Secure payment communication method and system based on dynamic PUF (Physical Unclonable Function)

Abstract

The invention provides a security payment communication method and system based on a dynamic PUF (Physical Unclonable Function), two communication parties exchange the same challenge value C to establish connection, and then generate a PUF response PUFA (C) and a PUF response PUFB (C) based on the same challenge value C and exchange the PUF response PUFA (C) and the PUF response PUFB (C); and the two communication parties calculate and obtain a session key K according to the PUF response PUFA (C) and the PUF response PUFB (C), establish transaction communication according to the session key K, and update the challenge value C after the communication is finished. Therefore, zero static secret key storage is realized, and the risk of secret key leakage is avoided; and the key is dynamically updated in each transaction to defend replay attacks, so that the forward security is greatly improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a secure payment communication method and system based on dynamic PUF. Background Art

[0002] The Internet of Things (IoT) has been a major technological development in recent years. Its core concept is to connect various objects to the internet, enabling intelligent control and management. Identity authentication technology plays a crucial role in IoT security, serving as the first line of defense in security systems. Before communicating and transmitting data, smart devices in IoT systems must first identify themselves to an authentication system.

[0003] Smart devices in the IoT collect, store, and process data, which contains a wealth of private and sensitive information. Once the identity authentication system is compromised, all security measures are rendered ineffective. Hackers often target the authentication system. Due to the openness and complexity of IoT connections, identity authentication in the IoT environment is even more complex.

[0004] Traditional payment devices currently rely on pre-stored keys, making them vulnerable to physical extraction or side-channel attacks. NFC / Bluetooth payment systems lack real-time detection of communication delays and offer no protection against relay attacks. Solutions like SMS verification codes require active user participation and carry the risk of phishing.

[0005] Therefore, there is an urgent need for a secure payment communication to quickly achieve identity authentication and secure payment.

[0006] The above statements are only used to provide background technical information related to this application. Unless otherwise indicated herein, the contents described in this section are not prior art for the contents of other parts of this application. Summary of the Invention

[0007] The present invention proposes a secure payment communication method and system based on dynamic PUF. The two communicating parties exchange the same challenge value C to establish a connection, and then generate PUF responses based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B (C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0008] According to a first aspect of an embodiment of the present application, a secure payment communication method based on a dynamic PUF is provided, which is applied to a card reader, comprising the following steps:

[0009] Get nanosecond timestamp and generate random numbers;

[0010] The challenge value C and PUF response PUF are obtained by splicing the timestamp and random number. B (C);

[0011] The challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card also responds to the PUF based on the PUF A (C) and PUF response PUF B (C) After calculating and signing the session key K;

[0012] After receiving the signed session key from the card, perform key verification;

[0013] Verify the session key. After successful verification, both parties establish transaction communication and update the challenge value C after the communication is completed.

[0014] In some embodiments of the present application, the card generates a PUF response PUF based on the challenge value C. A (C) After returning a response, the process further includes: executing a reaction test; the reaction test includes:

[0015] Set PUF response time window limit rules;

[0016] Calculate the real-time response time threshold according to the PUF response time window restriction rule;

[0017] Receive the PUF response PUF returned by the card A (C), if PUF responds to PUF A (C) Exceeding the real-time response time threshold will interrupt the transaction and trigger the safety circuit breaker mechanism.

[0018] This enables real-time interception of relay attacks and greatly improves the security of payment communications.

[0019] In some embodiments of the present application, setting a PUF response time window restriction rule includes:

[0020] Real-time detection of temperature and voltage values, setting of reference threshold, temperature reference, temperature compensation coefficient and voltage compensation coefficient;

[0021] The formula for limiting the PUF response time window Δt is:

[0022] Δt≤τ+k(T-T0)+β∣ΔV∣;

[0023] Where τ is the reference threshold; k is the temperature compensation coefficient; β is the voltage compensation coefficient; T0 is the temperature reference; T is the temperature at which the response is returned by the receiving card; and ΔV is the voltage difference.

[0024] In some embodiments of the present application, key verification is performed, including: performing session key K verification and PUF-TLS two-way authentication.

