An identity verification method and device, an electronic device, and a storage medium

Abstract

The application provides an identity authentication method and device, electronic equipment and storage medium. When receiving an authentication request from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal; an encrypted beacon based on a connectionless low-power wireless communication protocol and / or a Bluetooth low-power broadcast extension protocol is received from the user terminal, the encrypted beacon being a beacon frame encrypted by a temporary key generated by the user terminal based on the first random number and the first timestamp; an identity authentication attribute is determined based on a time difference between a receiving time and a sending time of the encrypted beacon, a wireless signal strength of the encrypted beacon and a decryption verification result of the encrypted beacon; when the identity authentication attribute is a successful verification, a verification pass confirmation information is returned to the user terminal through an established wireless communication connection. The scheme improves the overall security, attack resistance and authentication reliability of near-field wireless identity authentication in complex environments.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication security technology, and in particular to an authentication method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid popularization and development of IoT technology, near-field, high-security identity authentication between smart devices has become a key foundation for ensuring system security and user privacy. In typical application scenarios such as smart door locks, device network configuration, and near-field payment, there is an urgent need for a wireless identity authentication mechanism that can balance convenience, high security, and low latency. This mechanism needs to effectively verify the legitimate identity of the requesting device and its physical proximity to prevent man-in-the-middle attacks and relay attacks common in various wireless communications, thereby ensuring that only authorized user terminals physically located within the permitted range can be authenticated and perform corresponding operations.

[0003] Currently, authentication between devices can be achieved using wireless interaction technology. This method typically involves the authenticating device actively sending a wireless signal containing dynamic parameters. Upon receiving this signal, the authenticating device generates an encrypted response message based on predetermined rules and sends it back. The authenticating device ultimately determines whether authentication is successful by checking the legality and validity of this response message.

[0004] However, the above technical solutions have the following drawbacks: the authentication dimension is singular, relying solely on cryptographic verification of the encrypted response message itself, which cannot effectively defend against relay attacks, nor can it resist delay spoofing or signal replay attacks that exploit complex wireless environments, resulting in significant security risks in scenarios requiring high security and location authenticity. Summary of the Invention

[0005] This application provides an authentication method, apparatus, electronic device, and storage medium to address the security issues that current methods cannot effectively defend against relay attacks, delay spoofing, and signal replay attacks due to reliance solely on cryptographic authentication, thereby improving the overall security, anti-attack capability, and authentication reliability of near-field wireless authentication in complex environments.

[0006] In a first aspect, embodiments of this application provide an authentication method, the method comprising: When an authentication request is received from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal. The system receives an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein the encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on the first random number and the first timestamp; the point-to-point wireless communication protocol includes at least one of a connectionless low-power wireless communication protocol and a Bluetooth Low Energy Broadcast extension protocol. The authentication attribute is determined based on the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon. When the authentication attribute indicates successful authentication, a verification confirmation message is returned to the user terminal via the established wireless communication connection.

[0007] Secondly, embodiments of this application also provide an authentication device, the device comprising: A wireless signal broadcasting module is used to broadcast a wireless broadcast signal containing a first random number and a first timestamp to the user terminal when an authentication request is received from the user terminal. An encrypted beacon receiving module is used to receive an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein, the encrypted beacon is a beacon frame encrypted by the user terminal based on a temporary key generated by the first random number and the first timestamp; the point-to-point wireless communication protocol includes at least one of a connectionless low-power wireless communication protocol and a Bluetooth Low Energy Broadcast extension protocol; An authentication module is used to determine authentication attributes based on the time difference between the receiving time and the sending time of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon; The confirmation information feedback module is used to return a verification success confirmation message to the user terminal through the established wireless communication connection when the authentication attribute indicates successful authentication.

[0008] Thirdly, embodiments of this application also provide an electronic device, which includes: One or more processors; Storage device for storing one or more programs. When one or more programs are executed by one or more processors, the one or more processors implement an authentication method as described in any of the embodiments of this application.

[0009] Fourthly, embodiments of this application also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform any of the authentication methods described in the embodiments of this application.

[0010] This application provides an authentication method, which includes: when receiving an authentication request from a user terminal, broadcasting a wireless broadcast signal containing a first random number and a first timestamp to the user terminal; then, receiving an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal, wherein the encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on the first random number and the first timestamp; further, determining an authentication attribute based on the time difference between the receiving time and the sending time of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon; and finally, when the authentication attribute indicates successful authentication, returning a verification success confirmation message to the user terminal through the established wireless communication connection. The technical solution of this application determines the authentication attribute by using multi-dimensional information such as the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon to make a fusion decision. This achieves reliable dual verification of the authenticity of the communication entity's identity and the proximity of its physical location in wireless authentication. It solves the security problem that the current reliance on cryptographic verification alone cannot effectively defend against relay attacks, delay spoofing, and signal replay attacks, and improves the overall security, anti-attack capability, and authentication reliability of near-field wireless authentication in complex environments. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the exemplary embodiments of this application, the accompanying drawings used in describing the embodiments are briefly introduced below. Obviously, the accompanying drawings described are only a portion of the embodiments to be described in this application, and not all of them. For those skilled in the art, other drawings can be obtained from these drawings without any creative effort.

[0012] Figure 1 This is a flowchart illustrating an authentication method provided in an embodiment of this application. Figure 2 This is a schematic diagram of the ESP32 main control CPU involved in the embodiments of this application; Figure 3 A flowchart illustrating yet another authentication method provided in an embodiment of this application; Figure 4 This is a schematic diagram of a system architecture for implementing the authentication method provided in this embodiment of the application. Figure 5 This is a schematic diagram illustrating the initial registration process between the user terminal and the authentication control device involved in the embodiments of this application; Figure 6 This is a flowchart illustrating the routine dual authentication process between the user terminal and the authentication master control device involved in the embodiments of this application. Figure 7 A schematic diagram of the structure of an identity verification device provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0013] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the application and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present application, not the entire structure.

[0014] Before introducing the technical solution provided in this application, the application scenarios of the solution can be described first. This embodiment is applicable to various scenarios that require high-security authentication based on physical proximity. Currently, although wireless interaction schemes based on single cryptographic verification are widely used for device authentication, traditional methods have obvious limitations. In practical applications, since authentication needs to consider both identity authenticity and location authenticity, and needs to defend against various wireless security threats such as relay attacks and replay attacks, and the authentication process is easily affected by complex wireless environments, traditional authentication methods are difficult to balance security and reliability, easily leading to problems such as weak anti-attack capability, poor environmental adaptability, and high risk of false authentication. Therefore, there is an urgent need for an authentication method that can integrate multi-dimensional physical features and cryptographic verification to improve the overall security level and scenario adaptability of the authentication process. This embodiment aims to accurately determine the legitimate identity and real physical location of the user terminal. Under the premise of simultaneously verifying multi-dimensional information such as the decryption result of the encrypted beacon, the signal round-trip time difference, and the received signal strength, a composite verification strategy is executed to determine the authentication attributes, thereby ensuring the reliability of the authentication result in terms of security and effectively improving the anti-relay attack capability and overall robustness of the authentication system.

