A channel terminal identity authentication method without persistent storage

Abstract

This invention discloses a channel terminal authentication method without persistent storage, belonging to the field of authentication technology. The method includes: in response to a temporary authentication request, establishing a temporary communication channel between the terminal device and an authentication server through a one-time authentication module; generating a one-time session key based on the physical characteristic parameters of the terminal device and the current timestamp in the temporary communication channel; encrypting identity credential data using this key and transmitting it to the authentication server through the temporary communication channel; the authentication server extracting authentication rules according to the module identifier for decryption and verification; returning a temporary authorization token after successful verification and storing the one-time session key and identity credential data in a volatile storage area; and clearing all data in the volatile storage area when the temporary communication channel is disconnected. This method, through dynamic keys and an immediate data clearing mechanism, avoids the persistent storage of sensitive data while completing authentication.

Description

Technical Field

[0001] This invention relates to the field of authentication technology, specifically to a channel terminal authentication method without persistent storage. Background Technology

[0002] When terminal devices access network services, authentication is required to verify their legitimacy. Existing authentication methods typically rely on persistently storing keys, credentials, or identity configuration information locally on the terminal device or on the authentication server, establishing a trust relationship through this pre-stored information during the authentication process. However, in temporary, one-time access scenarios, the persistently stored data becomes a potential target for attacks. If an attacker obtains access to the storage medium, they can extract valid identity credentials or key materials, leading to identity impersonation and unauthorized access. Furthermore, pre-configured static keys or fixed credentials become invalid long-term after a single leak, lacking isolation tied to a single session and failing to meet the requirements for immediate revocation and one-time use in high-security environments.

[0003] In existing technical solutions, key generation mechanisms generally employ fixed parameters or simple random number generation, failing to fully utilize the inherent, non-transferable physical characteristics of terminal devices. The generated keys lack a strong correlation with the terminal hardware, making them easily copied or ported between different devices. Furthermore, there is a lack of a mandatory, communication-state-linked method for clearing temporary data generated during verification. Once verification is complete, sensitive information remains in memory, posing a risk of cold-start attacks or memory dumping. This data residue problem is particularly prominent in scenarios such as self-service terminals without human intervention and edge computing nodes.

[0004] To address the aforementioned issues, a method is needed that deeply binds terminal physical characteristics and time attributes during key generation and can instantly erase all verification-related data in an irreversible manner when the channel terminates, thereby eliminating the reliance on persistent storage and making each verification process an independent and untraceable security event. Summary of the Invention

[0005] This invention provides a channel terminal authentication method without persistent storage, aiming to establish an authentication mechanism that does not require persistent storage of keys and credentials on the terminal device or server. By dynamically generating a one-time session key bound to the terminal's physical characteristics and the current time during each authentication process, and forcibly clearing all sensitive data temporarily stored in the volatile storage area according to the channel status after authentication, a single authentication action constitutes a completely isolated temporary session at both the communication and data storage levels, eliminating the possibility of keys and credentials being recovered or reused after authentication.

[0006] To achieve the above objectives, the present invention provides the following technical solution: The present invention provides a channel terminal authentication method without persistent storage. In response to a temporary authentication request, a temporary communication channel is established between the terminal device and the authentication server through a one-time authentication module. In the temporary communication channel, a one-time session key is generated based on the physical characteristic parameters of the terminal device and the current timestamp. The one-time session key is used to encrypt the identity credential data sent by the terminal device, and the encrypted identity credential data is transmitted to the authentication server through the temporary communication channel. On the authentication server side, according to the module identifier carried in the temporary authentication request, the corresponding authentication rule is extracted from a preset temporary identity mapping table, and the encrypted identity credential data is decrypted and verified based on the authentication rule. After successful verification, a temporary authorization token is returned to the terminal device through the temporary communication channel. The terminal device forwards the temporary authorization token to the one-time authentication module, and the one-time authentication module stores the one-time session key and the identity credential data in its volatile storage area. When the temporary communication channel is disconnected, the one-time authentication module is triggered to clear all data in the volatile storage area. Throughout the authentication process, the key key, credential data, and authorization token are stored only in the volatile storage area. They are completely erased when power is cut off or the channel is disconnected, leaving no persistent trace. Combined with the physical destruction of the non-volatile storage area of ​​the security chip built into the one-time authentication module, the risk of identity leakage and replay attacks caused by residual data on the terminal or module is fundamentally eliminated. At the same time, the dynamic establishment of temporary communication channels and one-time session keys ensure the security isolation of each authentication process.

[0007] As a technical solution of the present invention, the specific implementation of establishing a temporary communication channel between a terminal device and a verification server through a one-time authentication module in response to a temporary authentication request is as follows: the one-time authentication module receives the temporary authentication request sent by the terminal device and extracts the device identifier and communication protocol type of the terminal device from the temporary authentication request; according to the communication protocol type, the one-time authentication module and the verification server perform a handshake negotiation operation, exchanging communication parameters and encryption capability information of both parties during the handshake negotiation; after the handshake negotiation is completed, the one-time authentication module sends a channel establishment request to the verification server, the channel establishment request carrying the device identifier and the module identifier of the one-time authentication module; the verification server verifies the legitimacy of the one-time authentication module according to the module identifier, and after successful verification, allocates a temporary network address and communication port to the terminal device, completing the establishment of the temporary communication channel. Through the module identifier legitimacy verification, only pre-registered legitimate modules can establish a temporary communication channel, effectively preventing counterfeit modules from accessing the system and improving the credibility of the verification infrastructure.

[0008] Preferably, the specific implementation of generating a one-time session key based on the physical characteristic parameters of the terminal device and the current timestamp in the temporary communication channel is as follows: the one-time authentication module collects the hardware serial number and network interface address of the terminal device as the physical characteristic parameters, and concatenates the hardware serial number and the network interface address into a physical characteristic string in a predetermined order; obtains the current timestamp, converts the current timestamp into an integer time characteristic value, and combines the time characteristic value with the physical characteristic string to form key seed data; performs a hash operation on the key seed data to obtain a hash digest value, and extracts a predetermined length of bits from the hash digest value as the one-time session key. The key is derived jointly from the terminal hardware characteristics and the timestamp, ensuring that each generated session key is unique and strongly bound to a specific device and time, so that any key leakage will not affect the security of other sessions.

[0009] Furthermore, the specific implementation of encrypting the identity credential data sent by the terminal device using the one-time session key and transmitting the encrypted identity credential data to the verification server through the temporary communication channel is as follows: The terminal device obtains the user-input identity information and biometric data, and encapsulates the identity information and biometric data into the identity credential data according to a predetermined data format; the terminal device uses the one-time session key as the key for a symmetric encryption algorithm to perform a symmetric encryption operation on the identity credential data, generating encrypted identity credential ciphertext data; the terminal device divides the identity credential ciphertext data into multiple data packets, adds a sequence number and a timestamp tag to each data packet, and sends the multiple data packets to the verification server sequentially through the temporary communication channel according to the sequence number; after receiving the multiple data packets, the verification server reassembles and sorts the multiple data packets according to the sequence number to restore the complete identity credential ciphertext data. The design of data packet segmentation and numbering, and timestamp tags, not only adapts to the transmission limitations that may exist in the temporary channel, but also effectively resists data packet replay and out-of-order attacks, ensuring the integrity and reliable restoration of the ciphertext data.

[0010] Preferably, the specific implementation method of extracting the corresponding verification rule from the preset temporary identity mapping table based on the module identifier carried in the temporary identity verification request on the verification server side, and decrypting and verifying the encrypted identity credential data based on the verification rule is as follows: the verification server parses the temporary identity verification request, extracts the module identifier, and uses the module identifier as an index key to query the preset temporary identity mapping table, and obtains the verification rule stored in association with the module identifier from the temporary identity mapping table. The verification rule includes a decryption algorithm type and an identity verification strategy; the verification server selects the corresponding decryption algorithm according to the decryption algorithm type, and uses the verification server... The private key is used to decrypt the encrypted identity credential data to obtain decrypted identity credential data. The verification server extracts the identity identifier information and biometric data to be verified from the decrypted identity credential data, and according to the verification order in the identity verification strategy, first matches the identity identifier information to be verified with the legitimate identity database stored in the verification server. When the identity identifier information to be verified is successfully matched, the verification server then compares the biometric data to be verified with the standard biometric template corresponding to the identity identifier information in the legitimate identity database, generates a matching score, and determines whether the matching score reaches a predetermined threshold. If it does, the verification is successful. The module identifier dynamically indexes the verification rules, allowing different batches of modules to use independent decryption algorithms and verification strategies, achieving flexible differentiated security management within a unified framework. Simultaneously, the step-by-step verification mechanism of identity identifier first and then biometrics terminates verification early when the identity identifier is invalid, reducing unnecessary biometric comparison overhead.

