Wireless authentication method and device for resisting replay attack

Abstract

The invention discloses an anti-replay-attack wireless authentication method and device, and the method is realized through an authentication end and a system end, and the method comprises the steps: carrying out the mutual verification of equipment through the authentication end and the system end, and obtaining the verification information of the equipment; the equipment verification information comprises system equipment verification information and authentication equipment verification information; each of the authentication end and the system end comprises a security information area; the security information area comprises an anti-counterfeiting information packet and a key data packet; system equipment lists and equipment identifiers are stored in the authentication end and the system end; based on the equipment verification information, the authentication end and the system end carry out identity verification processing; the authentication end sends the information to be sent to the system end; and the authentication end and the system end finish the communication process. Aiming at the problem of how to defend the replay attack in the wireless communication network, the problem of resisting the replay attack is effectively solved by establishing a dual verification system of equipment verification and identity verification.

Description

Technical Field

[0001] The present invention relates to the fields of communication and information security, and particularly to a wireless authentication method and device against replay attacks. Background Art

[0002] With the rapid development of wireless communication technologies, the security of wireless networks has been increasingly emphasized. As an effective attack pattern, replay attacks have been widely applied. Replay attacks are mainly used in the identity authentication process to undermine the correctness of authentication. Anti-replay attack refers to a security measure to prevent an attacker from re-sending previously captured data packets to deceive the system. In wireless communication networks, how to resist replay attacks has always been a research hotspot and difficulty in the field of network security. Summary of the Invention

[0003] The present invention mainly solves the problem of how to resist replay attacks in wireless communication networks, and discloses a wireless authentication method and device against replay attacks.

[0004] In the first aspect of the embodiments of the present application, a wireless authentication method against replay attacks is disclosed, which is implemented through an authentication end and a system end, and includes: S1. The authentication end and the system end perform mutual device verification to obtain device verification information; the device verification information includes system device verification information and authentication device verification information; both the authentication end and the system end include a security information area; the security information area includes an anti-counterfeiting information packet and a key data packet; both the authentication end and the system end store a system device list and a device identifier; S2. Based on the device verification information, the authentication end and the system end perform identity authentication processing; S3. The authentication end sends the information to be sent to the system end; S4. The authentication end and the system end end the communication process.

[0005] The authentication end and the system end perform mutual device verification to obtain device verification information, including: S11. The authentication end sends a preset symbol sequence to the system end; S12. The system end generates a secret key S, encrypts the received symbol sequence with the secret key S to obtain an encrypted sequence a, and sends the secret key S and the encrypted sequence a to the authentication end; S13. The authentication end encrypts the stored device identifier with the received secret key S to obtain an encrypted device identifier idN; S14. The authentication end decrypts the received encrypted sequence a with the received secret key S to obtain a decrypted sequence b, and performs a consistency discrimination process on the preset symbol sequence and the decrypted sequence b to obtain a consistency discrimination result; If the consistency discrimination result is passed, send the encrypted device identifier idN to the system side and execute S15; if the consistency discrimination result is not passed, stop the communication process between the authentication side and the system side; S15. The system side uses the stored authentication device list to determine whether the received encrypted device identifier idN is legal, and obtains the authentication device verification information; if the authentication device verification information is legal, the system side sends the security system device identifier IDN to the authentication side; if the authentication device verification information is not legal, stop the communication process between the authentication side and the system side; S16. The authentication side uses the stored system device list to determine whether the received security system device identifier IDN is legal, and obtains the system device verification information; If the system device verification information is legal, use the system device verification information and the authentication device verification information to construct the device verification information and execute S2; If the system device verification information is not legal, stop the communication process between the authentication side and the system side, and add the security system device identifier IDN to the anti-counterfeiting information packet Q in the security information area of the authentication side.