[0015] Example 1 Figure 1 This is a flowchart illustrating an authentication method provided in an embodiment of this application. This embodiment is applicable to various situations requiring high-security authentication based on physical proximity. The method can be executed by an authentication device, which can be implemented in the form of software and / or hardware. The hardware can be a controller, such as a mobile terminal, a PC, or a server.

[0016] like Figure 1 As shown, the authentication method provided in this embodiment of the invention includes the following steps: S110. When an authentication request is received from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal.

[0017] The authentication method provided in this embodiment of the invention can be executed by an authentication master control device. The user terminal refers to the device that acts as both the authenticated party and the responder in the authentication method; it is the interaction object of the authentication master control device. An authentication request refers to an initial signal or instruction initiated actively or passively by the user terminal, aimed at starting or triggering the subsequent complete authentication process.

[0018] The first random number is an unpredictable value generated by the authentication master device to enhance security. The first timestamp is a value representing the current time recorded by the authentication master device when generating the wireless broadcast signal. The wireless broadcast signal is a public signal carrying the first random number and first timestamp information, transmitted wirelessly by the authentication master device to the surrounding space. This signal is intended to be received by the user terminal to initiate subsequent authentication interactions.

[0019] Specifically, when the authentication master device senses the authentication request issued by the user terminal, it immediately executes an active wireless signal transmission process. This process uses the first random number and the first timestamp generated by the device as the core data payload and transmits them publicly within the spatial range in the form of a wireless broadcast signal. The purpose is to enable the user terminal that issued the authentication request to receive this signal, thereby providing the necessary data foundation for the subsequent generation of a temporary key based on the first random number and the first timestamp and the construction of an encrypted beacon.

[0020] For example, the authentication method provided in this embodiment can be applied to scenarios where a smart lock is opened by verifying the use of a terminal device. When a user uses a mobile phone (as a user terminal) to approach the smart lock (as the authentication master device) and clicks the unlocking application on the mobile phone to initiate an authentication request, the smart lock will actively send a wireless broadcast signal to the surrounding space through its wireless module after receiving the authentication request. This signal contains a first random number temporarily generated by the smart lock and a first timestamp of the current time. The mobile phone will receive this wireless broadcast signal containing the first random number and the first timestamp, and use this information to perform subsequent encryption and verification steps.

[0021] S120: Receive an encrypted beacon based on a point-to-point wireless communication protocol returned from a user terminal.

[0022] An encrypted beacon is a standardized wireless signal data unit constructed by a user terminal after receiving a wireless broadcast signal, based on the format and interaction rules specified by a specific point-to-point wireless communication protocol.

[0023] In this embodiment, the encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on a first random number and a first timestamp. This can be understood as follows: after constructing a beacon frame for communication, the user terminal does not directly send its original content. Instead, it first uses a temporarily generated key to encrypt the entire beacon frame or a key portion thereof. The generation process of this temporary key strictly depends on the first random number and the first timestamp obtained by the user terminal from the authentication master device. This ensures that the content of the ultimately sent encrypted beacon is transformed by the temporary key, forming an ciphertext form that can only be correctly decrypted by the authentication master device, which possesses the same generation rules and original data.

[0024] Specifically, the authentication master device can listen to and obtain a specific wireless signal sent back by the user terminal. This signal is an encrypted beacon that conforms to the point-to-point wireless communication protocol format. The encrypted beacon can be understood as an encrypted data frame. The key on which the encryption depends is a temporary key dynamically calculated by the user terminal using the first random number and the first timestamp obtained from the broadcast signal of the authentication master device as input materials. Therefore, the authentication master device receives a beacon frame in ciphertext form encrypted with this temporary key.

[0025] In this embodiment, optionally, the point-to-point wireless communication protocol may include at least one of the following: Connectionless Low Power Wireless Communication Protocol (ESP-NOW) and Bluetooth Low Energy Advertising Extensions protocol.

[0026] Connectionless low-power wireless communication protocols refer to low-power wireless communication protocols that do not require a pre-established stable connection between communication devices to exchange data. These protocols typically send data via broadcast, and the receiver can listen for and receive information without joining a network or completing a complex handshake process, thus achieving fast and energy-efficient data transmission.

[0027] Among them, Bluetooth Low Energy Broadcast Extension Protocol refers to a protocol in the Bluetooth Low Energy technology system that enhances broadcast communication capabilities by introducing mechanisms such as Extended Broadcast. This protocol supports the transmission of longer data loads in a connectionless state and can improve the efficiency and predictability of data transmission through periodic broadcasts, thereby meeting more complex application requirements.

[0028] This can be understood as follows: during the authentication process, the encrypted beacon returned by the user terminal is transmitted based on a point-to-point wireless communication protocol. Specifically, the point-to-point wireless communication protocol can be selected from at least one of two protocols: connectionless low-power wireless communication protocol and Bluetooth Low Energy Broadcast Extension Protocol. That is, both protocols belong to the category of point-to-point wireless communication protocols and have the characteristics of connectionless and low power consumption, which can support the user terminal to send encrypted beacons in a broadcast manner without having to establish a complete communication connection with the receiver before sending.

[0029] In addition, point-to-point wireless communication protocols can also include protocols with low latency and connectionless characteristics, such as Near Field Communication Active (NFC-ACTIVE) and Ultra Wideband (UWB) ranging protocols.

[0030] Based on the above example, after the smart lock broadcasts a wireless broadcast signal containing a first random number and a first timestamp to the mobile phone, it immediately enters a listening state, waits for and finally successfully obtains a specific wireless signal that conforms to the point-to-point wireless communication protocol format sent back by the mobile phone, namely an encrypted beacon. The beacon is a beacon frame encrypted by the mobile phone using the received first random number and first timestamp to generate a temporary key.

[0031] In practical applications, the point-to-point wireless communication channel used to receive the encrypted beacon can optionally be dynamically switched periodically. As one specific implementation, sequential or pseudo-random switching can be performed between different pre-selected wireless channels at preset time intervals. This channel switching reduces the potential for persistent interference or blocking attacks on fixed channels, increasing the difficulty for potential attackers to eavesdrop, intercept, or maliciously inject encrypted beacons, thereby enhancing the environmental adaptability and anti-cracking robustness of the entire authentication process at the physical wireless link layer.

[0032] In this embodiment, optionally, the method for generating the encrypted beacon may specifically include the following steps: (1) When the user terminal receives the wireless broadcast signal, a second random number is generated.

[0033] The second random number refers to a new, unpredictable value that the user terminal generates independently of the first random number after receiving the wireless broadcast signal from the authentication master control device.

[0034] Specifically, after the user terminal successfully captures and decodes the wireless broadcast signal containing the first random number and the first timestamp emitted by the authentication master device, the user terminal can generate a brand new, unpredictable value, namely the second random number. The generation of this second random number indicates that the user terminal has started the preparatory work for securely constructing an encrypted beacon using the received information.

