Bidirectional authentication system, method, and apparatus, device, and medium

Abstract

The present application discloses a bidirectional authentication system, method, and apparatus, a device, and a medium, for use in carrying out rapid, efficient and secure bidirectional authentication. According to the present application, a first communication device can send a first key application to a first key device; the first key device carries out key distribution with a second key device to generate at least one target key, and sends a first target key and a first target key identifier to the first communication device; the first communication device generates first authentication data, and sends the first authentication data and the first target key identifier to a second communication device; the second communication device authenticates the first communication device, generates, when the authentication is passed, second authentication data on the basis of a second target key obtained from the second key device, and sends the second authentication data and a second target key identifier to the first communication device; and the first communication device authenticates the second communication device. On this basis, the objective of carrying out rapid, efficient and secure bidirectional authentication can be achieved.

Description

A two-way authentication system, method, device, equipment and medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on August 3, 2023, with application number 202310974923.6 and application name “A two-way authentication system, method, device, equipment and medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to a two-way authentication system, method, apparatus, device and medium. Background Art

[0004] Two-way authentication is the authentication (verification) of the true identity of both the sender and receiver of information, and is one of the measures to protect network security. Existing identity authentication technologies mainly include: password-based, biometric-based, and password-based authentication. Password-based authentication technologies include: authentication based on symmetric cryptography and authentication based on public key cryptography. Among them, two-way authentication based on symmetric cryptography is mainly implemented using pre-shared symmetric keys. There is a problem of difficulty in distributing pre-shared symmetric keys in management. Even if a key center is introduced, the key shared by the communicating parties and the key center needs to be manually distributed in advance, which not only has high application costs but also poses security risks.

[0005] Therefore, there is an urgent need for a technical solution that can quickly, efficiently and safely perform two-way authentication.

[0006] Summary of the Invention

[0007] The present application provides a two-way authentication system, method, apparatus, device and medium for performing two-way authentication quickly, efficiently and securely.

[0008] In a first aspect, the present application provides a two-way authentication system, the system comprising:

[0009] The first communication device is configured to send a first key application to the first key device, where the first key application carries the first communication device identifier and the obtained second key device identifier corresponding to the second communication device;

[0010] The first key device is configured to perform key distribution with a second key device corresponding to the second key device identifier to generate at least one target key; and to send any first target key and the first target key identifier to the first communication device based on the first communication device identifier;

[0011] The first communication device is further configured to generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device;

[0012] The second communication device is further configured to generate first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, authenticate the first communication device based on the first authentication comparison data and the first authentication data, and if the authentication is successful, generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device;

[0013] The first communication device is further configured to generate second authentication comparison data based on a key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0014] In a second aspect, the present application provides a two-way authentication method based on any of the above systems, the method being applied to a first communication device, the method comprising:

[0015] Sending a first key application to a first key device, the first key application carrying the first communication device identifier and the obtained second key device identifier corresponding to the second communication device; performing key distribution between the first key device and the second key device corresponding to the second key device identifier to generate at least one target key;

[0016] receiving a first target key and a first target key identifier sent by the first key device; generating first authentication data based on the first target key, and sending the first authentication data and the first target key identifier to the second communication device; causing the second communication device to generate first authentication comparison data based on the key of the first target key identifier obtained from the second key device, and causing the second communication device to authenticate the first communication device based on the first authentication comparison data and the first authentication data; if the authentication is successful, causing the second communication device to generate second authentication data based on the second target key obtained from the second key device, and sending the second authentication data and the second target key identifier to the first communication device;

[0017] Receive the second authentication data and the second target key identifier sent by the second communication device, generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0018] In a third aspect, the present application discloses a two-way authentication method based on any of the above systems, the method being applied to a second communication device, the method comprising:

[0019] generating first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, and authenticating the first communication device based on the first authentication comparison data and the first authentication data received from the first communication device;

[0020] If the authentication is successful, second authentication data is generated based on the second target key obtained from the second key device, and the second authentication data and the second target key identifier are sent to the first communication device; the first communication device is enabled to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and the first communication device is enabled to authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0021] In a fourth aspect, the present application discloses a two-way authentication method based on any of the above-mentioned systems, the method being applied to a first key device, the method comprising:

[0022] receiving a first key application sent by a first communication device, where the first key application carries an identifier of the first communication device and a second key device identifier corresponding to a second communication device;

[0023] performing key distribution with a second key device corresponding to the second key device identifier to generate at least one target key;

[0024] Based on the first communication device identifier, any first target key and the first target key identifier are sent to the first communication device.

[0025] In a fifth aspect, the present application discloses a two-way authentication method based on any of the above-mentioned systems, the method being applied to a second key device, the method comprising:

[0026] receiving a second key application sent by a second communication device, where the second key application carries a first key authorization code, a first target key identifier, and a second communication device identifier;

[0027] Based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm, a first key authorization comparison code is generated. If the first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sends the second key application, the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

[0028] In a sixth aspect, the present application provides a two-way authentication apparatus based on any of the above-mentioned systems, the apparatus being applied to a first communication device, the apparatus comprising:

[0029] a first sending module, configured to send a first key application to a first key device, the first key application carrying the first communication device identifier and the obtained second key device identifier corresponding to the second communication device; and to enable key distribution between the first key device and the second key device corresponding to the second key device identifier to generate at least one target key;

[0030] a first receiving module, configured to receive a first target key and a first target key identifier sent by the first key device; generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device; cause the second communication device to generate first authentication comparison data based on the key of the first target key identifier obtained from the second key device, and cause the second communication device to authenticate the first communication device based on the first authentication comparison data and the first authentication data; if the authentication is successful, cause the second communication device to generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device;

[0031] The first authentication module is used to receive the second authentication data and the second target key identifier sent by the second communication device, generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0032] In a seventh aspect, the present application discloses a two-way authentication device based on any of the above-mentioned systems, the device being applied to a second communication device, the device comprising:

[0033] a second authentication module, configured to generate first authentication comparison data based on a key corresponding to the first target key identifier obtained from the second key device, and authenticate the first communication device based on the first authentication comparison data and the first authentication data received from the first communication device;

[0034] The second sending module is used to generate second authentication data based on the second target key obtained from the second key device if the authentication is successful, and send the second authentication data and the second target key identifier to the first communication device; enable the first communication device to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and enable the first communication device to authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0035] In an eighth aspect, the present application discloses a two-way authentication device based on any of the above-mentioned systems, the device being applied to a first key device, the device comprising:

[0036] A second receiving module is configured to receive a first key application sent by a first communication device, where the first key application carries an identifier of the first communication device and a second key device identifier corresponding to a second communication device;

[0037] a key generation module, configured to perform key distribution with a second key device corresponding to the second key device identifier, and generate at least one target key;

[0038] The third sending module is configured to send any first target key and a first target key identifier to the first communication device based on the first communication device identifier.

