A network terminal offline hierarchical one-time challenge-response authentication system and method
Patent Information
- Application Number
- CN202610951424.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-29
- Publication Date
- 2026-11-03
AI Technical Summary
Existing industrial terminal authentication solutions suffer from problems such as inability to operate independently of third-party systems, inability to differentiate permission levels, numerous security vulnerabilities, and inability to adapt to older equipment, thus failing to meet the high reliability and high security requirements of industrial networks.
The offline hierarchical one-time challenge-response authentication system, which adopts device-side authentication unit and local upper-level operation and maintenance tools, includes a compilation and adaptation module, a random number generation module, a challenge code generation module, a device-side key storage module, a verification and access control module, and a security locking module. It generates a unique random challenge code and performs offline verification. It supports multiple compilation standards and hardware architectures and has hierarchical access control and anti-attack capabilities.
It achieves high-security authentication that runs purely offline without static accounts, is compatible with older embedded environments, supports multiple permission levels, reduces the risk of accidental operation, and improves device stability and security.
Smart Images
Figure CN123034964A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of industrial network equipment security technology, specifically a method and system for offline hierarchical one-time challenge-response authentication of network terminals. Background Technology
[0002] Currently, the vast majority of industrial terminals still use the traditional login mode of "fixed username + static password", which has a security vulnerability that cannot be eradicated:
[0003] All devices in the same series are pre-set with a unified administrator account and password. One set of credentials can be used to log in to all devices of the same model across the entire network. Once the password is leaked, attackers can tamper with network configurations and erase firmware in batches, causing the entire industrial network to be paralyzed.
[0004] Static password login grants full access to all underlying operations, making it impossible to distinguish between the operational boundaries of routine maintenance personnel and development and debugging personnel. Misoperations by front-line maintenance personnel can lead to device downtime and configuration loss.
[0005] Account passwords have no expiration time limit, and permissions cannot be revoked in a timely manner when employees leave or outsourced services end, posing a long-term risk of unauthorized access and internal violations.
[0006] Most devices simply limit the number of login attempts without any additional locking mechanism, allowing attackers to obtain static passwords through dictionary traversal or brute-force attacks.
[0007] Existing dynamic authentication technologies based on responses generally cannot adapt to the special environments of industrial sites. In particular, the so-called "offline authentication" solutions that have emerged in recent years still fundamentally require centralized servers or certificate issuing centers for verification and cannot operate independently of third-party systems.
[0008] Most dynamic password solutions require cloud authentication servers, external network connections, or mobile apps as intermediaries, but industrial sites are mostly isolated intranet environments without external networks, making them completely unsuitable for deployment in serial port direct connection debugging scenarios.
[0009] Older industrial equipment often uses the C89 / C90 compilation standard, lacks a standard integer type library, and has poor cross-platform consistency in bit operations and hash calculations, which can easily lead to mismatches between calculation results at both ends.
[0010] The random number seed of embedded devices is easily fixed. In scenarios with multiple interrupts and multiple threads, the reentrancy of the random number generation function is poor, which easily generates repeated random values, making the challenge code predictable.
[0011] It fails to differentiate between the security level requirements of different scenarios such as operation and maintenance login, development and debugging, and user password reset. The challenge code length and permission rules are fixed, resulting in insufficient flexibility.
[0012] The lack of lifecycle management for hash operation objects can easily lead to memory leaks in embedded environments with limited memory resources, affecting device stability over the long term.
[0013] In summary, existing technologies lack a complete industrial terminal authentication solution that is fully offline, has no static accounts, hierarchical access control, is compatible with outdated embedded environments, and has high security strength, thus failing to meet the high reliability and high security operation and maintenance requirements of industrial networks. Summary of the Invention
[0014] To address the technical problems mentioned in the background art, the present invention provides an offline hierarchical one-time challenge-response authentication system for industrial network terminals, characterized in that...
