Method and system for two-way authentication and session key negotiation of NFC passive lock

Abstract

This invention belongs to the field of key negotiation technology, specifically relating to a method and system for two-way authentication and session key negotiation for NFC passive locks. The method includes the following steps: S1, the mobile device generates a first temporary private key and a first random number, and calculates a first temporary public key using a first hash function based on the NFC passive lock's identity identifier, the first random number, and the first base point G and second base point P of the elliptic curve. The first temporary public key and the first random number are then sent to the NFC passive lock. This invention achieves secure two-way authentication and key negotiation without increasing the hardware storage burden of the NFC passive lock, improving its resistance to physical and network attacks, and ensuring the confidentiality and integrity of communication.

Description

Technical Field

[0001] This invention belongs to the field of key negotiation technology, specifically relating to a method and system for two-way authentication and session key negotiation of NFC passive locks. Background Technology

[0002] With the rapid development of IoT technology, Near Field Communication (NFC) technology, due to its convenience and low power consumption, is widely used in smart locks, mobile payments, and identity verification. Especially in smart lock systems, NFC passive locks have become an important development direction in the market due to their advantages of not requiring an internal power supply, low cost, and simple maintenance. NFC passive locks use the radio frequency field energy provided by NFC reading and writing devices such as mobile phones during near-field interactions to complete power supply and data communication. However, the communication channel between the mobile phone and the NFC passive lock is open, making it vulnerable to various security threats such as eavesdropping, replay attacks, and man-in-the-middle attacks. Therefore, establishing a secure communication session between the two, achieving two-way identity authentication and session key negotiation, is the core issue in ensuring the security of NFC passive locks.

[0003] Most existing NFC security solutions employ encryption algorithms to protect communication content. While traditional symmetric encryption schemes have low computational overhead, they face challenges in key distribution and management. Schemes based on public-key cryptography, such as elliptic curve cryptography, are suitable for resource-constrained devices due to their advantages of short key lengths and high computational efficiency at the same security strength. The Elliptic Curve Diffie-Hellman (ECDHE) key exchange protocol is a common method for establishing shared keys, but the standard ECDHE protocol itself does not provide authentication functionality and cannot resist man-in-the-middle attacks. Researchers have proposed some improvements, attempting to integrate identity information into the key exchange process. However, storing a long-term private key or certificate within the NFC passive lock not only increases storage overhead but also introduces security vulnerabilities. Designing a protocol that can achieve efficient two-way authentication, avoid long-term private key storage, and fully adapt to the computational and storage space limitations of NFC passive locks remains a significant challenge in the current research field. Summary of the Invention

[0004] This invention provides a method and system for two-way authentication and session key negotiation of NFC passive locks to solve the technical problems of existing solutions having security risks and being limited by storage space.

[0005] In a first aspect, the present invention provides a method for two-way authentication and session key negotiation of an NFC passive lock, comprising the following steps:

[0006] S1, Generate the first temporary private key on the mobile device. and the first random number And based on the identity identifier of the NFC passive lock First random number The first base point G and the second base point P of the elliptic curve are determined using the first hash function. Calculate the first temporary public key , give the first temporary public key and the first random number Send to NFC passive lock;

[0007] S2, NFC passive lock receives the first temporary public key and the first random number Then, the first random number Input the built-in PUF to generate a second temporary private key And generate a second random number. Calculate the second temporary public key = ×G, will give the second temporary public key Second random number Send to the mobile device; the mobile device and the NFC passive lock respectively calculate... × and Obtain shared elliptic curve points and from the shared elliptic curve point Extract the x-coordinate as a shared secret. ;

[0008] S3, based on shared secrets and identity identifier Using the second hash function Calculate the authentication key AK and use a third hash function. Two-way authentication is performed, with the mobile device calculating the first authentication code. The code is then sent to the NFC passive lock for verification. After successful verification, the NFC passive lock calculates a second authentication code. And send it to the mobile device for verification;

[0009] S4, after mutual authentication is successful, both parties use KDF based on a shared secret. Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key.

[0010] Furthermore, in S1, the first temporary private key and the first random number Generated by a 256-bit secure random number generator.

[0011] Furthermore, the first random number Input the built-in PUF to generate a second temporary private key ,include:

[0012] PUF is the physically unclonable function of the arbitrator, which sets the first random number. The challenge value is input to the arbitrator PUF, and a stable second temporary private key is extracted from the response value output by the arbitrator PUF using a fuzz extractor. .