[0039] In a ninth aspect, the present application discloses a two-way authentication device based on any of the above-mentioned systems, the device being applied to a second key device, the device comprising:

[0040] A third receiving module is configured to receive a second key application sent by a second communication device, where the second key application carries the first key authorization code, the first target key identifier, and the second communication device identifier;

[0041] A comparison module is used to generate a first key authorization comparison code based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm; if the first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sends the second key application, then the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

[0042] In a tenth aspect, the present application provides an electronic device, which includes at least a processor and a memory, and the processor is used to implement the steps of any of the above methods when executing a computer program stored in the memory.

[0043] In an eleventh aspect, the present application provides a computer-readable storage medium storing a computer program, which implements the steps of any of the above methods when executed by a processor.

[0044] Since this application can send a key application to the corresponding key device each time the first communication device and the second communication device need to perform two-way authentication, and the corresponding key device will then perform the steps of generating and issuing the key, the communicating parties (such as the first communication device and the second communication device) do not need to share the key in advance or pre-share the key with a trusted third party. Based on this, the purpose of fast, efficient and secure two-way authentication can be achieved. Moreover, this application can use a newly generated (newly applied) key for authentication each time two-way authentication is required, achieving "one authentication, one key". Compared with the long-term use of a fixed key, this application can prevent attackers from stealing key information and has higher security. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the implementation methods in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0046] FIG1 shows a schematic diagram of a two-way authentication system provided by some embodiments;

[0047] FIG2 shows a schematic diagram of a first two-way authentication process provided by some embodiments;

[0048] FIG3 shows a schematic diagram of a second two-way authentication process provided by some embodiments;

[0049] FIG4 shows a schematic diagram of a third two-way authentication process provided by some embodiments;

[0050] FIG5 shows a schematic diagram of a fourth two-way authentication process provided by some embodiments;

[0051] FIG6 shows a schematic diagram of a fifth two-way authentication process provided by some embodiments;

[0052] FIG7 shows a schematic diagram of a sixth two-way authentication process provided by some embodiments;

[0053] FIG8 shows a schematic diagram of a seventh two-way authentication process provided by some embodiments;

[0054] FIG9 shows a schematic diagram of an eighth two-way authentication process provided by some embodiments;

[0055] FIG10 shows a schematic diagram of a first two-way authentication device provided by some embodiments;

[0056] FIG11 shows a schematic diagram of a second two-way authentication device provided by some embodiments;

[0057] FIG12 shows a schematic diagram of a third two-way authentication device provided by some embodiments;

[0058] FIG13 shows a schematic diagram of a fourth two-way authentication device provided by some embodiments;

[0059] FIG14 shows a schematic structural diagram of an electronic device provided by some embodiments. DETAILED DESCRIPTION

[0060] In order to perform two-way authentication quickly, efficiently and securely, the present application provides a two-way authentication system, method, apparatus, device and medium.

[0061] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0062] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0063] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0064] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0065] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0067] Example 1:

[0068] FIG1 shows a schematic diagram of a two-way authentication system provided by some embodiments. As shown in FIG1 , the system includes:

[0069] The first communication device 11 is configured to send a first key application to the first key device 12, where the first key application carries the first communication device identifier and the obtained second key device identifier corresponding to the second communication device;

[0070] The first key device 12 is configured to perform key distribution with the second key device 14 corresponding to the second key device identifier to generate at least one target key; and to send any first target key and the first target key identifier to the first communication device 11 based on the first communication device identifier;

[0071] The first communication device 11 is further configured to generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device 13;

[0072] The second communication device 13 is further configured to generate first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device 14, authenticate the first communication device 11 based on the first authentication comparison data and the first authentication data, and if the authentication is successful, generate second authentication data based on the second target key obtained from the second key device 14, and send the second authentication data and the second target key identifier to the first communication device 11;

[0073] The first communication device 11 is further configured to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device 12, and authenticate the second communication device 13 based on the second authentication comparison data and the second authentication data.

[0074] In one possible implementation, the devices that require two-way authentication are referred to as a first communication device 11 (such as communication device-A) and a second communication device 13 (such as communication device-B). In order to perform two-way authentication quickly, efficiently and securely, the first communication device 11 corresponds to a first key device 12 (such as QKD device-X), and the second communication device 13 corresponds to a second key device 14 (such as QKD device-Y). Optionally, a dedicated line can be used to directly connect the first communication device and the first key device, and they are located in the same security domain, which can effectively improve the security of communication. Similarly, a dedicated line can also be used to directly connect the second communication device and the second key device, and they are located in the same security domain. The communication device and the key device can trust and communicate the corresponding communication device information, key device information, information transmission protocol, encryption and decryption algorithm, initial key and key update strategy in advance, which can ensure that keys such as quantum keys are not transmitted in plain text. Optionally, considering that public key cryptographic algorithms may be affected by quantum computing, in order to improve the security of the authentication process, the key devices (first key device 12, second key device 14) in this application can be quantum key distribution (QKD) devices.

[0075] When bidirectional authentication is required between the first communication device 11 (communication device-A) and the second communication device 13 (communication device-B), the first communication device 11 may first send an authentication request to the second communication device 13, and the authentication request may carry the identifier of the first communication device (the first communication device identifier, such as ID A ). The communication device identifier can be flexibly set according to needs, and this application does not make specific limitations on this.

[0076] After receiving the authentication request sent by the first communication device 11, the second communication device 13 may return a challenge message to the first communication device 11. The challenge message may include the identifier of the second communication device 13 itself (the second communication device identifier, such as ID B ) and the second key device identifier (such as ID Y ).

[0077] After receiving the challenge information returned by the second communication device 13, the first communication device 11 can send a first key application to the first key device 12 (such as QKD device-X) that has been connected in advance. The first key application can carry the first communication device identifier (such as ID A ) and the second key device identifier (such as ID Y ).