[0035] (2) The user terminal generates a temporary encryption key based on the received first random number, first timestamp and second random number through the first key derivation function.

[0036] The first key derivation function is a deterministic cryptographic operation that replaces the first random number, the first timestamp, and the second random number with one or more secret keys that conform to the requirements of the encryption algorithm. The temporary encryption key is the encryption key used for this specific authentication session; it is temporary and unique.

[0037] Specifically, the user terminal can use the first random number and the first timestamp obtained from the wireless broadcast signal, together with the second random number generated by itself, as a set of input data, and provide them to a predefined cryptographic processing function called the first key derivation function. This process will perform deterministic calculations on these inputs according to its internal algorithm, and finally output a one-time encryption key, i.e., a temporary encryption key, specifically for the current authentication interaction.

[0038] (3) The user terminal performs a first hash operation on the combination of the first random number and the second random number based on the stored terminal private key to generate additional authentication data.

[0039] The terminal private key is a secret cryptographic parameter securely stored beforehand within the user terminal. It is a private key component unique to the user terminal in an asymmetric cryptosystem or specific authentication mechanism, used to generate digital signatures or perform specific operations to prove the terminal's identity. Additional authentication data refers to a specific piece of data generated by the user terminal using its terminal private key to perform a first hash operation on a combination of a first random number and a second random number. This data is not encrypted but is incorporated into the subsequent first authentication encryption algorithm to provide integrity protection and additional identity binding verification.

[0040] In this embodiment, the user terminal can call its internally stored private key as a cryptographic element to apply a cryptographic digest function called the first hash operation to the combined data composed of the first random number and the second random number. This operation generates a fixed-length, unique and irreversible data digest, which is defined as additional authentication data.

[0041] (4) The user terminal uses a temporary encryption key, with the combination of the first random number and the second random number as the initialization vector, and introduces additional authentication data to encrypt the device identifier through the first authentication encryption algorithm to generate an encrypted beacon.

[0042] Specifically, after the user terminal completes the key and data preparation, it can use the generated temporary encryption key as the core encryption key, the combination of the first random number and the second random number as the initialization vector required by the encryption algorithm, and the previously generated additional authentication data as the associated data input. It then uses a specific encryption mode called the first authentication encryption algorithm to process the plaintext data, the device identifier representing the user terminal's identity, and finally outputs a ciphertext result that provides both confidentiality and authentication guarantees. This ciphertext result constitutes the encrypted beacon to be sent.

[0043] S130. Based on the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon, determine the authentication attribute.

[0044] The time difference between receiving and sending refers to the time interval recorded by the authentication master device between the two events from when it sends out a wireless broadcast signal to when it receives the encrypted beacon returned by the user terminal. It is used to assess communication latency and physical distance.

[0045] Among them, wireless signal strength refers to the physical strength index of the wireless signal measured by the authentication master control device when receiving the encrypted beacon, and is often used to help determine the approximate distance of the user terminal.

[0046] The decryption verification result refers to the success or failure conclusion of the authentication master device after attempting to decrypt the encrypted beacon using the corresponding temporary key calculated by itself, and cryptographically verifying the integrity and authenticity of the decrypted data and the additional authentication data.

[0047] Among them, the authentication attribute refers to the final decision output made by the authentication master device on the entire authentication attempt after considering three factors: time difference, wireless signal strength, and decryption verification result. Its value is one of two states: verification passed or verification failed.

[0048] Specifically, the time difference between the received time of the encrypted beacon and the time when the wireless broadcast signal was initially sent can be calculated to determine whether the response is timely and to rule out remote relay attacks. Secondly, the wireless signal strength of the received encrypted beacon is detected to assess the approximate physical distance to the user terminal. Finally, the encrypted beacon is decrypted and its integrity and authenticity are verified to obtain the decryption verification result. The authentication master control device makes a joint judgment on these conditions according to preset rules to determine whether the authentication attribute is successfully verified or fails.

[0049] For example, continuing the example of opening a smart lock via a terminal device, after receiving the encrypted beacon returned by the mobile phone, the smart lock first calculates the time elapsed between when it previously sent a wireless broadcast signal and when it received the encrypted beacon (i.e., the time difference between the receiving and sending times), and measures the strength of the wireless signal of the currently received encrypted beacon. At the same time, it attempts to decrypt and verify the encrypted beacon using its own generated temporary key (i.e., the decryption verification result). The smart lock comprehensively judges these three factors, such as whether the time difference is extremely short (indicating that the mobile phone is responding nearby), whether the signal strength is strong enough (indicating that the mobile phone is physically close), and whether the decryption verification result is successful (indicating that the mobile phone has the correct key and identity). If all these conditions meet the preset security requirements, the smart lock determines that the authentication attribute is "verification passed"; otherwise, it determines that "verification failed".

[0050] S140. When the authentication attribute indicates successful authentication, a verification confirmation message is returned to the user terminal via the established wireless communication connection.

[0051] In practical applications, after the authentication master device completes all authentication steps and concludes that the authentication attribute is "authentication successful", it can use the point-to-point wireless communication link that has been established with the user terminal in the previous interaction to send a status confirmation message indicating that the authentication has been passed to the user terminal, so that the user terminal knows that its identity has been successfully verified and triggers subsequent authorization operations.

[0052] Optionally, after each authentication process, temporary key data generated locally or provided by the user terminal during this authentication process can be cleared. This enables session isolation and post-use destruction of keys, minimizing the time key materials reside in memory and effectively preventing temporary keys from being maliciously extracted or reused due to long-term retention. This significantly improves the system's resistance to key leakage risks and its ability to counter subsequent replay attacks, enhancing the forward security and session independence of the entire authentication mechanism.

[0053] In this embodiment, optionally, the user terminal includes a first type of composite terminal and a second type of integrated terminal; the first type of composite terminal is composed of a mobile intelligent terminal and an external dual-mode communication module; the second type of integrated terminal is an independent hardware device that integrates point-to-point wireless communication function and secure computing function required for wireless interaction with the authentication master control device.

[0054] In essence, user terminals are categorized into two hardware implementation types: The first type, known as the first-class composite terminal, is constructed by physically or logically connecting a general-purpose mobile smart terminal, such as a smartphone or tablet, with an additional external module supporting specific dual-mode communication capabilities. This external dual-mode communication module provides the wireless communication capabilities required for interaction with the authentication master device. The second type, known as the second-class integrated terminal, is designed to integrate all necessary functions (i.e., point-to-point wireless communication functions required for wireless interaction with the authentication master device, as well as secure computing functions for performing encryption, key generation, and other operations) into a single, independently operating hardware device, no longer relying on an external mobile smart terminal.

[0055] The purpose of this setup is twofold: First, the composite terminal, by reusing widely available mobile smart terminals and pairing them with a dedicated external dual-mode communication module, can quickly and conveniently endow existing mobile devices with authentication capabilities, maximizing functional expansion and resource utilization; while second, the integrated terminal, by highly integrating point-to-point wireless communication and secure computing functions into a single, independent hardware, can provide higher system reliability, security enclosure, and portability, making it particularly suitable for application environments with stringent requirements for security levels, device stability, or independent operation. Together, they construct a multi-layered user terminal hardware ecosystem that balances accessibility, flexibility, security, and professionalism.