[0013] Furthermore, the NFC passive lock calculates... × and Obtain shared elliptic curve points ,include:

[0014] NFC passive locks identify themselves With the first random number received Perform concatenation; use the first hash function. Calculate the hash digest value and convert it into an integer h; calculate the elliptic curve points. From the first temporary public key received Subtraction point Get the adjusted points Using a second temporary private key For the adjusted points Perform scalar multiplication on elliptic curves to obtain the points on the shared elliptic curve. .

[0015] Furthermore, using a third hash function Two-way authentication includes:

[0016] The mobile device uses the authentication key AK as the key to access the first temporary public key. Serialized byte string and second random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate the first authentication code. ;

[0017] The NFC passive lock received the first authentication code. Then, the first authentication code used for verification is calculated locally in the same way. ,like and If they are equal, the mobile authentication is successful;

[0018] The NFC passive lock uses the authentication key AK as the key and the second temporary public key. Serialized byte string and first random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate a second authentication code. ;

[0019] Received second authentication code on mobile device Then, the second authentication code used for verification is calculated locally in the same way. ,like and If they are equal, the NFC passive lock authentication is successful.

[0020] Furthermore, the third hash function It is a message authentication code algorithm based on SHA-256.

[0021] Furthermore, leveraging KDF, based on shared secrets Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key, including:

[0022] By employing hash-based message authentication code extraction and extension KDF, a shared secret will be established. After being serialized into a byte string, it is used as the input key material, and the first random number is... Second random number The concatenated value is used as the salt value, and the shared elliptic curve points are... The y-coordinate is serialized into a byte string and used as application-specific information to derive a 128-bit session key.

[0023] Furthermore, in S1, the first hash function It uses the SHA-256 algorithm.

[0024] Furthermore, in S1, the elliptic curve is the secp256r1 curve.

[0025] Secondly, the present invention provides a two-way authentication and session key negotiation system for NFC passive locks, including a memory and a processor. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the above-mentioned two-way authentication and session key negotiation method for NFC passive locks is implemented.

[0026] The beneficial effects are as follows: This invention utilizes a physically unclonable function to respond to a random number challenge on the mobile device to generate a temporary private key for the NFC passive lock, which can resist hardware attacks such as side-channel attacks and physical extraction. By integrating the identity identifier of the NFC passive lock into the calculation process of the temporary public key on the mobile device, an implicit binding between key exchange and identity information is achieved, making the key negotiation process inherently resistant to man-in-the-middle attacks and enhancing the intrinsic security of the protocol. After establishing a shared secret, an explicit two-way authentication challenge and response mechanism containing random numbers is designed, which can not only mutually confirm the authenticity of each other's identities but also prevent replay attacks. This method achieves secure two-way authentication and key negotiation without increasing the hardware storage burden of the NFC passive lock, improving its resistance to physical and network attacks, and ensuring the confidentiality and integrity of communication. Attached Figure Description

[0027] Figure 1 This is a flowchart of the two-way authentication and session key negotiation method for NFC passive locks. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] An embodiment of the two-way authentication and session key negotiation method for NFC passive locks provided by this invention:

[0030] like Figure 1 As shown, the two-way authentication and session key negotiation method for NFC passive locks includes the following steps:

[0031] S1, Generate the first temporary private key on the mobile device. and the first random number And based on the identity identifier of the NFC passive lock First random number The first base point G and the second base point P of the elliptic curve are determined using the first hash function. Calculate the first temporary public key , give the first temporary public key and the first random number Send to the NFC passive lock.

[0032] Specifically, the mobile app uses standard elliptic curves such as secp256r1, with publicly available parameters including the first base point G. A second base point P of another publicly available elliptic curve is pre-defined. The mobile app generates an integer using a cryptographically secure random number generator. As the first temporary private key, and a 128-bit first random number NFC passive lock identification It is a unique serial number. First hash function. It is SHA-256. The mobile device will... and The components are concatenated, a hash value is calculated using SHA-256, and this hash value is used as a scalar. The mobile device performs two elliptic curve scalar multiplication operations. ×G and ( || The temporary public key point is obtained by performing a 1x1000 P operation and an elliptic curve point addition operation. The mobile device transmits the first temporary public key via the NFC communication interface. coordinates and the first random number Send to the NFC passive lock.

