An offline type temporary password verification, generation method, system and encryption device

Abstract

This invention relates to the field of password verification technology, and discloses an offline temporary password verification and generation method, system, and encryption device. The temporary password verification system provided by this invention allows a mobile terminal to respond to a temporary password generation request by using an authorized usage threshold and a locally stored second rolling count value as input parameters. A temporary password is generated through a password generation algorithm, and after generating the temporary password, the second rolling count value is updated to its original value plus one. The encryption device, responding to an input verification request containing the temporary password, determines a set of temporary passwords based on the current first rolling count value and its preset fluctuation range. When a temporary password successfully matches a temporary password in the set, an unlocking operation is executed. Password generation and verification are performed using valid usage counts and the rolling count value, eliminating the need for time synchronization and avoiding verification failures due to time discrepancies, thus improving user experience.

Description

Technical Field

[0001] This invention relates to the field of cryptographic verification technology, specifically to an offline temporary password verification and generation method, system, and encryption device. Background Technology

[0002] Existing smart locks all have a temporary password function, which is generally dynamically generated based on time factors. That is, the lock and the mobile phone negotiate the algorithm in advance. After the temporary password generation stage is completed, there is no need to transmit the password data to the lock. During subsequent use, there is no need for the two to establish a communication connection. The lock and the user terminal use their respective local time as the dynamic calculation factor to independently calculate the temporary password corresponding to the current time. The password has a certain degree of dispersion on the time axis, which can meet the requirements of preventing duplication and uniqueness. It can be generated at any time without network communication. However, the temporary password generation method based on time factors may encounter errors in the lock's time system, such as real-time clock (RTC) reset or inability to obtain the latest time from the network. This will cause the lock to be unable to use the accurate time for temporary password verification, resulting in temporary password verification failure and affecting the stability and reliability of the lock's temporary password function. Summary of the Invention

[0003] This invention provides an offline temporary password verification and generation method, system, and encryption device to solve the problem that passwords calculated based on time may fail to be accurately verified due to time errors.

[0004] In a first aspect, the present invention provides an offline temporary password verification method applied to an encryption device. The method includes: responding to an input verification request containing a first temporary password, determining a set of allowed temporary passwords based on a local current first rolling count value and its preset floating range; determining whether there is a second temporary password in the set of temporary passwords that matches the first temporary password; if there is a second temporary password in the set of temporary passwords that matches the first temporary password, controlling the encryption device to perform an unlocking operation.

[0005] This invention optimizes the device by adding a flexible verification mechanism. The encryption device is based on the floating range corresponding to the local rolling count value and establishes a range of valid password counts. It generates multiple sets of temporary passwords through combined traversal operations. As long as the password matches within the legal floating error range, the device can be unlocked normally. This avoids the inconvenience caused by slight counting errors and improves the fault tolerance and stability of temporary password unlocking.

[0006] In one optional implementation, while controlling the encryption device to perform the unlocking operation, the method further includes: parsing a remote rolling count value and an authorized usage threshold from the successfully matched second temporary password; obtaining the current usage count corresponding to the second temporary password recorded locally; updating the current usage count based on the verification matching count of the second temporary password; and if the updated current usage count reaches the authorized usage threshold, updating the local current first rolling count value to the remote rolling count value.

[0007] In one optional implementation, determining a set of allowed temporary passwords based on the local current first rolling count value and its preset floating range includes: combining the count value in the floating range with the valid count value in the preset range of valid password counts as input parameters of a preset password generation algorithm; and generating multiple temporary passwords through the preset password generation algorithm to form the set of temporary passwords, wherein the password generation algorithm is an algorithm used to characterize the mapping relationship between the combination of the count value, the valid password count, and the temporary passwords.

[0008] This invention generates a set of temporary passwords by traversing the count values ​​within the floating range and the valid count values ​​within the valid count range. This effectively adapts to scenarios where the rolling count values ​​of mobile terminals and devices are not synchronized, avoiding password verification failures due to slight counting deviations. It balances security needs with user convenience. At the same time, the floating range of the count value and the valid count range of the password can be flexibly adjusted to adapt to temporary authorization requirements in different scenarios, further ensuring the stability of temporary password verification.

[0009] In an optional implementation, the method further includes: if there is no second temporary password in the set of temporary passwords that matches the first temporary password, accumulating the number of consecutive matching failures; when the number of consecutive matching failures reaches a preset threshold, refusing to respond to subsequent input temporary password verification requests.

[0010] When the first temporary password fails to match, the present invention automatically accumulates the number of consecutive errors. When the number of failures reaches a threshold, it intercepts subsequent temporary password verification requests, effectively preventing malicious attempts and other cracking behaviors, and improving the overall security protection capability of encrypted device verification scenarios.