[0056] For example, for the first type of composite terminal composed of a mobile smart terminal and an external dual-mode communication module, the external dual-mode communication module can be an ESP32 main control CPU (ESP32 series wireless communication microcontroller main control central processing unit). Figure 2 A schematic diagram of the ESP32 main control CPU, as shown below. Figure 2 As shown, it includes: a BLE controller; a Wi-Fi MAC layer (supporting ESP-NOW); a security coprocessor (integrating AES-128 / 256, HMAC-SHA256, and ECC engines); a Flash secure storage area (used for encrypting and storing sensitive data such as public keys); and GPIO / execution interfaces (used for connecting external actuators such as relays and motor drives). Both the BLE controller and the Wi-Fi MAC layer can communicate with the same 2.4GHz antenna (supporting BLE and Wi-Fi communication) via radio frequency signals.

[0057] The application of an external dual-mode communication module to execute the authentication method described in this solution is based on the core principle of using this module as a hardware bridge between the mobile smart terminal (such as a smartphone) and the authentication master control device (such as a smart lock) to execute the dedicated security protocol and wireless communication of this solution. The specific implementation steps are as follows: S1. Module deployment and initialization.

[0058] (1) Physical and logical connection: Connect the external dual-mode communication module (such as an ESP32-based module) to the mobile smart terminal through a standardized interface (such as USB, Bluetooth, or a custom hardware interface). Run a dedicated application (APP) on the mobile smart terminal. The APP is responsible for user interaction (such as clicking "unlock"), business logic control, and exchanges instructions and data with the external module through interface drivers or protocols.

[0059] (2) Pairing and Key Distribution: During the initial pairing phase, the mobile smart terminal's APP guides the user to initiate an "Add Device" operation. The APP controls the external module's BLE controller to enter scanning mode via interface commands, discovers and responds to the pairing broadcast of the authentication master device, and then establishes a secure BLE connection. Subsequently, the APP can generate a terminal key pair using its own or the external module's security capabilities, and send the terminal public key to the master device through the external module's BLE controller, while simultaneously receiving and storing the master device's public key. These public keys are ultimately securely stored in the external module's Flash secure storage area.

[0060] S2, Certificate Request and Broadcast Signal Response.

[0061] Request Relay and Signal Reception: When a user triggers authentication on the app (e.g., by clicking to unlock), the app sends an authentication command to the external module via an interface. The authentication master device then broadcasts a wireless broadcast signal containing a first random number and a first timestamp. This signal is received by the external module's Wi-Fi MAC layer (which supports ESP-NOW). The module's real-time response unit ensures that signal acquisition and decoding are completed within a very short time (e.g., <50ms).

[0062] S3. Generation and transmission of encrypted beacons.

[0063] (1) Secure computation: After receiving the broadcast signal, the external module's security coprocessor generates a second random number locally and combines it with the received first random number and the first timestamp. It then performs a series of secure operations through the built-in cryptographic engine (such as HMAC-SHA256, AES, ECC): it generates a temporary encryption key using the first key derivation function (such as HKDF); it performs a hash operation on the random number combination using the stored terminal private key (or the key material provided by the APP security) to generate additional authentication data; and finally, it encrypts the device identifier using the temporary encryption key and authentication encryption algorithms such as AES-GCM to generate an encrypted beacon (corresponding to the encryption beacon generation logic in the scheme).

[0064] (2) High-speed transmission: The generated encrypted beacon is transmitted back to the authentication master device at high speed and low latency via the Wi-Fi MAC layer of the external module using the ESP-NOW protocol. The entire process is completed independently by the module or strictly follows the synchronization instructions of the APP to meet the stringent requirements of time difference verification.

[0065] S4. Receiving and feedback of verification results.

[0066] (1) Result reception: After the authentication master device completes the authentication, it will return the final authentication attribute (success or failure) through the established BLE connection (or ESP-NOW). This return information is received by the BLE controller or Wi-Fi MAC layer of the external module.

[0067] (2) Result relay and execution: The external module reports the received verification result to the APP of the mobile smart terminal through the interface. The APP updates the user interface according to the result (such as displaying "Door open" or "Authentication failed"). If the external module integrates GPIO / execution interface and is authorized in a specific application mode, it may also directly drive the connected actuator (such as relay) according to the success instruction, but this function is usually executed by the main control device.

[0068] S5, Safety and Performance Guarantee.

[0069] Key security: Throughout the entire process, sensitive materials such as terminal private keys and temporary session keys are always generated, used, and cleared within the secure coprocessor and Flash secure storage area of ​​the external module, and are not exposed to the general operating system of the mobile smart terminal, effectively improving the ability to resist attacks.

[0070] Timing Guarantee: The module's real-time response unit and dedicated ESP-NOW protocol stack ensure that the entire processing flow from receiving the broadcast signal to sending the encrypted beacon can be completed in a very short time (e.g., <200ms), which is the key to meeting the first verification result (time difference verification).

[0071] Functional decoupling: This design decouples secure, real-time communication functions from the general computing and user interface functions of the mobile smart terminal. The mobile smart terminal provides a user-friendly interface and a rich ecosystem, while the external module provides dedicated, reliable, and secure protocol execution capabilities, together forming a first-type composite terminal that flexibly implements this authentication scheme.

[0072] This application provides an authentication method, which includes: when receiving an authentication request from a user terminal, broadcasting a wireless broadcast signal containing a first random number and a first timestamp to the user terminal; then, receiving an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal, wherein the encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on the first random number and the first timestamp; further, determining an authentication attribute based on the time difference between the receiving time and the sending time of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon; and finally, when the authentication attribute indicates successful authentication, returning a verification success confirmation message to the user terminal through the established wireless communication connection. The technical solution of this application determines the authentication attribute by using multi-dimensional information such as the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon to make a fusion decision. This achieves reliable dual verification of the authenticity of the communication entity's identity and the proximity of its physical location in wireless authentication. It solves the security problem that the current reliance on cryptographic verification alone cannot effectively defend against relay attacks, delay spoofing, and signal replay attacks, and improves the overall security, anti-attack capability, and authentication reliability of near-field wireless authentication in complex environments.

[0073] Example 2 Figure 3 This is a schematic diagram of an authentication method provided in an embodiment of this application. Based on the foregoing embodiments, this embodiment will provide a more detailed description of S130. For specific implementation details, please refer to the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here.

[0074] like Figure 3 As shown, the method specifically includes the following steps: S210. When an authentication request is received from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal.

[0075] S220, In response to the pairing trigger event, enters pairing mode and broadcasts a pairing broadcast signal.

[0076] Among them, pairing trigger events refer to specific internal or external signals, states, or conditions that the authentication master control device can identify and interpret during operation as a process that requires initiating an initial security binding or trust relationship establishment process with the user terminal.