[0078] After receiving the first key request, the first key device 12 (e.g., QKD device-X) can perform key distribution, such as quantum key distribution, with the second key device 14 to generate at least one target key, for example, multiple quantum keys. The key distribution process between the first key device 12 and the second key device 14 can utilize existing techniques and will not be further described here. Both the first key device 12 and the second key device 14 can store these multiple target keys.

[0079] The first key device 12 (such as QKD device-X) can generate any one of the target keys (for the convenience of description, referred to as the first target key, such as QK1) and the identifier corresponding to the first target key (the first target key identifier, such as ID QK1 ) is sent to the first communication device 11. In order to ensure the security of the key, the first key device 12 can use the set first encryption algorithm to encrypt the first target key QK1 and the first target key identifier ID QK1 Encrypt the encrypted first target key QK1 and the first target key identifier ID QK1 Sent to the first communication device 11.

[0080] After receiving the first target key and the first target key identifier encrypted by the first encryption algorithm, the first communication device 11 can use the first decryption algorithm corresponding to the first encryption algorithm to decrypt the first target key QK1 and the first target key identifier ID QK1 After decryption, the decrypted first target key QK1 and the first target key identifier ID are obtained. QK1 The first communication device 11 may generate the first authentication data based on the first target key. Optionally, the first communication device 11 may generate the first authentication data based on the first target key and the set authentication data encryption algorithm. Exemplarily, the first communication device 11 may encrypt the first communication device ID based on the first target key QK1 and the set authentication data encryption algorithm. A (local communication device identification), second communication device identification ID B (the peer communication device identifier) ​​is encrypted and calculated to generate the first authentication data. The cryptographic encryption algorithm used in the authentication data encryption algorithm may be a keyed hash function (HMAC), a block cipher, a stream cipher, an identifiable encryption technology, etc. The cryptographic encryption algorithm is represented by E, and the first communication device identifier ID can be encrypted based on the first target key QK1 and the set authentication data encryption algorithm E. A , second communication device identification ID BPerform encryption calculation to generate the first authentication data: Token1 = E QK1 (ID A ||ID B ). When the password encryption algorithm is HMAC, the first communication device identifier ID can be coded based on the first target key QK1 and HMAC. A , second communication device identification ID B Perform encryption calculation to obtain the first authentication data: Token1 = HMAC(QK1, ID A ||ID B ). The first authentication data may also be obtained based on other methods, which will not be described here in detail and will be described in subsequent embodiments.

[0081] Optionally, after the first communication device 11 generates the first authentication data Token1, the first authentication data and the first target key identifier ID QK1 Send to the second communication device 13.

[0082] Optionally, after receiving the first authentication data and the first target key identifier, the second communication device 13 may send a key request to the second key device 14 to obtain the key corresponding to the first target key identifier. The second key device 14 may encrypt the key corresponding to the first target key identifier using a predetermined second encryption algorithm and send the encrypted key corresponding to the first target key identifier to the second communication device 13. The second communication device 13 may also obtain the key corresponding to the first target key identifier from the second key device 14 using other methods, which will not be described in detail here and will be described in detail in subsequent embodiments.

[0083] The second communication device 13 can use a second decryption algorithm corresponding to the second encryption algorithm to decrypt the key corresponding to the first target key identifier encrypted by the second encryption algorithm, and obtain the key corresponding to the first target key identifier (first target key). The second communication device 13 can generate first authentication comparison data based on the first target key. Exemplarily, similar to the process of generating the first authentication data by the first communication device 11, the second communication device 13 can generate the first authentication comparison data based on the first target key and the set authentication data encryption algorithm. Exemplarily, the second communication device 13 can encrypt the first communication device identifier ID based on the first target key QK1 and the set authentication data encryption algorithm. A , second communication device identification ID B Perform encryption calculation to generate first authentication comparison data. For example, the first authentication comparison data can be expressed as: E QK1 (ID A ||ID B ), or HMAC(QK1, ID A||ID B In addition, the second communication device 13 can also obtain the first authentication comparison data based on other methods, which will not be described here and will be described in detail in subsequent embodiments.

[0084] The second communication device 13 generates first authentication comparison data (such as HMAC (QK1, ID A ||ID B )) After that, the first authentication comparison data can be compared with the received first authentication data (Token1 = HMAC (QK1, ID A ||ID B )) are compared, and based on the comparison result, the first communication device 11 is authenticated. Specifically, if the comparison result shows that the two are consistent, the first communication device 11 can be considered a secure device, and the first communication device 11 can be authenticated. If the comparison result shows that the two are inconsistent, the first communication device 11 can be considered unsafe, and the first communication device 11 can be authenticated. For example, a prompt message indicating that the authentication failed can be sent to the first communication device 11.

[0085] Optionally, after the second communication device 13 successfully authenticates the first communication device 11, the second communication device 13 may generate second authentication data, thereby enabling the first communication device 11 to authenticate the second communication device 13 based on the second authentication data. Specifically, the second communication device 13 may generate the second authentication data based on the target key obtained from the second key device 14. The target key used by the second communication device 13 to generate the second authentication data may be the same as the first target key, or two different keys. For ease of description, the target key used by the second communication device 13 to generate the second authentication data is referred to as the second target key. When the second target key is the same as the first target key, the second target key is represented by QK1. When the second target key is different from the first target key, the second target key is represented by QK2. When the second target key is the same as the first target key, the second communication device 13 may generate the second authentication data directly based on the key QK1 obtained from the second key device 14. When the second target key and the first target key are two different keys, the second communication device 13 can send a key acquisition request to the second key device 14 again, and the second key device 14 can send a target key QK2 and a key identification ID of the target key to the second communication device 13. QK2 .

[0086] Optionally, after the second communication device 13 generates the second authentication data, it can send the second authentication data and the second target key identifier to the first communication device 11. The first communication device 11 can generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device 12. The process of generating the second authentication comparison data is similar to the process of generating the first authentication data. For example, the second authentication comparison data can be generated based on the key (second target key) corresponding to the second target key identifier obtained from the first key device 12. Exemplarily, the first communication device 11 can generate the second authentication comparison data based on the second target key and the set authentication data encryption algorithm. Exemplarily, the first communication device 11 can encrypt the second communication device ID based on the second target key and the set authentication data encryption algorithm. B (Opposite communication device identification), first communication device identification ID A (this end communication device identification) performs encryption calculation to generate the second authentication comparison data. For example, when the second target key is the same as the first target key, the second authentication comparison data can be E QK1 (ID B ||ID A ), or, HMAC(QK1, ID B ||ID A ). When the second target key is different from the first target key, the second authentication comparison data can be E QK2 (ID B ||ID A ), or, HMAC(QK2, ID B ||ID A ). The second authentication comparison data may also be obtained based on other methods, which will not be described here in detail and will be described in subsequent embodiments.