[0011] Secondly, the present invention provides a method for generating a temporary password, applied to a mobile terminal. The method includes: in response to a temporary password generation request for an encrypted device, obtaining a second rolling count value stored locally, wherein the temporary password generation request includes an authorized usage count threshold; using the second rolling count value and the authorized usage count threshold as input parameters, calculating and generating a first temporary password through a preset password generation algorithm; and after generating the first temporary password, updating the second rolling count value to its original value plus one.

[0012] The password generation method provided by this invention involves a mobile terminal responding to a temporary password generation request that includes a threshold for authorized usage times. The mobile terminal obtains a second rolling count value, uses the second rolling count value and the authorized usage count threshold as input parameters, and calculates and generates a first temporary password using a preset password generation algorithm. After generating the first temporary password, the second rolling count value is updated to its original value plus one, ensuring that the generated temporary password is unique and corresponds to the current count value. This prevents password reuse, achieves preset control over the frequency of temporary password use, avoids the abuse of temporary passwords, and improves the security and controllability of password use. Furthermore, based on the rolling count value and the authorized usage count threshold as input parameters, the preset algorithm quickly generates temporary passwords without complex operations, balancing generation efficiency and password security.

[0013] Thirdly, the present invention provides a temporary password verification system, including a mobile terminal and an encryption device. The mobile terminal, in response to a temporary password generation request for the encryption device, uses an authorized usage count threshold and a locally stored second rolling count value as input parameters to calculate and generate a first temporary password using a preset password generation algorithm. After generating the first temporary password, the second rolling count value is updated to its original value plus one. The encryption device, in response to an input verification request containing the first temporary password, determines a set of allowed temporary passwords based on the current local first rolling count value and its preset floating range. If the first temporary password matches a second temporary password in the set of temporary passwords, an unlocking operation is executed.

[0014] The temporary password verification system provided by this invention allows a mobile terminal to respond to a temporary password generation request by using an authorized usage count threshold and a locally stored second rolling count value as input parameters. A first temporary password is generated through a password generation algorithm, and after generating the first temporary password, the second rolling count value is updated to its original value plus one. The encryption device, responding to an input verification request containing the first temporary password, determines a set of temporary passwords based on the current local first rolling count value and its preset fluctuation range. When the first temporary password successfully matches a second temporary password in the set, an unlocking operation is executed. Password generation and verification are performed using valid usage counts and the rolling count value, eliminating the need for time synchronization and avoiding verification failures due to time discrepancies. This improves user experience and satisfies the need for temporary authorization while effectively preventing password reuse, thus enhancing the security of the encryption device.

[0015] In an optional implementation, the encryption device is further configured to, in the event that no temporary password matching the first temporary password exists in the set of temporary passwords, respond to a counting synchronization instruction received via near-field communication, wherein the counting synchronization instruction is sent by a mobile terminal pre-bound to the encryption device and includes a second rolling count value currently maintained by the mobile terminal; after the sender of the counting synchronization instruction is authenticated, the local current first rolling count value is updated to the second rolling count value.

[0016] When the first temporary password fails to match, the present invention can receive a synchronization command through short-range communication to accurately calibrate the rolling count values ​​at both ends, realize the counting deviation, and ensure the normal operation of subsequent temporary password generation and verification logic.

[0017] Thirdly, the present invention provides an encryption device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the offline temporary password verification method of the first aspect or any corresponding embodiment described above.

[0018] In one alternative implementation, the encryption device is any one of a smart door lock, a safe lock, a vehicle lock controller, or a turnstile controller.

[0019] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the offline temporary password verification method or the temporary password generation method described in any of the preceding claims. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a structural block diagram of a temporary password verification system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the first type of offline temporary password verification method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the second process of the offline temporary password verification method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the first method for generating a temporary password according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0024] This invention provides a temporary password verification system, such as... Figure 1As shown, the system includes a mobile terminal 1 and an encryption device 2. The type of encryption device 2 is not limited. Any device with password verification function can be used to apply the temporary password verification method provided by this invention, such as smart door locks, safe locks, car lock controllers, or turnstile controllers. The mobile terminal 1 can be a mobile phone, watch, or tablet bound to the encryption device 2. When the two are initially bound and synchronized, the second rolling count value stored locally on the mobile terminal 1 is consistent with the first rolling count value stored locally on the encryption device 2. Both use the same preset password generation algorithm to ensure that the algorithm parameters and calculation logic are completely consistent, providing a basis for subsequent password generation and verification.

[0025] Specifically, the encryption device 2 is any one of a smart door lock, safe lock, vehicle lock controller, or gate controller.

[0026] Specifically, mobile terminal 1, in response to a temporary password generation request for encryption device 2, uses the authorized usage count threshold and a locally stored second rolling count value as input parameters, calculates and generates a first temporary password using a preset password generation algorithm, and updates the second rolling count value to the original value plus one after generating the first temporary password; encryption device 2, in response to an input verification request containing the first temporary password, determines a set of allowed temporary passwords based on the current local first rolling count value and its preset floating range; if the first temporary password matches the second temporary password in the set of temporary passwords, it controls the execution of the unlocking operation.