[0077] Specifically, when the authentication master device detects a pairing trigger event, its internal logic immediately switches to a special working state dedicated to performing the initial pairing process, namely the pairing mode. In this mode, the authentication master device will proactively and periodically or continuously send a specific wireless signal that can be recognized and responded to by unpaired user terminals, namely the pairing broadcast signal, to announce that it is in a state that accepts pairing requests, thereby guiding the user terminal to initiate subsequent pairing connections.

[0078] S230: Establish a secure Bluetooth Low Energy connection with the user terminal that initiates pairing.

[0079] In this embodiment, after the authentication master device broadcasts a pairing broadcast signal, it successfully executes a complete process including device discovery, link establishment, security feature negotiation, and encrypted link generation through the Bluetooth Low Energy wireless communication technology protocol stack with the user terminal that actively responds to the signal and sends a pairing request. Finally, a stable Bluetooth Low Energy data communication channel protected by encryption is formed between the two parties. This connection provides a secure and reliable transmission foundation for subsequent bidirectional transmission of data such as the master device's public key, the terminal's public key, and verification confirmation information.

[0080] S240. Generate a master control device key pair and send the public key in the generated master control device key pair to the user terminal.

[0081] Among them, the master control device key pair refers to a pair of asymmetric cryptographic keys generated locally by the authentication master control device. The key pair contains a master control device private key that must be kept strictly confidential and stored only inside the authentication master control device, and a master control device public key that can be disclosed to the communication counterpart (i.e., the user terminal).

[0082] In this embodiment, when executing the pairing process, the authentication master device first runs a cryptographic student generation algorithm internally to create a new pair of asymmetric keys, namely the master device key pair. For example, the master device key pair can be generated based on an elliptic curve cryptography algorithm. Subsequently, through an established wireless communication connection, such as a secure low-power Bluetooth connection, the publicly available master device public key portion of this key pair is actively transmitted to the paired user terminal, so that the user terminal can use this public key for subsequent secure communication or authentication operations.

[0083] S250: Receive and store the terminal public key from the user terminal, and receive the encrypted beacon based on the point-to-point wireless communication protocol returned by the user terminal.

[0084] Among them, the encrypted beacon is a beacon frame obtained by encrypting a temporary key generated by the user terminal based on the first random number and the first timestamp.

[0085] S260. Based on the time difference between the receiving time and the sending time of the encrypted beacon and a preset time threshold, determine the first verification result.

[0086] The preset time threshold refers to a fixed upper limit value for comparison that the authentication master device sets in advance during the authentication process. The first verification result refers to a binary judgment conclusion, such as "pass" or "fail", made by the authentication master device by comparing the time difference between the receiving time and the sending time of the encrypted beacon with the preset time threshold to determine whether the time delay meets the security requirements.

[0087] Specifically, the authentication master device can calculate the time difference between when it sends a wireless broadcast signal and when it receives the encrypted beacon returned by the user terminal. Then, it compares this calculated time difference with a preset time threshold. If the time difference is less than or equal to the preset time threshold, it meets the requirements; otherwise, it does not. Finally, it determines and outputs a verification conclusion on the time delay dimension of this authentication. This conclusion is the first verification result.

[0088] S270. Based on the wireless signal strength of the encrypted beacon and a preset strength threshold, determine the second verification result; based on the decryption verification result of the encrypted beacon, determine the third verification result.

[0089] The preset strength threshold refers to a fixed threshold value set in advance for comparing the strength of wireless signals. The second verification result refers to the conclusion drawn by comparing the wireless signal strength of the received encrypted beacon with the preset strength threshold, regarding whether the signal strength meets the distance or signal quality requirements. The third verification result refers to the cryptographic verification conclusion drawn by the authentication master control device after performing decryption and integrity verification on the received encrypted beacon, regarding whether the encrypted beacon has been correctly decrypted and whether its content is authentic and valid.

[0090] Specifically, the authentication master device can measure the wireless signal strength of the encrypted beacon and compare it with a preset strength threshold. If the signal strength is greater than or equal to the threshold, it determines and outputs a second verification result regarding the physical layer credibility of the signal. It can also perform a decryption operation on the encrypted beacon and verify its integrity and authenticity. Based on whether the decryption process is successful and whether the verification passes, it determines and outputs a third verification result regarding the cryptographic layer correctness.

[0091] In this embodiment, optionally, the specific steps for determining the third verification result based on the decryption verification result of the encrypted beacon may include: (1) Verify the signature information carried in the encrypted beacon based on the pre-stored user terminal public key.

[0092] Specifically, a cryptographic public key, namely the user terminal public key, which has been received and securely stored locally during the previous pairing process, can be used to perform a digital signature verification algorithm on the signature information extracted from the encrypted beacon to confirm whether the signature information was indeed generated by the user terminal private key corresponding to the stored public key, thereby verifying the authenticity and integrity of the encrypted beacon's source.

[0093] (2) If the signature verification fails, the third verification result is determined to be an identity verification failure.

[0094] Specifically, when the authentication master device executes the verification algorithm based on the pre-stored user terminal public key to verify the signature information carried in the encrypted beacon, if the conclusion is that the signature information is invalid, that is, it cannot pass the cryptographic verification, indicating that the signature may have been tampered with, forged, or come from a non-matching terminal, then the third verification result is determined to be a failure, and the entire authentication process will be processed in the direction of failure.

[0095] (3) If the signature verification is successful, the encrypted beacon is decrypted using the temporary key to obtain the plaintext device identifier.

[0096] Specifically, once the authentication master device verifies the signature information in the encrypted beacon based on the pre-stored user terminal public key and confirms its validity, it will then use its own locally calculated temporary key, obtained through the first random number and the first timestamp, to perform the corresponding decryption algorithm operation on the encrypted part of the encrypted beacon, thereby recovering the original data content protected by encryption, which is the plaintext device identifier.

[0097] (4) Compare the plaintext device identifier with the pre-stored legitimate device identifier to determine the third verification result.

[0098] Specifically, after successfully decrypting the plaintext device identifier, the authentication master device will compare the identifier with one or more legitimate device identifiers that are authorized to perform authentication and are stored in its internal memory. If the comparison results match, the third verification result is considered successful; if they do not match, the third verification result is considered unsuccessful. This step aims to finally confirm whether the user terminal that made the authentication request is a pre-registered legitimate device.

[0099] S280. Based on the first verification result, the second verification result, and the third verification result, determine the authentication attributes.

[0100] In this embodiment, after obtaining the first verification result regarding time delay, the second verification result regarding wireless signal strength, and the third verification result regarding decryption and identifier comparison, the authentication master control device determines that the overall result of this authentication attempt is successful if all verification results are passed; otherwise, it is considered a failure, i.e., the authentication attribute is determined to be "verification passed" or "verification failed".

[0101] S290. When the authentication attribute indicates successful authentication, a verification confirmation message is returned to the user terminal via the established wireless communication connection.

[0102] Based on the above embodiments, optionally, the method further includes: counting the number of consecutive authentication failures; when the number of authentication failures reaches a preset failure threshold, activating a locking mechanism to refuse to process any authentication request for a preset locking duration; and when the authentication attribute indicates successful authentication, returning authentication success confirmation information to the user terminal through the established wireless communication connection.