[0011] As another technical solution of the present invention, after the verification is successful, a temporary authorization token is returned to the terminal device through the temporary communication channel, and the one-time session key and the identity credential data are stored in the volatile storage area of ​​the one-time authentication module. The specific implementation is as follows: After the verification is successful, the verification server generates the temporary authorization token according to the device identifier of the terminal device and the current timestamp, and sends the temporary authorization token to the terminal device through the temporary communication channel. At the same time, the verification server records the start time and duration of the validity period of the temporary authorization token. After receiving the temporary authorization token, the terminal device forwards the temporary authorization token to the one-time authentication module. The one-time authentication module writes the one-time session key and the identity credential data into the first storage partition of the volatile storage area. The one-time authentication module also writes the temporary authorization token into the second storage partition of the volatile storage area and establishes an association index between the first storage partition and the second storage partition. The association index is used to mark the correspondence between the one-time session key, the identity credential data and the temporary authorization token. By storing temporary authorization tokens in association with key and credential data partitions, it is easy to quickly retrieve the corresponding relationship during the session to maintain the authorization status, and it also provides a clear operational boundary for subsequent secure deletion, ensuring that all related data can be completely removed together.

[0012] Preferably, the specific implementation of triggering the one-time authentication module to clear all data in the volatile storage area when the temporary communication channel is disconnected is as follows: The one-time authentication module monitors the connection status of the temporary communication channel in real time. When it detects that the connection status of the temporary communication channel changes from connected to disconnected, including but not limited to the disconnection caused by the one-time authentication module being physically removed from the slot of the terminal device, the one-time authentication module generates a channel disconnection interrupt signal. In response to the channel disconnection interrupt signal, the one-time authentication module calls a data erasure program pre-stored in the read-only memory of the one-time authentication module. The data erasure program performs multiple overwrite operations on the volatile storage area in the order of erasing the second storage partition first and then erasing the first storage partition. Each overwrite operation writes a different random data pattern. After the overwrite operation is completed, the volatile storage area is reset and initialized. By triggering the erasure program immediately through the channel disconnection interrupt signal, erasing the authorization token first and then the key and credential in the order of erasing the key and credential, and performing multiple overwrites with different random patterns, it is ensured that even if physical means are used to probe the volatile storage area, no valid data can be recovered, greatly enhancing the security of residual data.

[0013] Furthermore, the specific implementation of the one-time authentication module receiving the temporary authentication request from the terminal device and extracting the device identifier and communication protocol type from the temporary authentication request is as follows: The one-time authentication module receives an electrical signal sequence from the terminal device through its physical interface and converts the electrical signal sequence into a binary data stream according to a predetermined encoding rule; the one-time authentication module parses the request type field from the header of the binary data stream; when the value of the request type field indicates a temporary authentication request, the one-time authentication module continues to extract the device identifier field and protocol type field from the binary data stream; the one-time authentication module determines the value of the device identifier field as the device identifier, determines the value of the protocol type field as the communication protocol type, and performs integrity verification on the device identifier and the communication protocol type. After successful verification, the information is saved to the register of the one-time authentication module. Performing integrity verification after signal conversion and field parsing can promptly identify and discard tampered or damaged authentication requests, prevent invalid requests from entering subsequent processes, and improve the robustness of the system.

[0014] Preferably, the specific implementation of the terminal device acquiring user-input identity information and biometric data, and encapsulating the identity information and biometric data into identity credential data according to a predetermined data format, is as follows: The terminal device receives the user-input identity string through its input interface and converts the identity string into an identity byte sequence with a unified encoding format; the terminal device collects the user's raw biometric data through its biometric acquisition unit and performs feature extraction processing on the raw biometric data to obtain biometric template data; the terminal device encapsulates the identity byte sequence and the biometric template data according to a type-length value format, adding a first type label and first length information to the identity byte sequence during the encapsulation process, and adding a second type label and second length information to the biometric template data, thus forming the identity credential data after encapsulation. The standardized type-length value encapsulation format enables the identity credential data to have self-descriptive capabilities, allowing the verification server to accurately parse it without pre-defining field boundaries, thus improving the system's compatibility and processing efficiency for various identity credential formats.

[0015] The verification server parses the temporary authentication request, extracts the module identifier, and uses the module identifier as an index key to query the preset temporary identity mapping table. The specific implementation of retrieving the verification rule associated with the module identifier from the temporary identity mapping table is as follows: The verification server extracts the module identifier from the request header of the temporary authentication request and performs format validation on the module identifier to determine whether it conforms to a predetermined module identifier encoding specification. After passing the format validation, the verification server uses the module identifier as a query key and performs a key-value matching query operation in the preset temporary identity mapping table. The temporary identity mapping table stores multiple key-value pair entries, where the key of each key-value pair entry is the module identifier, and the value is the corresponding verification rule configuration data. The verification server reads the verification rule configuration data from the successfully matched key-value pair entries. The verification rule configuration data includes a decryption algorithm identifier, an encryption mode indication parameter, and an authentication policy identifier. The verification server determines the decryption algorithm type based on the decryption algorithm identifier and the authentication policy based on the authentication policy identifier. By employing a two-level search involving format validation and precise key-value matching, it ensures that only module identifiers with compliant formats and that have been registered can obtain the correct validation rules, effectively preventing security policies from being bypassed due to identifier forgery or mistransmission.

[0016] The technical effects and advantages provided by the present invention in the above technical solution are as follows: A scheme is adopted to generate one-time session keys based on the physical characteristic parameters of the terminal device and the current timestamp. The seed data of the key is formed by combining a physical characteristic string consisting of the hardware serial number and network interface address with a time characteristic value. This key generation method establishes a unique correspondence between the session key and the physical entity of the terminal device and the time of generation. Keys generated by different devices or by the same device at different times are not duplicated. Even if the key of a session is intercepted, it cannot be reused on other devices or at other times. Hash operations and truncation processing ensure that the output key has a fixed length and irreversible hashing properties. Attackers cannot reverse-engineer the original physical characteristic data of the device through the key, thus protecting the privacy of the device hardware information while ensuring the uniqueness of the key.

[0017] A scheme is adopted to store one-time session keys and identity credential data in a volatile storage area and trigger its erasure when the temporary communication channel is disconnected. The one-time authentication module monitors the channel connection status in real time. When the connection changes from connected to disconnected, a channel disconnection interrupt signal is generated, and the data erasure program in read-only memory is invoked to perform multiple overwrite operations on the volatile storage area using different random data patterns. This erasure mechanism is directly linked to the physical state of the communication channel and can be automatically triggered at the moment of channel termination without relying on application layer instructions or manual intervention, avoiding memory residues caused by program abnormalities or process omissions. The method of overwriting different random data patterns can eliminate data traces that may remain on the storage medium due to physical characteristics. The reset initialization after overwriting restores the volatile storage area to its initial data-free state, ensuring that all sensitive information such as keys, credentials, and tokens generated by a single authentication is completely disappeared from the hardware level when the channel ends, and cannot be recovered or retrieved by any offline means. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0019] Figure 1 This is a flowchart of a channel terminal authentication method without persistent storage; Figure 2 This is a flowchart of the one-time session key generation process; Figure 3 This is a flowchart of identity credential data processing and transmission. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] See Figure 1This invention provides a channel terminal authentication method without persistent storage. The method includes: in response to a temporary authentication request, establishing a temporary communication channel between a terminal device and an authentication server through a one-time authentication module; generating a one-time session key based on the physical characteristic parameters of the terminal device and the current timestamp in the temporary communication channel; encrypting identity credential data sent by the terminal device using the one-time session key, and transmitting the encrypted identity credential data to the authentication server through the temporary communication channel; on the authentication server side, extracting the corresponding authentication rule from a preset temporary identity mapping table according to the module identifier carried in the temporary authentication request, and decrypting and verifying the encrypted identity credential data based on the authentication rule; after successful verification, returning a temporary authorization token to the terminal device through the temporary communication channel, and storing the one-time session key and the identity credential data in the volatile storage area of ​​the one-time authentication module; when the temporary communication channel is disconnected, triggering the one-time authentication module to clear all data in the volatile storage area.

[0022] Example 1 In practice, the establishment of a temporary communication channel involves signal interaction, data parsing, handshake negotiation, and network resource allocation between the one-time authentication module and the terminal device. When the terminal device triggers the temporary authentication process, it sends an electrical signal sequence to the one-time authentication module through the physical transmission medium. The physical interface of the one-time authentication module receives the electrical signal sequence according to predetermined electrical characteristics and converts the electrical signal sequence bit by bit into a binary data stream according to predetermined encoding rules. The predetermined encoding rules define the logic '1' and '0' corresponding to high and low levels, as well as the arrangement of start bits, stop bits, and parity bits, enabling the one-time authentication module to synchronize the clock and recover the original binary data from continuous level changes.