[0033] In an optional embodiment, the first temporary private key and the first random number Generated by a 256-bit secure random number generator; first hash function The algorithm used is SHA-256; the elliptic curve is the secp256r1 curve.

[0034] Specifically, the hardware security module inside the mobile device calls a secure random number generator compliant with the NISTSP800-90A standard, which continuously collects noise from physical entropy sources. This process generates 256-bit random numbers twice consecutively.

[0035] The first generated random number serves as the first temporary private key. ,For example The value is the hexadecimal number 18E14A7B6A307F426A94F8114701E7C8E774E7F9A47E2C2035DB29A206321725. The second randomly generated number is used as the first random number. ,For example The value is the hexadecimal number C9A3F45B8E6F4B2D8C1A7E9F6D5C4B3A29E8D7C6B5A4F392E1D0C9B8A7F6E5D4.

[0036] It uniformly adopts internationally recognized and security-verified cryptographic standards. First hash function. The algorithm specified is SHA-256, which maps input data of arbitrary length to a fixed 256-bit hash value. Elliptic curve cryptography uses the secp256r1 curve, which provides 128 bits of security strength. Parameters such as the base point P and order n are publicly available standards, ensuring interoperability and security across different devices. For example, the x-coordinate of the base point P is: 6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296.

[0037] S2, NFC passive lock receives the first temporary public key and the first random number Then, the first random number Input the built-in PUF to generate a second temporary private key And generate a second random number. Calculate the second temporary public key = ×G, will give the second temporary public key Second random number Send to the mobile device; the mobile device and the NFC passive lock respectively calculate... × and Obtain shared elliptic curve points and from the shared elliptic curve point Extract the x-coordinate as a shared secret. .

[0038] Specifically, the NFC passive lock receives energy and data via an antenna. and It will receive The PUF circuitry serves as an input to the internal challenge mechanism. Based on its unique physical microstructure, the PUF circuitry responds to the challenge... This generates a unique, unpredictable, but repeatable response. This response is then hashed using SHA-256 and modulo the order of the elliptic curve to obtain an integer, which serves as the second temporary private key. Meanwhile, the NFC passive lock utilizes a hardware random number generator to produce a second 128-bit random number. The NFC passive lock performs one elliptic curve scalar multiplication operation. ×G, obtain the second temporary public key The NFC passive lock connects via the NFC interface. and Send back to the mobile device.

[0039] Receive the second temporary public key on the mobile device Then, use the first temporary private key you hold. right Perform elliptic curve scalar multiplication, that is, calculate... The NFC passive lock terminal uses the same first hash function as the mobile phone terminal. Identity identification and the first random number received Calculate The value is used to perform elliptic curve point subtraction, starting from the received first temporary public key. Subtract this value from the middle to get the intermediate result. NFC passive lock uses a second temporary private key. Perform scalar multiplication on this intermediate result, i.e., calculate... Due to the commutative law of elliptic curve operations, the shared elliptic curve points calculated by both parties... They are exactly the same. Both sides extract the shared elliptic curve points. The x-coordinate component is used as a shared secret. .

[0040] In an optional embodiment, the first random number is... Input the built-in PUF to generate a second temporary private key ,include:

[0041] PUF is the physically unclonable function of the arbitrator, which sets the first random number. The challenge value is input to the arbitrator PUF, and a stable second temporary private key is extracted from the response value output by the arbitrator PUF using a fuzz extractor. .

[0042] Specifically, the NFC passive lock's chip integrates a 64-level arbiter physically unclonable function. When the lock receives a 256-bit first random number... At that time, it will The first 64 bits are used as the challenge value. Each challenge value controls the selection input of a first-stage multiplexer, thus determining the path of a pair of parallel circuits. Due to submicron-level physical differences in the manufacturing process, there will always be a slight difference in the signal transmission delay between the two paths. An arbitrator at the end of the circuit determines which path's signal arrives first, outputting a 1-bit response value of 0 or 1. This process is repeated four times, using the first random number. Different segments are used as challenge values ​​to generate a 256-bit raw response.

