An identity feature-based target range system bidirectional authentication method and system

Abstract

This invention discloses a two-way authentication method and system for a target range system based on identity features, belonging to the field of target range system security technology. It includes three verification stages: the control server first generates a random challenge value and sends it to the target device; the target device calculates a response value using a non-cloning function and returns it. After successful verification, both parties exchange and confirm random numbers through hash operations, ultimately establishing a secure communication link. By dynamically generating random challenge values ​​and combining a two-way authentication mechanism using non-cloning functions and hash chains, it solves the problems of identity forgery, man-in-the-middle attacks, and replay attacks in traditional methods, offering advantages such as improved identity authentication security and ensured communication reliability.

Description

Technical Field

[0001] This invention belongs to the field of range system security technology, specifically relating to a two-way authentication method and system for range systems based on identity features. Background Technology

[0002] In recent years, the importance of cybersecurity has become increasingly prominent. With the continuous advancement of the construction of critical information infrastructure such as network ranges and realistic training platforms, range systems have become important platforms for improving network security defense capabilities and verifying attack and defense technologies. A range system mainly consists of target devices and a control server. The target devices simulate various terminals or server nodes in a real network environment, while the control server manages multiple target devices and monitors and analyzes their operational status. However, in realistic attack and defense exercises, target devices are often exposed to simulated attack environments. These devices may have security vulnerabilities due to improper configuration, lack of protection mechanisms, or failure to update patches in a timely manner, making them highly vulnerable to attacks. Once compromised, the range system may be maliciously manipulated, sensitive data may be leaked, and the stability of the entire training environment may be affected. Therefore, ensuring secure communication and authentication between target devices and the control server is crucial. Traditional authentication methods typically employ one-way authentication or simple two-way authentication mechanisms, which are susceptible to security vulnerabilities such as identity forgery and man-in-the-middle attacks, failing to meet the high-security authentication requirements of range systems. In particular, the lack of reliable authentication methods based on inherent device characteristics during device authentication makes it possible for attackers to gain system privileges by impersonating devices. Furthermore, existing authentication schemes lack dynamic challenge mechanisms during the authentication process, making them ineffective against security threats such as replay attacks. Therefore, existing technologies urgently need improvement to address these issues. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a two-way authentication method and system for a target range system based on identity features, so as to solve the problem that there is no secure communication and identity authentication method between the target device and the control server in the prior art.

[0004] To achieve the above objectives, the present invention employs the following technical solution: A two-way authentication method for a target range system based on identity features includes the following steps: S1, the control server generates a random challenge value C and sends it to the target device. The target device calculates the first response value R1 using a non-cloning function and returns it. If the control server verifies that R1 matches, the pre-authentication is successful; otherwise, the process terminates. S2, the control server generates a first random number N1, calculates a first hash value H1, and sends it to the target device; the target device verifies the first hash value H1, and if the verification is successful, it generates a second random number N2, calculates a second hash value H2, and sends it to the control server; the control server authenticates the second random number N2 and the second hash value H2, and if the authentication is successful, it proceeds to the next step; otherwise, the process terminates. S3, the control server sends an ACK, and the target device receives it and successfully authenticates.

[0005] A further improvement of the present invention is that: Preferably, in S1, the control server generates a random challenge value C based on the system clock and a random number; the control server sends the random challenge value C to the target device through a confidential channel.

[0006] Preferably, in S1, the first response value R1 = PUF(Identity_TD, C), where Identity_TD is the unique identifier of the target device; In S1, the control server verifies whether R1 matches the locally calculated PUF(Identity_TD, C) to confirm whether they are compatible.

[0007] Preferably, in S2, the process of the control server generating a first random number N1 and calculating a first hash value H1 is as follows: the control server generates a first random number N1 and calculates a first hash value H1 based on its built-in PUF module and the securely stored identity identifier, where the first hash value H1 = HASH(PUF(Identity_CS, N1) || N1).

[0008] Preferably, the control server sends an authentication data packet containing a first random number N1 and a first hash value H1 to the target device.

[0009] Preferably, in S2, after the target device receives the authentication data packet, it first verifies the timeliness of the data packet, calculates the response value using the pre-stored identity identifier and the received first random number N1, and recalculates the hash value by combining the response value with the first random number N1. It then verifies whether the first hash value H1 and the recalculated hash value are equal. If they are equal, the verification is successful; otherwise, the verification fails.

[0010] Preferably, in S2, the second hash value is HASH(Identity_TD || Identity_CS || N1 || N2), where Identity_TD is the unique identity of the target device and Identity_CS is the unique identity of the control server.

[0011] Preferably, in S2, the control server calculates a third hash value H3 based on the target device's unique identity (Identity_TD), the control server's unique identity (Identity_CS), a first random number N1, and a second random number N2 stored locally. It then compares whether the third hash value H3 is consistent with the second hash value H2. If they are consistent, the authentication is successful.

