Mobile user identity wireless authentication method based on NFC

Abstract

The invention discloses a mobile user identity wireless authentication method based on NFC (Near Field Communication). The method comprises the following steps: S1, equipment opens and loads authentication information and password resources; a complete set of authentication information and password resources are written into an encryption and decryption unit and an identity bracelet of the handheld terminal through an initialization system, wherein the authentication information and password resources comprise an identity serial number, an identity authentication code and components thereof, and a master key and corresponding components thereof; s2, safely transmitting a master key component, and completing startup authentication; when the equipment is used, identity information and the master key component are transmitted through a wireless channel, and after an encryption and decryption unit of the handheld terminal obtains the master key component and verifies the master key component, startup authentication is completed; wherein in the transmission process of the identity information and the master key component, integrity verification is carried out through a Hash algorithm, covering protection is carried out through the identity authentication code component, and secure transmission and forward security protection are achieved. The safety and availability of the handheld terminal are greatly improved, and the risk hidden danger after the handheld terminal is out of control is reduced.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular relates to a method for wireless authentication of mobile user identity based on NFC. Background Art

[0002] With advantages such as fast connection and ease of use, trunked mobile communication systems effectively meet the communication, dispatch, and command needs of various fields. This is especially true for military and armed police forces carrying out missions such as major event security, counter-terrorism and stability maintenance, and disaster relief. With its flexible and versatile networking and single-call, multi-functional approach, trunked mobile communication systems significantly improve mission efficiency. Because the information transmitted in these scenarios is sensitive, protection is often achieved by integrating software or hardware encryption and decryption units (collectively, "encryption and decryption units") within handheld terminals.

[0003] However, due to the decentralized deployment and flexible application characteristics of handheld terminals when in use, there is a certain risk of loss or loss of control, which leads to a certain risk of loss of control of the cryptographic resources in the encryption and decryption units of the handheld terminals.

[0004] Traditional methods often combine local authentication via a power-on stick with online activation to achieve separate storage of top-level keys, thereby reducing the level of control and mitigating security risks associated with uncontrolled cryptographic resources. However, for handheld devices, limited size makes it difficult to provide a power-on authentication interface. Furthermore, due to the narrow bandwidth of cluster channels, online activation is also not possible. Therefore, there is currently no effective power-on authentication method for handheld terminals to address the risks associated with uncontrolled access. Summary of the Invention

[0005] The purpose of this application is to overcome the problems of the existing technology and disclose a mobile user identity wireless authentication method based on NFC. Through the mobile user identity wireless authentication technology based on NFC, an NFC identity bracelet is distributed on the user side, and the top-level key component is stored in the identity bracelet. The NFC wireless channel is used to establish an authentication information transmission channel between the identity bracelet and the handheld terminal, and the top-level key component is securely transmitted wirelessly, which not only meets the requirements of separate storage of the top-level key, but also does not require the handheld terminal to provide an additional power-on authentication interface, thereby realizing power-on authentication and user identity confirmation of the handheld terminal, greatly improving the security and availability of the handheld terminal, and reducing the risk of it being out of control.

[0006] The purpose of this application is achieved through the following technical solutions:

[0007] A method for wireless authentication of a mobile user identity based on NFC, the method comprising:

[0008] S1: The device is activated and authentication information and password resources are loaded;

[0009] Write a complete set of authentication information and password resources into the encryption and decryption unit of the handheld terminal and the identity bracelet through the initialization system, including the identity serial number, identity authentication code and its components, master key and its corresponding components;

[0010] S2: The master key component is securely transmitted to complete the power-on authentication;

[0011] When the device is in use, the identity information and master key components are transmitted through the wireless channel. After the encryption and decryption unit of the handheld terminal obtains the master key components and verifies them, the power-on authentication is completed;

[0012] Among them, during the transmission process of identity information and master key components, integrity verification is performed through the Hash algorithm, and masking protection is performed through the identity authentication code component to achieve secure transmission and forward security protection.