[0043] Specifically, due to fluctuations in ambient temperature and voltage, the arbiter's PUF response to the same challenge value may contain a small number of bit errors, making it unstable. To generate a fixed private key, a PUF response measurement is performed during the initialization phase before the lock leaves the factory, from which a stable 256-bit second temporary private key is generated. And an auxiliary data string. This auxiliary data string does not reveal any information about... Any information is stored in the lock's non-volatile memory. During the actual authentication process, when the PUF determines the challenge value... When a new, potentially noisy, response is generated, the fuzzy extractor algorithm combines the noisy response with a pre-stored auxiliary data string and uses an error-correcting code mechanism to recover the second temporary private key, which is identical to the one used in the initialization phase. .

[0044] In an optional embodiment, the NFC passive lock respectively calculates Obtain shared elliptic curve points ,include:

[0045] NFC passive locks identify themselves With the first random number received Perform concatenation; use the first hash function. Calculate the hash digest value and convert it into an integer h; calculate the elliptic curve points. From the first temporary public key received Subtraction point Get the adjusted points Using a second temporary private key For the adjusted points Perform scalar multiplication on elliptic curves to obtain the points on the shared elliptic curve. .

[0046] Specifically, assuming the identity identifier of an NFC passive lock The first random number received is byte string 4C4F434B303031. The byte string is C9A3...E5D4. The NFC passive lock concatenates the two byte strings sequentially into a new long byte string. It takes the concatenated byte string as input and calls the SHA-256 algorithm to calculate a 256-bit hash digest value. This digest value is interpreted as a large integer h. The NFC passive lock performs elliptic curve scalar multiplication, multiplying the integer h by the second base point P of the secp256r1 curve to obtain a new elliptic curve point, denoted as... .

[0047] The first temporary public key sent from the mobile device It is itself an elliptic curve point. The NFC passive lock performs subtraction on elliptic curve points, that is, using... Subtract the points calculated above Result point Subtraction of a point on an elliptic curve is defined as adding the negative of a point. NFC passive locks use a second temporary private key generated via PUF. A 256-bit integer, for points Perform elliptic curve scalar multiplication. The result of the operation is the shared elliptic curve points. This point contains secret information from both the mobile device and the lock, laying the foundation for the subsequent generation of session keys.

[0048] S3, based on shared secrets and identity identifier Using the second hash function Calculate the authentication key AK and use a third hash function. Two-way authentication is performed, with the mobile device calculating the first authentication code. The code is then sent to the NFC passive lock for verification. After successful verification, the NFC passive lock calculates a second authentication code. And send it to the mobile device for verification.

[0049] Specifically, the second hash function and the third hash function Both are SHA-256 encoded. The two parties will share the secret. Identity identifier with NFC passive lock To splice together, using Calculate the hash value to generate the authentication key AK. The mobile device then sends the authentication key AK and its own first temporary public key to the device. and the second random number received from the lock end To splice together, using Calculate the hash value to obtain the first authentication code. The NFC passive lock then calculates an authentication code in the same way and sends it to the received NFC passive lock. A bit-by-bit comparison is performed; if they match completely, the mobile device authentication is successful. After successful verification, the NFC passive lock sends the authentication key AK and its own second temporary public key. and the first random number received from the mobile device To splice together, using Calculate the hash value to obtain the second authentication code. The data is then sent to the mobile device. The mobile device performs the same calculation and comparison; if they match, the NFC passive lock is successfully authenticated.

[0050] In an optional embodiment, a third hash function is used. Two-way authentication includes:

[0051] The mobile device uses the authentication key AK as the key to access the first temporary public key. Serialized byte string and second random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate the first authentication code. ;

[0052] The NFC passive lock received the first authentication code. Then, the first authentication code used for verification is calculated locally in the same way. ,like and If they are equal, the mobile authentication is successful;

[0053] The NFC passive lock uses the authentication key AK as the key and the second temporary public key. Serialized byte string and first random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate a second authentication code. ;

[0054] Received second authentication code on mobile device Then, the second authentication code used for verification is calculated locally in the same way. ,like and If they are equal, the NFC passive lock authentication is successful.

[0055] Specifically, to verify the legitimacy of the mobile device, the mobile device first sends the first temporary public key. The serialized string is compressed to 33 bytes according to the X9.62 standard, and then combined with the 32-byte second random number generated by the NFC passive lock. Concatenate them into a 65-byte message. The mobile device uses the pre-shared authentication key AK as... The function's key calculates the message authentication code for a 65-byte message and generates the first authentication code. And send it to the lock. The lock receives it. Then, using their stored authentication key AK and the known first temporary public key... And the second random number I generated myself Repeat the exact same splicing and calculation process locally to obtain a verification code. By comparing byte by byte and received If they are completely identical, it proves that the message source is a mobile device holding the correct authentication key AK, and the authentication is successful.

