device, equipment, medium and program product. Background Art

[0002] Due to the openness of wireless communication systems, information content will face various attack threats during transmission, such as eavesdropping, counterfeiting, tampering and replay. It is necessary to protect the wireless communication transmission process, realize the security authentication of the broadcast information, and ensure the security, validity and availability of the information content.

[0003] The security authentication schemes commonly used in wireless communication systems include WEP authentication, PSK authentication, 802.1x authentication, and Portal authentication. The above methods are mainly for wireless systems with high bandwidth and two-way communication, such as wireless Internet. In addition, for low-bandwidth wireless communication systems, the security authentication scheme is usually designed in a tightly coupled manner in combination with the characteristics of the communication system of the system. In summary, the various existing security authentication schemes for wireless communication systems first require the system itself to have two-way communication capabilities, and secondly, the authentication interaction process is complex (or the security is not high), and it is not universal, especially not applicable to low-bandwidth wireless broadcast communication systems such as satellite navigation systems. Summary of the invention

[0004] The present invention is based on cryptographic ideas and combines application designs such as one-way hashing, reverse broadcasting, and delayed authentication to provide a security authentication method, device, equipment, medium, and program product. It focuses on solving the security authentication of the legitimacy of the source of information broadcasting in a one-way wireless communication system, ensuring that the information recipient will not further cause system risks due to attacks such as forgery, tampering, or replay of the information during transmission, ensuring that the received information content is safe, effective, and available, and will not be induced by erroneous information (such as navigation location information, etc.) or execute erroneous commands, thereby ensuring the security of system applications.

[0005] The present invention provides a security authentication method, comprising:

[0006] Generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system;

[0007] The sender calculates the security authentication code in the broadcasted message information using the security authentication factor, and broadcasts the message information;

[0008] The receiver receives the message information and performs security authentication based on a consistency comparison between the security authentication factor and the security authentication code.

[0009] In some embodiments, generating a security authentication factor includes:

[0010] A message digest value is repeatedly generated based on a one-way hash operation, and a security authentication factor is generated based on the message digest value.

[0011] In some embodiments, generating a security authentication factor specifically includes:

[0012] Based on the root factor KS, the message digest value is calculated through a one-way hash operation and rolled derivation is performed;

[0013] From the message digest value derived each time, data of a specific length that meets security requirements and is supported by channel transmission resources is intercepted as a new security authentication factor;

[0014] According to the use cycle of the one-way chain, scroll to the last round and obtain the corresponding security authentication stop factor KE.

[0015] In some embodiments, each recipient presets the security authentication factor KE before use.

[0016] In some embodiments, when broadcasting message information, the security authentication factors carried in the message information are broadcast in reverse order.

[0017] In some embodiments, when broadcasting message information, for each packet of message information, the security authentication factor used in calculating the security authentication code of each current packet of message information is broadcasted in a delayed manner in the next packet of message information.

[0018] In some embodiments, the receiving party performs security authentication based on the security authentication factor and the security authentication code, including:

[0019] The receiver extracts the security authentication factor K and the corresponding rolling round from the received message information;

[0020] The receiver performs a one-way hash operation on the extracted security authentication factor K to obtain a new security authentication factor K'; wherein the one-way hash operation round is the difference between the rolling round extracted from the message information and the rolling round corresponding to the local backward security authentication factor;

[0021] The security authentication factor K' is compared with the local backward security authentication factor. If they are consistent, it means that the identity of the sender of the message information is legal, and the local security authentication factor is updated to K and the corresponding rolling round, and then the subsequent authentication process is continued, otherwise the security authentication fails;

[0022] The extracted security authentication factor K is used to calculate the security authentication code of the previous packet of message information, and compared with the security authentication code in the previous packet of message information. If they are consistent, the security authentication passes, otherwise it fails.