[0103] In this embodiment, in addition to the core verification steps, the authentication method can add a security protection step: the authentication master device records the cumulative number of consecutive authentication failures, i.e., the number of verification failures. When this number reaches a preset failure threshold, a lock state is automatically triggered. In this state, the authentication master device will no longer respond to or process any authentication requests from the user terminal during the lock duration, thus serving as a protection measure against brute-force attacks or malicious attempts. Regardless of whether the lock is triggered, when an authentication attribute is determined to be successful, the authentication master device still needs to execute its core steps, i.e., return a verification success confirmation message to the user terminal through the established wireless communication connection. In this way, by detecting and punishing consecutive failures, the time cost and operational difficulty for attackers to perform unlimited guesses or attempts are significantly increased, thereby enhancing the proactive defense capability against unauthorized access at the system level. At the same time, this mechanism is independent of and runs in parallel with the normal successful authentication process, ensuring that legitimate users can still receive a timely response after successful authentication, thus balancing security and availability.

[0104] The technical solution of this application embodiment, when determining the authentication attribute, determines a first verification result based on the time difference between the receiving and sending times of the encrypted beacon and a preset time threshold; determines a second verification result based on the wireless signal strength of the encrypted beacon and a preset strength threshold; determines a third verification result based on the decryption verification result of the encrypted beacon; and determines the authentication attribute based on the first, second, and third verification results. The technical solution provided in this embodiment effectively defends against remote relay attacks through time difference verification, constrains physical distance through signal strength verification to prevent unauthorized access from nearby areas, and ensures the legitimate identity and data integrity of the communicating party through cryptographic decryption verification. This layered verification mechanism significantly improves the accuracy and security of authentication, reduces the risk of overall authentication failure due to the breach of a single verification method, and thus constructs a more robust and reliable authentication system.

[0105] For example, Figure 4 This is a schematic diagram of a system architecture for implementing the authentication method provided in this embodiment, such as... Figure 4 As shown, it mainly consists of two parts: a user terminal and an authentication master control device. The user terminal is composed of a user interface (such as a mobile APP), a BLE host stack, and an ESP32 communication module (including a WIFI MAC) connected in sequence. The ESP32 communication module is also connected to a real-time response unit (response time less than 200 milliseconds) and a secure storage area (used to store user keys). The authentication master control device includes a BLE controller, a WIFI MAC module (supporting ESP-NOW), a security coprocessor, an application logic unit, and a secure storage area (used to store user keys). The BLE controller is connected to the security coprocessor, and the WIFI MAC module (supporting ESP-NOW), the security coprocessor, the application logic unit, and the secure storage area are interconnected. On the communication link, the BLE controller of the authentication master control device establishes a connection with the BLE host stack of the user terminal, and the ESP32 communication module (including the WIFI MAC) of the user terminal communicates with the WIFI MAC module (supporting ESP-NOW) of the authentication master control device.

[0106] Combination Figure 4 The system architecture diagram shown illustrates the execution flow of the authentication method described above: Authentication Request and Broadcast Signal: The user initiates an authentication request through a user terminal (such as a mobile app). This request is transmitted to the ESP32 communication module via the BLE host stack. After receiving this request through its application logic unit, the authentication master device controls the WIFI MAC module (supporting ESP-NOW) to broadcast a wireless broadcast signal containing a first random number and a first timestamp. The real-time response unit (response time less than 200 milliseconds) of the user terminal's ESP32 communication module (including the WIFI MAC) is responsible for quickly capturing this signal.

[0107] Pairing and Secure Connection Establishment: When needed, the authentication master device responds to the pairing trigger event, enters pairing mode through its BLE controller, and broadcasts a pairing signal. The user terminal's BLE host stack responds to this signal, and both parties establish a secure Bluetooth Low Energy connection through interaction between the BLE controller and the BLE host stack.

[0108] Key Exchange and Beacon Preparation: After the connection is established, the security coprocessor of the authentication master device generates a master device key pair and sends the public key to the user terminal via the BLE link. The user terminal's secure storage area provides its user key, which is used to generate or assist in generating the terminal public key. The user terminal then sends the terminal public key to the authentication master device via the BLE link, where it stores it in its own secure storage area. Simultaneously, the user terminal generates a temporary key based on the received first random number and first timestamp, using the user key from the secure storage area.

[0109] Encrypted Beacon Transmission and Authentication: The user terminal uses a temporary key to encrypt information such as the device identifier, generating an encrypted beacon based on the Point-to-Point Wireless Communication Protocol (ESP-NOW), and transmits it through its ESP32 communication module. The WIFI MAC module of the authentication master device receives this encrypted beacon. Subsequently, the security co-processor of the authentication master device collaborates with the application logic unit to perform a three-step authentication: calculating the round-trip time difference of the signal and comparing it with a preset threshold to obtain the first authentication result; measuring the signal strength and comparing it with a preset threshold to obtain the second authentication result; and decrypting and verifying the beacon using the stored key (including verifying the signature and comparing the device identifier) ​​to obtain the third authentication result.

[0110] Comprehensive Judgment and Confirmation: The application logic unit integrates the results of the first, second, and third verifications to determine the final authentication attribute. If the verification is successful, a verification success confirmation message is returned to the user terminal through the established BLE connection; if consecutive verification failures reach a threshold, a locking mechanism can be triggered.

[0111] In summary, this architecture clearly defines functional modules: the user terminal focuses on request initiation, real-time response, and user-side secure computation; the authentication master device focuses on signal broadcasting, authentication decision-making, and master-side secure processing. The two devices pair, exchange keys, and transmit control signaling via BLE, and interact with authentication beacons at high speed and low latency via ESP-NOW. A secure storage area provides trusted key storage for both parties, thus collaboratively achieving a highly secure authentication process integrating near-field sensing, physical layer anti-relay, and cryptographic verification.

[0112] As an optional embodiment, taking a mobile phone as the user terminal and a smart lock as the authentication master control device as an example, Figure 5 This is a schematic diagram illustrating the initial registration process between the user terminal and the authentication control device, as shown below. Figure 5 As shown, the user terminal (a combination of a mobile phone and an ESP32 module) and the authentication master device (smart lock) are in a physically close state (less than 1 meter apart). This process is initiated by the user terminal by launching the App and requesting to add the device. Subsequently, the authentication master device enters pairable mode and broadcasts an advertising packet via Bluetooth Low Energy. The user terminal responds to this broadcast and establishes a secure Bluetooth Low Energy connection with the authentication master device. After the connection is established, the authentication master device locally generates a master device key pair based on elliptic curve cryptography (Curve 25519 curve), including the public key Pub_Lock and the private key Priv_Lock, and then... The encrypted Bluetooth Low Energy channel sends Pub_Lock to the user terminal; the user terminal generates a terminal key pair based on the same cryptography locally, including the public key Pub_Phone and the private key Priv_Phone, and sends Pub_Phone to the authentication master device through the encrypted Bluetooth Low Energy channel; finally, the authentication master device securely stores Pub_Phone in its secure storage area, and the user terminal securely stores Pub_Lock in its secure storage area, completing the secure exchange and storage of the two-way public keys, and establishing a basic cryptographic trust relationship for the subsequent authentication process based on wireless broadcast signals and encrypted beacons.