[0015] It includes a device-side authentication unit and local upper-level operation and maintenance tools, operating in a fully offline closed-loop manner. The device-side authentication unit includes: a compilation and adaptation module, a random number generation module, a challenge code generation module, a device-side key storage module, a verification and access control module, and a security locking module. The local upper-level operation and maintenance tools include: a parameter input and key library module and an answer code calculation module. Each industrial network terminal is configured with an independent 64-byte dedicated encryption key, which is stored on both the device side and the upper-level tools.
[0016] The device generates a unique random challenge code for this login. The upper-level tool combines the challenge code, device model, and permission roles to calculate a one-time response code offline. After the device verifies the code, operation permissions are granted in a tiered manner.
[0017] Among them: the compilation adaptation module automatically adapts to the integer type definitions of different compilation standards through the conditional compilation mechanism, is compatible with big / little endian hardware architecture, and ensures cross-platform operation consistency;
[0018] Specifically: the random number generation module generates 32-bit random numbers based on the ttgfsr algorithm, and truncates the lower 24 bits as the valid random value. The random number seed is generated by a mixture of multiple factors, including the device's unique identifier, power-on duration, and running count. It supports an interrupt disable / enable mechanism to ensure the reentrancy of operations in multi-interrupt scenarios.
[0019] Specifically, the challenge code generation module pads the 24-bit random value to 30 or 40 bits, then splits it into 6 or 8 groups of 5 bits each. Each group's value is used as an index to map to a preset character set, generating a challenge code of the corresponding length. The challenge code generation module supports two scenario specifications: generating a 6-bit challenge code for maintenance / development login scenarios and generating an 8-bit challenge code for user password reset scenarios. The challenge code is automatically invalidated and refreshed when the device restarts, the session ends, or the submission is not submitted within the timeout period.
[0020] Among them: the device-side key storage module pre-stores a 64-byte encryption key exclusive to this model. The keys of different models are independent of each other. It adopts a factory security injection mechanism to derive exclusive keys based on the device's unique identifier. The keys cannot be exported and cannot be read.
[0021] Among them, the verification and permission control module uses the same algorithm as the upper-level tool to verify the response code. After the verification is successful, the corresponding operation permissions are granted according to the role level. The verification and permission control module supports two levels of permissions. Ordinary operation and maintenance roles are only granted viewing and basic maintenance permissions, while underlying development roles are granted all underlying operation permissions. The same challenge code corresponds to two different types of response codes with different permissions.
[0022] Specifically, the security lock module counts the number of consecutive authentication failures and triggers login lock when the threshold is reached to resist brute-force attacks. The security lock module counts the number of consecutive authentication failures and triggers login lock when the number of consecutive failures reaches 10.
[0023] The parameter input and key library module allows users to enter the challenge code, select the device model and operation role, and retrieve the 64-byte exclusive key for the corresponding device model.
[0024] Specifically, the response code calculation module concatenates the challenge code, permission role identifier, and 64-byte model key in a preset order, performs a SHA-256 one-way hash operation to obtain a 32-byte digest, and extracts the first 6 bytes to convert it into a response code.
[0025] The specific method of using this invention is as follows:
[0026] Step 1: Generate and display a random challenge code on the device.
[0027] When the device is powered on or enters the login interface, the random number generation module integrates multiple factors such as the device's unique identifier, power-on duration, and running count to generate a random number seed.
[0028] 32-bit random numbers are generated based on the TTGFSR algorithm. The lower 24 bits of the valid random value are truncated by bitmasking, with the value range being 0x000000~0x00FFFFFF.
[0029] The challenge code specifications are matched according to the current authentication scenario: the challenge code for operation and maintenance / development login scenario is 6 digits, and the challenge code for user password reset scenario is 8 digits.
[0030] The 24-bit random value is used as the low bit, and 6 fixed check bits are added to the high bit, such as binary 000000, to form a 30-bit binary string. The 30-bit binary string is split into 6 groups of 5 bits each, with each group having a value range of 0 to 31. These groups are mapped to the corresponding characters in the preset character set 234567ABCDEFGHJKLMNPQRSTUVWXYZ and then concatenated sequentially to generate a 6-bit challenge code.