[0027] The temporary password generation request includes a threshold for the number of authorized uses.

[0028] When a user wants to unlock the device using a temporary password, they can send a temporary password generation request to the mobile terminal 1. This request includes a threshold N for the authorized use of the temporary password, which limits the maximum number of times the temporary password can be used. In response to the user's request, the mobile terminal 1 can input the threshold N and the currently stored second rolling count value CP as input parameters into a preset password generation algorithm to calculate a first temporary password. Considering that the input methods for the long-term valid ordinary password and the temporary password are the same, the encryption device 2 cannot accurately determine the required verification algorithm (i.e., whether to directly check the validity of the ordinary password or perform temporary password verification). Therefore, the lengths of the temporary password and the ordinary password are different to allow the encryption device 2 to accurately determine whether to enter the temporary password verification process. The long-term valid ordinary password is 6 characters long, and the temporary password is 8 characters long. This is just an example. Furthermore, the type of password generation algorithm is not limited; the first temporary password can be generated using symmetric encryption algorithms, hash message authentication algorithms, etc.

[0029] After the first temporary password is generated, the mobile terminal 1 of this embodiment can update the locally stored second rolling count value CP to the original value plus one, thereby completing the dynamic update of the rolling count value and ensuring that a new count value is used when generating the next temporary password, thus avoiding password duplication. In an optional embodiment, the encryption device 2 takes a smart lock as an example. If the smart lock is a networked smart lock, after the door lock locally matches and authorizes the temporary password, it can push the temporary password opening message to the mobile terminal 1 while opening the door. After the mobile terminal 1 receives the temporary password and successfully opens the door, it will then increment the CP value.

[0030] Synchronization can be completed without exchanging any key information or rolling counter code C value information between the two parties.

[0031] In this embodiment of the invention, the user enters a first temporary password on the interactive interface (such as a button panel, touch screen, etc.) of the encryption device 2, triggering a verification request from the encryption device 2. Upon receiving the verification request, the encryption device 2 considers that since it is not communicating with the mobile terminal 1, the rolling count value may be offset. For example, if the user's mobile terminal has generated a temporary password once, the rolling count code CP on the user's mobile terminal would be CP+1. However, this password was not actually used to open the door. When the mobile terminal generates a temporary password again, its rolling count code CP = CP+2, which is inconsistent with the CD on the device. Considering this scenario, the device needs to perform flexible verification within a certain range. Specifically, the encryption device 2 can retrieve the currently stored first rolling count value locally and set a corresponding floating range. The range can be set based on requirements such as password security and user experience. For example, it can be adjusted by ±2 to obtain the floating range corresponding to the first rolling count value. At the same time, the range of valid password counts is preset, such as N value range of [1,5] and CD floating range of [1,5]. Then, each count value in the floating range is concatenated with each valid count value in the range of valid password counts as output parameters, which are substituted into the password generation algorithm to calculate and generate the corresponding number of temporary passwords. Based on the above example, 25 temporary passwords are obtained, forming a set of allowed temporary passwords. Then, the first temporary password entered by the user can be matched with the set of temporary passwords. If the first temporary password matches the second temporary password in the set of temporary passwords, authorization is accepted within the flexible range, and the unlocking action is executed.

[0032] This invention optimizes the device by adding a flexible verification mechanism. The encryption device is based on the floating range corresponding to the local rolling count value and establishes a range of valid password counts. It generates multiple sets of temporary passwords through combined traversal operations. As long as the password matches within the legal floating error range, the device can be unlocked normally. This avoids the inconvenience caused by slight counting errors and improves the fault tolerance and stability of temporary password unlocking.

[0033] The temporary password verification system provided by this invention allows a mobile terminal to respond to a temporary password generation request by using an authorized usage count threshold and a locally stored second rolling count value as input parameters. A first temporary password is generated through a password generation algorithm, and after generating the first temporary password, the second rolling count value is updated to its original value plus one. The encryption device, responding to an input verification request containing the first temporary password, determines a set of temporary passwords based on the current local first rolling count value and its preset fluctuation range. When the first temporary password successfully matches a second temporary password in the set, an unlocking operation is executed. Password generation and verification are performed using valid usage counts and the rolling count value, eliminating the need for time synchronization and avoiding verification failures due to time discrepancies. This improves user experience and satisfies the need for temporary authorization while effectively preventing password reuse, thus enhancing the security of the encryption device.

[0034] In one optional implementation, if the encryption device 2 detects that there is no second temporary password in the set of temporary passwords that matches the first temporary password, it accumulates the number of consecutive matching failures. When the number of consecutive matching failures reaches a preset threshold, it refuses to respond to subsequent input temporary password verification requests.