[0023] The present invention also provides a security authentication device, comprising:

[0024] A first processing module, configured to generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system;

[0025] A second processing module, configured for the sender to calculate the security authentication code in the broadcasted message information by using the security authentication factor, and broadcast the message information;

[0026] The third processing module is used for the receiver to receive the message information and perform security authentication based on the consistency comparison between the security authentication factor and the security authentication code.

[0027] The present invention also provides an electronic device, comprising:

[0028] at least one processor; and a memory communicatively coupled to the at least one processor;

[0029] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor performs the method.

[0030] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.

[0031] The present invention also provides a computer program product, which, when called by a computer, enables the computer to execute the above method.

[0032] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0033] 1. The present invention can effectively solve the problem in a wireless broadcast communication system that the broadcast messages cannot be securely authenticated because the communicating parties cannot perform two-way interaction.

[0034] 2. The present invention can effectively simplify the security authentication process without requiring too many complicated interaction processes, which is conducive to large-scale promotion and application in low-bandwidth communication systems.

[0035] 3. The present invention can effectively solve the security risk problem caused by the leakage of the key itself when using the pre-shared key for security authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Flow chart of a security authentication method in an embodiment of the present invention.

[0037] Figure 2 A schematic diagram of the principle of generating a security authentication factor in an embodiment of the present invention.

[0038] Figure 3 The figure is a schematic diagram of the principle of the information content broadcasting strategy in the embodiment of the present invention.

[0039] Figure 4 Schematic diagram of the principle of the security authentication calculation process in an embodiment of the present invention.

[0040] Figure 5 Schematic diagram of the structure of the security authentication method in an embodiment of the present invention.

[0041] Figure 6 The figure is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0043] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Example

[0045] This embodiment proposes a security authentication method, which configures security authentication factors on the sender and receiver of the wireless communication system, calculates a security authentication code for the broadcasted information content, and performs a consistency comparison with the security authentication code carried in the message to achieve security authentication of the authenticity of the message source and the legality and validity of the information. Figure 1 As shown, specifically including:

[0046] Generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system;

[0047] The sender calculates the security authentication code in the broadcasted message information using the security authentication factor, and broadcasts the message information;

[0048] The receiver receives the message information and performs security authentication based on a consistency comparison between the security authentication factor and the security authentication code.

[0049] Different from other pre-shared key security authentication schemes, this embodiment has special security designs for security authentication factor generation, information content broadcasting strategy, and security authentication calculation process, which can ensure the authenticity and effectiveness of the security authentication process.

[0050] S1. Security authentication factor generation: Generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system.

[0051] Since the data transmission of the low-bandwidth wireless broadcast communication system relies on the one-way broadcast broadcasting mode of the air interface, the security authentication factor used by different receivers to calculate the security authentication code of the broadcasted message information is the same, so that the security authentication process can be completed correctly. In this embodiment, in order to ensure the security of the application process of the security authentication factor, a message digest value is generated in sequence based on a one-way hash operation (one-way chain rolling), and a security authentication factor is generated based on the message digest value. Utilizing the one-way irreversible characteristic of the one-way hash operation process, the security authentication factor is broadcasted in reverse order (reverse broadcast, that is, opposite to the direction of the one-way chain rolling, starting with the backward factor), which can ensure that when the current security authentication factor is known, it is impossible to deduce the security authentication factor used for the subsequent message information broadcast, that is, it is impossible to forge the sender to broadcast the information content.

[0052] like Figure 2 As shown, the generating of the security authentication factor specifically includes:

[0053] Based on the root factor KS, the message digest value is calculated through a one-way hash operation and rolled derivation is performed;

[0054] From the message digest value derived from each roll, data of a specific length that meets security requirements and is supported by channel transmission resources is intercepted as a new security authentication factor; the roll process is irreversible, that is, it can only be rolled in one direction. The backward factor can be obtained from the forward factor through multiple rolls, but the backward factor cannot be rolled back to obtain the forward factor;

[0055] According to the use cycle of the one-way chain, the last round is rolled to obtain the corresponding security authentication stop factor KE. It should be noted that after the security authentication factor is generated, each receiving party presets the security authentication stop factor KE before using it.