[0031] 8-bit challenge code: Use 24 random bits as the low bits, and add 16 fixed check bits to the high bits to form a 40-bit binary string. Divide the string into 8 groups of 5 bits each for mapping.
[0032] The challenge code will be displayed on the login screen, and a 5-minute timeout timer will be started. If the response code is not submitted within the timeout period or the login session ends, the system will automatically return to step 3 to regenerate a new random challenge code, and the original challenge code will become permanently invalid.
[0033] The maintenance personnel copy the challenge code from the device, select the corresponding device model and operation role in the local overhead tool, and paste the challenge code.
[0034] The host tool retrieves the 64-byte proprietary encryption key for this device model from the local keystore;
[0035] Concatenate the input data in the following order: [Challenge Code String][1-Byte Role Identifier][64-Byte Device Key]. For example, if the challenge code is KX2ABC, the role identifier is 0x00 (normal maintenance), and the device key is 0x30, 0xed, ... 0xb5, 0xdf, then the length of the concatenated data is 6 + 1 + 64 = 71 bytes.
[0036] The standard SHA-256 one-way hash algorithm is used to process the concatenated data, resulting in a 32-byte fixed-length hash digest.
[0037] Extract the first 6 bytes of the hash digest, convert it into a character response code in the character set 234567ABCDEFGHJKLMNPQRSTUVWXYZ, and output it.
[0038] Step 3: Local verification and hierarchical authorization on the device
[0039] The device receives the input response code and performs local calculations using the same algorithm, key, and concatenation order as the host tool.
[0040] Compare the local calculation result with the input response code: If the comparison matches, the corresponding operation permissions are granted according to the role level. Ordinary operation and maintenance roles are only granted viewing and basic maintenance permissions, while low-level development roles are granted all low-level operation permissions. If the comparison does not match, the consecutive failure count is incremented by 1, and a login failure message is returned.
[0041] Step 4: Automatic Failure Mechanism
[0042] When a login session ends, the device restarts, or the challenge code is not submitted after a timeout, the current challenge code will be automatically invalidated, and the device will regenerate a new random challenge code. The generated response code is only valid for the current single challenge and cannot be reused.
[0043] The present invention has the following beneficial effects:
[0044] The security level is fundamentally improved: the static account password system is completely abandoned, and there are no login credentials that can be leaked in the long term; the challenge code is randomly generated each time and is valid only once, and the device key is isolated and unique for each device. Even if the interaction information of a single device is leaked, it is impossible to invade the entire network of devices in batches, thus solving the batch security risk of fixed passwords from the root.
[0045] Purely offline with strong adaptability: The entire process is serverless, without external network or third-party device relay, and is fully compatible with offline debugging scenarios such as industrial isolated intranet and direct serial port connection; at the same time, it is compatible with the full range of C89 to C99 compilation standards, supports big-endian / little-endian hardware architecture, and can be directly deployed on various old embedded industrial equipment with low transformation cost.
[0046] Fine-grained access control: The same challenge code can generate two levels of response codes, eliminating the need for multiple account systems to isolate the operation boundaries between maintenance and development, significantly reducing the risk of misoperation and unauthorized operation by frontline personnel, and meeting the needs of enterprise hierarchical operation and maintenance management.
[0047] High stability and resistance to attacks: multi-factor seed for random numbers + reentrancy protection mechanism to avoid duplicate random values; 10 consecutive failures locking mechanism to effectively resist brute-force attacks; full lifecycle management of hash objects to avoid memory leaks in embedded environments and ensure long-term stable operation of the device.