[0035] In practical applications, mobile terminal 1 may generate and discard temporary passwords multiple times without verification by encryption device 2. However, its CP value is incremented after password generation, which may cause the CP value to exceed the device's set range. This can lead to a mismatch between the rolling count values ​​at both ends, resulting in the first scenario where the first temporary password calculated based on the second rolling count value recorded by mobile terminal 1 and the authorized usage threshold fails to match the temporary password set. Alternatively, there may be a probing attack, leading to the second scenario where the temporary password fails to match. When encryption device 2 detects a second temporary password that does not match the first temporary password in the temporary password set, it can automatically accumulate the number of consecutive matching failures. When the number of consecutive matching failures reaches a preset threshold, encryption device 2 can refuse to respond to subsequent temporary password verification requests, restricting the temporary password unlocking function and completing security protection and control.

[0036] When the first temporary password fails to match, the present invention automatically accumulates the number of consecutive errors. When the number of failures reaches a threshold, it intercepts subsequent temporary password verification requests, effectively preventing malicious attempts and other cracking behaviors, and improving the overall security protection capability of encrypted device verification scenarios.

[0037] In one alternative implementation, if the encryption device 2 determines that there is no temporary password in the set of temporary passwords that matches the first temporary password, it responds to a counting synchronization instruction received via short-range communication, wherein the counting synchronization instruction is sent by a mobile terminal 1 pre-bound to the encryption device 2 and contains a second rolling count value currently maintained by the mobile terminal 1; after the sender of the counting synchronization instruction is authenticated, the local current first rolling count value is updated to the second rolling count value.

[0038] The encryption device 2 of this embodiment of the invention can maintain the short-range communication module (such as Bluetooth, near-field communication) when it is determined that there is no temporary password in the temporary password set that matches the first temporary password. The device monitors the status of the encryption device (such as NFC) and responds in real time to external communication commands. If the first situation mentioned above causes a temporary password verification error, and the user finds that the temporary password verification has failed, a counting synchronization operation can be established between the mobile terminal 1 and the encryption device 2. The mobile terminal 1 sends a counting synchronization command to the encryption device 2 through near-field communication. After receiving the counting synchronization command, the encryption device 2 can first identify the sender of the counting synchronization command and confirm whether it is the mobile terminal 1 that is pre-bound to it. For example, it can confirm this by comparing the preset binding information or verifying the identity. After confirming that the sender is the mobile terminal 1 that is pre-bound to it, it can parse the counting synchronization command, extract the second rolling count value currently maintained by the mobile terminal 1 contained in the command, and then retrieve the first rolling count value currently stored locally and update it directly to the second rolling count value, completing the synchronization calibration of the rolling count values ​​at both ends. After the count value is updated, the encryption device 2 saves the updated first rolling count value. When generating and verifying temporary passwords, the relevant operations are performed based on the updated first rolling count value to ensure the consistency of the count with the mobile terminal 1.

[0039] When the first temporary password fails to match, the present invention can receive a synchronization command through short-range communication to accurately calibrate the rolling count values ​​at both ends, realize the counting deviation, and ensure the normal operation of subsequent temporary password generation and verification logic.

[0040] This invention also provides an offline temporary password verification method, applicable to, for example... Figure 1 The encryption device 2 shown is... Figure 2 This is a flowchart of an offline temporary password verification method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: In response to the input verification request containing the first temporary password, a set of allowed temporary passwords is determined based on the local current first rolling count value and its preset floating range.

[0041] In this embodiment of the invention, the user enters a first temporary password on the interactive interface of the encryption device (such as a button panel, touch screen, etc.), triggering a verification request from the encryption device. Upon receiving the verification request, the encryption device, considering that it is not communicating with the mobile terminal, may have a shift in the rolling count value. For example, if the user's mobile terminal has generated a temporary password once, the rolling count code CP on the user's mobile terminal would be CP+1. However, this password was not actually used to open the door. When the mobile terminal generates a temporary password again, its rolling count code CP = CP+2, which is inconsistent with the CD on the device. Considering this scenario, the device needs to perform flexible verification within a certain range. Specifically, the encryption device... The system can retrieve the first rolling count value currently stored locally and set the corresponding floating range. This floating range can be set based on requirements such as password security and user experience, for example, a ±2 floating range. This gives the floating range corresponding to the first rolling count value. At the same time, a range of valid password counts is preset, such as N value range of [1,5] and CD floating range of [1,5]. Then, each count value within the floating range is concatenated with each valid count value within the range of valid password counts as an output parameter, which is substituted into the password generation algorithm to calculate and generate the corresponding number of temporary passwords. Based on the above example, 25 temporary passwords are obtained, forming a set of allowed temporary passwords.

[0042] Step S202: Determine whether there is a second temporary password in the set of temporary passwords that matches the first temporary password.

[0043] The encryption device of this embodiment of the invention can then match the first temporary password entered by the user with the set of temporary passwords.

[0044] Step S203: If a second temporary password that matches the first temporary password exists in the set of temporary passwords, control the encryption device to perform an unlocking operation.

[0045] If the encryption device of this embodiment determines that the first temporary password matches the second temporary password in the set of temporary passwords, it will accept authorization within a flexible range and perform the unlocking action.