[0023] The one-time authentication module parses the binary data stream from the beginning, locating the request type field, which occupies several bits at a fixed offset in the header of the binary data stream. The module reads the value of the request type field and compares it with a pre-stored temporary authentication request code. When the value matches, the module determines the received data stream as a temporary authentication request. It then continues to extract the device identifier and protocol type fields from the binary data stream according to the field offset order specified in the protocol. The device identifier field carries a globally unique identifier assigned to the terminal device during production or registration, and the protocol type field indicates the network protocol type the terminal device expects to use for subsequent communication. After extraction, the module assigns the device identifier field value as the device identifier and the protocol type field value as the communication protocol type.

[0024] The one-time authentication module performs integrity checks on the extracted device identifier and communication protocol type. The integrity check process involves the one-time authentication module calculating the cyclic redundancy check (CRC) value of the combined data of the device identifier and communication protocol type, and comparing this value with a check field appended to the end of the binary data stream. When the comparison results match, it confirms that the device identifier and communication protocol type have not experienced any errors or tampering during transmission. The one-time authentication module then stores the verified device identifier and communication protocol type in a register within its internal storage for use in subsequent channel establishment processes. This register is a static random access memory (SRAM) unit configured within the one-time authentication module's control unit, featuring low-latency read / write capabilities.

[0025] Based on the communication protocol type stored in the register, the one-time authentication module initiates a handshake negotiation process with the authentication server. The one-time authentication module reads the protocol stack configuration parameters corresponding to the communication protocol type, constructs a handshake request message, which lists the encryption algorithm suites supported by the one-time authentication module, the compression method list, and the session cache identifier. The one-time authentication module transmits the handshake request message to the authentication server over the network. Upon receiving the handshake request message, the authentication server parses the message content, selects an encryption algorithm suite supported by the authentication server that matches the encryption capabilities of the one-time authentication module, and simultaneously selects a compression method, constructing a handshake response message. The handshake response message contains the identifier of the encryption algorithm suite selected by the authentication server, the identifier of the compression method, and the authentication server's digital certificate. The one-time authentication module receives the handshake response message, verifies the legality and validity of the digital certificate, and extracts the authentication server's public key from the digital certificate. The one-time authentication module generates a random number, encrypts the random number using the authentication server's public key, generates a pre-master key ciphertext, and sends the pre-master key ciphertext to the authentication server. The authentication server decrypts the pre-master key ciphertext using its private key to obtain the plaintext random number. The one-time authentication module and the authentication server independently derive the same symmetric encryption key and message authentication code key based on the plaintext random number and the publicly available parameters exchanged in the handshake message, thus completing the handshake negotiation operation. During the handshake negotiation, the exchanged communication parameters include the communication protocol version number, cipher suite type, and compression method type. The exchanged encryption capability information includes the supported key length range and elliptic curve parameter group identifier.

[0026] After the handshake negotiation is complete, the one-time authentication module constructs a channel establishment request. The channel establishment request message body carries, in key-value pairs, the device identifier read from the register and the module identifier permanently stored at the factory. The module identifier is the hardware-unique identifier of the one-time authentication module, typically using a universally accepted unique identifier format conforming to the International Telecommunication Union (ITU) standard. The one-time authentication module then sends the channel establishment request to the authentication server through the established encrypted temporary connection.

[0027] After receiving a channel establishment request, the verification server parses the message content and extracts the module identifier. The verification server's security subsystem maintains a whitelist of legitimate module identifiers, each entry of which is pre-entered by the administrator during the security deployment phase. The verification server matches the extracted module identifier against each record in the whitelist. When the extracted module identifier completely matches a record in the whitelist, the verification server determines that the one-time authentication module's legitimacy verification is successful. After successful legitimacy verification, the verification server selects an unused Internet Protocol address from its managed temporary network address pool and allocates a communication port from the available temporary port range. The verification server writes the temporary network address and communication port into the temporary communication channel context record and returns this temporary network address and communication port to the one-time authentication module via a channel establishment response message. The one-time authentication module receives the channel establishment response message, records the temporary network address and communication port, and at this point, the temporary communication channel between the terminal device and the verification server is established. During the validity period of the temporary communication channel, the terminal device uses the temporary network address and communication port to send and receive data packets with the verification server via the one-time authentication module.

[0028] Example 2 In specific implementation, please refer to Figure 2 After the temporary communication channel is established, the one-time authentication module initiates the one-time session key generation process. The one-time authentication module accesses the terminal device's hardware information acquisition interface through the internally integrated main controller. This interface provides a system call entry point for accessing the terminal device's underlying hardware configuration parameters. The one-time authentication module obtains the terminal device's hardware serial number and network interface address through system calls, using both as physical characteristic parameters. The hardware serial number is a unique identifier encoded by the terminal device manufacturer during the production phase and burned into the one-time programmable memory area. The network interface address is a 48-bit media access control address assigned by the terminal device's network interface controller.

[0029] After obtaining the hardware serial number and network interface address, the one-time authentication module records the string corresponding to the hardware serial number as the first physical characteristic factor and the string corresponding to the network interface address as the second physical characteristic factor. The one-time authentication module reads a predetermined order descriptor from the fixed configuration information. This predetermined order descriptor defines the order in which the first and second physical characteristic factors are concatenated. If the predetermined order descriptor sets the first physical characteristic factor to precede the second, the one-time authentication module concatenates the first and second physical characteristic factors to form a physical characteristic string. If the predetermined order descriptor sets the second physical characteristic factor to precede the first, the one-time authentication module concatenates the second and first physical characteristic factors to form a physical characteristic string. The physical characteristic string contains the complete characters of the terminal device's hardware serial number and network interface address, but does not contain the separator between the two factors.

[0030] The one-time authentication module calls the real-time clock unit to obtain the current timestamp. The real-time clock unit is driven by the crystal oscillator onboard the one-time authentication module and outputs a time value in Coordinated Universal Time (UTC) format. The one-time authentication module parses the obtained current timestamp, extracting the year, month, day, hour, minute, second, and millisecond components. The one-time authentication module concatenates these components in descending order of byte order, converting them into an integer value, which is then used as the time feature value. The value of the time feature value is the total number of milliseconds accumulated from the start of UTC to the current time.

[0031] After obtaining the physical feature string and time feature value, the one-time authentication module performs a key seed data synthesis operation. The one-time authentication module converts the time feature value into a decimal string and concatenates this decimal string with the physical feature string. The combination method involves directly concatenating the end of the physical feature string with the beginning of the decimal string representation of the time feature value. The resulting single continuous string is the key seed data.

[0032] The one-time authentication module performs a hash operation on the key seed data. The hash operation uses a cryptographically secure one-way hash function pre-programmed into the firmware of the one-time authentication module. The hash operation process is represented as follows:

[0033] in, Represents key seed data, The input is a variable-length message string that has undergone hash operations; This represents a cryptographically secure one-way hash function. Maps input messages of arbitrary length to fixed-length output hash values; This represents the hash digest value output by the hash operation. A binary sequence of fixed bit length. The length is determined by the chosen cryptographically secure one-way hash function. When a secure hash algorithm with an output length of 256 bits is used, The length is 256 bits.

[0034] The one-time authentication module extracts a predetermined length of bits from the hash digest value as a one-time session key. The predetermined length is determined based on the key length specification of the symmetric encryption algorithm used by the temporary communication channel. When the symmetric encryption algorithm negotiated by the temporary communication channel is a 256-bit key length encryption standard, the one-time authentication module reads 256 bits of binary data consecutively, starting from the high-order bits of the hash digest value, and uses this 256 bits as the one-time session key. The one-time session key is stored in a register variable within the one-time authentication module and remains valid throughout the validity period of the temporary communication channel.

[0035] Example 3 In specific implementation, please refer to Figure 3 After obtaining the one-time session key, the terminal device performs the collection and encapsulation of identity credential data. The terminal device displays an identity information input area on its interface, which includes a text input box and a biometric feature collection prompt control. The terminal device receives the character sequence entered by the user via the physical keyboard or touch-sensitive virtual keyboard through the text input box, and uses this character sequence as an identity identifier string. The content of the identity identifier string can be one of a set of identifiers such as a unique account name assigned during user registration, an email address, or a mobile phone number.

[0036] After obtaining the identity string, the terminal device initiates the encoding conversion unit. The encoding conversion unit reads the original character encoding format of the identity string, which is typically the operating system's default local encoding scheme or the Hypertext Transfer Protocol's common character set. The encoding conversion unit converts each character in the identity string into its corresponding code point value in a unified encoding format according to a predetermined mapping table, and arranges all code point values ​​in their original character order to form the identity byte sequence. The unified encoding format adopts the 8-bit encoding standard of the Common Character Set Transformation Format defined by the International Organization for Standardization (ISO), and each byte of the identity byte sequence falls within the legal value range defined by this encoding standard.