[0056] To verify the legitimacy of the NFC passive lock, the authentication process is reversed once. The NFC passive lock transmits the second temporary public key. The serialized string is converted to a 33-byte string, and then compared with the first 32-byte random number sent from the mobile device. Concatenate them into a 65-byte message. The NFC passive lock uses the same authentication key AK, through... The function calculates the second authentication code. And send it to the mobile device. The mobile device receives the second authentication code. Then, similarly, they used their stored authentication key AK and the known second temporary public key locally. And the first random number you generated Perform the same calculation to obtain the verification code. If the calculated With received If the identities are completely equal, the mobile phone confirms the legitimacy of the NFC passive lock. At this point, two-way authentication is complete, ensuring that the identities of both communicating parties are trustworthy.

[0057] In an optional embodiment, the third hash function It is a message authentication code algorithm based on SHA-256.

[0058] Specifically, during two-way authentication, a first authentication code is generated. Second authentication code The third hash function It is explicitly identified as the HMAC-SHA256 algorithm. The HMAC-SHA256 algorithm is a key-based hash function that uses SHA-256 as its core hash engine. When the mobile device calculates the first authentication code... At that time, it uses the authentication key AK and the concatenated message data as the two inputs to the HMAC-SHA256 function.

[0059] The HMAC-SHA256 calculation process follows the RFC2104 standard. The authentication key AK is processed by internal and external padding constants, and the processed key is then subjected to two consecutive SHA-256 hash operations with the message data. This process produces a 256-bit output, the authentication code. For example, the mobile device calculates the first authentication code. The formula is HMAC-SHA256. Due to the characteristics of the HMAC algorithm, even if an attacker intercepts the message and authentication code, they cannot forge or tamper with a new authentication code without knowing the authentication key AK, thus ensuring the security of the authentication process.

[0060] S4, after mutual authentication is successful, both parties use KDF based on a shared secret. Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key.

[0061] Specifically, after both authentication steps are successful, both parties use a standard key derivation function (KDF), such as the HMAC-based key derivation function HKDF-SHA256. The two parties will then share the secret. That is, sharing elliptic curve points The x-coordinate is used as the initial key material to share elliptic curve points. y-coordinate, first random number on mobile device And the second random number of NFC passive lock The concatenated data is used as salt or context information and input into the KDF. The KDF then performs extraction and expansion stages to generate a session key of a predetermined length, such as 128 bits or 256 bits. This session key can be used with symmetric encryption algorithms such as AES to protect the confidentiality and integrity of subsequent communications.

[0062] In an optional embodiment, KDF is utilized, based on a shared secret. Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key, including:

[0063] By employing hash-based message authentication code extraction and extension KDF, a shared secret will be established. After being serialized into a byte string, it is used as the input key material, and the first random number is... Second random number The concatenated value is used as the salt value, and the shared elliptic curve points are... The y-coordinate is serialized into a byte string and used as application-specific information to derive a 128-bit session key.

[0064] Specifically, the key derivation process is divided into two stages: extraction and expansion. In the extraction stage, the function extracts the shared secret calculated on the mobile device. Convert it into a 32-byte input key material IKM. Simultaneously, generate a 32-byte first random number. With a second random number of 32 bytes The salt is concatenated into a 64-byte salt value. HKDF extraction uses this salt value to perform an HMAC operation on the input key material IKM, such as HMAC-SHA256, generating a high-entropy 32-byte pseudo-random key PRK. While this PRK is not the final session key, it is a cryptographically strong intermediate key.

[0065] During the expansion phase, the function uses the pseudo-random key PRK generated in the previous step as the HMAC key. To bind the generated session key to the current communication context, the shared elliptic curve points calculated by both parties are... The y-coordinate is extracted and serialized into a 32-byte string, serving as the application-specific information `info`. The expansion step generates key material by performing an HMAC operation on `info`, with the formula HMAC-SHA256(PRK, info||0x01). Since the target session key length is 128 bits (16 bytes), the HKDF expansion function truncates the first 16 bytes from the output as the final session key. This key will be used in symmetric encryption algorithms such as AES to protect the confidentiality and integrity of subsequent communications.

