An identity authentication and control method and device based on two-component dynamic verification
By using a dual-component dynamic verification method and ISO7816 standard APDU frame encapsulation, the problems of high computational overhead, high interaction latency, vulnerability to attacks, and poor compatibility in short-range communication authentication are solved, achieving low-power and efficient authentication and management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- 浙江芯微云联智能科技有限公司
- Filing Date
- 2026-07-02
- Publication Date
- 2026-07-31
AI Technical Summary
Existing short-range communication authentication schemes suffer from problems such as high lock-end computation overhead, high interaction latency, susceptibility to replay attacks, non-standard administrator management, and poor protocol compatibility.
A dual-component dynamic verification method is adopted. Through a short-range communication session between the first terminal and the second terminal, dynamic session factors and identity credentials are used to perform synthesis calculations to generate a verification code. The communication data is encapsulated in an ISO7816 standard APDU frame to achieve hierarchical administrator management and dual integrity verification.
It reduces lock-end computational overhead and power consumption, shortens interaction latency, resists replay attacks, improves protocol compatibility and management standardization, and ensures the stability and security of interaction.
Smart Images
Figure FT_1 
Figure FT_2
Abstract
Description
Technical Field
[0001] This invention relates to the field of identity authentication and security control technology, specifically to an identity authentication method, device, and short-range communication control system based on dual-component dynamic verification. Background Technology
[0002] Short-range communication is widely used in security scenarios such as smart door locks and access control. However, existing short-range communication authentication solutions have many security and performance defects: some solutions use heavy encryption algorithms, resulting in excessive computing power and power consumption of the terminal; some solutions use static password verification, which is vulnerable to replay attacks; there is a lack of standardized hierarchical permission management processes; and poor protocol compatibility makes it difficult to integrate with the existing ecosystem.
[0003] To address the shortcomings of existing technologies, the present invention aims to provide an identity authentication and control method, device, and system based on dual-component dynamic verification, which solves the technical problems of high lock-end computational overhead, high interaction latency, susceptibility to replay attacks, non-standard administrator management, and poor protocol compatibility. Summary of the Invention
[0004] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a universal two-component dynamic verification authentication method that is applicable to all short-distance communication scenarios and solves the technical problems of complex authentication algorithms, low security, and poor compatibility in existing technologies.
[0005] To achieve the above objectives, the present invention provides the following technical solution: S1. Establishing a short-range communication session between a first terminal and a second terminal; S2. The second terminal returns its identification information and a dynamic session factor to the first terminal; wherein, in the bound administrator state, the dynamic session factor is a random number generated by the second terminal; in the initialization state, the dynamic session factor is associated with the second terminal device identifier; S3. The first terminal uses the identity credential bound locally to the second terminal identification information as a first verification component, and the dynamic session factor as a second verification component, and performs a synthesis operation on the first and second verification components according to the agreed bit width and algorithm to obtain a verification code; S4. The first terminal sends a service protocol frame to the second terminal, the service protocol frame including at least a frame prefix, the verification code, a service instruction field, and an integrity verification field; S5. The second terminal performs integrity verification on the service protocol frame and performs consistency verification on the verification code based on the stored identity credential and the current dynamic session factor. After successful verification, it executes the operation indicated by the service instruction field. It should be noted that the second terminal can be a smart lock.
[0006] By adopting the above technical solution, a short-range communication session is first established between the first terminal and the second terminal. The second terminal returns the corresponding second terminal identification information and dynamic session factor according to the binding or initialization status. The first terminal synthesizes a verification code using the bound identity credential as the first verification component and the dynamic session factor as the second verification component, and sends it in frames. After the second terminal completes the integrity and verification code consistency verification, it executes the business instruction. This process replaces heavy encryption and decryption with dual-component dynamic verification, which greatly reduces the lock-end computing overhead and power consumption, shortens the interaction latency, and the dynamic session factor can bind the session and resist simple replay attacks. At the same time, it realizes the reliable binding of the lock and the key and improves the stability of near-field interaction.
[0007] The present invention is further configured such that: the synthesis operation is an integer field multiplication operation, and the operation result is truncated to a preset byte length or reduced to the verification code width by modulo operation; in the business process of adding the first administrator, the verification code is set as a protocol-defined field to avoid operation overflow.