[0025] In some embodiments of the present application, PUF-TLS two-way authentication includes:

[0026] During the card registration phase, the receiving card obtains the physical response PUF (C0) of the card chip based on the reference challenge value C0;

[0027] The hash anchor value Hreg is calculated based on the chip physical response PUF (C0);

[0028] Store the hash anchor value Hreg in the CA database and obtain the issued certificate;

[0029] Send the issuance certificate to the card side.

[0030] This application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0031] In some embodiments of the present application, PUF-TLS two-way authentication further includes:

[0032] During the authentication phase, the card receives the issuance certificate and issues a random number to the card.

[0033] The dynamic private key Kpriv generated by the card end based on the random number is signed and the signature private key σ is formed;

[0034] Perform private key verification on the signature private key σ.

[0035] In some embodiments of the present application, performing private key verification on the signature private key σ includes:

[0036] Send a query request to the CA database to obtain the hash anchor value Hreg;

[0037] Compare and verify based on the dynamic private key Kpriv and the hash anchor value Hreg. If they are the same, the verification passes.

[0038] Kpriv=KDF(PUF(Ns|Nd)); Sign the random number σ=SignK(Ns|Nd);

[0039] The server verifies Hreg and the authentication is completed.

[0040] According to a second aspect of an embodiment of the present application, a secure payment communication method based on a dynamic PUF is provided, which is applied to a card side and includes the following steps:

[0041] Receive the challenge value C and PUF response PUF sent by the card reader B (C), generates a PUF response PUF based on the challenge value C A (C);

[0042] PUF-based response PUF A (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification;

[0043] The card reader successfully verifies and both parties establish transaction communication.

[0044] According to a third aspect of an embodiment of the present application, a secure payment communication system based on a dynamic PUF is provided, which is applied to a card reader, including:

[0045] Parameter module: used to obtain nanosecond timestamps and generate random numbers;

[0046] PUF response module: used to obtain the challenge value C and PUF response PUF based on the timestamp and random number splicing B (C);

[0047] Receiving module: used to send challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card also responds to the PUF based on the PUF A (C) and PUF response PUF B (C) After calculating and signing the session key K;

[0048] Verification module: used to verify after receiving the signature session key from the card side;

[0049] Communication module: used to establish transaction communication between the two parties after successful verification, and update the challenge value C after the communication is completed.

[0050] According to a fourth aspect of an embodiment of the present application, a secure payment communication system based on a dynamic PUF is provided, which is applied to a card side and includes:

[0051] PUF response module: used to receive the challenge value C and PUF response PUF sent by the card reader B(C), generates a PUF response PUF based on the challenge value C A (C);

[0052] Key generation module: used for PUF response based on PUF A (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification;

[0053] Communication module: used for successful card reader verification and establishment of transaction communication between the two parties.

[0054] According to a fifth aspect of an embodiment of the present application, a secure payment communication device based on a dynamic PUF is provided, including: a storage unit for storing executable instructions; and a processing unit for connecting to the memory to execute the executable instructions to complete a secure payment communication method based on a dynamic PUF.

[0055] According to a sixth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement a secure payment communication method based on dynamic PUF.

[0056] Using the secure payment communication method and system based on dynamic PUF of the present application, the communicating parties exchange the same challenge value C to establish a connection, and then generate PUF responses PUF based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B (C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0057] In addition, this application also achieves real-time interception of relay attacks by setting PUF response time window limit rules, greatly improving the security of payment communications.

[0058] The PUF-TLS two-way authentication in this application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0060] Figure 1 : shows a communication flow diagram of a secure payment communication method based on dynamic PUF according to an embodiment of the present application;

[0061] Figure 2 : A schematic diagram of the steps of a secure payment communication method based on dynamic PUF according to an embodiment of the present application is shown;

[0062] Figure 3 : shows a schematic diagram of the steps of performing a reaction test according to an embodiment of the present application;

[0063] Figure 4 FIG2 shows a schematic diagram of the principle of PUF-TLS two-way authentication according to an embodiment of the present application;

[0064] Figure 5 FIG2 shows a schematic diagram of the steps of another secure payment communication method based on dynamic PUF according to an embodiment of the present application;