[0012] Preferably, in S3, after confirming successful two-way authentication, the control server generates an ACK, which includes at least the session ID, timestamp, and authentication validity period.

[0013] A two-way authentication system for a target range system based on identity features, comprising: The pre-authentication module involves the control server generating a random challenge value C and sending it to the target device. The target device calculates the first response value R1 using a non-cloning function and returns it. If the control server verifies that R1 matches, the pre-authentication is successful; otherwise, the process terminates. The two-way authentication module involves the control server generating a first random number N1, calculating a first hash value H1, and sending it to the target device. The target device verifies the first hash value H1. If the verification is successful, the target device generates a second random number N2, calculates a second hash value H2, and sends it to the control server. The control server authenticates the second random number N2 and the second hash value H2. If the authentication is successful, the next step is executed; otherwise, the process is terminated. Once the authentication is complete, the control server sends an ACK, and the target device receives it and the authentication is successful.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention employs a triple authentication mechanism to perform two-way authentication on both the target device and the control server, ensuring the security of both parties' identities and communication. First, the target device is pre-authenticated using the response value to initially verify its identity. Second, the control server is authenticated based on the hash calculation result to ensure its legitimacy. Finally, the target device is authenticated again based on the hash calculation result to ensure its legitimacy.

[0015] 2. This invention uses a Physically Unclonable Function (PUF) to authenticate the control server and introduces random numbers, increasing the dynamism and unpredictability of authentication, making it difficult for attackers to forge authentication information and enhancing the security of the authentication process and the control server's identity. Attached Figure Description

[0016] Figure 1 This is a flowchart of the present invention; Figure 2 This is a system composition diagram of the present invention. Detailed Implementation

[0017] Hereinafter, the terms "first," "second," "third," and "fourth" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first," "second," "third," or "fourth" may explicitly or implicitly include one or more of that feature.

[0018] The synchronization method provided in this application can be applied to mobile phones, tablets, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, and ultra-mobile personal computers. In this application, the specific type of terminal device is not limited to terminal devices such as mobile personal computers (UMPCs), netbooks, and personal digital assistants (PDAs).

[0019] It should be noted that the terms "first," "second," etc., used in the specification and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] The first aspect of this invention discloses a two-way authentication method for a target range system based on identity features, comprising the following steps: S1, the control server generates a random challenge value C and sends it to the target device. The target device calculates the first response value R1 using a non-cloning function and returns it. If the control server verifies that R1 matches, the pre-authentication is successful; otherwise, the process terminates. S2, the control server generates a first random number N1, calculates a first hash value H1, and sends it to the target device; the target device verifies the first hash value H1, and if the verification is successful, it generates a second random number N2, calculates a second hash value H2, and sends it to the control server; the control server authenticates the second random number N2 and the second hash value H2, and if the authentication is successful, it proceeds to the next step; otherwise, the process terminates. S3, the control server sends an ACK, and the target device receives it and successfully authenticates.

[0021] This invention proposes a two-way authentication method for a target range system based on identity features, comprising three verification stages. The control server first generates a random challenge value and sends it to the target device. The target device calculates a response value using a non-cloning function and returns it. After successful verification, both parties exchange and confirm random numbers through hash operations, ultimately establishing a secure communication link. The random challenge value refers to dynamic data used to verify the device's identity, which can be implemented using a timestamp and random number generator combination. This mechanism ensures the uniqueness of each authentication process. The non-cloning function is a hardware function based on the device's physical characteristics, which can be implemented using an SRAM PUF or a ring oscillator circuit. It generates an uncopyable response value by extracting the device's inherent physical characteristics. The hash value is a data digest generated using a cryptographic algorithm, specifically the SHA-256 algorithm, used to verify data integrity and identity authenticity. The two-way authentication process refers to the mutual verification process between the control server and the target device, which can be implemented using a challenge-response mechanism combined with hash chain technology, completing identity confirmation and key negotiation in stages.

[0022] Specifically, the authentication process is executed in three stages. In the first stage, the control server generates a dynamic challenge value and transmits it to the target device. The target device calls a physically unclonable function to generate a response code, and the server completes initial authentication by comparing it with pre-stored feature values. In the second stage, both parties exchange random numbers and generate a hash chain. The control server verifies whether the hash value generated by the target device contains the correct combination of identity information and random numbers. In the third stage, a final handshake is completed through an acknowledgment message, establishing an encrypted communication channel. The entire process uses a step-by-step verification mechanism to ensure reliable confirmation of the identities of both parties and prevent man-in-the-middle attacks.

[0023] In some embodiments of the present invention, in S1, the control server generates a random challenge value C based on the system clock and a random number; the control server sends the random challenge value C to the target device through a confidential channel.