[0008] By adopting the above technical solution, the dual-component synthesis operation is limited to integer field multiplication. The operation result is truncated according to the preset bit width or reduced by modulo operation. When adding the first administrator, the verification code is set as a field agreed upon in the protocol to avoid overflow. Integer multiplication is simple and efficient and adaptable to low computing power hardware on the lock end. Bit width reduction ensures the uniformity of the verification code format. The overflow prevention setting can ensure the stable execution of the initialization binding process, further improving the reliability and compatibility of the verification process.
[0009] The present invention is further configured such that: the first check component and the second check component are analogs of the real part and the imaginary part of a complex number, respectively; the composition operation is implemented in the integer arithmetic field and complex multiplication operation is not performed in the complex field.
[0010] By adopting the above technical solution, the first and second verification components are analogized to the real and imaginary parts of complex numbers, respectively, and the synthesis operation is implemented in the integer arithmetic field without performing complex multiplication. The concept of complex numbers is used to visualize the independent yet cooperative relationship between the two components, unifying the patent terminology system. At the same time, the integer field operation avoids complex complex number operations, reducing the difficulty of algorithm implementation and the consumption of lock-end computing power, while taking into account both intuitive expression and lightweight execution.
[0011] The present invention is further configured such that: the short-range communication session is encapsulated using the ISO7816 standard APDU frame; the service data field of the APDU response data carries the second terminal identification information and dynamic session factor; the service protocol frame is encapsulated in the APDU command data field; the command header includes a category byte, an instruction byte, a parameter byte, and a length byte; the length byte is consistent with the length of the service protocol frame.
[0012] By adopting the above technical solution, short-range communication sessions are encapsulated using ISO7816 standard APDU frames. The APDU response data field carries the lock identifier and dynamic session factor, and the service protocol frame is encapsulated in the APDU command data field with the command header length matching the frame length. This design is compatible with standard APDU protocols and can directly interface with existing near-field communication (NFC) protocol stacks and testing tools, improving interactive compatibility, debuggability, and solution scalability.
[0013] The present invention is further configured such that: the frame prefix of the service protocol frame is a preset first constant; the response service frame returned by the second terminal includes a second constant that is different from the first constant as a response prefix, execution result content and response integrity verification field.
[0014] By adopting the above technical solution, a first constant is set as a frame prefix for the business protocol frame, and a different second constant is set as a prefix for the response business frame. The response frame includes the execution result and integrity verification field. The dedicated constant prefix can quickly distinguish the frame type and improve the frame parsing efficiency. The dual integrity verification further ensures the accuracy and integrity of the interactive data.
[0015] The present invention is further configured to include a hierarchical administrator management process, in which the second terminal enters a time-limited state of allowing the addition of a secondary administrator after authorization by the first administrator. The authorized first terminal sends an add command, and the second terminal completes the binding and returns the secondary administrator's identity identifier and identity credentials when the administrator's seat becomes available.
[0016] By adopting the above technical solution, a hierarchical administrator management process is added. After the first administrator authorizes the second terminal, the second terminal enters a time-limited state that allows the addition of secondary administrators. The authorized terminal sends an add command, and the binding is completed when the seat is available, and the corresponding identity identifier and identity credential are returned. This process realizes hierarchical permission control through time-limited state and seat verification, avoids unauthorized addition and seat conflicts, and improves the security and standardization of second terminal management.
[0017] The present invention is further configured such that when the second terminal enables the location detection mode, only the execution result encoding of the lock-type service instructions is interchanged with the default mode, while the response encoding of the other service instructions remains consistent.
[0018] By adopting the above technical solution, when the second terminal starts the location detection mode, only the execution result encoding of the locking command is swapped, while the response encoding of other commands remains at the default. This design can adapt to the location detection peripheral and human-machine interface logic, does not affect the protocol compatibility of other business commands, and takes into account both scenario adaptability and interaction protocol stability.
[0019] The present invention is further configured such that: the APDU response includes a status word, and the determination order is to first confirm the successful transmission and command processing through the status word, and then parse the response service frame in the service data field.
[0020] By adopting the above technical solution, a status word is added to the APDU response. When making a judgment, the status word is used to confirm that the transmission and command processing were successful before parsing the response frame of the service data field. The layered judgment logic can quickly distinguish between transport layer and service layer anomalies, improve fault location efficiency, and simplify the joint debugging and problem-solving process.
[0021] The present invention is further configured as follows: a key-end short-range communication module, used to establish a short-range communication session with the smart lock, and receive the second terminal identification information returned by the smart lock and the unique dynamic session factor of this session; a key-end memory, used to store the identity credential bound to the second terminal identification information; and a key-end processor, electrically connected to the short-range communication module and the memory respectively, configured to: use the identity credential as a first verification component and the dynamic session factor as a second verification component, perform linear integer field operations according to a preset fixed bit width and an agreed algorithm to generate a verification code; generate a business protocol frame containing a frame prefix, the verification code, a business instruction field, and an integrity verification field, and send it to the smart lock through the short-range communication module.