[0087] The first communication device 11 may compare the second authentication comparison data with the second authentication data and, based on the comparison result, authenticate the second communication device 13. Optionally, if the comparison result shows that the two are consistent, the second communication device 13 may be authenticated; if the comparison result shows that the two are inconsistent, the second communication device 13 may be authenticated.

[0088] Since this application can send a key application to the corresponding key device each time the first communication device and the second communication device need to perform two-way authentication, and the corresponding key device will then perform the steps of generating and issuing the key, the communicating parties (the first communication device and the second communication device) do not need to share the key in advance or pre-share the key with a trusted third party. Based on this, the purpose of performing two-way authentication quickly, efficiently and securely can be achieved. Moreover, this application can use a newly generated (newly applied) key for authentication each time two-way authentication is required, achieving "one authentication, one key". Compared with the long-term use of a fixed key, this application can prevent attackers from stealing key information and has higher security.

[0089] Example 2:

[0090] In order to improve security, based on the above embodiment, in the embodiment of the present application, the second communication device 13 is further configured to send the obtained first random factor to the first communication device 11;

[0091] The first communication device 11 is specifically configured to generate first authentication data based on the first target key, the first random factor, and a set authentication data encryption algorithm;

[0092] The second communication device 13 is specifically configured to generate first authentication comparison data based on the first random factor, a set authentication data encryption algorithm, and a key corresponding to the first target key identifier obtained from the second key device 14 .

[0093] In a possible implementation manner, after the second communication device 13 receives the authentication request sent by the first communication device 11, when returning the challenge information to the first communication device 11, the challenge information may include the second communication device identifier (ID B ) and the second key device identifier (such as ID Y ), it may also include the obtained first random factor, that is, the second communication device 13 may also send the obtained first random factor to the first communication device 11. The first random factor may be a random number R, a count currently generated by a counter, a timestamp, or other sharable information, etc., which is not specifically limited in this application.

[0094] Optionally, the first communication device 11 receives a message including the first random factor and the second communication device identifier (ID B ) and the second key device identifier (such as ID Y), a first key application may be sent to the first key device 12. After receiving the first key application, the first key device 12 may perform key distribution with the second key device 14 corresponding to the second key device identifier to generate at least one target key. The first key device 12 may also send the first target key and the first target key identifier encrypted using the first encryption algorithm to the first communication device 11. This will not be described in detail here.

[0095] Optionally, in order to improve security, after receiving the first target key, the first communication device 11 may generate the first authentication data based on the first target key, the first random factor, and the set authentication data encryption algorithm. For example, taking the first random factor as a random number R1 as an example, the first authentication data may be generated by encrypting the first random factor, the first communication device identifier, and the second communication device identifier based on the first target key and the set authentication data encryption algorithm. For example, the first authentication data Token1 may be represented as: HMAC(QK1, R1||ID A ||ID B ), or Token1 can also be expressed as: E QK1 (R1||ID A ||ID B ), which will not be elaborated here.

[0096] For example, taking the counter1 generated by the first random factor as an example, the first authentication data Token1 can be expressed as: HMAC(QK1, counter1||ID A ||ID B ), or Token1 can also be identified as: E QK1 (counter1||ID A ||ID B ). For example, taking the first random factor as timestamp timestamp1 as an example, the first authentication data Token1 can be expressed as: HMAC(QK1, timestamp1||ID A ||ID B ), or Token1 can also be expressed as: E QK1 (timestamp1||ID A ||ID B ).

[0097] Optionally, when generating the first authentication comparison data, the second communication device 13 may also generate the first authentication comparison data based on the first random factor (such as R1), the set authentication data encryption algorithm, and the key (first target key) corresponding to the first target key identifier obtained from the second key device 14. The process of generating the first authentication comparison data is similar to the process of generating the first authentication data. For example, the first authentication comparison data can be expressed as: HMAC(QK1, R1||ID A ||ID B ), E QK1 (R1||ID A ||ID B )、HMAC(QK1,counter1||ID A ||ID B ), E QK1 (counter1||ID A ||ID B )、HMAC(QK1,timestamp1||ID A ||ID B ), or E QK1 (timestamp1||ID A ||ID B ) etc., which will not be elaborated here.

[0098] Among them, after generating the first authentication comparison data, the second communication device 13 can compare the first authentication comparison data with the first authentication data, thereby authenticating the first communication device 11. The process of authenticating the first communication device 11 is the same as the above embodiment and will not be repeated here.

[0099] Since the present application can generate the first authentication data and the first authentication comparison data based on the first random factor, the security of the authentication process can be further improved.

[0100] Example 4:

[0101] In order to improve the security of the authentication process, based on the above embodiments, in the embodiment of the present application, the first communication device 11 is further configured to send the obtained second random factor to the second communication device 13;

[0102] The second communication device 13 is specifically configured to generate second authentication data based on the second random factor, a set authentication data encryption algorithm, and a second target key obtained from the second key device 14;

[0103] The first communication device 11 is specifically configured to generate second authentication comparison data based on the second random factor, a set authentication data encryption algorithm, and a key corresponding to the second target key identifier obtained from the first key device 12 .

[0104] In one possible implementation, in addition to sending the first authentication data, the first target key identifier, etc., to the second communication device 13, the first communication device 11 may also send the obtained second random factor to the second communication device 13. Exemplarily, while sending the first authentication data, the first target key identifier, etc. to the second communication device 13, the first communication device 11 may also send the generated second random factor to the second communication device 13. The second random factor may be a random number R, a count counter generated by a counter, a timestamp, or other shareable information, and this application does not specifically limit this.