[0024] In some embodiments of the present invention, in S1, the first response value R1 = PUF(Identity_TD, C), where Identity_TD is the unique identifier of the target device; In S1, the control server verifies whether R1 matches the locally calculated PUF(Identity_TD, C) to confirm whether they are compatible.

[0025] In some embodiments of the present invention, in S2, the process of the control server generating a first random number N1 and calculating a first hash value H1 is as follows: the control server generates a first random number N1 and calculates a first hash value H1 based on its built-in PUF module and the securely stored identity identifier, wherein the first hash value H1 = HASH(PUF(Identity_CS, N1) || N1).

[0026] In some embodiments of the present invention, the control server sends an authentication data packet containing a first random number N1 and a first hash value H1 to the target device.

[0027] In some embodiments of the present invention, in S2, after the target device receives the authentication data packet, it first verifies the timeliness of the data packet, calculates the response value using the pre-stored identity identifier and the received first random number N1, and recalculates the hash value by combining the response value with the first random number N1. It then verifies whether the first hash value H1 and the recalculated hash value are equal. If they are equal, the verification is successful; otherwise, the verification fails.

[0028] In some embodiments of the present invention, in S2, the second hash value is HASH(Identity_TD ||Identity_CS || N1 || N2), where Identity_TD is the unique identity of the target device and Identity_CS is the unique identity of the control server.

[0029] In some embodiments of the present invention, in S2, the control server calculates a third hash value H3 based on the locally stored unique identity of the target device (Identity_TD), the unique identity of the control server (Identity_CS), a first random number N1, and a second random number N2. The control server then compares whether the third hash value H3 is consistent with the second hash value H2. If they are consistent, the authentication is successful.

[0030] In some embodiments of the present invention, in S3, after confirming successful two-way authentication, the control server generates an ACK, which includes at least a session ID, a timestamp, and an authentication validity period.

[0031] In one specific embodiment, a two-way authentication method for a target range system based on identity features is disclosed. This method ensures the two-way identity trustworthiness between the target device and the control server through a multi-layered security verification mechanism, effectively preventing security threats such as man-in-the-middle attacks and identity forgery. The method includes the following steps: S1, Pre-certification Phase (Challenge-Response Verification) S11, Challenge Generation: The Control Server first generates a high-entropy random challenge value C based on the system clock and a random number generator, and then transmits the challenge value C unidirectionally to the Target Device through a pre-established encrypted secure channel (such as a TLS / SSL encrypted tunnel) to ensure that the transmission process is not eavesdropped on or tampered with.

[0032] S12, Response Calculation: After receiving the challenge value C, the target device immediately calls its hardware-integrated Physically Unclonable Function (PUF) module. This PUF module generates a unique response based on the microscopic physical structure differences naturally formed during the manufacturing process of the target device. Specifically, the response value R1 = PUF(Identity_TD, C) is calculated, where Identity_TD is an unchangeable unique identifier burned into the target device during production, usually a 64-bit or 128-bit device fingerprint code.

[0033] S13, Pre-authentication verification: The control server simultaneously retrieves the registered PUF feature parameters of the target device from its local secure storage area, calculates the PUF(Identity_TD, C) locally using the same Identity_TD and the received challenge value C, and compares the calculation result bit-by-bit with the received R1 for verification. If the two are completely consistent, the target device is confirmed to have successfully pre-authenticated and proceeds to the subsequent authentication process; otherwise, a security alarm is immediately triggered and the entire authentication process is terminated, while a failure log is recorded for security auditing.

[0034] S2, Two-way authentication phase S21, Server Authentication: (1) The control server first generates a highly random first random number N1, and calculates the composite hash value H1 = HASH(PUF(Identity_CS, N1) || N1) based on its built-in PUF module and the securely stored identity identifier Identity_CS (which is also a unique device code). The HASH function uses collision-resistant hash algorithms such as SM3 or SHA-3.

[0035] (2) The authentication data packet containing the first random number N1 and the calculated first hash value H1 is sent to the target device through a secure channel. The data packet also contains a timestamp and a sequence number to prevent replay attacks.

[0036] S22, Target Equipment Verification: (1) After receiving (N1, H1), the target device first verifies the timeliness of the data packet (e.g., checks whether the timestamp is within the allowed time window). Then, using the pre-stored Identity_CS and the received N1, it calculates the response value PUF(Identity_CS, N1) in the local PUF module and recalculates the HASH value by combining N1. It then verifies whether H1 is equal to the locally calculated HASH(PUF(Identity_CS, N1) || N1). If the verification fails, the authentication process is immediately terminated and a failure response is sent to the control server; otherwise, the next step is executed after the verification is successful.

[0037] (2) The target device generates another independent high-entropy random number N2, calculates a composite hash value H2 = HASH(Identity_TD || Identity_CS || N1 || N2) containing the identity identifiers of both parties and the two random numbers, and securely transmits the H2 value together with N2 to the control server to form a challenge response to the control server.