[0048] Flexible adaptation to multiple scenarios: Supports two challenge code specifications: 6-digit operation and maintenance / development login and 8-digit user password reset, which can match the authentication requirements of different security levels. No need to develop multiple sets of authentication logic, and it has strong reusability. Attached Figure Description
[0049] Figure 1 is a schematic diagram of the overall architecture of the offline hierarchical authentication system for industrial network terminals according to the present invention;
[0050] Figure 2 is a flowchart of the challenge code generation method of the present invention;
[0051] Figure 3 is a flowchart of the complete authentication login method described in this invention;
[0052] Figure 4 is a flowchart of the hierarchical permission verification method of the present invention;
[0053] Figure 5 The flowchart for the challenge code generated by this invention;
[0054] Figure 6 This is a flowchart of the copy challenge code for this invention. Detailed Implementation
[0055] Example 1
[0056] like Figures 1-6 As shown:
[0057] Complete workflow:
[0058] 1. Upon powering on the device, the terminal or web login page displays the challenge code generated by the device's authentication unit. See details. Figure 5 ,
[0059] The operations and maintenance personnel copy the challenge code UNX607, open the local upper-level operations and maintenance tool, and enter the challenge code, machine model, and role;
[0060] See details Figure 6 ,
[0061] 3. Click Genrate to convert and generate the response code CFB019.
[0062] 4. Copy the response code CFB019 to the terminal interface or web login interface, and finally display "Login successful".
[0063] Press ENTER to get started
[0064] Challenge Code: UNX607
[0065] Response Code: ######
[0066] %2025-01-01T00:12:54+00:00 HUB-3000 [Notice] CONSOLE: login success!
[0067] The authentication system in this embodiment is applied to the low-level debugging and login of industrial network terminal devices, and consists of a device-side authentication unit and local upper-level operation and maintenance tools.
[0068] The device-side authentication unit comprises six functional modules:
[0069] Compilation and adaptation module: Through conditional compilation directives, the stdint standard type is reused in environments that support the standard library, and the 8 / 16 / 32 / 64-bit signed / unsigned integer types are automatically redefined in older compilation environments. At the same time, it provides the ability to automatically convert between big endianness and little endianness to ensure consistent operation logic under different hardware architectures.
[0070] Random number generation module: Built-in ttgfsr pseudo-random number algorithm, which uses a mixture of three types of parameters, namely device MAC address, power-on timer value and startup count, to generate random number seeds, avoiding the predictability of random numbers caused by fixed seeds; through interrupt disable / enable mechanism to ensure the reentrancy of operation in multi-interrupt scenarios, and to prevent seed abnormality when multiple tasks are concurrent.
[0071] Challenge code generation module: Receives a 24-bit valid random value and supports challenge code mapping output of two lengths, 6 bits and 8 bits, to correspond to different authentication scenarios.
[0072] Device-side key storage module: Permanently stores a 64-byte proprietary encryption key corresponding to this device model. The key adopts a secure factory injection mechanism: the central management system derives the device's proprietary key based on the device serial number and master key, transmits it to the production line programming device through an encrypted channel, and simultaneously synchronizes it to the operation and maintenance upper-level tool library, ensuring that the key cannot be exported or read during its life cycle.
[0073] Verification and access control module: Built-in standard SHA-256 operation logic. After receiving the input response code, it calculates and compares it locally. If the comparison is successful, the corresponding permissions are granted according to the role identifier.
[0074] Security lock module: Maintains a consecutive failure counter. When 10 consecutive failures are reached, the login interface is locked and can only be reset after the device is restarted.
[0075] The local upper-level operation and maintenance tools are installed on the local computer of the operation and maintenance personnel, requiring no internet connection; all calculations are completed locally.
[0076] It includes a parameter input unit, a full-model key library, and a response code calculation unit; it supports selecting the device model and operation role, and generating a response code with one click after entering the challenge code.
[0077] The device and the host tool are pre-configured with a completely identical 64-byte dedicated encryption key for the same model of device;
[0078] The keys for different models of devices are independent of each other and there is no correlation or derivation relationship between them.
[0079] Challenge Code Generation Process
[0080] The device enters the login interface, which can be a web interface or a console serial terminal, triggering the challenge code generation process.
[0081] Read three types of parameters: the device's unique hardware identifier, the current power-on duration, and the total system startup count, and generate a random number seed through mixed operations;
[0082] The ttgfsr random number algorithm is called to generate 32-bit unsigned random numbers. During the operation, an interrupt disable / enable mechanism is used to ensure atomicity and avoid seed abnormality caused by multiple interrupts.