[0065] Figure 6 FIG2 shows a schematic structural diagram of a secure payment communication system based on dynamic PUF according to an embodiment of the present application;

[0066] Figure 7 FIG2 shows a structural diagram of a secure payment communication system based on dynamic PUF according to another embodiment of the present application;

[0067] Figure 8 : shows a structural diagram of a secure payment communication device 400 based on dynamic PUF according to an embodiment of the present application. DETAILED DESCRIPTION

[0068] Regarding this application, identity authentication technology plays an extremely important role in IoT security and is the first checkpoint in the security system. Before interactive communication and data transmission, smart devices in the IoT system must first identify themselves to the identity authentication system. However, traditional payment devices currently rely on pre-stored keys, which are easily stolen by physical extraction or side-channel attacks. NFC / Bluetooth payment lacks a real-time detection mechanism for communication delays and has no defense against relay attacks. Alternatively, solutions such as SMS verification codes require active user participation and pose a phishing risk. Therefore, there is an urgent need for a secure payment communication to quickly achieve identity authentication and secure payment.

[0069] The present invention proposes a secure payment communication method and system based on dynamic PUF. The two communicating parties exchange the same challenge value C to establish a connection, and then generate PUF responses based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B (C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0070] In addition, this application also achieves real-time interception of relay attacks by setting PUF response time window limit rules, greatly improving the security of payment communications.

[0071] The PUF-TLS two-way authentication in this application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0072] This application uses a dynamic PUF mechanism to achieve the trinity of "zero key storage + real-time anti-relay + senseless authentication" to solve the core pain points of payment security.

[0073] In order to make the technical solutions and advantages of the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, and are not an exhaustive list of all the embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other unless they conflict.

[0074] Example 1

[0075] Figure 1 : shows a communication flow diagram of a secure payment communication method based on dynamic PUF according to an embodiment of the present application;

[0076] like Figure 1 As shown, the secure payment communication method of the present application mainly includes a challenge value exchange phase, a PUF response generation phase, a PUF response exchange phase, a session key calculation phase, an encryption communication phase, and a connection termination phase.

[0077] First, in the challenge value exchange phase, the two communicating parties exchange the same challenge value C to establish a connection; then in the PUF response generation phase, both parties generate PUF responses based on the same challenge value C. A(C) and PUF response PUF B (C) and exchange; in the session key calculation phase, the communicating parties respond to the PUF according to the PUF A (C) and PUF response PUF B (C) The session key K is calculated; in the encrypted communication phase, both parties establish transaction communication based on the session key K and update the challenge value C after the communication ends.

[0078] This achieves zero static key storage and avoids the risk of key leakage; by dynamically updating the key for each transaction, it defends against replay attacks and greatly improves forward security.

[0079] Figure 2 : shows a schematic diagram of the steps of a secure payment communication method based on dynamic PUF according to an embodiment of the present application.

[0080] like Figure 2 As shown, a secure payment communication method based on dynamic PUF according to an embodiment of the present application is applied to a card reader, comprising the following steps:

[0081] S1: Get nanosecond timestamp and generate random number;

[0082] S2: The challenge value C and PUF response PUF are obtained by concatenating the timestamp and random number. B (C);

[0083] S3: The challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card also responds to the PUF based on the PUF A (C) and PUF response PUF B (C) Calculate the session key K and sign it;

[0084] S4: After receiving the signed session key from the card, perform key verification;

[0085] S5: Verify the session key. After successful verification, both parties establish transaction communication and update the challenge value C after the communication is completed.

[0086] By combining the dual mechanisms of digital signature and delayed detection, the missed detection rate is greatly reduced, zero static key storage is achieved, and the risk of key leakage is avoided; by dynamically updating the key for each transaction, replay attacks are defended, greatly improving forward security.

[0087] Preferably, the card generates a PUF response PUF based on the challenge value C. A (C) and after returning a response, it also includes: executing a reaction test.

[0088] Figure 3 Schematic diagram of the steps of performing a reaction test according to an embodiment of the present application is shown in FIG.