[0006] The consistency discrimination process between the preset symbol sequence and the decryption sequence b includes: Represent the preset symbol sequence as c; Perform consistency calculation processing on sequence c and sequence b to obtain a consistency value; The expression of the consistency calculation processing is: , where, is the consistency value, N is the length of sequence b, and are the i-th elements of sequence b and sequence c respectively, is the preset deviation value; Judge whether the consistency value is greater than the set consistency threshold. If it is greater, determine that the consistency discrimination result is not passed; if it is less than or equal to, determine that the consistency discrimination result is passed.

[0007] The identity verification process between the authentication side and the system side based on the device verification information includes: Judge whether both the system device verification information and the authentication device verification information in the device verification information are legal, and obtain the verification result information; If the verification result information is all legal, the authentication side and the system side perform identity verification processing; If the verification result information is not all legal, execute S1.

[0008] The authentication terminal and the system terminal perform identity authentication processing, including: S21. The authentication terminal sends the anti-counterfeiting information packet Q and the key data packet P stored in the security information area to the system terminal; S22. The system terminal reads the key data packet P and determines whether the key data packet P is consistent with the key data packet stored in the security information area of the system terminal to obtain a first verification result. If the first verification result is consistent, execute S23; if the first verification result is inconsistent, send an illegal identity warning message and stop the communication process between the authentication terminal and the system terminal; S23. The system terminal reads the anti-counterfeiting information packet Q and determines whether the anti-counterfeiting information packet Q is an empty packet to obtain a second verification result. If the second verification result is yes, the authentication terminal and the system terminal complete the identity authentication processing and execute S3; if the second verification result is no, send an illegal identity warning message and stop the communication process between the authentication terminal and the system terminal.

[0009] The authentication terminal sends the information to be sent to the system terminal, including: S31. Perform statistical processing on the information to be sent to obtain a set of statistical feature values; the set of statistical feature values includes a median value, a mode value, a range value, and a variance value; S32. Use the coding dimension model to perform calculation processing on the length of the information to be sent and the set of statistical feature values to obtain a matrix row dimension value and a matrix column dimension value; S33. Based on the matrix row dimension value and the matrix column dimension value, use the information to be sent to construct an information matrix; S34. Use a preset coding matrix to perform coding processing on the information matrix to obtain a matrix to be sent; S35. Perform splicing processing on all row vectors of the matrix to be sent to obtain a sending vector; S36. Send the sending vector to the system terminal.

[0010] The authentication terminal and the system terminal end the communication process, including: After the authentication terminal sends all the information to be sent to the system terminal, the system terminal generates a symbol sequence for executing the next wireless authentication method and sends the symbol sequence to the authentication terminal; After receiving the symbol sequence, the authentication terminal stores it.

[0011] In the second aspect of the embodiments of the present application, a wireless authentication device against replay attacks is disclosed. The device includes: A memory storing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory and executes the wireless authentication method for resisting replay attacks.

[0012] In a third aspect of the embodiments of the present application, a computer-readable storage medium is disclosed. The computer-readable storage medium stores computer instructions, which are used to execute the wireless authentication method for resisting replay attacks when called by a computer.

[0013] In a fourth aspect of the embodiments of the present application, an information data processing terminal is disclosed. The information data processing terminal is used to implement the wireless authentication method for resisting replay attacks.

[0014] The beneficial effects of the present invention are as follows: In view of the problem of how to resist replay attacks in a wireless communication network, the present invention discloses a wireless authentication method for resisting replay attacks. By establishing a two-fold verification system of device verification and identity verification, the problem of resisting replay attacks is effectively solved.

[0015] Traditional replay attacks are mainly achieved by forging device information. The present invention first generates a secret key S at the system end, encrypts the received symbol sequence using the secret key S, and the authentication end uses the received secret key S to encrypt the stored device identifier. By mutually verifying the two types of device information, the effectiveness of verification and the accuracy of identifying replay attacks are effectively improved.

[0016] The present invention specifically designs a consistency discrimination processing algorithm for the discrimination process of a preset symbol sequence and a decryption sequence b. By effectively using multi-source information, the accuracy of the consistency discrimination result is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of the implementation of the method of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0018] To better understand the content of the present invention, an embodiment is given here.