[0037] Simultaneously, the terminal device acquires biometric data through a biometric acquisition unit. This biometric acquisition unit is a biometric sensor integrated within the terminal device or connected via a peripheral interface. In fingerprint acquisition, the biometric acquisition unit is a capacitive or optical fingerprint sensor. The terminal device drives the fingerprint sensor to scan the surface texture of the user's finger, generating a grayscale image of the fingerprint as the raw biometric data. In facial feature acquisition, the biometric acquisition unit is a combination of an infrared structured light projection module and an infrared camera component. The terminal device drives these components to acquire three-dimensional depth point cloud data and two-dimensional texture images of the user's face, using these data as the raw biometric data.

[0038] After obtaining the raw biometric data, the terminal device performs feature extraction processing. This processing is executed by a feature extraction algorithm running within the terminal device. The algorithm sequentially performs region-of-interest (ROI) segmentation, noise filtering, feature point localization, and feature descriptor calculation on the raw biometric data. ROI segmentation removes background portions from the raw data that do not contain biometric information. Noise filtering applies Gaussian smoothing or bilateral filtering to the retained portions to eliminate random noise introduced by the sensor. Feature point localization detects local extrema or locations with drastic gradient changes on the filtered data, recording the coordinates and orientation of the feature points. Feature descriptor calculation uses each feature point as the center, sampling the gradient distribution statistics of neighboring pixels or point clouds to generate multidimensional feature vectors. The terminal device arranges all the multidimensional feature vectors of all feature points in order of their coordinates, combining them into biometric template data. The biometric template data is a fixed-structure binary data block. Its header contains a feature point count identifier and a dimension identifier for each feature descriptor, followed by a sequence of floating-point or integer values ​​for each feature descriptor.

[0039] After acquiring the identity identifier byte sequence and biometric template data, the terminal device performs a type-length value format encapsulation operation. This encapsulation operation is performed within the terminal device's secure encapsulation module, which defines the writing rules for the first type label, first length information, second type label, and second length information. The terminal device sequentially writes the following data into the encapsulation buffer: At the buffer's starting offset of zero, the first type label is written. The first type label is a preset integer constant value, defined as an integer between zero and 255. This first type label is assigned a specific integer constant, which is allocated during the system design phase to identify the identity identifier data category. Immediately following the first type label, the first length information is written. This first length information occupies four bytes and is stored as an unsigned integer. The first length information is the total number of bytes in the identity identifier byte sequence. Immediately following the first length information, the entire identity identifier byte sequence is written. The process involves several steps: Following the initial byte sequence of the identity identifier, a second type tag is written. This second type tag is also a preset integer constant, ranging from zero to 255. It is assigned a specific integer constant different from the first type tag, allocated during the system design phase to identify the biometric data category. Immediately following the second type tag, a second length information is written. This second length information occupies four bytes and is stored as an unsigned integer, representing the total number of bytes in the biometric template data. Following the second length information, the entire byte sequence of the biometric template data is written. The resulting continuous byte sequence constitutes the identity credential data.

[0040] After obtaining the identity credential data, the terminal device performs symmetric encryption on it using a one-time session key. The symmetric encryption algorithm used is a suite of encryption algorithms negotiated and determined between the one-time authentication module and the authentication server during the establishment of the temporary communication channel. The terminal device invokes the symmetric encryption engine in the security component, passing the one-time session key as the encryption key parameter and the identity credential data as the plaintext input parameter. Before starting the encryption operation, the symmetric encryption engine obtains an initialization vector from the hardware random number generator; the length of the initialization vector is consistent with the block size of the symmetric encryption algorithm. Using the initialization vector and the one-time session key as input, the symmetric encryption engine performs encryption calculations on the plaintext identity credential data according to the block encryption mode specified by the symmetric encryption algorithm, outputting the encrypted ciphertext identity credential data. The block encryption mode uses either cipher block chaining mode or Galois counter mode to complete the encryption iteration.

[0041] After generating encrypted identity credential data, the terminal device performs packet segmentation on the encrypted identity credential data. The terminal device reads the maximum transmission unit (MTU) value determined during the temporary communication channel negotiation process. The MTU value limits the maximum payload bytes that a single data packet can carry. The terminal device divides the total byte length of the encrypted identity credential data by the MTU value to determine the total number of data packets to be segmented. The segmentation formula is expressed as:

[0042] in, This indicates the total length of the encrypted identity credential data in bytes. It is an integer value greater than zero; This represents the maximum transmission unit value of the link. The maximum number of bytes to be transmitted, as agreed upon by both parties during the temporary communication channel negotiation phase. It is an integer value greater than zero; This represents the floor function. The result of the operation is taken as the smallest integer not less than the original value; This indicates the total number of data packets that need to be segmented. It is a positive integer.

[0043] Terminal devices based on the total number of data packets create The first data packet structure. (For the first...) A data packet structure, in which The value of starts from 1 and increases in increments of 1 until . The terminal device is the first Each data packet structure is assigned a sequence number field and a timestamp tag field. The sequence number field takes the value corresponding to the current data packet structure. The value of the timestamp tag field is the current time in milliseconds, obtained by the terminal device from the system's real-time clock. The terminal device will then store the encrypted identity credential data... byte to the Copy a contiguous data segment of bytes to the first... The payload area of ​​each data packet structure. Terminal devices are numbered sequentially from 1 to... The increasing order is transmitted sequentially through a temporary communication channel. Each data packet is sent to the verification server. The sending interval of each data packet is automatically adjusted by the terminal device's network protocol stack according to the flow control window policy.

[0044] The verification server receives multiple data packets from the terminal device through a temporary communication channel. The verification server's network protocol stack performs header parsing on each arriving data packet, extracting the sequence number and timestamp fields. The verification server sorts the data packets in its receive buffer according to the sequence number field value. If a missing sequence number is detected, the verification server sends a retransmission request to the terminal device, which then retransmits the data packet with the corresponding sequence number. The verification server collects all... After 10 data packets are generated, and the sequential numbers of each data packet are consecutive and without any missing packets, they are ordered from 1 to 10. In the order of extraction, the data segments in the payload area of ​​each data packet are extracted sequentially, and the data segments are then concatenated in order to reconstruct the complete encrypted identity credential data.

[0045] Example 4 In practice, after reconstructing the encrypted identity credential data, the verification server initiates the verification rule extraction and authentication process. The verification server locates the request header area from the storage structure of the temporary authentication request. This header area contains a set of extended fields arranged in a type-length-value format. The verification server iterates through each type-length-value entry in the request header area, reading the type identifier. When the value of the type identifier matches the system-predefined module identifier type code, the verification server extracts the module identifier from the corresponding value field. The module identifier is a globally unique identifier string written by the one-time authentication module before it leaves the factory; its character set is limited to a combination of uppercase and lowercase letters and numbers.

[0046] After obtaining the module identifier, the verification server performs format validation on it. The format validation process involves the verification server calling a pre-stored module identifier encoding specification description file. This file records the legal character set requirements, length range requirements, and checksum calculation rules for the module identifier. The verification server checks whether the length value of the module identifier falls between the lower and upper limits of the length range requirements, and checks each character in the module identifier character by character to ensure it belongs to the character set specified in the legal character set requirements. Simultaneously, it calculates the checksum value of the module identifier according to the checksum calculation rules and compares the calculated checksum value with the checksum value carried at the end of the module identifier. If the length check, character set check, and checksum comparison all pass, the format validation passes.

[0047] After format validation, the verification server uses the module identifier as the query key and performs a key-value matching query in a pre-configured temporary identity mapping table. The temporary identity mapping table is a key-value pair database stored in the verification server's secure storage partition, organized using a balanced tree index structure. Each key-value pair entry in the temporary identity mapping table consists of a key field and a value field. The key field stores the module identifier string, and the value field stores the corresponding verification rule configuration data. The verification rule configuration data is stored in binary block format serialized using a structured data description language. The verification server uses the extracted module identifier as input and calls the query interface of the key-value pair database. The query interface traverses the balanced tree index structure, comparing the module identifier with the key field of each node in lexicographical order, locating the key-value pair entry whose key field is completely equal to the module identifier. If the location is successful, the verification server reads the verification rule configuration data stored in the value field from the successfully matched key-value pair entry.

[0048] The verification server deserializes and parses the verification rule configuration data, obtaining three main configuration elements: decryption algorithm identifier, encryption mode indicator parameter, and authentication policy identifier. The decryption algorithm identifier is an enumerated integer, with each value corresponding to a decryption algorithm number registered in the verification server's internal cryptographic algorithm library. For example, a value of 5 corresponds to the RSA decryption algorithm, and a value of 12 corresponds to the elliptic curve integrated encryption scheme decryption algorithm. The encryption mode indicator parameter is an integer flag indicating whether a strong padding mode was used in the encryption operation. A value of 0 indicates the standard padding mode, and a value of 1 indicates the probabilistic signature padding mode. The authentication policy identifier is a string label used to index multiple pre-configured authentication policy sets in the verification server. An example value for the authentication policy identifier is "ID_FIRST_BIOMETRIC_THEN," indicating that the identity identifier is verified first, followed by biometric verification.