[0056] S2. Information content broadcasting strategy: The sender uses the security authentication factor to calculate the security authentication code in the broadcast message information, and broadcasts the message information.

[0057] Considering the security of wireless open channel transmission, the security authentication factor used in the calculation of the security authentication code (MAC) of the currently broadcast message information cannot be broadcast in the same message data frame as the current packet message information, so as to avoid being illegally eavesdropped and tampered with and then broadcast to the target receiver for deception. Figure 3 As shown, in this embodiment, when designing the broadcast of message information, for each packet of message information, the security authentication factor used in calculating the security authentication code (MAC) of the current message information is broadcasted in a delayed manner in the next packet of message information. After receiving the current packet of message information, the receiver stores it locally, and waits for the next packet of message information to broadcast the security authentication factor used in this packet. After the receiver passes the local verification, the message information of this packet can be used for application services. The delayed broadcast strategy can ensure that the security authentication factor is not broadcast when it is not used, is broadcast after it is in use, and becomes invalid after it is broadcast. It can not only ensure the security and availability of system user services, but also effectively avoid deception attacks.

[0058] S3, security authentication calculation process: the receiver receives the message information and performs security authentication based on the consistency comparison between the security authentication factor and the security authentication code.

[0059] For the security authentication factors of the one-way chain, they are used in reverse from the security authentication end factor KE to the security authentication root factor KS. Unused security authentication factors are not released in advance. The security authentication calculation process is as follows: Figure 4 As shown, the details are as follows:

[0060] The receiver extracts the security authentication factor K and the corresponding rolling round from the received message information;

[0061] The receiver performs a one-way hash operation on the extracted security authentication factor K to obtain a new security authentication factor K'; wherein the one-way hash operation round is the difference between the rolling round extracted from the message information and the rolling round corresponding to the local backward security authentication factor;

[0062] The security authentication factor K' is compared with the local backward security authentication factor. If they are consistent, it means that the identity of the sender of the message information is legal, and the local security authentication factor is updated to K and the corresponding rolling round, and then the subsequent authentication process is continued, otherwise the security authentication fails;

[0063] The extracted security authentication factor K is used to calculate the security authentication code of the previous packet of message information, and compared with the security authentication code in the previous packet of message information. If they are consistent, the security authentication passes, otherwise it fails. After the message information passes the security authentication, the data can be applied.

[0064] Based on the same technical concept, such as Figure 5 As shown, an embodiment of the present invention further provides a security authentication device, characterized in that it includes:

[0065] A first processing module, configured to generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system;

[0066] A second processing module, configured for the sender to calculate the security authentication code in the broadcasted message information by using the security authentication factor, and broadcast the message information;

[0067] The third processing module is used for the receiver to receive the message information and perform security authentication based on the consistency comparison between the security authentication factor and the security authentication code.

[0068] The working principle of each functional module in the above device can refer to the description of the method in the above embodiment, which will not be repeated here.

[0069] Based on the same technical concept, an embodiment of the present invention further provides an electronic device, which can implement the security authentication method process provided by the above embodiment of the present invention. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 6 As shown, the electronic device may include:

[0070] At least one processor, and a memory connected to the at least one processor. The specific connection medium between the processor and the memory is not limited in the embodiment of the present invention. Figure 6 The example in this article is that the processor and memory are connected through a bus. Figure 6 The connections between other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into address bus, data bus, control bus, etc. Figure 6 In the diagram, only one thick line is used, but this does not mean that there is only one bus or only one type of bus. Alternatively, a processor can also be called a controller, and there is no limitation on the name.

[0071] In an embodiment of the present invention, the memory stores instructions that can be executed by at least one processor, and the at least one processor can execute a security authentication method discussed above by executing the instructions stored in the memory. The processor can implement Figure 6 The functions of each module in the device shown.