[0013] According to a preferred embodiment, step S1 includes:

[0014] When the device is activated, the initialization system generates resource and configuration information for the handheld terminal and identity bracelet, and sends it to the programmer of each device according to the plan;

[0015] The identity bracelet writer writes the identity serial number SN, identity authentication code PWD, check value Hash (PWD2), and master key component MK2 into the identity bracelet to complete the activation of the identity bracelet;

[0016] The handheld terminal writer writes the identity serial number SN, identity authentication code component PWD1, identity authentication code component PWD2, and master key component MK1 into the encryption and decryption unit of the handheld terminal to activate the encryption and decryption unit of the handheld terminal.

[0017] According to a preferred embodiment, step S2 includes:

[0018] S21: After the handheld terminal and the identity bracelet are powered on and initialized, the handheld terminal actively queries the identity bracelet for the identity number periodically until it receives a response from the identity bracelet;

[0019] S22: The handheld terminal checks the identity serial number SN obtained from the identity bracelet with its own identity serial number SN. If they are consistent, it means "identity matching is successful"; then it reads the identity authentication code component PWD1 stored in itself and sends it to the identity bracelet through the wireless channel; if they are inconsistent, it means "identity matching fails" and the SN is obtained from the identity bracelet again;

[0020] S23: The identity bracelet performs XOR on the received identity authentication code component PWD1 and the locally stored identity authentication code PWD to obtain the identity authentication code component PWD2, and calculates its check value Hash(PWD2).

[0021] Compare Hash (PWD2) with the Hash (PWD2) stored locally on the identity bracelet. If they are consistent, the authentication is successful and the response is "Identity authentication successful"; if they are inconsistent, the authentication fails and the response is "Identity authentication failed", and the process is terminated.

[0022] According to a preferred embodiment, in step S23 , the calculation process of the check value Hash(PWD2) includes: Hash(PWD2)=SM3_Hash(PWD2).

[0023] According to a preferred embodiment, step S2 further includes:

[0024] S24: After receiving the identity authentication success message from the identity bracelet, the handheld terminal sends a request to the identity bracelet to read the master key component MK2;

[0025] S25: The identity bracelet reads the master key component MK2 and its check value Hash(MK2) stored in itself, uses the identity authentication code component PWD2 obtained in step S23 to mask and protect it, obtains data DATA1, and sends it to the handheld terminal;

[0026] S26: The handheld terminal masks and verifies the received master key component MK2. If the verification is successful, a new set of configuration information is randomly generated, including: SN, MK1, MK2, PWD1, PWD2, and PWD2 is used. 旧 That is, after masking the identity authentication code component PWD2 obtained in step S23, data DATA2 is obtained and sent to the authentication bracelet for data update;

[0027] S27: After receiving the updated data, the identity bracelet performs an integrity check. If successful, the local information is updated and a response "update successful" is sent to the handheld terminal. Otherwise, a response "update failed" is sent.

[0028] S28: After receiving the "update successful" message, the handheld terminal stores the updated SN, MK1, PWD1, and PWD2 locally to complete the power-on authentication.

[0029] According to a preferred embodiment, in step S25, data DATA1 = PWD2⊕(MK2, Hash(MK2)).

[0030] According to a preferred embodiment, in step S26, DATA2=PWD2 旧⊕(SN,PWD,Hash(PWD2),MK2).

[0031] The aforementioned main solution of this application and its further options can be freely combined to form multiple solutions, all of which can be adopted and protected by this application. After understanding the solution of this application, those skilled in the art will understand that there are many combinations based on existing technology and common knowledge, all of which are technical solutions to be protected by this application, and these are not exhaustive here.

[0032] Beneficial effects of this application:

[0033] When this application uses wireless channels to transmit key components, it not only achieves security masking but also provides strong forward security protection. During the power-on authentication process, since PWD2 is never transmitted over the wireless channel and is not stored long-term in the authentication bracelet, it has high inherent security. Therefore, PWD2 is used to mask and protect the transmitted key components, ensuring the security of the transmission. Moreover, since a new PWD2 is randomly generated and replaced after each successful authentication, strong forward security is ensured during the use of PWD2.