[0022] By adopting the above technical solutions, the core methods are implemented in physical terminal devices, the hardware modules are adapted to near-field interaction characteristics, and standardized dual-component verification and full-process management are achieved, thereby improving the feasibility and versatility of the solution.
[0023] The present invention is further configured as follows: a lock-end short-range communication module, used to establish a short-range communication session with a first terminal, return the second terminal identification information and the unique dynamic session factor of this session to the first terminal, and receive the service protocol frame sent by the first terminal; a lock control execution mechanism, used to perform unlocking or locking operations; a lock-end memory, used to store identity credentials bound to each first terminal; and a lock-end processor, electrically connected to the short-range communication module, the lock control execution mechanism, and the memory respectively, configured to: perform integrity verification on the service protocol frame, and recalculate the verification code based on the stored identity credentials and the dynamic session factor of this session to complete the consistency verification; after the verification is passed, drive the lock control execution mechanism to execute the operation indicated by the service instruction field.
[0024] By adopting the above technical solution, the core method is implemented into a physical lock device. The lightweight verification logic is adapted to the resource-constrained characteristics of the lock end, and the opening and closing, verification and management operations are completed safely and efficiently, ensuring the stable and reliable function of the lock. Attached Figure Description
[0025] Figure 1 This is a flowchart of the control method of the present invention; Figure 2 This is a schematic diagram of the related device of the present invention.
[0026] In the diagram: 1. Second terminal; 11. Lock end short-range communication module; 12. Lock control actuator; 13. Lock end processor; 14. Lock end memory; 2. First terminal; 21. Key end short-range communication module; 22. Key end processor; 23. Key end memory. Detailed Implementation
[0027] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0028] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.
[0029] like Figure 1-2 As shown, this invention discloses an identity authentication and control method and device based on dual-component dynamic verification.
[0030] Example 1 System Architecture: The second terminal 1 includes a lock end short-range communication module 11, a lock control actuator 12, a lock end processor 13, and a lock end memory 14; the first terminal 2 includes a key end short-range communication module 21, a key end processor 22, and a key end memory 23; the two establish a communication session through near-field communication (NFC) near-field coupling, and exchange APDU data to complete authentication, unlocking or locking, and administrator management operations.
[0031] Example 2: Dual-component verification unlocking process: First terminal 2 establishes a near-field communication (NFC) session with second terminal 1. Second terminal 1 returns second terminal identification information and a 1-byte dynamic random encryption cipher. First terminal 2 retrieves the identity credential bound to the lock identifier locally, uses it as the first verification component, and the dynamic session factor as the second verification component. Multiplication is performed and the verification code is obtained by reducing the cipher to a 4-byte width. First terminal 2 frames and sends a business protocol frame containing a frame prefix, verification code, unlocking command, and verification. Second terminal 1 recalculates the verification code and verifies the frame integrity. After the dual verification is successful, the lock control actuator 12 is driven to complete the unlocking operation.
[0032] Example 3: Hierarchical Administrator Addition Process: The first administrator sends an authorization command to add a secondary administrator. The second terminal 1 verifies the availability of the administrator seat. If the seat is available, it enters a 30-second time-limited allow-addition state. The authorized first terminal 2 reads the allow-addition instruction returned by the lock terminal and sends a secondary administrator addition command. After the second terminal 1 completes the binding, it returns the new administrator's identity credentials and seat identifier, and the addition process is completed.
[0033] Example 4: APDU Encapsulation and Position Detection Mode Adaptation: Service data is encapsulated in ISO7816 standard APDU frames, and the command frame format is 00C50000LC+service protocol frame, with the LC byte having the same length as the service protocol frame; the APDU response frame contains service data and a status word, with the status word 9000H indicating successful transmission and command processing; when the second terminal 1 enables position detection mode, only the success or failure encoding of the lock command is interchanged, while the encodings of other commands such as unlocking and administrator management remain at their default values, adapting to the logic of external position sensors.
[0034] It should be noted that this solution is not only used in Near Field Communication (NFC) locks, but can be used in all short-range communication controls, such as access control and attendance, public transportation access, small-amount payments and identity verification. It also covers many other scenarios, including product anti-counterfeiting and traceability, warehouse and logistics management, touch-based museum exhibit navigation, smart scene quick triggering, pet anti-loss, passive car unlocking and industrial equipment inspection, and fixed asset management. NFC locks are just one example. Furthermore, the communication protocol has a prefix, so the overlap in protocol applications is almost zero, making its application scope very wide.