[0089] like Figure 3 As shown, the reaction test includes the following steps:

[0090] S41: Setting PUF response time window restriction rules;

[0091] S42: Calculate the real-time response time threshold according to the PUF response time window restriction rule;

[0092] S43: Receive PUF response PUF returned by the card A (C), if PUF responds to PUF A (C) Exceeding the real-time response time threshold will interrupt the transaction and trigger the safety circuit breaker mechanism.

[0093] By performing reaction tests, relay attacks can be intercepted in real time, greatly improving the security of payment communications.

[0094] This application considers that the PUF response time is determined by the inherent characteristics of semiconductor circuits and cannot be shortened through software acceleration or pre-calculation. Therefore, the physical unclonability of the PUF and the deterministic nature of hardware calculation delay are utilized to establish a PUF response time window constraint rule.

[0095] Setting the PUF response time window restriction rule specifically includes the following steps: detecting temperature and voltage values ​​in real time, setting a reference threshold, a temperature reference, a temperature compensation coefficient, and a voltage compensation coefficient;

[0096] Then, set the reference threshold, temperature compensation coefficient and voltage compensation coefficient;

[0097] The formula for setting the limit PUF response time window Δt is as follows:

[0098] Δt≤τ+k(T-T0)+β∣ΔV∣;

[0099] Where τ is the reference threshold; k is the temperature compensation coefficient; β is the voltage compensation coefficient; T0 is the temperature reference; T is the temperature at which the response is returned by the receiving card; and ΔV is the voltage difference.

[0100] ΔV is the voltage difference, which is the voltage detected when the card reader sends a challenge value C and the voltage detected when the card receiving end returns a response. The temperature difference and voltage difference ΔV are determined based on the two voltage values.

[0101] Next, key verification in S4 includes: session key K verification and PUF-TLS two-way authentication.

[0102] This application uses a dual verification mechanism, adopts time window limit and digital signature verification to form a double defense of "physical layer + protocol layer", which greatly improves communication security.

[0103] The session key K verification process includes:

[0104] On the card reader side, 1. Generate a challenge value using the following formula:

[0105] C = SHA-256(Tns||N);

[0106] 2. Generate PUF response R B =PUF B (C); and receive the R returned by the other party's card A =PUF A (C);

[0107] 3. Calculate the session key K using the formula:

[0108] K=HKDF(R A ⊕R B ).

[0109] On the card side, 1. Receive the challenge value;

[0110] 2. Generate PUF response R A =PUF A (C);

[0111] 3. Based on the PUF response homology guarantee, the session key K is calculated as follows:

[0112] K=HKDF(R A ⊕R B ).

[0113] Therefore, after receiving the signed session key from the chip, the card reader compares the session key K on the card with the session key K calculated by itself. If they are the same, the verification is passed; otherwise, access is denied.

[0114] Figure 4 A schematic diagram of the principle of PUF-TLS two-way authentication according to an embodiment of the present application is shown in FIG.

[0115] like Figure 4 As shown, PUF-TLS two-way authentication includes:

[0116] During the card registration phase, the receiving card obtains the physical response PUF (C0) of the card chip based on the reference challenge value C0;

[0117] The hash anchor value Hreg is calculated based on the chip physical response PUF (C0), as follows:

[0118] Hreg = SHA-256(PUF(C0));

[0119] Among them, C0 is the trigger password for activating the physical characteristics of PUF, which is an immutable value pre-programmed at the factory;

[0120] Then, the hash anchor value Hreg is stored in the CA database and the issued certificate Cert-device is obtained;

[0121] Send the issuance certificate to the card side.

[0122] This application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0123] PUF-TLS mutual authentication also includes:

[0124] During the authentication phase, the card receives the issuance certificate Cert-device and issues a random number to the card.

[0125] The dynamic private key Kpriv generated by the card end based on the random number is signed and the signature private key σ is formed:

[0126] σ=Sign Kpriv;

[0127] Finally, the signature private key σ is verified.

[0128] During specific implementation, the private key verification of the signature private key σ includes:

[0129] Send a query request to the CA database to obtain the hash anchor value Hreg;

[0130] Compare and verify based on the dynamic private key Kpriv and the hash anchor value Hreg. If they are the same, the verification passes.