[0034] This application realizes the anti-copying capability of the NFC authentication bracelet through the design of dual authentication. The identity serial number SN and identity verification code PWD are designed to perform dual authentication of identity matching and identity authentication. Only after the authentication is successful, the key component is transmitted; after each successful authentication, the SN and PWD randomly generate a new set of data, effectively preventing the identity bracelet from being copied and used illegally. In addition, through the use of SN, the currently used authentication information and password resources are effectively distinguished, which can effectively prevent the encryption and decryption unit of the handheld terminal and the identity bracelet from having resource mismatches after the power-on authentication fails, thereby improving fault tolerance.

[0035] This application uses NFC technology to achieve power-on authentication, which solves the problem that traditional power-on sticks require the design of a dedicated physical interface when in use and are not conducive to carrying and storage. Compared with Bluetooth, WIFI and other technologies, NFC identity bracelets do not require battery power, which solves the charging problem when users use them for a long time. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a schematic diagram of the equipment activation for this application;

[0037] Figure 2 This is a schematic diagram of the power-on authentication process for this application;

[0038] Figure 3 This is the workflow diagram of the encryption and decryption unit of the handheld terminal of this application;

[0039] Figure 4 This is the workflow diagram for applying for an NFC identity bracelet. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present application through specific examples. Those skilled in the art can easily understand the other advantages and effects of the present application from the content disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. In addition, the terms "first," "second," "third," etc. are used only to distinguish the descriptions and are not to be understood as indicating or implying relative importance.

[0042] Example

[0043] refer to Figures 1 to 4 As shown in the figure, a mobile user identity wireless authentication method based on NFC is shown, and the mobile user identity wireless authentication method includes the following steps.

[0044] Step S1: The device is activated and authentication information and password resources are loaded; a complete set of authentication information and password resources, including identity serial number, identity authentication code and its components, master key and its corresponding components, are written into the encryption and decryption unit of the handheld terminal and the identity bracelet through the initialization system.

[0045] Specifically, step S1 includes: when the device is activated, the initialization system generates resource and configuration information of the handheld terminal and the identity bracelet, and sends it to the burner of each device according to the plan.

[0046] The identity bracelet writer writes the identity serial number SN, identity authentication code PWD, check value Hash (PWD2), and master key component MK2 into the identity bracelet to complete the activation of the identity bracelet.

[0047] The handheld terminal writer writes the identity serial number SN, identity authentication code component PWD1, identity authentication code component PWD2, and master key component MK1 into the encryption and decryption unit of the handheld terminal to activate the encryption and decryption unit of the handheld terminal.

[0048] The definitions of relevant symbols during device activation and power-on authentication are as follows:

[0049] SN: Identity serial number, a set of random numbers jointly maintained by the handheld terminal and the NFC identity bracelet, used for identity matching between the two parties, and randomly generated and replaced each time the power-on authentication is successful; PWD: Identity authentication code, used by the handheld terminal to authenticate the identity of the NFC identity bracelet; PWD1: Identity authentication code component one; PWD2: Identity authentication code component two, used to mask and protect the transmission of sensitive information; MK: Master key, the top-level key used by the encryption and decryption unit of the handheld terminal; MK1: Master key component one, stored in the encryption and decryption unit of the handheld terminal; MK2: Master key component two, stored in the identity bracelet to achieve separate storage of the top-level key.

[0050] Step S2: Securely transmit the master key components to complete power-on authentication. When the device is in use, the identity information and master key components are transmitted over a wireless channel. After the handheld terminal's encryption and decryption unit obtains and verifies the master key components, power-on authentication is completed. During the transmission of the identity information and master key components, a hash algorithm is used for integrity verification and the identity authentication code component is used for masking protection, achieving secure transmission and forward security.

[0051] Specifically, step S2 includes.