Claims
1. A method for identity authentication and control based on two-component dynamic check, characterized in that, include: S1. Establish a short-range communication session between the first terminal and the second terminal; the short-range communication includes, but is not limited to, near field communication (NFC), radio frequency identification (RFID), and ultra-wideband (UWB). S2. The second terminal returns its identification information and dynamic session factor to the first terminal; wherein, in the bound administrator state, the dynamic session factor is a random number generated by the second terminal; in the initialization state, the dynamic session factor is associated with the second terminal device identifier. S3. The first terminal uses the identity credential bound to the local and second terminal identification information as the first verification component and the dynamic session factor as the second verification component. The first verification component and the second verification component are synthesized according to the preset fixed bit width and the agreed algorithm to obtain the verification code. S4. The first terminal sends a service protocol frame to the second terminal. The service protocol frame includes at least a frame prefix, the verification code, a service instruction field, and an integrity verification field. S5. The second terminal performs integrity verification on the service protocol frame and performs consistency verification on the verification code based on the stored identity credentials and the current dynamic session factor. After the verification is successful, the operation indicated by the service instruction field is executed.
2. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: The synthesis operation is a linear operation in the integer field, and the operation result is truncated to a preset byte length or reduced to the width of the verification code through modulo operation; in the business process of adding the first administrator, the verification code is set as a field agreed upon in the protocol to avoid operation overflow.
3. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: The first verification component is a fixed identity credential bound to the second terminal, and the second verification component is a dynamic session factor for this session. The two are independent verification factors. The composition operation is implemented in the integer arithmetic domain and does not involve complex number domain operations.
4. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: The short-range communication session uses ISO7816 standard APDU frame encapsulation. The service data field of the APDU response data carries the second terminal identification information and dynamic session factor. The service protocol frame is encapsulated in the APDU command data field. The command header contains category bytes, instruction bytes, parameter bytes, and length bytes. The length byte is consistent with the length of the service protocol frame.
5. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: The frame prefix of the service protocol frame is a preset first constant; The response service frame returned by the second terminal includes a second constant, which is different from the first constant, as a response prefix, the execution result content, and a response integrity verification field.
6. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: It also includes a hierarchical administrator management process. After the first administrator authorizes the second terminal, the second terminal enters a time-limited state where it is allowed to add a secondary administrator. The authorized first terminal sends an add command, and the second terminal completes the binding and returns the secondary administrator's identity identifier and identity credentials when the administrator's seat becomes available.
7. The identity authentication and control method based on dual-component dynamic check according to claim 1, characterized in that: When the second terminal enables location detection mode, only the execution result encoding of lock-type service commands is swapped with the default mode, while the response encoding of other service commands remains consistent.
8. The identity authentication and control method based on dual-component dynamic check according to claim 4, characterized in that: APDU responses contain status words. The order of judgment is as follows: first, confirm the success of transmission and command processing through the status word, and then parse the response service frame in the service data field.
9. A first terminal, characterized by include: The key-end short-range communication module is used to establish a short-range communication session with the smart lock and receive the second terminal identification information and the unique dynamic session factor of this session returned by the smart lock; The key end storage is used to store the identity credentials bound to the second terminal identification information; The key-end processor is electrically connected to the short-range communication module and the memory, and is configured to: use the identity credential as the first verification component and the dynamic session factor as the second verification component, perform linear integer field operations according to a preset fixed bit width and agreed algorithm to generate a verification code; generate a business protocol frame containing a frame prefix, the verification code, a business instruction field and an integrity verification field, and send it to the smart lock through the short-range communication module.
10. A smart lock, characterized in that: The lock-end short-range communication module is used to establish a short-range communication session with the first terminal, return the second terminal identification information and the unique dynamic session factor of this session to the first terminal, and receive the service protocol frame sent by the first terminal. Locking actuator, used to perform unlocking or locking operations; Lock-end memory is used to store identity credentials bound to each first terminal; The lock-end processor is electrically connected to the short-range communication module, the lock control actuator, and the memory, and is configured to: perform integrity verification on the service protocol frame, and recalculate the verification code based on the stored identity credentials and the dynamic session factor of the current session to complete the consistency verification; after the verification is successful, drive the lock control actuator to execute the operation indicated by the service instruction field.