[0113] Based on the above examples, Figure 6 A flowchart illustrating the routine two-factor authentication process between user terminals and the authentication master control device, such as... Figure 6As shown, the user terminal (a combination of a mobile phone and an ESP32 module) initiates an authentication request by clicking "Unlock" on the App interface; the authentication master control device (smart lock) then broadcasts a wireless broadcast signal containing a first random number (R1=0x8A3F) and a first timestamp (T=1717020000) through its BLE controller; after receiving the signal, the real-time response unit of the ESP32 communication module of the user terminal (response time less than 200 milliseconds) generates a second random number (R2=0xC21D) locally, and uses the first key derivation function HKDF-SHA256 to generate R... 1. Using R2 and T as inputs, a temporary encryption key (K_temp) is generated. Simultaneously, the terminal's private key (Priv_Phone) stored in its secure storage area is used to perform an HMAC-SHA256 hash operation on the combination of R1 and R2 to generate Additional Authentication Data (AAD). Then, the AES-GCM authentication encryption algorithm is used with K_temp as the key, the combination of R1 and R2 as the initialization vector, and AAD is introduced to encrypt the device identifier (DeviceID_Phone), generating an encrypted beacon. This beacon is then transmitted via its Wi-Fi network within 50 milliseconds. The Mac module sends the encrypted beacon to the authentication master device via the ESP-NOW protocol. The WIFI Mac module (supporting ESP-NOW) of the authentication master device receives the encrypted beacon and records the reception time t1. Its security coprocessor calculates the time difference Δt = t1 - t0 (t0 being the transmission time) and compares it with a preset time threshold to obtain the first verification result. Simultaneously, it measures the signal strength and compares it with a preset strength threshold to obtain the second verification result. Then, it uses the pre-stored terminal public key (Pub_Phone) in its secure storage area to verify the HMAC signature in the AAD. If the verification is successful, it uses the locally synchronized K_temp to decrypt the Beacon and extract the DeviceID. This DeviceID is then compared with a pre-stored valid identifier to obtain the third verification result. The application logic unit of the authentication master device determines the authentication attribute based on the above three verification results: if all verifications pass, it returns a "Success" confirmation message to the user terminal via the established BLE secure connection and drives the actuator to complete the unlocking action; the user terminal app then displays "Door Opened." If any verification fails, it returns the corresponding error message (such as "Auth Failed," "Signature Failed," etc.) via the BLE connection. If the message "Invalid" or "Timeout or Out of Range" is displayed, unlocking will not be performed.

[0114] Example 3 Figure 7 This is a schematic diagram of an authentication device provided in an embodiment of this application. The authentication device provided in an embodiment of this application includes: The wireless signal broadcasting module 310 is used to broadcast a wireless broadcast signal containing a first random number and a first timestamp to the user terminal when it receives an authentication request from the user terminal. The encrypted beacon receiving module 320 is used to receive an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein, the encrypted beacon is a beacon frame encrypted by the user terminal based on a temporary key generated by the first random number and the first timestamp; the point-to-point wireless communication protocol includes at least one of connectionless low-power wireless communication protocol and Bluetooth Low Energy Broadcast Extensions protocol; The authentication module 330 is used to determine the authentication attribute based on the time difference between the receiving time and the sending time of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon; The confirmation information feedback module 340 is used to return verification success confirmation information to the user terminal through the established wireless communication connection when the authentication attribute is verified successfully.

[0115] This application provides an authentication device. When the device is in use, upon receiving an authentication request from a user terminal, it broadcasts a wireless broadcast signal containing a first random number and a first timestamp to the user terminal. Then, it receives an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal. The encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on the first random number and the first timestamp. Furthermore, based on the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon, it determines the authentication attribute. Finally, when the authentication attribute indicates successful authentication, it returns a verification success confirmation message to the user terminal through the established wireless communication connection. The technical solution of this application determines the authentication attribute by using multi-dimensional information such as the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon to make a fusion decision. This achieves reliable dual verification of the authenticity of the communication entity's identity and the proximity of its physical location in wireless authentication. It solves the security problem that the current reliance on cryptographic verification alone cannot effectively defend against relay attacks, delay spoofing, and signal replay attacks, and improves the overall security, anti-attack capability, and authentication reliability of near-field wireless authentication in complex environments.

[0116] Optionally, based on the above-described device, the encrypted beacon receiving module 320 is specifically configured to generate a second random number when the user terminal receives the wireless broadcast signal; the user terminal generates a temporary encryption key based on the received first random number, the first timestamp, and the second random number through a first key derivation function; the user terminal performs a first hash operation on the combination of the first random number and the second random number based on the stored terminal private key to generate additional authentication data; the user terminal uses the temporary encryption key, with the combination of the first random number and the second random number as the initialization vector, and introduces the additional authentication data to encrypt the device identifier through a first authentication encryption algorithm to generate the encrypted beacon.

[0117] Based on the above-mentioned device, optionally, the authentication device further includes: a Bluetooth connection module, used to enter pairing mode and broadcast a pairing broadcast signal in response to a pairing trigger event; establish a secure low-power Bluetooth connection with the user terminal initiating pairing; generate a master control device key pair and send the public key in the generated master control device key pair to the user terminal; and receive and store the terminal public key from the user terminal.

[0118] Based on the above-mentioned device, optionally, the authentication module 330 is specifically used to determine a first authentication result based on the time difference between the receiving time and the sending time of the encrypted beacon and a preset time threshold; determine a second authentication result based on the wireless signal strength of the encrypted beacon and a preset strength threshold; determine a third authentication result based on the decryption authentication result of the encrypted beacon; and determine an authentication attribute based on the first authentication result, the second authentication result, and the third authentication result.

[0119] Based on the above-mentioned device, optionally, the authentication module 330 is further used to verify the signature information carried in the encrypted beacon based on the pre-stored user terminal public key; if the signature verification fails, the third verification result is determined to be authentication failure; if the signature verification passes, the encrypted beacon is decrypted using the temporary key to obtain the plaintext device identifier; the plaintext device identifier is compared with the pre-stored legitimate device identifier to determine the third verification result.

[0120] Optionally, based on the above-mentioned device, the authentication device may further include: a device locking module, used to count the number of consecutive authentication failures; when the number of authentication failures reaches a preset failure threshold, a locking mechanism is activated to refuse to process any authentication request within a preset locking duration.

[0121] Based on the above-mentioned device, optionally, the user terminal includes a first type of composite terminal and a second type of integrated terminal; the first type of composite terminal is composed of a mobile intelligent terminal and an external dual-mode communication module; the second type of integrated terminal is an independent hardware device that integrates point-to-point wireless communication function and secure computing function required for wireless interaction with the authentication master control device.