[0066] An embodiment of the NFC passive lock two-way authentication and session key negotiation system provided by the present invention:

[0067] The NFC passive lock two-way authentication and session key negotiation system includes a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement the above-mentioned NFC passive lock two-way authentication and session key negotiation method.

[0068] The two-way authentication and session key negotiation system of the NFC passive lock also includes other components well known to those skilled in the art, such as communication interfaces. Their settings and functions are known in the art and will not be described in detail here.

[0069] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions stored or otherwise maintained by such a computer-readable medium.

[0070] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for mutual authentication and session key agreement of NFC passive lock, characterized in that, The method comprises the following steps: S1, the mobile phone end generates a first temporary private key and a first random number , and based on the identity of the NFC passive lock , the first random number , the first base point G and the second base point P of the elliptic curve, the first hash function calculates the first temporary public key , the first temporary public key and the first random number are sent to the NFC passive lock; S2, NFC passive lock receives the first temporary public key and the first random number Then, the first random number is input into the built-in PUF to generate a second temporary private key , and a second random number is generated = × G, the second temporary public key and the second random number are sent to the mobile phone end; the mobile phone end and the NFC passive lock respectively obtain the shared elliptic curve point × and by calculating from the shared elliptic curve point , and the x coordinate is extracted as the shared secret ; S3, both sides based on shared secret and identity , using the second hash function authentication key AK is calculated, and using the third hash function two-way authentication, wherein the mobile phone side calculates the first authentication code and sent to the NFC passive lock for verification, NFC passive lock in the verification through the calculation of the second authentication code and sent to the mobile phone for verification; S4, after the two-way authentication is passed, the two parties use KDF to calculate the session key based on the shared secret , the y-coordinate of the shared elliptic curve point , the first random number and the second random number .

2. The mutual authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, S1, the first temporary private key and the first random number generated by a 256-bit secure random number generator.

3. The mutual authentication and session key agreement method of NFC passive lock according to claim 1, wherein, The first random number Inputting the built-in PUF generates a second temporary private key , comprising: PUF is a physical unclonable function of the arbitrator, and the first random number is input as a challenge value to the arbitrator PUF, and a stable second temporary private key is extracted from a response value output from the arbitrator PUF using a fuzzy extractor .

4. The mutual authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, NFC passive lock is obtained by calculating and obtaining a shared elliptic curve point , comprising:​ The NFC passive lock will identify itself with the received first random number and perform splicing; using a first hash function to calculate a hash digest value and convert the hash digest value into an integer h; calculate the elliptic curve point ; subtract the point from the received first temporary public key to obtain an adjusted point ; using the second temporary private key to perform elliptic curve scalar multiplication operation on the adjusted point to obtain a shared elliptic curve point .

5. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, wherein, Utilizing a third hash function Performing mutual authentication, comprising: The mobile device uses the authentication key AK as the key to access the first temporary public key. Serialized byte string and second random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate the first authentication code. ; NFC passive lock receives the first authentication code After, the first authentication code for verification is calculated in the same way locally If Is equal to , the authentication mobile terminal passes The NFC passive lock uses the authentication key AK as the key and the second temporary public key. Serialized byte string and first random number The concatenation is performed, and the concatenation result is used to calculate the message authentication code to generate a second authentication code. ; The mobile phone receives the second authentication code After that, the second authentication code for verification is calculated in the same way locally If is equal to , the NFC passive lock is authenticated.

6. The bidirectional authentication and session key agreement method of NFC passive lock according to claim 1 or 5, characterized in that, Third hash function is a message authentication code algorithm based on SHA-256.

7. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, Using KDF, based on shared secrets Shared elliptic curve points y-coordinate, first random number Second random number Calculate the session key, including: A shared secret is used to derive a 128-bit session key using an extraction and expansion KDF based on a hash-based message authentication code The first random number and the concatenation of the second random number are serialized into byte strings and used as salt values, and the y-coordinate of a shared elliptic curve point is serialized into a byte string and used as application-specific information.

8. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, characterized in that, In S1, the first hash function is the SHA-256 algorithm.

9. The bidirectional authentication and session key agreement method of the NFC passive lock according to claim 1, wherein, In S1, the elliptic curve is a secp256r1 curve.

10. A bidirectional authentication and session key agreement system for NFC passive lock, characterized in that, The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method for bidirectional authentication and session key negotiation of the NFC passive lock according to any one of claims 1-9 is realized.

Images