[0105] Optionally, in order to improve security, after the second communication device 13 receives the second random factor, when generating the second authentication data, the second authentication data may be generated based on the second target key, the second random factor and the set authentication data encryption algorithm. Exemplarily, taking the second random factor as a random number R2 as an example, the second authentication data may be generated by encrypting and calculating the second random factor, the second communication device identifier and the first communication device identifier based on the second target key and the set authentication data encryption algorithm. Exemplarily, when the second target key is the same as the first target key, the second authentication data Token2 may be: HMAC(QK1, R2||ID B ||ID A ), E QK1 (R2||ID B ||ID A )、HMAC(QK1,counter2||ID B ||ID A ), E QK1 (counter2||ID B ||ID A )、HMAC(QK1,timestamp2||ID B ||ID A ), E QK1 (timestamp2||ID B ||ID A )wait.

[0106] For example, when the second target key is different from the first target key, the second authentication data Token2 can be: HMAC(QK2, R2||ID B ||IDA ), E QK2 (R2||ID B ||ID A )、HMAC(QK2,counter2||ID B ||ID A ), E QK2 (counter2||ID B ||ID A )、HMAC(QK2,timestamp2||ID B ||ID A ), E QK2 (timestamp2||ID B ||ID A )wait.

[0107] Optionally, when generating the second authentication comparison data, the first communication device 11 may also generate the second authentication comparison data based on the second random factor (such as R2), the set authentication data encryption algorithm, and the key (second target key) corresponding to the second target key identifier obtained from the first key device 12. The process of generating the second authentication comparison data is similar to the process of generating the second authentication data. For example, the second authentication comparison data may be: HMAC(QK1, R2||ID B ||ID A ) etc., which will not be elaborated here.

[0108] Among them, after the second authentication comparison data is generated, the second authentication comparison data is compared with the second authentication data, and the process of authenticating the second communication device 13 is the same as the above embodiment, which will not be repeated here.

[0109] Since the present application can generate the second authentication data and the second authentication comparison data based on the second random factor, the security of the authentication process can be further improved.

[0110] For ease of understanding, the bidirectional authentication process provided by this application is explained below through a specific embodiment. Referring to Figure 2, Figure 2 shows a schematic diagram of the first bidirectional authentication process provided by some embodiments, which includes the following steps:

[0111] S201: The first communication device (communication device-A) sends an authentication request to the second communication device (communication device-B), and the authentication request carries the first communication device ID A .

[0112] S202: The second communication device receives the authentication request and returns a challenge message to the first communication device, where the challenge message includes the second communication device ID. B, the second key device identification ID corresponding to the second communication device Y , the first random factor R1.

[0113] S203: The first communication device sends a first key application to the first key device (QKD device-X), and the first key application carries the first communication device ID A and the obtained second key device identification ID corresponding to the second communication device Y .

[0114] S204: The first key device (QKD device-X) and the second key device (QKD device-Y) corresponding to the second key device identifier are key-distributed to generate at least one target key.

[0115] S205: The first key device (QKD device-X) uses the first communication device identifier to encrypt the first target key QK1 and the first target key identifier ID using the first encryption algorithm. QK1 Sent to the first communication device.

[0116] S206: The first communication device uses the first decryption algorithm corresponding to the first encryption algorithm to decrypt the encrypted first target key QK1 and the first target key identifier ID QK1 Decrypt and obtain the decrypted first target key QK1 and the first target key identifier ID QK1 , based on the first target key, the first random factor and the set authentication data encryption algorithm, generate the first authentication data Token1 (such as HMAC (QK1, R1 | | ID A ||ID B )), the first authentication data Token1, the second random factor R2, and the first target key identifier ID QK1 Sent to the second communication device.

[0117] S207: The second communication device generates first authentication comparison data based on the key (QK1) corresponding to the first target key identifier obtained from the second key device, and compares the first authentication comparison data with the first authentication data to see if they are consistent. If they are consistent, the first communication device is authenticated, and based on the second random factor, the set authentication data encryption algorithm and the second target key obtained from the second key device, a second authentication data Token2 (such as HMAC (QK2, R2||ID B ||ID A )), the second authentication data and the second target key identification ID QK2 Sent to the first communication device.

[0118] S208: The first communication device generates second authentication comparison data based on the key QK2 corresponding to the second target key identifier obtained from the first key device, and compares the second authentication comparison data with the second authentication data to see if they are consistent. If they are consistent, the second communication device is authenticated.

[0119] Example 5:

[0120] To improve security, based on the above embodiments, in an embodiment of the present application, the first communication device 11 is further configured to generate a first key authorization code based on the first target key, the second communication device identifier, and the set key authorization code encryption algorithm, and send the first key authorization code to the second communication device 13;

[0121] The second communication device 13 is further configured to send a second key application to the second key device 14, where the second key application carries the first key authorization code, the first target key identifier, and the second communication device identifier;

[0122] The second key device 14 is also used to receive the second key application, and generate a first key authorization comparison code based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm. If the first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sends the second key application, the first target key identifier and the first target key are sent to the second communication device 13 corresponding to the second communication device identifier.

[0123] In a possible implementation, considering that the same key device may serve multiple communication devices at the same time, for example, QKD device-Y can serve communication device B while also serving other communication devices, such as communication device-C. In order to prevent other communication devices such as communication device-C from obtaining the first target key QK1 from QKD device-Y and to ensure the security of the authentication process, the first communication device 11 can also use the first target key QK1 and the second communication device identification ID to obtain the first target key QK1. B And set the key authorization code encryption algorithm, generate the first key authorization code, and send the first key authorization code to the second communication device 13, so that when the second communication device 13 applies for the first key from the second key device 14, it can send the first key authorization code to the second key device 14. The second key device 14 verifies the second communication device 13 based on the first key authorization code. After the verification is passed, the first target key is sent to the second communication device 13, thereby ensuring the security of the authentication process.

[0124] Specifically, when generating the first key authorization code, the first key authorization code can be generated by encrypting and calculating the second communication device identifier based on the first target key and the set key authorization code encryption algorithm. For example, the first key authorization code KeyAuth1 can be: HMAC(QK1, ID B ). Optionally, the password encryption algorithm used in the key authorization code encryption algorithm can be, in addition to HMAC, a block cipher such as Advanced Encryption Standard (AES) and SM4, a stream cipher such as Zu Chongzhi Algorithm (ZUC) and RC4 (Rivest Cipher 4), or an identifiable encryption technology such as AES-CCM (Counter with CBC-MAC), AES-GCM (Galois / Counter Mode), SM4-CCM, and SM4-GCM. Similar to the authentication data and authentication comparison data in the above embodiment, the first key authorization code KeyAuth1 can also be expressed as: E QK1 (ID B ), which will not be described here. In addition, when generating the first key authorization code, the second communication device identification ID B The first key authorization code is generated after encryption calculation based on the first target key and the set key authorization code encryption algorithm together with other obtainable information such as the corresponding session identifier. This application does not specifically limit the generation method of the key authorization code and the information contained therein.