[0052] Step S21: After the handheld terminal and the identity bracelet are powered on and initialized, the handheld terminal actively queries the identity bracelet for the identity number periodically until a response is received from the identity bracelet.

[0053] Step S22: The handheld terminal checks the identity serial number SN of the identity bracelet with its own identity serial number SN. If they are consistent, it means "identity matching is successful"; then it reads the identity authentication code component PWD1 stored in itself and sends it to the identity bracelet through the wireless channel; if they are inconsistent, it means "identity matching fails" and the SN is obtained from the identity bracelet again.

[0054] Step S23: The identity bracelet performs XOR on the received identity authentication code component PWD1 and the locally stored identity authentication code PWD to obtain the identity authentication code component PWD2, that is, PWD2 = PWD1⊕PWD; and calculates its check value Hash(PWD2).

[0055] Compare Hash (PWD2) with the Hash (PWD2) stored locally on the identity bracelet. If they are consistent, the authentication is successful and the response is "Identity authentication successful"; if they are inconsistent, the authentication fails and the response is "Identity authentication failed", and the process is terminated.

[0056] Preferably, in step S23 , the calculation process of the check value Hash(PWD2) includes: Hash(PWD2)=SM3_Hash(PWD2).

[0057] Step S24: After receiving the identity authentication success message from the identity bracelet, the handheld terminal sends a request to read the master key component MK2 to the identity bracelet.

[0058] Step S25: The identity bracelet reads the master key component MK2 and its check value Hash(MK2) stored in itself, and uses the identity authentication code component PWD2 obtained in step S23 to mask and protect it, obtains data DATA1, and sends it to the handheld terminal. ).

[0059] Step S26: The handheld terminal masks and verifies the received master key component MK2. If the verification is successful, a new set of configuration information is randomly generated, including: SN, MK1, MK2, PWD1, PWD2, and PWD2 is used to 旧 That is, after masking the identity authentication code component PWD2 obtained in step S23, data DATA2 is obtained and sent to the authentication bracelet for data update.

[0060] Step S27: After receiving the updated data, the identity bracelet performs an integrity check. If successful, the local information is updated and a response of "update successful" is sent to the handheld terminal. Otherwise, a response of "update failed" is sent.

[0061] Step S28: After receiving the "update successful" message, the handheld terminal stores the updated SN, MK1, PWD1, and PWD2 locally to complete the power-on authentication.

[0062] When this application uses wireless channels to transmit key components, it not only achieves security masking but also provides strong forward security protection. During the power-on authentication process, since PWD2 is never transmitted over the wireless channel and is not stored long-term in the authentication bracelet, it has high inherent security. Therefore, PWD2 is used to mask and protect the transmitted key components, ensuring the security of the transmission. Moreover, since a new PWD2 is randomly generated and replaced after each successful authentication, strong forward security is ensured during the use of PWD2.

[0063] This application realizes the anti-copying capability of the NFC authentication bracelet through the design of dual authentication. The identity serial number SN and identity verification code PWD are designed to perform dual authentication of identity matching and identity authentication. Only after the authentication is successful, the key component is transmitted; after each successful authentication, the SN and PWD randomly generate a new set of data, effectively preventing the identity bracelet from being copied and used illegally. In addition, through the use of SN, the currently used authentication information and password resources are effectively distinguished, which can effectively prevent the encryption and decryption unit of the handheld terminal and the identity bracelet from having resource mismatches after the power-on authentication fails, thereby improving fault tolerance.

[0064] This application uses NFC technology to achieve power-on authentication, which solves the problem that traditional power-on sticks require the design of a dedicated physical interface when in use and are not conducive to carrying and storage. Compared with Bluetooth, WIFI and other technologies, NFC identity bracelets do not require battery power, which solves the charging problem when users use them for a long time.