[0049] The verification server determines the decryption algorithm type based on the decryption algorithm identifier and loads the corresponding decryption algorithm implementation module from the cryptographic algorithm library. The verification server loads its own private key from the key management hardware security module into a protected key slot in memory. This private key, along with the public key transmitted via digital certificate during the handshake phase by the one-time authentication module, forms a key pair. The verification server calls the decryption interface of the decryption algorithm implementation module, passing in its private key, encryption mode indicator parameters, and the previously reconstructed complete ciphertext data of the identity credential. The decryption algorithm implementation module determines the decryption padding method based on the encryption mode indicator parameters, extracts the ciphertext payload from the ciphertext data, performs decryption operations on the ciphertext payload using the verification server's private key, and outputs the decrypted original byte sequence. This decrypted original byte sequence is the identity credential data.

[0050] The verification server reverse-parses the decrypted identity credential data according to the type-length value format. The server reads the first type tag at the starting offset of the identity credential data, confirming that the value of the first type tag matches the system-defined tag constant used to identify identity data. Then, it reads the first length information, extracts the identity byte sequence to be verified based on the number of bytes recorded in the first length information, and restores the identity string to be verified through encoding conversion. The verification server continues to read the second type tag, confirming that the value of the second type tag matches the system-defined tag constant used to identify biometric data. Then, it reads the second length information, extracts the biometric template data to be verified based on the number of bytes recorded in the second length information. The biometric template data to be verified includes biometric information such as the number of feature points and the feature descriptor vectors of each feature point.

[0051] The verification server performs verification operations according to the authentication policy indicated by the authentication policy identifier. The authentication policy defines the verification order; the current verification order is to perform identity matching first, followed by biometric comparison. After extracting the identity string to be verified, the verification server uses this string as a query condition to initiate an index query in the legitimate identity database to which it connects. The legitimate identity database contains multiple legitimate user records, each containing at least an identity field and a standard biometric template field. The verification server uses the identity string as the matching key. If a record is found in the legitimate identity database whose identity field is exactly the same as the identity string to be verified, the identity information to be verified is considered to have matched successfully. If no matching record is found, the verification server terminates the verification process and returns an authentication failure response to the terminal device.

[0052] Once the identity information to be verified is successfully matched, the verification server extracts the standard biometric template corresponding to the identity string from the matched legitimate user records. The verification server runs a biometric comparison algorithm to compare the biometric template data to be verified with the standard biometric template. The biometric comparison algorithm pairs common feature points in the biometric template data to be verified and the standard biometric template. The pairing principle is that the Euclidean distance between the feature descriptor vectors of two feature points is less than a preset feature point pairing threshold. The feature point pairing threshold is set according to the performance index of the biometric acquisition unit, and its value is 0.2. After completing the feature point pairing, the biometric comparison algorithm calculates a matching score, which reflects the overall similarity between the biometric template to be verified and the standard biometric template. The formula for calculating the matching score is:

[0053] in, This represents the number of common feature points in successfully paired pairs. This represents the total number of feature points detected in the biometric template data to be verified. This represents the total number of feature points stored in the standard biometric template; Indicates the matching score. The value of is a real number from 0 to 1. The closer to 1, the higher the similarity.

[0054] The verification server will calculate the matching score. The score is compared with a preset threshold in the system. This preset threshold is set according to security level requirements and has a value of 0.85. If the score matches... If the predetermined threshold is reached or exceeded, the verification server determines that the biometric comparison has passed, and thus the entire identity verification process is considered complete. If the matching score... If the predetermined threshold is not reached, the verification server determines that the biometric comparison has failed and the identity verification has failed.

[0055] Example 5 In practice, after verifying successful authentication, the verification server immediately initiates the generation and distribution process of a temporary authorization token. The verification server extracts the device identifier of the terminal device from the current verification session context. This device identifier is a globally unique identifier reported by the one-time authentication module and verified for integrity during the temporary communication channel establishment phase. The verification server calls the real-time clock interface to obtain the current system time value. This system time value is a Coordinated Universal Time (UTC) timestamp maintained by the operating system on which the verification server resides, accurate to milliseconds. The verification server uses the system time value as the current timestamp and combines it with the terminal device's device identifier. The combination method involves concatenating the device identifier string with the millisecond-level numerical string of the current timestamp using a predetermined separator to form the token generation factor string.

[0056] The verification server inputs the token generation factor string into the token generation algorithm module, which internally uses a message authentication code generation function based on hash operations. The token generation algorithm module reads the token seed key from the verification server's secure storage area. The token seed key is a 256-bit random byte string, generated and encrypted by the hardware security module during verification server deployment. Using the token seed key as the key parameter and the token generation factor string as the message input, the token generation algorithm module performs a hash-based message authentication code calculation and outputs a fixed-length message authentication code digest. The verification server extracts the first 128 bits from the message authentication code digest as the body of the temporary authorization token, appends a version identifier header and token type code before the body, and appends a checksum field after the body, combining these to form a complete temporary authorization token.

[0057] When generating a temporary authorization token, the verification server sets a start time and duration of validity for it. The start time is the system time value read when the temporary authorization token is generated. The duration is an integer value pre-configured in the verification server's policy library, representing the number of seconds the temporary authorization token will remain active from the start time. The duration is set according to the security level of the application scenario, and is set to 600 seconds. The verification server combines the start time and duration to form a token validity record, and associates this record with the digest value of the temporary authorization token in the verification server's token status table for subsequent online verification of the temporary authorization token's validity.

[0058] After the verification server generates the temporary authorization token, it encapsulates the token in a channel response message and sends it to the terminal device via a temporary communication channel. The payload area of ​​the channel response message contains the complete byte sequence of the temporary authorization token and a token validity period message from the verification server. The terminal device's network protocol stack receives the channel response message, parses the payload area, and extracts the temporary authorization token. The terminal device forwards the extracted temporary authorization token to the one-time authentication module via an internal bus or inter-process communication mechanism. During forwarding, the terminal device also includes a session identifier corresponding to the temporary authorization token in the transmitted message body. This session identifier is used to distinguish different temporary communication sessions within the one-time authentication module.

[0059] Upon receiving the temporary authorization token, the one-time authentication module initiates the data writing process to the volatile storage area. The volatile storage area of ​​the one-time authentication module is a temporary data storage space composed of static random access memory (SRAM). The contents of all storage units in this space will be irrecoverably lost after a power outage or reset. The one-time authentication module logically divides the volatile storage area into a first storage partition and a second storage partition. The first and second storage partitions are two different address ranges, defined by the memory management unit of the one-time authentication module using a base address register and a limit register. The base address register of the first storage partition sets the starting physical address of the first storage partition, and the limit register of the first storage partition sets the addressable range size of the first storage partition; similarly, the base address register of the second storage partition sets the starting physical address of the second storage partition, and the limit register of the second storage partition sets the addressable range size of the second storage partition.

[0060] The one-time authentication module writes the one-time session key generated during the establishment of the temporary communication channel and the identity credential data forwarded from the terminal device to the first storage partition. The one-time session key is written in the form of a key object structure, which includes a key length field, a key algorithm identifier field, and a key data field. The byte length of the key data field is specified by the key length field. The identity credential data is written in the raw byte sequence format when encapsulated as a type-length value, immediately following the storage area of ​​the key object structure. After writing, the one-time authentication module updates the used space pointer of the first storage partition.

[0061] The one-time authentication module writes a temporary authorization token to the second storage partition. The temporary authorization token is written as a token object structure, which includes a token version identifier field, a token type code field, a token body data field, and a checksum field. The token body data field stores the 128-bit body portion of the temporary authorization token after removing the version identifier header, token type code, and checksum fields. After writing, the one-time authentication module updates the used space pointer of the second storage partition.

[0062] The one-time authentication module establishes an association index between the first and second storage partitions. The association index is an index data structure stored in the index reservation area of ​​the volatile storage area. The index data structure contains three index entries: the first index entry stores a pointer to the starting address of the one-time session key storage in the first storage partition; the second index entry stores a pointer to the starting address of the identity credential data storage in the first storage partition; and the third index entry stores a pointer to the starting address of the temporary authorization token storage in the second storage partition. These three index entries are bound within the same association index structure. The one-time authentication module writes the memory address of the association index structure into the association index pointer field of the session context register, completing the establishment of the association index. The association index marks the one-to-one correspondence between the one-time session key, identity credential data, and temporary authorization token, enabling the retrieval of the corresponding one-time session key and identity credential data in one go when the temporary authorization token is verified.