[0019] Figure 1 It is a flowchart of the implementation of the method of the present invention.

[0020] In a first aspect of the embodiments of the present application, a wireless authentication method for resisting replay attacks is disclosed, which is implemented by an authentication end and a system end, and includes: S1. The authentication end and the system end perform mutual device verification to obtain device verification information; the device verification information includes system device verification information and authentication device verification information; both the authentication end and the system end include a security information area; the security information area includes an anti-counterfeiting information packet and a key data packet; both the authentication end and the system end store a system device list. S2. Based on the device verification information, the authentication end and the system end perform identity verification processing; S3. The authentication end sends the information to be sent to the system end; S4. The authentication end and the system end end the communication process.

[0021] The authentication end and the system end perform mutual device verification to obtain device verification information, including: S11. The authentication end sends a preset symbol sequence to the system end; the preset symbol sequence can be a binary sequence corresponding to 32 / 64 / 128, or a symbol sequence stored in the authentication end; S12. The system end generates a secret key S, uses the secret key S to encrypt the received symbol sequence to obtain an encrypted sequence a, and sends the secret key S and the encrypted sequence a to the authentication end; S13. The authentication end uses the received secret key S to encrypt the stored device identifier to obtain an encrypted device identifier idN; S14. The authentication end uses the received secret key S to decrypt the received encrypted sequence a to obtain a decrypted sequence b, performs a consistency discrimination process on the preset symbol sequence and the decrypted sequence b to obtain a consistency discrimination result; if the consistency discrimination result is passed, the encrypted device identifier idN is sent to the system end, and S15 is executed; if the consistency discrimination result is not passed, the communication process between the authentication end and the system end is stopped; S15. The system end uses the stored authentication device list to determine whether the received encrypted device identifier idN is legal to obtain authentication device verification information; if the authentication device verification information is legal, the system end sends a secure system device identifier IDN to the authentication end; if the authentication device verification information is not legal, the communication process between the authentication end and the system end is stopped; S16. The authentication end uses the stored system device list to determine whether the received secure system device identifier IDN is legal to obtain system device verification information; If the system device verification information is legal, use the system device verification information and the authentication device verification information to construct device verification information and execute S2; If the system device verification information is not legal, stop the communication process between the authentication end and the system end, and add the secure system device identifier IDN to the anti-counterfeiting information package Q in the security information area of the authentication end; The system end uses the stored authentication device list to determine whether the received encrypted device identifier idN is legal, that is, to determine whether the received encrypted device identifier idN is in the stored authentication device list. If it is, it is legal; if not, it is not legal; The authentication end uses the stored system device list to determine whether the received security system device identifier IDN is legal, that is, to determine whether the security system device identifier IDN is in the stored system device list. If it is, it is legal; if not, it is illegal; The preset symbol sequence and the decryption sequence b are subjected to a consistency discrimination process, including: Represent the preset symbol sequence as c; Perform a consistency calculation process on sequence c and sequence b to obtain a consistency value; The expression of the consistency calculation process is: , where, is the consistency value, N is the length of sequence b, and are the i-th elements of sequence b and sequence c respectively, is the preset deviation value; Judge whether the consistency value is greater than the set consistency threshold. If it is greater, determine that the consistency discrimination result fails; if it is less than or equal to, determine that the consistency discrimination result passes.

[0022] The expression of the consistency calculation process comprehensively considers the differences between the corresponding elements of sequence b and sequence c. By calculating the differences between the corresponding elements at each position and combining the deviation of the exponential function, the consistency of the two sequences can be accurately measured. In wireless authentication, it can more accurately judge whether the received sequence is the correct decryption result of the original transmitted sequence, thereby improving the accuracy of authentication and reducing the misjudgment rate. In this expression, absolute value and division operations are used, which makes it more robust to noise and interference. In a wireless communication environment, signals are vulnerable to interference, and this robustness can ensure that even if there is a certain degree of interference in the sequence, the consistency of the sequence can be accurately discriminated, ensuring the reliability of the authentication process.