[0046] This invention optimizes the device by adding a flexible verification mechanism. The encryption device is based on the floating range corresponding to the local rolling count value and establishes a range of valid password counts. It generates multiple sets of temporary passwords through combined traversal operations. As long as the password matches within the legal floating error range, the device can be unlocked normally. This avoids the inconvenience caused by slight counting errors and improves the fault tolerance and stability of temporary password unlocking.

[0047] This embodiment also provides an offline temporary password verification method, applicable to, for example... Figure 1 The encryption device 2 shown is... Figure 3This is a flowchart of an offline temporary password verification method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps: Step S301: In response to the input verification request containing the first temporary password, a set of allowed temporary passwords is determined based on the local current first rolling count value and its preset floating range.

[0048] Specifically, step S301 above includes: Step S3011: Combine the count value in the floating range with the valid count value in the preset valid password count range, and use it as the input parameter of the preset password generation algorithm.

[0049] Step S3012: Calculate and generate multiple temporary passwords using a preset password generation algorithm to form a temporary password set.

[0050] Among them, the password generation algorithm is an algorithm used to represent the mapping relationship between the combination of count value, the number of times the password is valid, and the temporary password.

[0051] The password generation algorithm set in this embodiment of the invention is a hash-based message authentication code algorithm (Hmac-SHa256), and the specific function formula is as follows: PWD=Hmac-Sha-256(K, N&C) mod (10^j) Wherein, PWD is the temporary password; Hmac-Sha-256 is the encryption function that generates a message authentication code using a key and a SHA256 hash function. Its characteristics include digital signature effect, one-way communication, ability to verify message integrity and legitimacy, and inability to reverse-engineer the data; K represents the initial key of the encryption device, which is factory-preset and randomly generated and written to the encryption device; N represents the number of valid attempts; C represents the count value within a floating range; N&C: N and C are concatenated to form the first parameter; mod represents taking the modulo of the Hmac authentication algorithm result to generate a j-bit temporary password, where j is 8 bits, distinguishing it from long-term valid ordinary passwords.

[0052] The encryption device of this invention obtains a preset initial device key, concatenates the count value in the floating range with the valid count value in the preset valid password count range to obtain a first parameter, uses the initial device key as the key and the first parameter as the message, calculates the message authentication code using a hash-based message authentication code algorithm, generates a message authentication code, performs a modulo operation on the message authentication code to obtain a temporary password, and then iterates through any count value in the floating range and any valid count value in the valid password count range to generate multiple temporary passwords, forming a temporary password set.

[0053] This invention employs a hash-based message authentication code algorithm. Relying on a factory-preset random initial key and combining the one-way nature of the algorithm with the characteristics of digital signatures, it can effectively verify the integrity of the first parameter after concatenation, ensuring the anti-cracking capability of the temporary password from the source of calculation and reducing the risk of temporary password leakage.

[0054] This invention generates a set of temporary passwords by traversing the count values ​​within the floating range and the valid count values ​​within the valid count range. This effectively adapts to scenarios where the rolling count values ​​of mobile terminals and devices are not synchronized, avoiding password verification failures due to slight counting deviations. It balances security needs with user convenience. At the same time, the floating range of the count value and the valid count range of the password can be flexibly adjusted to adapt to temporary authorization requirements in different scenarios, further ensuring the stability of temporary password verification.

[0055] Step S302: Determine whether a second temporary password exists in the temporary password set that matches the first temporary password. For details, please refer to [link to relevant documentation]. Figure 2 Step S202 of the illustrated embodiment will not be described again here.

[0056] Step S303: If a second temporary password that matches the first temporary password exists in the set of temporary passwords, control the encryption device to perform an unlocking operation.

[0057] In one optional implementation, while controlling the encryption device to perform the unlocking operation, the encryption device can also parse the remote rolling count value and the authorized usage threshold from the successfully matched second temporary password; obtain the current usage count corresponding to the locally recorded second temporary password; update the current usage count based on the verification matching count of the second temporary password; if the updated current usage count reaches the authorized usage threshold, update the local current first rolling count value to the remote rolling count value. The remote rolling count value and the authorized usage threshold are updated based on the authorized usage threshold.