[0063] During the validity period of the temporary communication channel's connectivity, the one-time authentication module monitors the connection status of the temporary communication channel in real time. This monitoring is achieved through a channel keep-alive detection circuit built into the one-time authentication module. The keep-alive detection circuit sends keep-alive probe messages to the authentication server at a fixed period of five seconds. The keep-alive probe message is a Lightweight User Datagram Protocol (LTP) message, with a payload consisting of a monotonically increasing sequence number and a timestamp. After sending the keep-alive probe message, the keep-alive detection circuit starts a keep-alive response timer with a timeout threshold of three seconds. If the keep-alive detection circuit does not receive a keep-alive response message from the authentication server before the keep-alive response timer reaches the timeout threshold, a probe failure count is accumulated. If the probe failure count reaches the consecutive probe failure threshold (set to three times), the keep-alive detection circuit determines that the temporary communication channel's connection status has changed from connected to disconnected.

[0064] When the connection status of the temporary communication channel changes from connected to disconnected, the interrupt controller of the one-time authentication module generates a channel disconnection interrupt signal. The channel disconnection interrupt signal is an active-high interrupt request line signal, and the interrupt source number is configured as the pre-assigned channel disconnection interrupt number in the one-time authentication module's interrupt vector table. The interrupt controller routes the channel disconnection interrupt signal to the central processing unit (CPU) of the one-time authentication module. The CPU responds to the channel disconnection interrupt signal, saves the current execution context, and jumps to the entry address of the channel disconnection interrupt service routine.

[0065] The channel disconnect interrupt service routine executes the data erasure procedure within the interrupt context. The channel disconnect interrupt service routine calls a pre-stored data erasure program from the read-only memory (ROM) of the one-time authentication module. The ROM is a non-volatile program memory onboard to the one-time authentication module, implemented using masked ROM or one-time programmable ROM technology. The binary image of the data erasure program is burned into the ROM during the manufacturing or programming phase. The starting address and length of the data erasure program stored in the ROM are recorded in the system call table by the bootloader during system startup.

[0066] The data erasure procedure is executed after being loaded into the instruction cache of the one-time authentication module. The procedure reads the base address register and limit register of the second storage partition to obtain its starting physical address and addressable range, generating the complete address range of the second storage partition. Following a predetermined overwrite order, the procedure performs multiple overwrite operations on the complete address range of the second storage partition. The number of overwrite operations is set to three, with each operation writing a different random data pattern. The first overwrite operation writes each addressable storage cell of the second storage partition to an all-zero data pattern (all bits are zero). The second overwrite operation writes each addressable storage cell of the second storage partition to an all-one data pattern (all bits are one). The third overwrite operation writes each addressable storage cell of the second storage partition to a random data pattern, which is generated in real-time by the true random number generator of the one-time authentication module. The true random number generator generates an unpredictable random bit stream based on a thermal noise amplifier circuit or a ring oscillator jitter sampling principle. After writing to a storage cell in each overwrite operation, the data erasure program immediately performs a readback check, comparing the readback value with the written value. If the comparison is inconsistent, the storage cell is written again until the readback check passes.

[0067] After completing three write operations on the second storage partition, the data erasure program performs the same write operation on the first storage partition. The program reads the base address register and limit register of the first storage partition to obtain its starting physical address and addressable range, generating the complete address range for that partition. The program then sequentially performs a first all-zero data pattern write, a second all-one data pattern write, and a third random data pattern write generated by a true random number generator on the complete address range of the first storage partition. A read-back verification is performed after each write operation. This execution order of erasing the second storage partition before the first ensures that the temporary authorization token storage area is completely cleared before the one-time session key and identity credential data storage areas.

[0068] After completing the overwrite operations on both the first and second storage partitions, the data erasure procedure resets and initializes the volatile storage area. The reset and initialization process involves the data erasure procedure writing a reset command word to the reset control register of the one-time authentication module's memory management unit. Upon receiving the reset command word, the memory management unit sets the addressing logic of all storage units in the first and second storage partitions to an uninitialized state. Simultaneously, it resets all pointer fields in the base address register, limit register, and limit register of the first and second storage partitions, as well as all pointer fields in the associated index structure within the index reservation area, to zero. The memory management unit releases the used space pointers, restoring the volatile storage area to its power-on initial state. After reset and initialization, the data erasure procedure returns an execution status code to the channel disconnect interrupt service routine. The channel disconnect interrupt service routine executes the interrupt return instruction, restoring the interrupted processor context. The one-time authentication module exits the data erasure process, and all data related to this temporary authentication in the volatile storage area is irreversibly erased.

[0069] Example 6 In its implementation, the one-time authentication module, while clearing data from the volatile storage area, introduces a two-tiered destruction mechanism based on physical damage to ensure that sensitive data stored within the module cannot be recovered even under extreme attack conditions. This two-tiered destruction mechanism is directly linked to the disconnection event of the temporary communication channel. It can clear the volatile storage area by overwriting when the logical channel is disconnected, and further perform irreversible damage to the non-volatile storage area through instantaneous arc discharge when the module is physically removed. The two-stage destruction operation of mechanical fuse and instantaneous arc discharge is executed sequentially, triggered by the physical removal of the module from the terminal device.

[0070] The physical interface of the one-time authentication module adopts a six-pin contact interface according to the ISO 7816-3 standard. This interface includes a power supply pin (VCC), a ground pin (GND), a reset pin (RST), a clock pin (CLK), a programming voltage pin (VPP), and input / output pins (IO). Within the metal contact area of ​​the IO contacts, a 5- to 10-micron wide metal film fuse is embedded. This fuse is made of a highly conductive metal material, and its narrow cross-section design makes it the weakest point in terms of mechanical strength under external force. When the one-time authentication module is removed from the terminal device's slot, the pulling force is applied along the long axis of the module across the entire interface area. Because the IO contacts are located at the edge of the interface, the shear force is concentrated at the narrow cross-section of the metal film fuse. At the moment of removal, the metal film fuse breaks due to shear stress exceeding its tensile strength, permanently severing the electrical path of the IO contacts. The width design of this metal film fusible link makes it impossible to repair after breakage using conventional welding or conductive adhesive bonding. To restore its conductivity, a nanoscale metal deposition process using focused ion beam equipment is required. Such equipment is expensive and time-consuming, making physical repair extremely costly in terms of both time and money. Furthermore, the metal film fusible link's response time upon breakage is extremely short, far faster than any attempt to maintain an electrical connection through external means, thus ensuring that the first level of destruction takes effect immediately at the physical level.

[0071] Simultaneously with the breakage of the metal film fuse, the voltage monitoring circuit inside the one-time authentication module begins detecting the voltage state of the VCC pin. The one-time authentication module incorporates a high-voltage pulse film capacitor with a rated voltage of 35 volts and a capacitance of 10 microfarads. This capacitor utilizes a polypropylene metallized film dielectric structure, featuring low equivalent series resistance and high pulse current withstand capability. During normal insertion of the one-time authentication module into the terminal device, this energy storage capacitor draws power from the terminal device through the VCC pin and continuously charges, maintaining its voltage at approximately 35 volts. When the one-time authentication module is removed, the VCC pin is disconnected from the terminal device's power supply circuit, and the voltage on the VCC pin begins to drop. The voltage monitoring circuit continuously samples the voltage value of the VCC pin. When it detects that the VCC pin voltage is below a preset low-voltage threshold, it activates a 500-millisecond debounce timer. This debounce window distinguishes between a genuine removal event and a brief voltage drop caused by poor contact or transient interference. If the VCC pin voltage fails to return to normal operating level within the 500-millisecond debounce window, the voltage monitoring circuit determines that a real physical pull-out event has occurred and generates a trigger signal.

[0072] The trigger signal is transmitted to the control electrode of the MOSFET discharge switch built into the one-time authentication module. The MOSFET discharge switch uses a power MOSFET with low on-resistance and high pulse current capability. Its drain is connected to the positive terminal of the high-voltage pulse film capacitor, and its source is connected to the discharge circuit between the VDD and GND pins of the SE security chip. Upon receiving the trigger signal, the MOSFET discharge switch switches from the off state to the fully on state in a very short time, instantly releasing the energy stored in the high-voltage pulse film capacitor through the power supply pin of the SE security chip. Because the equivalent series resistance of the high-voltage pulse film capacitor is extremely low, and the on-resistance of the MOSFET discharge switch is also controlled at the milliohm level, the total impedance of the discharge circuit is extremely small, causing the discharge current to reach an extremely high peak value at the moment of conduction. The current density of this instantaneous arc discharge far exceeds the electromigration threshold of the silicon chip PN junction, causing the bonding wires inside the SE security chip to heat up rapidly due to overcurrent and melt. An arc is generated between the chip pins and the packaging substrate due to air ionization, and the packaging material vaporizes and expands at high temperatures. Under the impact of high temperature and high current generated by arc discharge, the non-volatile memory array inside the SE security chip suffers physical damage to the structure of its storage cells, resulting in the irreversible destruction of stored information such as keys, identity credentials, and temporary authorization tokens. The instantaneous arc discharge generates a large amount of Joule heat while damaging the chip, causing the temperature of the SE security chip to rise sharply at the moment of discharge, reaching a level sufficient to cause a phase transition in the chip material.