[0023] In the above expression, the preset deviation value ε can be adjusted according to the actual communication environment and security requirements. In an environment with large interference, the value of ε can be appropriately increased to tolerate a certain degree of difference; while in a scenario with extremely high security requirements, the value of ε can be decreased to increase the strictness of consistency discrimination, so that the authentication system has better dynamic adaptability.

[0024] Based on the device verification information, the authentication end and the system end perform an identity verification process, including: Judge whether both the system device verification information and the authentication device verification information in the device verification information are legal to obtain verification result information; If the verification result information is all legal, the authentication end and the system end perform an identity verification process; If the verification result information is not all legal, execute S1; The authentication end and the system end perform identity verification processing, including: S21, the authentication end sends the anti-counterfeiting information packet Q and the key data packet P stored in the security information area to the system end; S22, the system end reads the key data packet P, determines whether the key data packet P is consistent with the key data packet stored in the security information area of the system end, and obtains a first verification result; if the first verification result is consistent, execute S23; if the first verification result is inconsistent, send an illegal identity warning message and stop the communication process between the authentication end and the system end; S23, the system end reads the anti-counterfeiting information packet Q, determines whether the anti-counterfeiting information packet Q is an empty packet, and obtains a second verification result; if the second verification result is yes, the authentication end and the system end complete the identity verification processing and execute S3; if the second verification result is no, send an illegal identity warning message and stop the communication process between the authentication end and the system end; The authentication end sends the information to be sent to the system end, including: Perform statistical processing on the information to be sent to obtain a set of statistical feature values; the set of statistical feature values includes median value, mode value, range value, and variance value; Use the coding dimension model to perform calculation processing on the length of the information to be sent and the set of statistical feature values to obtain a matrix row dimension value and a matrix column dimension value; Based on the matrix row dimension value and the matrix column dimension value, use the information to be sent to construct an information matrix; Use a preset coding matrix to perform coding processing on the information matrix to obtain a matrix to be sent; Perform splicing processing on all row vectors of the matrix to be sent to obtain a sending vector; Send the sending vector to the system end; The authentication end and the system end end the communication process, including: After the authentication end sends all the information to be sent to the system end, the system end generates a symbol sequence for the next wireless authentication method and sends the symbol sequence to the authentication end; After the authentication end receives the symbol sequence, it stores it and uses the symbol sequence as the symbol sequence preset for the authentication end to send to the system end in subsequent wireless authentication; The expression of the coding processing is: , , Among them, is the Gaussian function, and are the time-domain transformation length and the frequency-domain transformation length respectively, A is the information matrix, P is the matrix to be transmitted, is the element in the k-th row and z-th column of the encoding matrix, and G is the encoding matrix.

[0025] The expression of the encoding process realizes efficient information encoding by means of the Gaussian function and the information matrix A. The Gaussian function has good locality and decay characteristics, can effectively compress and encode information within a limited bandwidth, reduce the amount of data transmitted, and improve the information transmission efficiency.

[0026] The expression of the encoding process includes the time-domain transformation length and the frequency-domain transformation length, which enables the encoding process to be flexibly adjusted in the time domain and the frequency domain; the encoding parameters can be optimized according to different wireless communication channel characteristics and bandwidth limitations to adapt to different communication environments and improve the performance and adaptability of the system. The design of the encoding matrix G combines the transformations in the time domain and the frequency domain and includes the operation of the exponential function, increasing the complexity of the encoding. This makes it difficult for attackers to crack the encoding rules, improves the confidentiality of information during transmission, and effectively resists replay attacks and other forms of information theft.

[0027] Encoding the information matrix by using a preset encoding matrix to obtain a matrix to be transmitted includes: Performing cross-correlation calculation on all row vectors of the information matrix to obtain a cross-correlation matrix; the element in the i-th row and j-th column of the cross-correlation matrix is the cross-correlation value between the i-th row vector and the j-th row vector of the information matrix; Performing singular value decomposition on the cross-correlation matrix to obtain an intermediate matrix; Multiplying the preset encoding matrix by the intermediate matrix to obtain an updated encoding matrix; Multiplying the updated encoding matrix by the information matrix to obtain a matrix to be transmitted.