[0131] Figure 5 FIG2 shows a schematic diagram of the steps of another secure payment communication method based on dynamic PUF according to an embodiment of the present application.

[0132] like Figure 5 As shown, a secure payment communication method based on dynamic PUF in this embodiment is applied to the card side, including the following steps:

[0133] S10: Receive the challenge value C and PUF response PUF sent by the card reader B (C), generates a PUF response PUF based on the challenge value C A (C);

[0134] S20: PUF-based response PUFA (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification;

[0135] S30: The card reader successfully verifies and both parties establish transaction communication.

[0136] Compared with traditional solutions, this application has the following technical advantages.

[0137]

[0138] Table 1 Comparison of technical effects

[0139] The following describes the implementation scenario.

[0140] Implementation scenario 1: Anti-cloning payment of smart POS terminals, such as supermarket POS terminals and IC card transactions.

[0141] First, the POS machine sends electromagnetic noise interference (anti-side channel); the IC card generates a dynamic key K and encrypts the transaction data; then the PUF hash matching is verified, and delivery communication is successful if the match is successful.

[0142] Implementation scenario 1: Mobile phone-watch Bluetooth contactless payment, for example, users use their watches to pay for subway fares.

[0143] First, the phone and watch are pre-paired; when making a payment, the watch's PUF generates a signature and sends it to the phone; the phone verifies, and the transaction is carried out after successful verification.

[0144] This application forms a payment security closed loop by combining dynamic PUF keys, time window defense and PUF-TLS dual authentication, breaking through the technical defects of the impossible triangle of "security-experience-cost" in existing technologies.

[0145] This application is the first to use PUF response time as a relay criterion, rather than the traditional communication protocol layer. It also uses a CA to store PUF hashes instead of public keys, addressing the core security pain points of traditional payments. Zero static key storage is achieved, eliminating the risk of key leakage. Dynamic key updates with each transaction protect against replay attacks, significantly improving forward security.

[0146] In summary, the secure payment communication method based on dynamic PUF of this application is adopted. The two communicating parties exchange the same challenge value C to establish a connection, and then generate PUF response PUF based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B(C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0147] In addition, this application also achieves real-time interception of relay attacks by setting PUF response time window limit rules, greatly improving the security of payment communications.

[0148] The PUF-TLS two-way authentication in this application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0149] Example 2

[0150] This embodiment provides a secure payment communication system based on dynamic PUF. For details not disclosed in the secure payment communication system based on dynamic PUF in this embodiment, please refer to the specific implementation content of the secure payment communication method based on dynamic PUF in other embodiments.

[0151] Figure 6 Graph 1 shows a schematic structural diagram of a secure payment communication system based on dynamic PUF according to an embodiment of the present application.

[0152] like Figure 6 As shown, a secure payment communication system based on dynamic PUF according to an embodiment of the present application is applied to a card reader, including:

[0153] Parameter module 10: used to obtain nanosecond timestamps and generate random numbers;

[0154] PUF response module 20: used to obtain the challenge value C and PUF response PUF according to the timestamp and random number splicing B (C);

[0155] Receiving module 30: used to receive the challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card also responds to the PUF based on the PUF A (C) and PUF response PUF B (C) After calculating and signing the session key K;

[0156] Verification module 40: used to verify after receiving the signature session key from the card side;

[0157] Communication module 50: used to establish transaction communication between the two parties after successful verification, and update the challenge value C after the communication is completed.

[0158] Figure 7 Graph 1 shows a schematic structural diagram of a secure payment communication system based on dynamic PUF according to another embodiment of the present application.

[0159] like Figure 7 As shown, a secure payment communication system based on dynamic PUF according to an embodiment of the present application is applied to a card side, including:

[0160] PUF response module 100: used to receive the challenge value C and PUF response PUF sent by the card reader B (C), generates a PUF response PUF based on the challenge value C A (C);

[0161] Key generation module 200: used to generate PUF based on PUF response A (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification;

[0162] Communication module 300: used for establishing transaction communication between the two parties after successful verification at the card reader end.