[0073] To provide visual verification of the destruction process, the SE security chip of the one-time authentication module and its adjacent area are encapsulated in transparent epoxy resin. Transparent epoxy resin has high light transmittance, allowing clear visibility of its internal structure. The encapsulation structure employs a double-layer design: an inner layer of approximately 1 mm thick transparent epoxy resin tightly wraps the surface of the SE security chip; an outer layer of approximately 1 mm thick transparent epoxy resin covers the inner layer. The two epoxy resin layers form a continuous transparent solid layer during casting. After a momentary arc discharge, the temperature of the SE security chip rises rapidly, and heat is conducted through the chip surface to the adjacent inner epoxy resin layer. Upon absorbing heat, the inner epoxy resin layer's temperature rises. When its temperature exceeds the epoxy resin's carbonization initiation temperature, the epoxy resin's molecular structure begins to change, polymer chains break and cross-link, causing the material to gradually change from a transparent state to brown or black, i.e., carbonization discoloration. The degree of carbonization and discoloration depends on the highest temperature reached and the duration of the carbonization process in the inner epoxy resin. As the temperature increases further, the carbonization deepens, and the color changes from light brown to dark brown or even black. Due to the thermal resistance between the outer epoxy resin and the inner layer, and its own low thermal conductivity, the temperature of the outer epoxy resin remains low for a short period after the instantaneous arc discharge, preventing it from reaching the carbonization initiation temperature and thus maintaining its transparency. Users can directly observe the color change of the inner epoxy resin through the transparent outer epoxy resin, thus visually confirming that the SE security chip has been physically damaged and the destruction process is complete.

[0074] The execution timing of the dual-layer destruction chain is tightly coupled with the physical removal event of the one-time authentication module. The first-stage mechanical fuse trips immediately upon removal, permanently severing the electrical path of the I / O contacts. Simultaneously, the VCC pin power-down trigger voltage monitoring circuit activates a 500-millisecond debounce window. If the VCC pin voltage fails to recover within the debounce window, it is considered a genuine removal event, triggering the second-stage instantaneous arc discharge. This instantaneous arc discharge completes within a very short time after triggering, causing devastating physical damage to the SE security chip. The Joule heat generated by the arc discharge is conducted to the inner epoxy resin within seconds of discharge completion, causing irreversible carbonization and discoloration, providing the user with visible evidence of destruction. The entire dual-layer destruction chain, from physical removal to completion of destruction, is completed in an extremely short time, ensuring that all sensitive data stored internally cannot be recovered after the module is illegally removed.

[0075] Example 7 In practical deployment scenarios of one-time authentication modules, users or auditors need to reliably confirm that sensitive data within the module has been irreversibly destroyed after destruction occurs. To this end, this embodiment introduces dual verifiability channels on the basis of a two-layer destruction mechanism, providing destruction evidence from two dimensions: direct physical observation and electronic data records. These two methods are independent of each other and complement each other.

[0076] The SE security chip of the one-time authentication module and its adjacent area are encapsulated with transparent epoxy resin. This transparent epoxy resin has a light transmittance of no less than 90%, allowing the color and shape changes of the internal structure to be clearly visible when light passes through. The encapsulation structure employs a double-layer design with a total thickness of approximately 2 mm. The inner layer is a transparent epoxy resin layer approximately 1 mm thick, tightly wrapping the upper surface and surrounding area of ​​the SE security chip; the outer layer is another transparent epoxy resin layer approximately 1 mm thick, covering the inner layer. After casting and curing, the two epoxy resin layers form a single transparent solid lens-like structure. During a transient arc discharge, the SE security chip undergoes a rapid Joule heating in a very short time, causing its surface temperature to rise sharply. The inner epoxy resin layer, which is in close contact with the chip surface, directly absorbs the heat from the chip, and its temperature rises accordingly. When the temperature of the inner epoxy resin exceeds its carbonization initiation temperature, the organic polymer chains of the epoxy resin begin a pyrolysis reaction. The carbon-hydrogen bonds in the molecular structure break and recombine to form carbon atom clusters, causing the material to lose its light transmittance. The color gradually changes from initially colorless and transparent to brown, and further deepens to black with continued heat transfer. This carbonization process is irreversible because the pyrolysis reaction alters the chemical composition of the epoxy resin, and it cannot be restored to its original state after cooling. Users can directly observe the color gradient of the inner epoxy resin through the outer transparent epoxy resin layer, from transparent to light brown to dark black. The entire process is visible to the naked eye within tens of seconds after the arc discharge is completed. Due to its low thermal conductivity and thermal resistance with the inner layer, the outer epoxy resin remains at near room temperature for a period after the arc discharge is completed, without reaching the carbonization temperature or burning the user's fingers. Users can touch the module surface and feel no significant temperature rise, while clearly seeing the internal color change through the transparent outer layer. This visual verification method requires no additional instruments or equipment, nor does it rely on cryptographic methods such as digital signatures or hash chains. Its determination is based solely on the physical fact, as seen by the user, that the inner epoxy resin changes from transparent to brown or black. The extent and depth of the carbonization and discoloration directly correspond to the degree of heat applied to the SE security chip. If the chip is not sufficiently destroyed, the inner epoxy resin may only partially change color or remain unchanged. Therefore, the carbonization and discoloration itself is direct visual evidence of whether the destruction is complete. This method is particularly suitable for scenarios requiring immediate judgment, such as rapid on-site inspections, logistics handovers, and compliance audits. Any user with normal vision can make an accurate assessment.

[0077] In addition to the physical visual channel, this embodiment also provides an electronic destruction certificate as an auxiliary verification method. The one-time authentication module integrates a destruction control logic unit, which generates a destruction confirmation signal after the instantaneous arc discharge is triggered and completed. This signal is transmitted to the terminal device through the communication interface between the one-time authentication module and the terminal device (e.g., the IO pin of the ISO 7816-3 protocol; although this pin has broken in the first-stage mechanical fuse, the transmission of the destruction confirmation signal can be completed before the arc discharge or through an independent backup communication path. Specifically, a brief window can be reserved before the arc discharge for signal transmission, or the signal can be transmitted using the module's internal wireless near-field communication component). Upon receiving the destruction confirmation signal, the main control unit of the terminal device generates and displays an electronic destruction certificate on its display unit. This electronic destruction certificate contains several key information fields: the terminal device's unique device identifier (such as the device serial number or MAC address), the serial number of the one-time authentication module itself, the precise timestamp of the destruction event (taken from the terminal device's real-time clock or a network time server), and a verification hash value. The calculation of the verification hash value is completed by the security processor within the one-time authentication module before or at the moment of destruction triggering. Based on three data items—device identifier, module serial number, and destruction timestamp—it calculates a fixed-length digest value using the SHA-256 one-way hash algorithm. This digest value is then sent to the terminal device along with the destruction confirmation signal and displayed on the screen. Users or auditors can compare the displayed verification hash value with their self-calculated hash value to confirm the authenticity and integrity of the destruction certificate and prevent forgery. The existence of electronic destruction certificates facilitates remote auditing, log archiving, and post-event traceability, especially in scenarios involving the batch destruction of multiple modules. The terminal device can automatically collect and save all destruction certificates, forming an immutable electronic record. However, electronic destruction certificates are inherently supplementary; they cannot replace physical visual verification because electronic data can be intercepted, tampered with, or forged, while physical carbonization and discoloration are irreversible changes occurring on the module itself, possessing higher credibility. The parallel use of these two verification methods satisfies both the need for on-site visual inspection and the convenience of digital management, constituting a complete destruction verifiability system.

[0078] In practice, when the one-time authentication module is removed from the terminal device, the user will first notice a color change in the transparent resin area on the module's surface. If the module is immediately recycled or discarded after removal, the user can confirm successful destruction simply by visual inspection. If a record is required, the user can also view the corresponding electronic destruction certificate on the terminal device's screen and take a photo of it along with the physical module for archiving. For scenarios requiring third-party verification, such as regulatory spot checks, both the physical module and the electronic certificate recorded on the terminal can be requested for mutual verification. Since the carbonization discoloration is directly caused by the Joule heating of the instantaneous arc discharge, its color depth is positively correlated with the chip's heating level. Therefore, even if the electronic certificate is lost, a reliable judgment can be made based solely on the module's appearance. Conversely, if the electronic certificate exists but the module's appearance remains unchanged, it indicates that the destruction mechanism has not been properly activated, requiring further investigation. This dual-channel design effectively reduces the risk of misjudgment associated with a single verification method.