[0072] Among them, the processor is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory and calling data stored in the memory, various functions of the device and processing data.

[0073] In an optional design, the processor may include one or more processing units, and the processor may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor. In some embodiments, the processor and the memory may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0074] The processor may be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a security authentication method disclosed in conjunction with an embodiment of the present invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0075] As a non-volatile computer-readable storage medium, the memory can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. The memory is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, used to store program instructions and / or data.

[0076] By designing and programming the processor, the code corresponding to a security authentication method introduced in the above embodiment can be fixed into the chip, so that the chip can perform the steps of a security authentication method in the above embodiment when running. How to design and program the processor is a technology well known to those skilled in the art and will not be described here.

[0077] Based on the same inventive concept, an embodiment of the present invention further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a security authentication method discussed above.

[0078] In some optional embodiments, the present invention also provides various aspects of a security authentication method that can also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a security authentication method according to various exemplary embodiments of the present invention described above in this specification.

[0079] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of a unit described above can be further divided into multiple units to be embodied. In addition, although the operation of the method of the present invention is described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution.

[0080] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0081] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0082] Program code for performing the operations of the present invention may be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user equipment, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0083] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0084] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security authentication method, characterized in that: include: Generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system; The sender calculates the security authentication code in the broadcasted message information using the security authentication factor, and broadcasts the message information; The receiver receives the message information and performs security authentication based on a consistency comparison between the security authentication factor and the security authentication code.

2. The security authentication method according to claim 1, characterized in that: The generating of the security authentication factor comprises: A message digest value is repeatedly generated based on a one-way hash operation, and a security authentication factor is generated based on the message digest value.

3. The security authentication method according to claim 2, characterized in that: The generating of the security authentication factor specifically includes: Based on the root factor KS, the message digest value is calculated through a one-way hash operation and rolled derivation is performed; From the message digest value derived each time, data of a specific length that meets security requirements and is supported by channel transmission resources is intercepted as a new security authentication factor; According to the use cycle of the one-way chain, scroll to the last round and obtain the corresponding security authentication stop factor KE.

4. The security authentication method according to claim 3, characterized in that: Each receiving party presets the security authentication factor KE before use.

5. The security authentication method according to claim 1, characterized in that: When broadcasting message information, the security authentication factors carried in the message information are broadcast in reverse order.

6. The security authentication method according to claim 1, characterized in that: When broadcasting message information, for each packet of message information, the security authentication factor used in calculating the security authentication code of the current message information is broadcasted in a delayed manner in the next packet of message information.

7. The security authentication method according to claim 1, characterized in that: The receiving party performs security authentication based on the security authentication factor and the security authentication code, including: The receiver extracts the security authentication factor K and the corresponding rolling round from the received message information; The receiver performs a one-way hash operation on the extracted security authentication factor K to obtain a new security authentication factor K'; wherein the one-way hash operation round is the difference between the rolling round extracted from the message information and the rolling round corresponding to the local backward security authentication factor; The security authentication factor K' is compared with the local backward security authentication factor. If they are consistent, it means that the identity of the sender of the message information is legal, and the local security authentication factor is updated to K and the corresponding rolling round, and then the subsequent authentication process is continued, otherwise the security authentication fails; The extracted security authentication factor K is used to calculate the security authentication code of the previous packet of message information, and compared with the security authentication code in the previous packet of message information. If they are consistent, the security authentication passes, otherwise it fails.

8. A security authentication device, characterized in that: include: A first processing module, configured to generate a security authentication factor and configure the security authentication factor at a sender and a receiver of a wireless communication system; A second processing module, configured for the sender to calculate the security authentication code in the broadcasted message information by using the security authentication factor, and broadcast the message information; The third processing module is used for the receiver to receive the message information and perform security authentication based on the consistency comparison between the security authentication factor and the security authentication code.

9. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method as described in any one of claims 1 to 7 by executing the instructions stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that When the computer program product is called by a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

Images