[0028] The expression of the singular value decomposition is where is the intermediate matrix and R is the cross-correlation matrix.

[0029] The expression of the encoding dimension model is: , , where is the median value, is the mode value, is the variance value, is the range value, N is the length of the information to be transmitted, and are the matrix row dimension value and the matrix column dimension value respectively, denotes rounding up, denotes rounding down.

[0030] Based on the matrix row dimension value and the matrix column dimension value, using the information to be sent, an information matrix is constructed, including: The information to be sent is evenly divided into segmented vectors with a length equal to the matrix row dimension value; Using all the segmented vectors as row vectors, an information matrix is constructed; The authentication end is a terminal that needs to perform security authentication and communicate with the system end, which can be a mobile phone, a computer, an embedded system, etc.

[0031] The system end is a server that connects all the authentication ends and is installed with a security system; In the second aspect of the embodiments of the present application, a wireless authentication device against replay attacks is disclosed. The device includes: A memory storing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the wireless authentication method against replay attacks.

[0032] In the third aspect of the embodiments of the present application, a computer-readable storage medium is disclosed. The computer-readable storage medium stores computer instructions, which are used to execute the wireless authentication method against replay attacks when called by a computer.

[0033] In the fourth aspect of the embodiments of the present application, an information data processing terminal is disclosed. The information data processing terminal is used to implement the wireless authentication method against replay attacks.

[0034] The above are only the embodiments of the present application and are not used to limit the present application. For those skilled in the art, various changes and modifications can be made to the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims

1. A wireless authentication method against replay attacks, characterized in that It is implemented through an authentication end and a system end, including: S1. The authentication end and the system end perform mutual device verification to obtain device verification information; the device verification information includes system device verification information and authentication device verification information; both the authentication end and the system end include a security information area; the security information area includes an anti-counterfeiting information packet and a key data packet; both the authentication end and the system end store a system device list and a device identifier; The authentication end and the system end perform mutual device verification to obtain device verification information, including: S101. The authentication end sends a preset symbol sequence to the system end for consistency discrimination processing to obtain a consistency discrimination result; if the consistency discrimination result is passed, the encrypted device identifier idN is sent to the system end, and S102 is executed; if the consistency discrimination result is not passed, the communication process between the authentication end and the system end is stopped; S102. The authentication end uses the stored authentication device list to obtain system device verification information; based on the system device verification information, device verification information is obtained; S2. Based on the device verification information, the authentication end and the system end perform identity verification processing; S3. The authentication end sends the information to be sent to the system end; S4. The authentication end and the system end end the communication process.

2. The wireless authentication method against replay attack according to claim 1, wherein The authentication end and the system end perform mutual device verification to obtain device verification information, including: S11. The authentication end sends a preset symbol sequence to the system end; S12. The system end generates a secret key S, uses the secret key S to encrypt the received symbol sequence to obtain an encrypted sequence a, and sends the secret key S and the encrypted sequence a to the authentication end; S13. The authentication end uses the received secret key S to encrypt the stored device identifier to obtain an encrypted device identifier idN; S14. The authentication end uses the received secret key S to decrypt the received encrypted sequence a to obtain a decrypted sequence b, and performs consistency discrimination processing on the preset symbol sequence and the decrypted sequence b to obtain a consistency discrimination result; If the consistency discrimination result is passed, the encrypted device identifier idN is sent to the system end, and S15 is executed; if the consistency discrimination result is not passed, the communication process between the authentication end and the system end is stopped; S15. The system end uses the stored authentication device list to determine whether the received encrypted device identifier idN is legal to obtain authentication device verification information; if the authentication device verification information is legal, the system end sends a secure system device identifier IDN to the authentication end; if the authentication device verification information is not legal, the communication process between the authentication end and the system end is stopped; S16. The authentication end uses the stored system device list to determine whether the received secure system device identifier IDN is legal to obtain system device verification information; If the system device verification information is legal, device verification information is constructed using the system device verification information and the authentication device verification information, and S2 is executed; If the system device verification information is not legal, the communication process between the authentication end and the system end is stopped, and in the security information area of the authentication end, the secure system device identifier IDN is added to the anti-counterfeiting information packet Q.