[0163] Using the dynamic PUF-based secure payment communication system of the present application, the communicating parties exchange the same challenge value C to establish a connection, and then generate PUF responses PUF based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B (C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0164] In addition, this application also achieves real-time interception of relay attacks by setting PUF response time window limit rules, greatly improving the security of payment communications.

[0165] The PUF-TLS two-way authentication in this application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0166] Example 3

[0167] This embodiment provides a secure payment communication device based on dynamic PUF. For details not disclosed in the secure payment communication device based on dynamic PUF in this embodiment, please refer to the specific implementation content of the secure payment communication method or system based on dynamic PUF in other embodiments.

[0168] Figure 8 : shows a structural diagram of a secure payment communication device 400 based on dynamic PUF according to an embodiment of the present application.

[0169] like Figure 8 As shown, the secure payment communication device 400 based on dynamic PUF includes: a storage unit 402: for storing executable instructions; and a processing unit 401: for connecting with the storage unit 402 to execute the executable instructions to complete the secure payment communication method based on dynamic PUF.

[0170] Those skilled in the art will understand that Figure 8 This is merely an example of a dynamic PUF-based secure payment communication device 400 and does not constitute a limitation of the dynamic PUF-based secure payment communication device 400. The device may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the dynamic PUF-based secure payment communication device 400 may also include input and output devices, network access devices, buses, etc.

[0171] The so-called processing unit 401 (Central Processing Unit, CPU) can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor, or the processing unit 401 can also be any conventional processor. The processing unit 401 is the control center of the dynamic PUF-based secure payment communication device 400, and uses various interfaces and lines to connect the various parts of the dynamic PUF-based secure payment communication device 400.

[0172] Storage unit 402 can be used to store computer-readable instructions. Processing unit 401 implements the various functions of dynamic PUF-based secure payment communication device 400 by running or executing the computer-readable instructions or modules stored in storage unit 402 and accessing the data stored in storage unit 402. Storage unit 402 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as sound playback or image playback); the data storage area may store data generated based on the use of dynamic PUF-based secure payment communication device 400. Furthermore, storage unit 402 may include a hard disk, memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, a read-only memory (ROM), a random access memory (RAM), or other non-volatile or volatile memory devices.

[0173] If the integrated modules of the dynamic PUF-based secure payment communication device 400 are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the present invention can also implement all or part of the processes in the above-mentioned method embodiments by instructing the relevant hardware through computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium. When executed by a processor, these computer-readable instructions can implement the steps of each of the above-mentioned method embodiments.

[0174] Example 4

[0175] This embodiment provides a computer-readable storage medium having a computer program stored thereon; the computer program is executed by a processor to implement the dynamic PUF-based secure payment communication method in other embodiments.

[0176] Using the secure payment communication device based on dynamic PUF and the computer-readable storage medium of the present application, the communicating parties exchange the same challenge value C to establish a connection, and then generate PUF responses PUF based on the same challenge value C. A (C) and PUF response PUF B (C) and exchange; both communicating parties respond to PUF based on PUF A (C) and PUF response PUF B(C) The session key K is calculated, and both parties establish transaction communication based on the session key K. After the communication ends, the challenge value C is updated. This achieves zero static key storage, avoiding the risk of key leakage. By dynamically updating the key with each transaction, replay attacks are prevented, greatly improving forward security.

[0177] In addition, this application also achieves real-time interception of relay attacks by setting PUF response time window limit rules, greatly improving the security of payment communications.

[0178] The PUF-TLS two-way authentication in this application uses CA pre-stored certificates, which reduces storage overhead by 50% compared to existing conventional pre-stored certificates; at the same time, it also improves side-channel attack defense and greatly reduces the risk of key leakage.

[0179] Those skilled in the art will appreciate that the terms used in the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any or all possible combinations of one or more of the associated listed items.

[0180] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0181] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0182] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A secure payment communication method based on dynamic PUF, characterized in that: Applied to the card reader side, including the following steps: Get nanosecond timestamp and generate random numbers; The challenge value C and the PUF response PUF are obtained by splicing the timestamp and the random number. B (C); The challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card side also responds to PUF based on the PUF A (C) and PUF response PUF B (C) Calculate the session key K and sign it; After receiving the signed session key from the card, perform key verification; The session key is verified. After successful verification, both parties establish transaction communication and update the challenge value C after the communication is completed.