[0058] When the encryption device of this embodiment of the invention determines that the second temporary password has been successfully matched and performs the unlocking operation, it can parse the corresponding remote rolling count value and authorized usage threshold from the second temporary password to determine the number of times the temporary password set by the user can be used. Then, it can obtain the current usage count corresponding to the second temporary password recorded locally and update the current usage count based on the verification matching count of the second temporary password. For example, if the current usage count of the second temporary password is currently 0 times, after the second temporary password is successfully matched, the verification matching count is incremented by one, and the corresponding current usage count of the second temporary password is also incremented by one to 1 time. Then, it can determine whether the updated current usage count has reached the authorized usage threshold. If the current usage count has not reached the authorized usage threshold, the currently recorded first rolling count value is maintained, and the second temporary password and the updated current usage count can be stored locally for subsequent use. When a user uses a second temporary password for door unlocking verification, the encryption device can first perform a local search. If the second temporary password matches the locally stored temporary password, the door unlocking operation is immediately executed, improving unlocking efficiency. At this time, after successful verification, the current number of uses corresponding to the second temporary password can be increased again and compared with the authorized use threshold. If the authorized use threshold has not yet been reached, it continues to be stored locally. Compared with temporary password schemes based on time factors, where the password only has an expiration time and no use limit setting function, and generally becomes invalid after one use, this invention achieves on-demand limited use frequency of temporary passwords by setting an authorized use threshold and combining it with real-time accumulation and updating of locally used counts. This allows for limited reuse of temporary passwords, while retaining the valid temporary password and the updated use count locally. Subsequent verification can directly and quickly match the unlocking locally, improving verification efficiency and usage flexibility, and reducing user operating costs.

[0059] If the updated current usage count reaches the authorized usage count threshold, the second temporary password and its corresponding current usage count can be removed from local storage, and the first rolling count value recorded locally by the encryption device can be updated to the rolling count value corresponding to the second temporary password.

[0060] This invention parses and obtains the remote rolling count value and the authorized usage count threshold, updates the count in real time by combining the local usage count, and compares the updated usage count with the authorized usage count threshold. When the usage limit is reached, the second rolling count value is updated synchronously with the remote rolling count value, thereby achieving precise control over temporary password usage permissions and dynamic synchronization of the counting data at both ends, ensuring the security and data consistency of temporary password verification.

[0061] In one optional implementation, if the encryption device detects that there is no second temporary password in the set of temporary passwords that matches the first temporary password, it accumulates the number of consecutive matching failures. When the number of consecutive matching failures reaches a preset threshold, it refuses to respond to subsequent input temporary password verification requests.

[0062] In practical applications, mobile terminals may generate and discard temporary passwords multiple times without verification by the encryption device. However, the CP value is incremented after password generation, which may cause the CP value to exceed the device's settings range. This can lead to a mismatch between the rolling count values ​​at both ends, resulting in the first scenario where the first temporary password calculated based on the second rolling count value recorded by the current mobile terminal and the authorized usage threshold fails to match the temporary password set. Alternatively, a probing attack may occur, leading to the second scenario where the temporary password fails to match. When the encryption device detects a second temporary password that does not match the first temporary password in the temporary password set, it can automatically accumulate the number of consecutive matching failures. When the number of consecutive matching failures reaches a preset threshold, the encryption device can refuse to respond to subsequent temporary password verification requests, restricting the temporary password unlocking function and completing security protection and control.

[0063] When the first temporary password fails to match, the present invention automatically accumulates the number of consecutive errors. When the number of failures reaches a threshold, it intercepts subsequent temporary password verification requests, effectively preventing malicious attempts and other cracking behaviors, and improving the overall security protection capability of encrypted device verification scenarios.

[0064] This embodiment also provides a method for generating temporary passwords, applicable to, for example... Figure 1 The mobile terminal 1 shown is... Figure 4 This is a method for generating temporary passwords according to embodiments of the present invention, such as... Figure 4 As shown, the process includes the following steps: Step S401: In response to a temporary password generation request for the encryption device, obtain the second rolling count value stored locally.

[0065] The temporary password generation request includes a threshold for the number of authorized uses.

[0066] When a user wants to unlock the device with a temporary password, they can send a temporary password generation request to the mobile terminal. The temporary password generation request includes a threshold N for the authorized usage times corresponding to the temporary password entered by the user, which is used to limit the upper limit of the number of times the temporary password can be used. In response to the user's temporary password generation request for the encrypted device, the mobile terminal can obtain a second rolling count value stored locally.

[0067] Step S402: Using the second rolling count value and the authorized usage threshold as input parameters, a first temporary password is generated by calculating using a preset password generation algorithm.

[0068] The authorized usage threshold N and the currently stored second rolling count value CP can be used as input parameters to input into a preset password generation algorithm to calculate the first temporary password. Considering that the input method of the long-term valid ordinary password and the temporary password is the same, the encryption device cannot accurately determine the verification logic algorithm to be used (i.e., whether to directly judge whether the ordinary password is correct or to perform temporary password verification). Therefore, the lengths of the temporary password and the ordinary password are set to be different to enable the encryption device to accurately determine whether to enter the temporary password verification process. The long-term valid ordinary password is 6 characters and the temporary password is 8 characters. This is just an example. Moreover, there is no limitation on the type of password generation algorithm. The first temporary password can be generated by symmetric encryption algorithm, hash message authentication algorithm, etc.

[0069] Specifically, in this embodiment of the invention, the mobile terminal concatenates and combines the authorized usage threshold set by the user with the second rolling count value stored locally to obtain the first parameter. Using the device initial key and the first parameter as the message, the same hash-based message authentication code algorithm is used to calculate and generate a message authentication code. The message authentication code is then moduloed to obtain the first temporary password. For a detailed description, please refer to the above embodiment, which will not be repeated here.