[0083] Perform a bitmasking operation on a 32-bit random number, retaining the lower 24 bits of valid data, with the value range constrained to 0x000000~0x00FFFFFF;
[0084] Determine the current authentication scenario:
[0085] For operation and maintenance / development login scenarios, the target challenge code is 6 digits long and requires 30 valid bits of encoding. Shifting the 24-bit random value to the left by 6 bits is equivalent to padding the high bits with 6 fixed 0 bits, thus expanding it to a 30-bit value.
[0086] In the case of a user password reset, the target length is 8 bits, requiring 40 bits of valid encoding. The 24-bit random value is shifted left by 16 bits and expanded to a 40-bit value.
[0087] The extended binary string is split into groups of 5 bits from the high bit to the low bit. Each group of 5 binary bits, with a value range of 0-31, is used as an index and mapped to a character set 234567ABCDEFGHJKLMNPQRSTUVWXYZ (with easily confused characters such as 0, 1, I, and O removed). The characters are then concatenated in sequence to generate a challenge code of the corresponding length.
[0088] The challenge code will be displayed on the login screen, and a 5-minute timeout timer will be started at the same time;
[0089] If the response code is not submitted within the time limit or the login session ends, a new random challenge code will be automatically generated, and the original challenge code will become permanently invalid.
[0090] The complete authentication login process involves the operations and maintenance personnel copying the challenge code, selecting the machine model and the "ordinary operations and maintenance" role in the upper-level tools, and pasting the challenge code.
[0091] The host tool retrieves the 64-byte key, concatenates it according to [challenge code][0x00][key], performs SHA-256 calculation, and extracts the first 6 bytes to generate a response code. The maintenance personnel input the response code into the device, and the device performs local recalculation and comparison.
[0092] Consistent: Allow general operation and maintenance permissions, including status viewing, log reading, and packet capture, but prohibit firmware flashing and modification of core parameters;
[0093] Inconsistency: Failure counter incremented by 1; 10 consecutive failures trigger locking.
[0094] Hierarchical access control is implemented, allowing the same set of challenge codes to correspond to two different access levels of response codes, distinguished by role identifier bytes concatenated during computation:
[0095] Ordinary operation and maintenance role: The role identifier byte is 0x00 during operation. After verification, only basic operation and maintenance permissions are granted, including viewing device running status, reading system logs, capturing network packets, and viewing general configurations. High-risk operations such as firmware upgrade / rollback, modification of underlying parameters, and factory reset are prohibited.
[0096] Low-level development role: The role identifier byte is 0x01 during operation. After verification, all low-level debugging permissions are granted, including firmware writing, modification of low-level register parameters, factory mode debugging, full configuration modification and other operations.
[0097] The response codes for the two roles are not interchangeable; the response code for a lower-privilege role cannot unlock higher-privilege features. There is no need to configure multiple account systems for different roles; permission isolation can be achieved simply by using role identifiers.
[0098] Replacement and extension of hash algorithms: SHA-256 can be replaced by other one-way operation methods such as SM3 national cryptographic algorithm and HMAC algorithm.
[0099] Challenge code / response code length adjustment: The length of the challenge code and response code can be adjusted according to security level requirements, and is not limited to 6 or 8 digits.
[0100] Permission level expansion: Permission levels can be expanded to level three and above, such as adding an "auditor" role, not limited to the operations and maintenance and development levels.
[0101] Application scenario expansion: In addition to industrial network terminals, this solution can also be applied to certification scenarios for other embedded terminals such as industrial control equipment, security equipment, and automotive electronics.
[0102] This invention is simple to operate, convenient to use, and suitable for widespread promotion and application. Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. An offline hierarchical one-time challenge-response authentication system for industrial network terminals, characterized in that, Including device-side authentication units and local upper-level operation and maintenance tools, the entire process operates offline in a closed loop; The device-side authentication unit includes: a compilation and adaptation module, a random number generation module, a challenge code generation module, a device-side key storage module, a verification and access control module, and a security locking module; The local upper-level operation and maintenance tools include: a parameter input and key store module and a response code calculation module; Industrial network terminals are equipped with an independent 64-byte proprietary encryption key, which is stored both on the device and in the host computer. The device generates a unique random challenge code for this login. The upper-level tool combines the challenge code, device model, and permission roles to calculate a one-time response code offline. After the device verifies the code, operation permissions are granted in a tiered manner.