[0125] Optionally, after generating the first key authorization code, the first communication device 11 may send the first key authorization code to the second communication device 13. Exemplarily, the first communication device 11 may send the first target key identification ID to the second communication device 13. QK1 , the first authentication data Token1 and the second random factor R2, and sends the first key authorization code KeyAuth1 to the second communication device 13 together.

[0126] After receiving the first key authorization code, the second communication device 13 can send a second key application to the second key device 14. The second key application can carry the first key authorization code KeyAuth1 and the first target key identification ID QK1 and the second communication device identification ID B .

[0127] Optionally, after receiving the second key application, the second key device 14 may obtain the second communication device identification ID carried in the second key application. B The second key device 14 can identify the key QK1 corresponding to the first target key and the second communication device identifier ID BAnd the set key authorization code encryption algorithm generates the first key authorization comparison code. Among them, the process of generating the key authorization comparison code is similar to the process of generating the key authorization code, which will not be repeated here. For example, the first key authorization comparison code can be expressed as HMAC(QK1, ID B ) or E QK1 (ID B ).

[0128] Optionally, after generating the first key authorization comparison code, the second key device 14 may compare the generated first key authorization comparison code with the received first key authorization code. If the generated first key authorization code is consistent with the received first key authorization code, in order to ensure security, the second key device 14 may further determine whether the communication device identifier used to generate the first key authorization code is the same as the identifier of the communication device to which the second key application is sent. If the communication device identifier used to generate the first key authorization code is the same as the identifier of the communication device to which the second key application is sent, it can be considered that the communication device corresponding to the second communication device identifier is indeed a secure device that requires the first target key, and the first target key and the corresponding first target key identifier can be sent to the second communication device 13 together.

[0129] For ease of understanding, the bidirectional authentication process provided by this application is explained below through a specific embodiment. In this embodiment, the first target key and the second target key are the same key. For ease of description, both are referred to as target keys. Figure 3 shows a schematic diagram of the second bidirectional authentication process provided by some embodiments, and Figure 4 shows a schematic diagram of the third bidirectional authentication process provided by some embodiments. Referring to Figures 3 and 4, the process includes the following steps:

[0130] S300: The first communication device (communication device-A) sends a QKD service registration request to the first key device (QKD device-X). The first key device (QKD device-X) responds to the QKD service registration request and registers the first communication device for the QKD service. Similarly, the second communication device (communication device-B) sends a QKD service registration request to the first key device (QKD device-Y). The second key device (QKD device-Y) responds to the QKD service registration request and registers the second communication device for the QKD service.

[0131] The first communication device and the first key device can be directly connected via a dedicated line within the same security domain, effectively enhancing communication security. The second communication device and the second key device can also be directly connected via a dedicated line within the same security domain. When registering a communication device for QKD services, the communication device and the key device can mutually trust and communicate corresponding communication device information, key device information, information transmission protocol, encryption and decryption algorithms, initial keys, and key update policies, ensuring that quantum keys and other keys are not transmitted in plaintext. The QKD service registration process can utilize existing technologies and will not be further elaborated here.

[0132] S301: The first communication device (communication device-A) sends an authentication request to the second communication device (communication device-B), and the authentication request carries the first communication device ID A .

[0133] S302: The second communication device (communication device-B) receives the authentication request and returns a challenge message to the first communication device, which includes the second communication device ID. B , a first random factor R1, a second key device identification ID corresponding to the second communication device Y .

[0134] S303: The first communication device (communication device-A) sends a first key application to the first key device (QKD device-X) to apply for a quantum key. The first key application carries the first communication device ID A and the obtained second key device identification ID corresponding to the second communication device Y .

[0135] S304: The first key device (QKD device-X) performs key distribution (such as quantum key distribution) with the second key device (QKD device-Y) corresponding to the second key device identifier to generate a target key.

[0136] S305: The first key device (QKD device-X) uses the first communication device identifier to encrypt the target key QK and the target key identifier ID after using the first encryption algorithm. QK Sent to the first communication device (communication device-A).

[0137] Among them, S305 can also be called the quantum key issuance process.

[0138] S306: The first communication device (communication device-A) uses the first decryption algorithm to decrypt the encrypted target key QK and target key identifier ID QK Decrypt and obtain the decrypted target key QK and target key identification ID QKThe first communication device generates the first authentication data Token1 (such as HMAC (QK, R1 | | ID) based on the target key QK, the first random factor R1 and the set authentication data encryption algorithm. A ||ID B )). At the same time, the first communication device can generate a first key authorization code KeyAuth1 (such as HMAC (QK, ID B )), the first communication device sends the first key authorization code KeyAuth1, the first authentication data Token1, the second random factor R2, and the target key identifier (quantum key identifier) ​​ID QK Send (respond) to the second communication device (communication device-B).

[0139] S307: The second communication device (communication device-B) sends a request for obtaining a second key to the second key device (QKD device-Y). The second key request carries the first key authorization code KeyAuth1 and the target key identification ID QK , second communication device identification ID B .

[0140] S308: The second key device (QKD device-Y) receives the second key application, verifies that the first authorization code is valid, and if the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sent the second key application, the target key identifier ID encrypted by the second encryption algorithm will be used. QK and the target key QK are sent to the second communication device.

[0141] Among them, the process of verifying the validity of the first authorization code is: the second key device generates a first key authorization comparison code based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm. If the generated first key authorization comparison code is consistent with the first key authorization code, the first authorization code is determined to be valid.

[0142] It is understandable that if the generated key authorization comparison code is inconsistent with the first key authorization code, the first key authorization code is verified to be invalid and the target key identification ID may not be used. QK and the target key QK are sent to the second communication device.

[0143] Among them, S308 can also be called the quantum key issuance process.

[0144] S309: The second communication device (communication device-B) uses the second decryption algorithm to decrypt the encrypted target key ID QK And the target key QK is decrypted to obtain the decrypted target key identification ID QKThe second communication device generates first authentication comparison data based on the key QK corresponding to the target key identifier, the first random factor R1, and the set authentication data encryption algorithm, and compares the first authentication comparison data with the first authentication data. If the first authentication comparison data is consistent with the first authentication data, the first communication device is authenticated, that is, the authentication result is passed.