3. The wireless authentication method against replay attack according to claim 2, wherein Performing consistency discrimination processing on the preset symbol sequence and the decryption sequence b includes: Representing the preset symbol sequence as c; Performing consistency calculation processing on sequence c and sequence b to obtain a consistency value; The expression of the consistency calculation processing is: ， Among them, is the consistent value, N is the length of sequence b, and are the i-th elements of sequence b and sequence c respectively, is the preset deviation value; Judging whether the consistency value is greater than the set consistency threshold. If it is greater, determining that the consistency discrimination result fails; if it is less than or equal to, determining that the consistency discrimination result passes.

4. The wireless authentication method against replay attacks according to claim 1, characterized in that Based on the device verification information, the authentication end and the system end perform identity verification processing, including: Judging whether both the system device verification information and the authentication device verification information in the device verification information are legal to obtain verification result information; If the verification result information is all legal, the authentication end and the system end perform identity verification processing; If the verification result information is not all legal, execute S1.

5. The wireless authentication method against replay attack according to claim 4, characterized in that, The authentication end and the system end perform identity verification processing, including: S21, the authentication end sends the anti-counterfeiting information packet Q and the key data packet P stored in the security information area to the system end; S22, the system end reads the key data packet P and judges whether the key data packet P is consistent with the key data packet stored in the security information area of the system end to obtain a first verification result; if the first verification result is consistent, execute S23; if the first verification result is inconsistent, send an illegal identity warning message and stop the communication process between the authentication end and the system end; S23, the system end reads the anti-counterfeiting information packet Q and judges whether the anti-counterfeiting information packet Q is an empty packet to obtain a second verification result; if the second verification result is yes, the authentication end and the system end complete the identity verification processing and execute S3; if the second verification result is no, send an illegal identity warning message and stop the communication process between the authentication end and the system end.

6. The wireless authentication method against replay attack according to claim 1, characterized in that, The authentication end sends the information to be sent to the system end, including: S31, performing statistical processing on the information to be sent to obtain a set of statistical feature values; the set of statistical feature values includes a median value, a mode value, a range value, and a variance value; S32, using the coding dimension model to perform calculation processing on the length of the information to be sent and the set of statistical feature values to obtain a matrix row dimension value and a matrix column dimension value; The expression of the coding dimension model is: ， ， Among them, is the median value, is the mode value, is the variance value, is the range value, N is the length of the information to be sent, and are the matrix row dimension value and the matrix column dimension value respectively, represents rounding up, represents rounding down; S33, based on the matrix row dimension value and the matrix column dimension value, using the information to be sent to construct an information matrix; S34, using a preset coding matrix to perform coding processing on the information matrix to obtain a matrix to be sent; S35, performing splicing processing on all row vectors of the matrix to be sent to obtain a sending vector; S36, sending the sending vector to the system end.

7. The wireless authentication method against replay attack according to claim 1, wherein The authentication end and the system end end the communication process, including: After the authentication end sends all the information to be sent to the system end, the system end generates a symbol sequence for executing the next wireless authentication method and sends the symbol sequence to the authentication end; After receiving the symbol sequence, the authentication end stores it.

8. A wireless authentication device against replay attacks, characterized in that The device includes: A memory storing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory and executes the wireless authentication method against replay attacks as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions which, when called by a computer, are used to execute the wireless authentication method against replay attacks as described in any one of claims 1 to 7.

10. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the wireless authentication method against replay attacks as described in any one of claims 1 to 7.

Images