2. The industrial network terminal offline hierarchical one-time challenge-response authentication system as described in claim 1, characterized in that, The aforementioned compilation adaptation module automatically adapts to the integer type definitions of different compilation standards through a conditional compilation mechanism, ensuring compatibility with big-endian / little-endian hardware architectures and guaranteeing cross-platform operational consistency.
3. The offline hierarchical one-time challenge-response authentication system for industrial network terminals as described in claim 1, characterized in that, The random number generation module generates 32-bit random numbers based on the ttgfsr algorithm, and truncates the lower 24 bits as the valid random value. The random number seed is generated by a mixture of multiple factors, including the device's unique identifier, power-on duration, and running count. It supports an interrupt disable / enable mechanism to ensure the reentrancy of operations in multi-interrupt scenarios.
4. The offline hierarchical one-time challenge-response authentication system for industrial network terminals as described in claim 1, characterized in that, The challenge code generation module pads the 24-bit random value to 30 or 40 bits, then splits it into 6 or 8 groups of 5 bits each. Each group's value is used as an index to map to a preset character set, generating a challenge code of the corresponding length. The challenge code generation module supports two scenario specifications: generating a 6-bit challenge code for maintenance / development login scenarios and generating an 8-bit challenge code for user password reset scenarios. The challenge code is automatically invalidated and refreshed when the device restarts, the session ends, or the submission is not submitted within the timeout period.
5. The industrial network terminal offline hierarchical one-time challenge-response authentication system as described in claim 1, characterized in that, The device-side key storage module pre-stores a 64-byte encryption key specific to each device model. The keys for different models are independent of each other. It adopts a factory-secure injection mechanism to derive a unique key based on the device's unique identifier. The key cannot be exported or read.
6. The offline hierarchical one-time challenge-response authentication system for industrial network terminals as described in claim 1, characterized in that, The verification and access control module uses the same algorithm as the upper-level tool to verify the response code. After successful verification, the corresponding operation permissions are granted according to the role level. The verification and access control module supports two levels of permissions. Ordinary operation and maintenance roles are only granted viewing and basic maintenance permissions, while underlying development roles are granted all underlying operation permissions. The same challenge code corresponds to two different response codes with different permissions.
7. The industrial network terminal offline hierarchical one-time challenge-response authentication system as described in claim 1, characterized in that, The security lock module counts the number of consecutive authentication failures and triggers login lock when the threshold is reached to resist brute-force attacks. The security lock module counts the number of consecutive authentication failures and triggers login lock when the number of consecutive failures reaches 10.
8. The offline hierarchical one-time challenge-response authentication system for industrial network terminals as described in claim 1, characterized in that, The parameter input and key library module allows users to enter the challenge code, select the device model and operation role, and retrieve the 64-byte exclusive key for the corresponding device model.
9. The offline hierarchical one-time challenge-response authentication system for industrial network terminals as described in claim 1, characterized in that, The response code calculation module concatenates the challenge code, permission role identifier, and 64-byte model key in a preset order, performs a SHA-256 one-way hash operation to obtain a 32-byte digest, and extracts the first 6 bytes to convert it into a response code.
10. A method for offline hierarchical one-time challenge-response authentication of industrial network terminals, characterized in that: The authentication system according to any one of claims 1 to 9 includes the following steps: Step 1: The device-side authentication unit generates a 24-bit random value, which is then converted into a challenge code of the corresponding length through padding mapping according to the authentication scenario and displayed. Step 2: Enter the challenge code, device model, and operation role into the local upper-level operation and maintenance tool, call the 64-byte exclusive key for the corresponding device model, and generate a one-time response code through SHA-256 hash operation; Step 3: The device uses the same algorithm to locally verify the response code. After successful verification, the corresponding operation permissions are granted according to the role level. Step 4: The challenge code will automatically expire after the session ends or the device restarts, and the response code cannot be reused.