[0079] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A channel terminal authentication method without persistent storage, characterized in that, Includes the following steps: In response to a temporary authentication request, a temporary communication channel is established between the terminal device and the authentication server through the one-time authentication module; In the temporary communication channel, a one-time session key is generated based on the physical characteristic parameters of the terminal device and the current timestamp; The identity credential data sent by the terminal device is encrypted using the one-time session key, and the encrypted identity credential data is transmitted to the verification server through the temporary communication channel. On the verification server side, based on the module identifier carried in the temporary identity verification request, the corresponding verification rule is extracted from the preset temporary identity mapping table, and the encrypted identity credential data is decrypted and verified based on the verification rule; After successful verification, a temporary authorization token is returned to the terminal device through the temporary communication channel; The terminal device forwards the temporary authorization token to the one-time authentication module, which stores the one-time session key and the identity credential data in its volatile storage area. When the temporary communication channel is disconnected, the one-time authentication module is triggered to clear all data in the volatile storage area. The disconnection of the temporary communication channel includes, but is not limited to, the situation where the one-time authentication module is physically disconnected from the terminal device.

2. The channel terminal authentication method without persistent storage according to claim 1, characterized in that, The specific implementation method for establishing a temporary communication channel between the terminal device and the verification server through the one-time authentication module in response to the temporary authentication request is as follows: The one-time authentication module receives the temporary authentication request sent by the terminal device and extracts the device identifier and communication protocol type of the terminal device from the temporary authentication request; According to the communication protocol type, the one-time authentication module performs a handshake negotiation operation with the authentication server, exchanging communication parameters and encryption capability information between the two parties during the handshake negotiation process; After the handshake negotiation is completed, the one-time authentication module sends a channel establishment request to the authentication server. The channel establishment request carries the device identifier and the module identifier of the one-time authentication module. The verification server verifies the legitimacy of the one-time authentication module based on the module identifier. After successful verification, it allocates a temporary network address and communication port to the terminal device, thereby establishing the temporary communication channel.

3. The channel terminal authentication method without persistent storage according to claim 1, characterized in that, The specific implementation method for generating a one-time session key based on the physical characteristic parameters of the terminal device and the current timestamp in the temporary communication channel is as follows: The one-time authentication module collects the hardware serial number and network interface address of the terminal device as the physical feature parameters, and concatenates the hardware serial number and network interface address into a physical feature string in a predetermined order; Obtain the current timestamp, convert the current timestamp into an integer time feature value, and combine the time feature value with the physical feature string to form key seed data; A hash operation is performed on the key seed data to obtain a hash digest value, and a predetermined length of bits is extracted from the hash digest value as the one-time session key.

4. The channel terminal authentication method without persistent storage according to claim 1, characterized in that, The specific implementation method of encrypting the identity credential data sent by the terminal device using the one-time session key and transmitting the encrypted identity credential data to the verification server through the temporary communication channel is as follows: The terminal device acquires the user's input identity information and biometric data, and encapsulates the identity information and biometric data into the identity credential data according to a predetermined data format. The terminal device uses the one-time session key as the key for a symmetric encryption algorithm to perform a symmetric encryption operation on the identity credential data, generating encrypted identity credential ciphertext data. The terminal device divides the encrypted identity credential data into multiple data packets, adds a sequence number and a timestamp tag to each data packet, and sends the multiple data packets to the verification server sequentially through the temporary communication channel according to the sequence number; After receiving the multiple data packets, the verification server reassembles and sorts the multiple data packets according to the sequence number to restore the complete encrypted identity credential data.

5. The channel terminal authentication method without persistent storage according to claim 1, characterized in that, The specific implementation method on the verification server side, which extracts the corresponding verification rule from the preset temporary identity mapping table based on the module identifier carried in the temporary identity verification request, and decrypts and verifies the encrypted identity credential data based on the verification rule, is as follows: The verification server parses the temporary authentication request, extracts the module identifier, and uses the module identifier as an index key to query the preset temporary identity mapping table. It then retrieves the verification rule associated with the module identifier from the temporary identity mapping table. The verification rule includes a decryption algorithm type and an authentication strategy. The verification server selects the corresponding decryption algorithm according to the decryption algorithm type, and uses the private key of the verification server to decrypt the encrypted identity credential data to obtain the decrypted identity credential data. The verification server extracts the identity identification information and biometric data to be verified from the decrypted identity credential data, and matches the identity identification information to be verified with the legitimate identity database stored in the verification server according to the verification order in the identity verification strategy. Once the identity information to be verified is successfully matched, the verification server then compares the biometric data to be verified with the standard biometric template corresponding to the identity information in the legal identity database, generates a matching score, and determines whether the matching score reaches a predetermined threshold. If it does, the verification is successful.

6. The channel terminal authentication method without persistent storage according to claim 1, characterized in that, After successful verification, a temporary authorization token is returned to the terminal device through the temporary communication channel, and the one-time session key and the identity credential data are stored in the volatile storage area of ​​the one-time authentication module. The specific implementation method is as follows: After successful verification, the verification server generates a temporary authorization token based on the device identifier of the terminal device and the current timestamp, and sends the temporary authorization token to the terminal device through the temporary communication channel. At the same time, the verification server records the start time and duration of the validity period of the temporary authorization token. After receiving the temporary authorization token, the terminal device forwards the temporary authorization token to the one-time authentication module, and the one-time authentication module writes the one-time session key and the identity credential data into the first storage partition of the volatile storage area; The one-time authentication module also writes the temporary authorization token into the second storage partition of the volatile storage area and establishes an association index between the first storage partition and the second storage partition. The association index is used to mark the correspondence between the one-time session key, the identity credential data and the temporary authorization token.

7. The channel terminal authentication method without persistent storage according to claim 6, characterized in that, The specific implementation method for triggering the one-time authentication module to clear all data in the volatile storage area when the temporary communication channel is disconnected is as follows: The one-time authentication module monitors the connection status of the temporary communication channel in real time. When it detects that the connection status of the temporary communication channel changes from connected to disconnected, the one-time authentication module generates a channel disconnection interruption signal. In response to the channel disconnection interrupt signal, the one-time authentication module invokes a data erasure program pre-stored in the read-only memory of the one-time authentication module; The data erasure program performs multiple overwrite operations on the volatile storage area in the order of erasing the second storage partition first and then erasing the first storage partition. Each overwrite operation writes a different random data pattern. After the overwrite operation is completed, the volatile storage area is reset and initialized.

8. A channel terminal authentication method without persistent storage according to claim 2, characterized in that, The specific implementation method for the one-time authentication module to receive the temporary authentication request issued by the terminal device and extract the device identifier and communication protocol type of the terminal device from the temporary authentication request is as follows: The one-time authentication module receives an electrical signal sequence from the terminal device through its physical interface and converts the electrical signal sequence into a binary data stream according to a predetermined encoding rule. The one-time authentication module parses the request type field from the header of the binary data stream. When the value of the request type field indicates a temporary authentication request, the one-time authentication module continues to extract the device identifier field and protocol type field from the binary data stream. The one-time authentication module determines the value of the device identifier field as the device identifier, determines the value of the protocol type field as the communication protocol type, and performs integrity verification on the device identifier and the communication protocol type. After the verification is successful, the information is saved to the register of the one-time authentication module.

9. A channel terminal authentication method without persistent storage according to claim 4, characterized in that, The specific implementation method for the terminal device to acquire user-input identity information and biometric data, and to encapsulate the identity information and biometric data into the identity credential data according to a predetermined data format is as follows: The terminal device receives the identity string input by the user through its input interface and converts the identity string into a unified encoding format identity byte sequence. The terminal device collects the user's raw biometric data through its biometric acquisition unit, and performs feature extraction processing on the raw biometric data to obtain biometric template data. The terminal device encapsulates the identity identifier byte sequence and the biometric template data according to the type length value format. During the encapsulation process, a first type label and a first length information are added to the identity identifier byte sequence, and a second type label and a second length information are added to the biometric template data. After encapsulation, the identity credential data is formed.

10. A channel terminal authentication method without persistent storage according to claim 5, characterized in that, The verification server parses the temporary authentication request, extracts the module identifier, and uses the module identifier as an index key to query the preset temporary identity mapping table. The specific implementation method for retrieving the verification rule associated with the module identifier from the temporary identity mapping table is as follows: The verification server extracts the module identifier from the request header of the temporary authentication request, performs format verification on the module identifier, and determines whether the module identifier conforms to the predetermined module identifier encoding specification. After the format verification is passed, the verification server uses the module identifier as the query key value and performs a key-value matching query operation in the preset temporary identity mapping table. The temporary identity mapping table stores multiple key-value pair entries, where the key of each key-value pair entry is the module identifier and the value is the corresponding verification rule configuration data. The verification server reads the verification rule configuration data from the successfully matched key-value pairs. The verification rule configuration data includes a decryption algorithm identifier, an encryption mode indication parameter, and an authentication policy identifier. The verification server determines the decryption algorithm type based on the decryption algorithm identifier and determines the authentication policy based on the authentication policy identifier.

Images