[0145] S310: The second communication device (communication device-B) generates the second authentication data Token2 (such as HMAC (QK, R2 || ID) based on the target key QK, the second random factor R2 and the set authentication data encryption algorithm B ||ID A )), the second authentication data Token2 and the target key identifier ID QK Send (respond) to the first communication device.

[0146] S311: The first communication device (communication device-A) generates second authentication comparison data based on the key QK corresponding to the target key identifier, the second random factor R2 and the set authentication data encryption algorithm, and compares the second authentication comparison data with the received second authentication data Token2. If the second authentication comparison data is consistent with the received second authentication data Token2, the second communication device is authenticated, that is, the authentication result is passed.

[0147] Please refer to Figure 4 again. The communication device may include a key authorization code generation module, a QKD service registration module, and a quantum key application module. The key authorization code can be generated based on the key authorization code generation module. The QKD service registration request is sent to the key device based on the QKD service registration module to complete the first mutual trust and communication between the communication device and the QKD device. The key application module sends a key application to the key device based on the quantum key application module, etc., which will not be repeated here. The key device (such as a QKD device) may include a key authorization code verification module. The key authorization code can be verified to be valid based on the key authorization code generation module. This will not be repeated here.

[0148] The cryptographic encryption algorithm used in the authentication data encryption algorithm in this application is not limited to a keyed hash function (HMAC), nor does it require pre-sharing of keys between communication devices. Communication devices do not need to have QKD capabilities, but rather use QKD services through QKD devices. This requires minimal modification to communication devices and has a wide range of applications.

[0149] The quantum key (target key) in this application can be used for encryption and decryption, and can also be used as a symmetric key when generating authentication data by applying for a new real-time quantum key from the QKD device each time two-way authentication is required. The target key in this application can be deleted after a two-way authentication is completed and is only used for one two-way authentication, achieving "one authentication, one key", which can prevent attackers from stealing key information and has higher security than using the same key for a long time.

[0150] In addition, since the two communicating parties in this application do not need to share keys in advance or pre-share keys with a trusted third party, but instead obtain a real-time target key (such as a quantum key) that is consistent between both parties from their respective key devices (QKD devices), the difficulty of key management is not affected even if the number of communicating devices increases. The two-way authentication method of this application can be applied to two-way authentication between communication devices such as data centers and high-security dedicated line nodes.

[0151] For ease of understanding, the bidirectional authentication process provided by this application is explained below using a specific embodiment. In this embodiment, the first target key and the second target key are different keys. Referring to Figure 5, Figure 5 shows a schematic diagram of a fourth bidirectional authentication process provided by some embodiments, which includes the following steps:

[0152] S500: The first communication device (communication device-A) sends a QKD service registration request to the first key device (QKD device-X). The first key device (QKD device-X) responds to the QKD service registration request and registers the first communication device for the QKD service. Similarly, the second communication device (communication device-B) sends a QKD service registration request to the first key device (QKD device-Y). The second key device (QKD device-Y) responds to the QKD service registration request and registers the second communication device for the QKD service.

[0153] S501: The first communication device (communication device-A) sends an authentication request to the second communication device (communication device-B), and the authentication request carries the first communication device ID A .

[0154] S502: The second communication device (communication device-B) receives the authentication request and returns a challenge message to the first communication device, which includes the second communication device ID. B , a first random factor R1, a second key device identification ID corresponding to the second communication device Y .

[0155] S503: The first communication device (communication device-A) sends a first key application to the first key device (QKD device-X) to apply for a quantum key. The first key application carries the first communication device IDA and the obtained second key device identification ID corresponding to the second communication device Y .

[0156] S504: The first key device (QKD device-X) and the second key device (QKD device-Y) corresponding to the second key device identifier are key-distributed to generate at least one target key.

[0157] S505: The first key device (QKD device-X) uses the first communication device identifier to encrypt the first target key QK1 and the first target key identifier ID using the first encryption algorithm. QK1 Sent to the first communication device (communication device-A).

[0158] S506: The first communication device (communication device-A) receives the first target key QK1 and the first target key identifier ID encrypted using the set first encryption algorithm. QK1 After that, the first decryption algorithm corresponding to the first encryption algorithm can be used to decrypt the first target key QK1 and the first target key identifier ID QK1 After decryption, the decrypted first target key QK1 and the first target key identifier ID are obtained. QK1 The first communication device generates the first authentication data Token1 (such as HMAC (QK1, R1 | | ID A ||ID B )). At the same time, the first communication device can generate a first key authorization code KeyAuth1 (such as HMAC (QK1, ID B )), the first communication device sends the first key authorization code KeyAuth1, the first authentication data Token1, the second random factor R2, and the target key identification ID QK Sent to the second communication device (communication device-B).

[0159] S507: The second communication device (communication device-B) sends a second key application to the second key device (QKD device-Y), and the second key application carries the first key authorization code KeyAuth1 and the first target key identification ID QK1 , second communication device identification ID B .

[0160] The second communication device can use the set second encryption algorithm to encrypt the first key authorization code KeyAuth1 and the first target key identification ID QK1 , second communication device identification ID BEncrypt the encrypted first key authorization code KeyAuth1 and the first target key identification ID QK1 , second communication device identification ID B Sent to the second key device.

[0161] S508: The second key device (QKD device-Y) receives the second key application, verifies that the first authorization code is valid, and if the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sent the second key application, the first target key identifier ID encrypted by the second encryption algorithm is used. QK1 and the first target key QK1 are sent to the second communication device, and at the same time, the second target key identifier ID encrypted by the second encryption algorithm can also be sent to the second communication device. QK2 and the second target key QK2 are sent to the second communication device.

[0162] The second key device can use a second decryption algorithm corresponding to the second encryption algorithm to decrypt the first key authorization code KeyAuth1 and the first target key identification ID encrypted by the second encryption algorithm. QK1 , second communication device identification ID B Decrypt and obtain the decrypted first key authorization code KeyAuth1 and the first target key identification ID QK1 , second communication device identification ID B .