[0065] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for wireless authentication of mobile user identity based on NFC, characterized in that: The mobile user identity wireless authentication method comprises: S1: The device is activated and authentication information and password resources are loaded; Write a complete set of authentication information and password resources into the encryption and decryption unit of the handheld terminal and the identity bracelet through the initialization system, including the identity serial number, identity authentication code and its components, master key and its corresponding components; S2: The master key component is securely transmitted to complete the power-on authentication; When the device is in use, the identity information and master key components are transmitted through the wireless channel. After the encryption and decryption unit of the handheld terminal obtains the master key components and verifies them, the power-on authentication is completed; Among them, during the transmission process of identity information and master key components, integrity verification is performed through the Hash algorithm, and masking protection is performed through the identity authentication code component to achieve secure transmission and forward security protection.

2. The method for wireless authentication of mobile user identity according to claim 1, wherein: Step S1 includes: When the device is activated, the initialization system generates resource and configuration information for the handheld terminal and identity bracelet, and sends it to the programmer of each device according to the plan; The identity bracelet writer writes the identity serial number SN, identity authentication code PWD, check value Hash (PWD2), and master key component MK2 into the identity bracelet to complete the activation of the identity bracelet; The handheld terminal writer writes the identity serial number SN, identity authentication code component PWD1, identity authentication code component PWD2, and master key component MK1 into the encryption and decryption unit of the handheld terminal to activate the encryption and decryption unit of the handheld terminal.

3. The method for wireless authentication of mobile user identity according to claim 1, wherein: Step S2 includes: S21: After the handheld terminal and the identity bracelet are powered on and initialized, the handheld terminal actively queries the identity bracelet for the identity number periodically until it receives a response from the identity bracelet; S22: The handheld terminal checks the identity serial number SN obtained from the identity bracelet with its own identity serial number SN. If they are consistent, it means "identity matching is successful"; then it reads the identity authentication code component PWD1 stored in itself and sends it to the identity bracelet through the wireless channel; if they are inconsistent, it means "identity matching fails" and the SN is obtained from the identity bracelet again; S23: The identity bracelet performs XOR on the received identity authentication code component PWD1 and the locally stored identity authentication code PWD to obtain the identity authentication code component PWD2, and calculates its check value Hash(PWD2). Compare Hash (PWD2) with the Hash (PWD2) stored locally on the identity bracelet. If they are consistent, the authentication is successful and the response is "Identity Authentication Successful"; if they are inconsistent, the authentication fails and the response is "Identity Authentication Failed", terminating the process.

4. The method for wireless authentication of mobile user identity according to claim 3, wherein: In step S23 , the calculation process of the check value Hash(PWD2) includes: Hash(PWD2)=SM3_Hash(PWD2).

5. The method for wireless authentication of mobile user identity according to claim 3, wherein: Step S2 further includes: S24: After receiving the identity authentication success message from the identity bracelet, the handheld terminal sends a request to the identity bracelet to read the master key component MK2; S25: The identity bracelet reads the master key component MK2 and its check value Hash(MK2) stored in itself, uses the identity authentication code component PWD2 obtained in step S23 to mask and protect it, obtains data DATA1, and sends it to the handheld terminal; S26: The handheld terminal masks and verifies the received master key component MK2. If the verification is successful, a new set of configuration information is randomly generated, including: SN, MK1, MK2, PWD1, PWD2, and PWD2 is used. 旧 That is, after masking the identity authentication code component PWD2 obtained in step S23, data DATA2 is obtained and sent to the authentication bracelet for data update; S27: After receiving the updated data, the identity bracelet performs an integrity check. If successful, the local information is updated and a response "update successful" is sent to the handheld terminal. Otherwise, a response "update failed" is sent. S28: After receiving the "update successful" message, the handheld terminal stores the updated SN, MK1, PWD1, and PWD2 locally to complete the power-on authentication.

6. The method for wireless authentication of mobile user identity according to claim 5, wherein: In step S25, data DATA1 = PWD2⊕(MK2, Hash(MK2)).

7. The method for wireless authentication of mobile user identity according to claim 5, wherein: In step S26, DATA2=PWD2 旧 ⊕(SN,PWD,Hash(PWD2),MK2).

Images