[0038] S23, Control Server Verification: After receiving H2 and N2 from the target device, the control server uses the locally stored Identity_TD, Identity_CS, its own generated N1, and the received N2 to recalculate the third hash value H3 = HASH(Identity_TD || Identity_CS || N1 || N2) using the same algorithm. The calculated result is then rigorously compared with the received H2. If verification fails, the authentication process terminates and a security protection mechanism is activated. Only when the verification is completely consistent is the legitimacy of the target device confirmed, and both parties enter the authentication completion phase.

[0039] S3, Certification Completion Phase S31, Command Sending: After confirming that both authentications are successful, the control server generates an authentication success command ACK containing information such as session ID, timestamp, and authentication validity period, and sends it to the target device through a secure channel. This command may also contain encryption key parameters required for subsequent communication.

[0040] S32, Authentication Complete: After receiving a valid ACK command, the target device completes the entire authentication process, establishing a secure and reliable communication session between the two parties. Encrypted data transmission, remote control, or other trusted operations can then be performed. This authentication method achieves highly reliable two-way authentication of device identities within the range system through hardware-level security features of physically unclonable functions and a multi-factor challenge-response mechanism.

[0041] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0042] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0043] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0044] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A two-way authentication method for a target range system based on identity features, characterized in that, Includes the following steps: S1, the control server generates a random challenge value C and sends it to the target device. The target device calculates the first response value R1 using a non-cloning function and returns it. If the control server verifies that R1 matches, the pre-authentication is successful; otherwise, the process terminates. S2, the control server generates a first random number N1, calculates a first hash value H1, and sends it to the target device; The target device verifies the first hash value H1. After successful verification, the target device generates a second random number N2, calculates the second hash value H2, and sends it to the control server. The control server authenticates the second random number N2 and the second hash value H2. If the authentication is successful, the next step is executed; otherwise, the process is terminated. S3, the control server sends an ACK, and the target device receives it and successfully authenticates.

2. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S1, the control server generates a random challenge value C based on the system clock and a random number; the control server sends the random challenge value C to the target device through a confidential channel.

3. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S1, the first response value R1 = PUF(Identity_TD, C), where Identity_TD is the unique identifier of the target device; In S1, the control server verifies whether R1 matches the locally calculated PUF(Identity_TD, C) to confirm whether they are compatible.

4. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S2, the process of the control server generating a first random number N1 and calculating a first hash value H1 is as follows: the control server generates a first random number N1 and calculates a first hash value H1 based on its built-in PUF module and the securely stored identity identifier. The first hash value H1 = HASH(PUF(Identity_CS, N1) || N1).

5. The two-way authentication method for a target range system based on identity features according to claim 4, characterized in that, The control server sends an authentication data packet containing a first random number N1 and a first hash value H1 to the target device.

6. The two-way authentication method for a target range system based on identity features according to claim 4, characterized in that, In S2, after the target device receives the authentication data packet, it first verifies the timeliness of the data packet, calculates the response value using the pre-stored identity identifier and the received first random number N1, and recalculates the hash value by combining the response value with the first random number N1. It then verifies whether the first hash value H1 and the recalculated hash value are equal. If they are equal, the verification is successful; otherwise, the verification fails.

7. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S2, the second hash value is HASH(Identity_TD || Identity_CS || N1 || N2), where Identity_TD is the unique identity of the target device and Identity_CS is the unique identity of the control server.

8. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S2, the control server calculates a third hash value H3 based on the target device's unique identity (Identity_TD) stored locally, the control server's unique identity (Identity_CS), a first random number N1, and a second random number N2. It then compares whether the third hash value H3 is consistent with the second hash value H2. If they are consistent, the authentication is successful.

9. The two-way authentication method for a target range system based on identity features according to claim 1, characterized in that, In S3, after confirming the success of two-way authentication, the control server generates an ACK, which includes at least the session ID, timestamp, and authentication validity period.

10. A two-way authentication system for a target range system based on identity features, characterized in that, include: The pre-authentication module controls the server to generate a random challenge value C and send it to the target device. The target device calculates the first response value R1 using a non-cloning function and returns it. If the control server verifies that R1 matches, the pre-authentication is successful; otherwise, the process terminates. The two-way authentication module controls the server to generate a first random number N1, calculate a first hash value H1, and send it to the target device. The target device verifies the first hash value H1. After successful verification, the target device generates a second random number N2, calculates the second hash value H2, and sends it to the control server. The control server authenticates the second random number N2 and the second hash value H2. If the authentication is successful, the next step is executed; otherwise, the process is terminated. Once the authentication is complete, the control server sends an ACK, and the target device receives it and the authentication is successful.

Images