[0122] The authentication device provided in this application can execute the authentication method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of executing the method.

[0123] It is worth noting that the various units and modules included in the above system are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the protection scope of the embodiments of this application.

[0124] Example 4 Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 A block diagram is shown of an exemplary electronic device 40 suitable for implementing embodiments of the present application. Figure 8 The electronic device 40 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0125] like Figure 8 As shown, electronic device 40 is represented in the form of a general-purpose computing device. The components of electronic device 40 may include, but are not limited to: one or more processors or processing units 401, system memory 402, and bus 403 connecting different system components (including system memory 402 and processing unit 401).

[0126] Bus 403 represents one or more of several bus architectures, including memory buses or memory electronics, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0127] Electronic device 40 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by electronic device 40, including volatile and non-volatile media, removable and non-removable media.

[0128] System memory 402 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 404 and / or cache memory 405. Electronic device 40 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 406 may be used to read and write non-removable, non-volatile magnetic media (… Figure 8 Not shown (usually referred to as a hard drive). Although Figure 8 As not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a floppy disk) and an optical disc drive for reading and writing to a removable non-volatile optical disc (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 403 via one or more data media interfaces. Memory 402 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the embodiments of this application.

[0129] A program / utility 408 having a set (at least one) of program modules 407 may be stored, for example, in memory 402. Such program modules 407 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 407 typically perform the functions and / or methods described in the embodiments of this application.

[0130] Electronic device 40 can also communicate with one or more external devices 409 (e.g., keyboard, pointing device, display 410, etc.), and with one or more devices that enable a user to interact with electronic device 40, and / or with any device that enables electronic device 40 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed via input / output (I / O) interface 411. Furthermore, electronic device 40 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 412. As shown, network adapter 412 communicates with other modules of electronic device 40 via bus 403. It should be understood that, although... Figure 8 Not shown, other hardware and / or software modules may be used in conjunction with electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0131] The processing unit 401 executes various functional applications and page processing by running programs stored in the system memory 402, such as implementing the authentication method provided in the embodiments of this application.

[0132] Example 5 This application also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform an authentication method, the method comprising: When an authentication request is received from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal. Receive an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein the encrypted beacon is a beacon frame encrypted by the user terminal based on a temporary key generated by the first random number and the first timestamp; The authentication attribute is determined based on the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon. When the authentication attribute indicates successful authentication, a verification confirmation message is returned to the user terminal via the established wireless communication connection.

[0133] The computer storage medium in this application embodiment can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0134] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0135] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0136] Computer program code for performing the operations of the embodiments of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as C or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0137] Note that the above description is merely a preferred embodiment and the technical principles employed in this application. Those skilled in the art will understand that this application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments. Many other equivalent embodiments may be included without departing from the concept of this application, and the scope of this application is determined by the scope of the appended claims.

Claims

1. An authentication method, characterized in that, The method includes: When an authentication request is received from a user terminal, a wireless broadcast signal containing a first random number and a first timestamp is broadcast to the user terminal. The system receives an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein the encrypted beacon is a beacon frame encrypted by the user terminal using a temporary key generated based on the first random number and the first timestamp; the point-to-point wireless communication protocol includes at least one of a connectionless low-power wireless communication protocol and a Bluetooth Low Energy Broadcast extension protocol. The authentication attribute is determined based on the time difference between the receiving and sending times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon. When the authentication attribute indicates successful authentication, a verification confirmation message is returned to the user terminal via the established wireless communication connection.

2. The method according to claim 1, characterized in that, The method for generating the encrypted beacon includes: When the user terminal receives the wireless broadcast signal, it generates a second random number; The user terminal generates a temporary encryption key based on the received first random number, first timestamp, and second random number through a first key derivation function; The user terminal performs a first hash operation on the combination of the first random number and the second random number based on the stored terminal private key to generate additional authentication data; The user terminal uses the temporary encryption key, with the combination of the first random number and the second random number as the initialization vector, and introduces the additional authentication data to encrypt the device identifier through the first authentication encryption algorithm to generate the encrypted beacon.

3. The method according to claim 1, characterized in that, Before receiving the encrypted beacon from the user terminal, the method further includes: In response to a pairing trigger event, it enters pairing mode and broadcasts a pairing broadcast signal; Establish a secure Bluetooth Low Energy connection with the user terminal that initiates pairing; Generate a master control device key pair and send the public key in the generated master control device key pair to the user terminal; Receive and store the terminal public key from the user terminal.

4. The method according to claim 1, characterized in that, The method of determining authentication attributes based on the time difference between the reception and transmission times of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon includes: The first verification result is determined based on the time difference between the receiving time and the sending time of the encrypted beacon and a preset time threshold. The second verification result is determined based on the wireless signal strength of the encrypted beacon and a preset strength threshold. Based on the decryption verification result of the encrypted beacon, a third verification result is determined; Based on the first verification result, the second verification result, and the third verification result, the authentication attribute is determined.

5. The method according to claim 4, characterized in that, The determination of the third verification result based on the decryption verification result of the encrypted beacon includes: Based on the pre-stored user terminal public key, verify the signature information carried in the encrypted beacon; If signature verification fails, the third verification result is determined to be an identity verification failure. If the signature verification passes, the temporary key is used to decrypt the encrypted beacon to obtain the plaintext device identifier; The plaintext device identifier is compared with the pre-stored legitimate device identifier to determine the third verification result.

6. The method according to claim 1, characterized in that, The method further includes: Count the number of consecutive authentication failures; When the number of verification failures reaches a preset failure threshold, a locking mechanism is activated, and any authentication request is refused to be processed within a preset locking duration.

7. The method according to claim 1, characterized in that, The user terminal includes a first type of composite terminal and a second type of integrated terminal; the first type of composite terminal is composed of a mobile intelligent terminal and an external dual-mode communication module; the second type of integrated terminal is an independent hardware device that integrates point-to-point wireless communication function and secure computing function required for wireless interaction with the authentication master control device.

8. An authentication device, characterized in that, The device includes: A wireless signal broadcasting module is used to broadcast a wireless broadcast signal containing a first random number and a first timestamp to the user terminal when an authentication request is received from the user terminal. An encrypted beacon receiving module is used to receive an encrypted beacon based on a point-to-point wireless communication protocol returned by the user terminal; wherein, the encrypted beacon is a beacon frame encrypted by the user terminal based on a temporary key generated by the first random number and the first timestamp; the point-to-point wireless communication protocol includes at least one of a connectionless low-power wireless communication protocol and a Bluetooth Low Energy Broadcast extension protocol; An authentication module is used to determine authentication attributes based on the time difference between the receiving time and the sending time of the encrypted beacon, the wireless signal strength of the encrypted beacon, and the decryption verification result of the encrypted beacon; The confirmation information feedback module is used to return a verification success confirmation message to the user terminal through the established wireless communication connection when the authentication attribute indicates successful authentication.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the authentication method as described in any one of claims 1-7.

10. A storage medium comprising computer-executable instructions, which, when executed by a computer processor, are used to perform the authentication method as described in any one of claims 1-7.

Images