2. The secure payment communication method based on dynamic PUF according to claim 1, characterized in that: The card generates a PUF response PUF based on the challenge value C A (C) After returning a response, the method further includes: executing a reaction test; the reaction test includes: Set PUF response time window limit rules; Calculating a real-time response time threshold according to the PUF response time window limitation rule; Receive the PUF response PUF returned by the card A (C), if the PUF responds to PUF A (C) If the real-time response time threshold is exceeded, the transaction is interrupted and the safety circuit breaker mechanism is triggered.

3. The secure payment communication method based on dynamic PUF according to claim 2, characterized in that: The setting of the PUF response time window restriction rule includes: Real-time detection of temperature and voltage values, setting of reference threshold, temperature reference, temperature compensation coefficient and voltage compensation coefficient; The formula for setting the limit PUF response time window Δt is: Δt≤τ+k(T-T0)+β∣ΔV∣; Where τ is the reference threshold; k is the temperature compensation coefficient; β is the voltage compensation coefficient; T0 is the temperature reference; T is the temperature at which the response is returned by the receiving card; and ΔV is the voltage difference.

4. The secure payment communication method based on dynamic PUF according to claim 1, characterized in that: The key verification includes: performing session key K verification and PUF-TLS two-way authentication.

5. The secure payment communication method based on dynamic PUF according to claim 4, characterized in that: The PUF-TLS two-way authentication includes: During the card registration phase, the receiving card obtains the physical response PUF (C0) of the card chip based on the reference challenge value C0; Calculate a hash anchor value Hreg based on the chip physical response PUF (C0); The hash anchor value Hreg is stored in the CA database and a certificate is obtained; The issuance certificate is sent to the card end.

6. The secure payment communication method based on dynamic PUF according to claim 5, characterized in that: The PUF-TLS two-way authentication further includes: During the authentication phase, the card receives the issuance certificate and issues a random number to the card. The dynamic private key Kpriv generated by the card end based on the random number is signed and the signature private key σ is formed; Perform private key verification on the signature private key σ.

7. The secure payment communication method based on dynamic PUF according to claim 6, characterized in that: The performing private key verification on the signature private key σ includes: Send a query request to the CA database to obtain the hash anchor value Hreg; A comparison and verification is performed based on the dynamic private key Kpriv and the hash anchor value Hreg. If they are the same, the verification is passed. Kpriv=KDF(PUF(Ns|Nd)); Sign the random number σ=SignK(Ns|Nd); The server verifies the Hreg and the authentication is completed.

8. A secure payment communication method based on dynamic PUF, characterized in that: Applied to the card side, it includes the following steps: Receive the challenge value C and PUF response PUF sent by the card reader B (C), generating a PUF response PUF based on the challenge value C A (C); PUF response based on the PUF A (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification; The card reader successfully verifies and both parties establish transaction communication.

9. A secure payment communication system based on dynamic PUF, characterized in that: Applied to the card reader side, including: Parameter module: used to obtain nanosecond timestamps and generate random numbers; PUF response module: used to obtain the challenge value C and PUF response PUF according to the timestamp and random number splicing B (C); Receiving module: used to receive the challenge value C and PUF response PUF B (C) is sent to the card side so that the card side generates a PUF response PUF based on the challenge value C A (C) and returns a response; the card side also responds to PUF based on the PUF A (C) and PUF response PUF B (C) After calculating and signing the session key K; Verification module: used to verify after receiving the signature session key from the card side; Communication module: used for establishing transaction communication between the two parties after successful verification, and updating the challenge value C after the communication is completed.

10. A secure payment communication system based on dynamic PUF, characterized in that: Applied to the card side, including: PUF response module: used to receive the challenge value C and PUF response PUF sent by the card reader B (C), generating a PUF response PUF based on the challenge value C A (C); Key generation module: used to generate PUF based on the PUF response A (C) and PUF response PUF B (C) Calculate and sign the session key K, and send the signature key to the card reader for verification; Communication module: used for successful card reader verification and establishment of transaction communication between the two parties.

Images