[0070] Step S403: After generating the first temporary password, update the second rolling counter value to the original value plus one.

[0071] After the first temporary password is generated, the mobile terminal of this embodiment can update the locally stored second rolling count value CP to the original value plus one, thereby completing the dynamic update of the rolling count value and ensuring that a new count value is used when generating the next temporary password, thus avoiding password duplication. In an optional embodiment, the encryption device takes a smart lock as an example. If the smart lock is a networked smart lock, after the door lock locally matches and authorizes the temporary password, it can push the temporary password opening message to the mobile terminal at the same time as opening the door. After the mobile terminal receives the temporary password and successfully opens the door, it will then increment the CP value.

[0072] The password generation method provided by this invention involves a mobile terminal responding to a temporary password generation request that includes a threshold for authorized usage times. The mobile terminal obtains a second rolling count value, uses the second rolling count value and the authorized usage count threshold as input parameters, and calculates and generates a first temporary password using a preset password generation algorithm. After generating the first temporary password, the second rolling count value is updated to its original value plus one, ensuring that the generated temporary password is unique and corresponds to the current count value. This prevents password reuse, achieves preset control over the frequency of temporary password use, avoids the abuse of temporary passwords, and improves the security and controllability of password use. Furthermore, based on the rolling count value and the authorized usage count threshold as input parameters, the preset algorithm quickly generates temporary passwords without complex operations, balancing generation efficiency and password security.

[0073] In a specific embodiment, it is assumed that after the encryption device and the mobile terminal are initially bound, both are in the initial state, K = "my_secret_key_12345", the mobile terminal CP = 1, the encryption device CD = 1, the mobile terminal generates a one-time temporary password, and the mobile terminal inputs CP = 1 and the authorized usage threshold N = 1 into the password generation algorithm to calculate PWD = Hmac - Sha - 256("my_secret_key_12345", 0x0000000100000001) mod ( 10^8) = 29158172; at the same time, the mobile terminal updates CP = CP + 1 = 2.

[0074] After the user enters the first temporary password, the encryption device combines the first rolling count value and its floating range with the preset password validity count range as input parameters for the password generation algorithm. For example, the encryption device inputs CD∈(1,5), N∈(1,5) into the password generation algorithm to obtain the temporary password set, i.e., PWD1=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000100000001) mod ( 10^8)= 29158172. It can be seen that PWD1=PWD, the key verification is successful, the validity count is 1, the encryption device successfully verifies the password, and updates CD=1.

[0075] When generating the temporary password for the second time, the mobile terminal generates a temporary password that can be used twice. It then inputs the currently recorded CP=2 and N=2 into the preset password generation algorithm to obtain the first temporary password: PWD=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000200000002) mod (10^8)=08134000. Simultaneously, the mobile terminal updates CP=CP+1=3. After the user inputs the first temporary password, the device substitutes CD∈(2,6) and N∈(1,5) to calculate the temporary password set and compares them sequentially. PWD1=Hmac-Sha-256(“my_secret_key_12345” , 0x0000000100000002) mod (10^8)= 42170595 PWD2=Hmac-Sha-256(“my_secret_key_12345” , 0x0000000200000002) mod (10^8)= 08134000 ... PWD5=Hmac-Sha-256(“my_secret_key_12345” , 0x0000000500000002) mod (10^8)= 19543583 PWD6=Hmac-Sha-256(“my_secret_key_12345” , 0x0000000100000003) mod (10^8)= 88531995 PWD7=Hmac-Sha-256(“my_secret_key_12345” , 0x0000000200000003) mod (10^8)= 06651753 ... PWD10=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000500000003) mod (10^8)= 72987147 PWD11=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000100000006) mod (10^8)= 63977753 PWD12=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000200000006) mod (10^8)= 75265224 ... PWD25=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000500000006) mod (10^8)= 88024166; The encryption device determines that PWD2=PWD, indicating that the temporary password verification is successful. The current password's authorized usage threshold is 2. Based on the verification matching count, the current usage count is updated to 1. At this point, the current usage count has not reached the authorized usage threshold, so the recorded CD value does not need to be updated. When the password 08134000 is entered for the second time, N=2, CD=2, the current usage count is updated to 2. It is confirmed that the authorized usage threshold has been reached, so CD=2 is updated.

[0076] The mobile terminal generates three consecutive temporary passwords, all of which are discarded, and the door is not opened. A fourth temporary password is generated: the mobile terminal calculates and discards the password using CP=2 and N=1; it calculates and discards the password using CP=3 and N=1; it calculates and discards the password using CP=4 and N=1; it calculates and discards the password using CP=5 and N=1; and it calculates PWD=Hmac-Sha-256(“my_secret_key_12345”, 0x0000000100000005) mod (10^8)=25945027. After the user enters the temporary password, the current record's first rolling count value is CD=2. The encryption device calculates and compares 25 sets of passwords sequentially using CD∈(2,7) and N∈(1,5). Similarly, when CD=5 and N=1, the password comparison passes, the door is opened, and CD=5 is updated. If the mobile terminal generates five or more temporary passwords consecutively and discards them all, and the CP value exceeds the floating range set by the encryption device, then subsequent passwords will become invalid. The user needs to manually update the CD=CP recorded by the encryption device to ensure normal subsequent functions. In this example, exhaustive calculation is used. The device distribution is substituted with CD∈(CD, CD+5), N∈(1,5). The number of password flexibility offsets is calculated to be within 5, and the number of valid door openings is calculated to be within 5, for a total of 25 passwords. These are compared with the password entered by the user. When a password passes the comparison, the door is opened. The above floating range is only an example and can be set according to actual needs. It is not limited. For detailed explanation, please refer to the above embodiment. It will not be repeated here.

[0077] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0078] The following is a detailed reference. Figure 5The diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from memory 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the electronic device. The processor 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0079] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0080] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a memory 508, or installed from a ROM 502. When the computer program is executed by the processor 501, it performs the functions defined in the offline temporary password verification method or the temporary password generation method of the embodiments of the present invention.

[0081] Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0082] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the offline temporary password verification method or temporary password generation method shown in the above embodiments is implemented.

[0083] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0084] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for verifying an offline temporary password, characterized in that, Applied to encryption devices, the method includes: In response to an input verification request containing a first temporary password, a set of allowed temporary passwords is determined based on the current local first rolling count value and its preset floating range; Determine whether a second temporary password that matches the first temporary password exists in the set of temporary passwords; If a second temporary password that matches the first temporary password exists in the set of temporary passwords, the encryption device is controlled to perform an unlocking operation.

2. The method according to claim 1, characterized in that, While controlling the encryption device to perform the unlocking operation, the method further includes: Parse the remote rolling count value and authorized usage threshold from the successfully matched second temporary password; Retrieve the current number of times the second temporary password has been used, as recorded locally; The current number of uses is updated based on the number of verification matches of the second temporary password; If the updated current usage count reaches the authorized usage count threshold, the local current first scroll count value is updated to the remote scroll count value.

3. The method according to claim 1, characterized in that, The step of determining a set of allowed temporary passwords based on the current local first rolling count value and its preset floating range includes: The count value in the floating range is combined with the valid count value in the preset valid password count range as the input parameter of the preset password generation algorithm; Multiple temporary passwords are generated by calculating a preset password generation algorithm to form the temporary password set. The password generation algorithm is an algorithm used to represent the mapping relationship between the combination of count value, the number of times the password is valid, and the temporary password.

4. The method according to claim 1, characterized in that, The method further includes: If there is no second temporary password in the set of temporary passwords that matches the first temporary password, the number of consecutive failed matches is accumulated; When the number of consecutive matching failures reaches a preset threshold, subsequent temporary password verification requests will be rejected.

5. A method for generating a temporary password, characterized in that, Applied to a mobile terminal, the method includes: In response to a temporary password generation request for an encrypted device, a second rolling count value stored locally is obtained, wherein the temporary password generation request includes an authorized usage count threshold; Using the second rolling count value and the authorized usage threshold as input parameters, a first temporary password is generated by a preset password generation algorithm. After generating the first temporary password, the second rolling counter value is updated to the original value plus one.

6. A temporary password verification system, characterized in that, Including mobile terminals and encrypted devices, among which, A mobile terminal is used to respond to a temporary password generation request for an encrypted device, taking an authorized usage count threshold and a locally stored second rolling count value as input parameters, to calculate and generate a first temporary password using a preset password generation algorithm, and after generating the first temporary password, to update the second rolling count value to the original value plus one. The encryption device is configured to respond to an input verification request containing a first temporary password, determine a set of allowed temporary passwords based on the local current first rolling count value and its preset floating range; if the first temporary password matches a second temporary password in the set of temporary passwords, control the execution of an unlocking operation.

7. The system according to claim 6, characterized in that, The encryption device is further configured to, in the event that no temporary password matching the first temporary password exists in the set of temporary passwords, respond to a counting synchronization instruction received via near-field communication, wherein the counting synchronization instruction is sent by a mobile terminal pre-bound to the encryption device and includes a second rolling count value currently maintained by the mobile terminal; After the sender of the count synchronization command is authenticated, the local current first rolling count value is updated to the second rolling count value.

8. An encryption device, characterized in that, include: Memory, used to store computer instructions; A processor, communicatively connected to the memory, is used to execute the computer instructions to implement the offline temporary password verification method as described in any one of claims 1 to 4.

9. The encryption device according to claim 8, characterized in that, The encryption device is any one of a smart door lock, a safe lock, a vehicle lock controller, or a turnstile controller.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the offline temporary password verification method as described in any one of claims 1 to 4, or the temporary password generation method as described in claim 5.

Images