[0163] S509: The second communication device (communication device-B) uses the second decryption algorithm to decrypt the encrypted first target key ID QK1 , first target key QK1, second target key identification ID QK2 , decrypt the second target key QK2 to obtain the decrypted first target key identification ID QK1 , first target key QK1, second target key identification ID QK2 , second target key QK2. The second communications device generates first authentication comparison data based on the key QK1 corresponding to the first target key identifier, the first random factor R1, and the set authentication data encryption algorithm, and compares the first authentication comparison data with the first authentication data. If the first authentication comparison data is consistent with the first authentication data, the first communications device is authenticated.

[0164] S510: The second communication device (communication device-B) generates a second authentication data Token2 (such as HMAC (QK2, R2 || ID) based on the second target key QK2, the second random factor R2 and the set authentication data encryption algorithm B ||ID A)). At the same time, the second communication device can generate a second key authorization code KeyAuth2 (such as HMAC (QK2, ID A )), the second key authorization code KeyAuth2, the second authentication data Token2 and the second target key identification ID QK2 Sent to the first communication device.

[0165] S511: The first communication device (communication device-A) sends a third key application to the first key device (QKD device-X), and the third key application carries the second key authorization code KeyAuth2 and the second target key identification ID QK2 , first communication device identification ID A .

[0166] The first communication device can use the first encryption algorithm to encrypt the second key authorization code KeyAuth2 and the second target key identification ID QK2 , first communication device identification ID A Encrypt the encrypted second key authorization code KeyAuth2 and the second target key identification ID QK2 , first communication device identification ID A Sent to the first key device.

[0167] S512: The first key device (QKD device-X) receives the third key application, verifies that the second authorization code is valid, and if the communication device identifier used to generate the second key authorization comparison code is the same as the identifier of the communication device that sent the third key application, the second target key identifier ID encrypted by the first encryption algorithm is used. QK2 and the second target key QK2 are sent to the first communication device.

[0168] The process for verifying the validity of the second key authorization code is as follows: the first key device generates a second key authorization comparison code based on the key corresponding to the second target key identifier, the first communication device identifier, and the set key authorization code encryption algorithm. If the generated second key authorization comparison code is consistent with the second key authorization code, the second key authorization code is determined to be valid. The process for verifying the validity of the second key authorization code is similar to the process for verifying the validity of the first key authorization code and is not further described here.

[0169] The first key device can use the first decryption algorithm corresponding to the first encryption algorithm to decrypt the second key authorization code KeyAuth2 and the second target key identification ID encrypted by the first encryption algorithm. QK2 , first communication device identification ID A Decrypt and obtain the decrypted second key authorization code KeyAuth2 and the second target key identification IDQK2 , first communication device identification ID A .

[0170] S513: The first communication device (communication device-A) may use a first decryption algorithm corresponding to the first encryption algorithm to decrypt the encrypted second target key identifier ID QK2 and the second target key QK2 to decrypt and obtain the decrypted second target key ID QK2 and the second target key QK2. The first communications device generates second authentication comparison data based on the key QK2 corresponding to the second target key identifier, the second random factor R2, and the set authentication data encryption algorithm, and compares the second authentication comparison data with the received second authentication data Token2. If the second authentication comparison data is consistent with the received second authentication data Token2, the second communications device is authenticated.

[0171] Example 6:

[0172] Based on the same technical concept, the present application provides a two-way authentication method based on any of the above-described systems, the method being applied to a first communication device. Referring to FIG6 , FIG6 shows a schematic diagram of a fifth two-way authentication process provided in some embodiments, the process comprising the following steps:

[0173] S601: Send a first key application to a first key device, where the first key application carries a first communication device identifier and a second key device identifier corresponding to a second communication device; perform key distribution between the first key device and a second key device corresponding to the second key device identifier to generate at least one target key.

[0174] S602: Receive the first target key and the first target key identifier sent by the first key device; generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device; enable the second communication device to generate first authentication comparison data based on the key of the first target key identifier obtained from the second key device, and enable the second communication device to authenticate the first communication device based on the first authentication comparison data and the first authentication data. If the authentication is successful, enable the second communication device to generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device.

[0175] S603: Receive the second authentication data and the second target key identifier sent by the second communication device, generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0176] In a possible implementation manner, before sending the first key application to the first key device, the method further includes:

[0177] An authentication request is sent to the second communication device, where the authentication request carries the first communication device identifier.

[0178] In a possible implementation, generating first authentication data based on the first target key includes:

[0179] First authentication data is generated based on the first target key, a first random factor received from the second communication device, and a set authentication data encryption algorithm.

[0180] In a possible implementation, after receiving the first target key and the first target key identifier sent by the first key device and before receiving the second authentication data and the second target key identifier sent by the second communication device, the method further includes:

[0181] Sending the obtained second random factor to the second communication device;

[0182] The generating second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device includes:

[0183] Second authentication comparison data is generated based on the second random factor, the set authentication data encryption algorithm, and the key corresponding to the second target key identifier obtained from the first key device.

[0184] In a possible implementation, after receiving the first target key and the first target key identifier sent by the first key device and before receiving the second authentication data and the second target key identifier sent by the second communication device, the method further includes:

[0185] A first key authorization code is generated based on the first target key, the second communication device identifier, and a set key authorization code encryption algorithm, and the first key authorization code is sent to the second communication device.

[0186] In one possible implementation, after receiving the second authentication data and the second target key identifier sent by the second communication device, generating second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, the method further includes:

[0187] If the first target key and the second target key are different keys, a third key application is sent to the first key device, where the third key application carries the second target key identifier, the first communication device identifier, and the second key authorization code received from the second communication device.

[0188] In a possible implementation, after receiving the target key and the target key identifier sent by the first key device, the method further includes:

[0189] If the target key and target key identifier encrypted by the first encryption algorithm are received from the first key device, the encrypted target key and target key identifier are decrypted using the first decryption algorithm corresponding to the first encryption algorithm to obtain the decrypted target key and target key identifier.

[0190] Based on the same technical concept, the present application provides a two-way authentication method based on any of the above-described systems, the method being applied to a second communication device. Referring to FIG. 7 , FIG. 7 shows a schematic diagram of a sixth two-way authentication process provided in some embodiments, the process comprising the following steps:

[0191] S701: Generate first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, and authenticate the first communication device based on the first authentication comparison data and the first authentication data received from the first communication device.

[0192] S702: If the authentication is successful, generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device; enable the first communication device to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and enable the first communication device to authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0193] In a possible implementation, before generating the first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, the method further includes:

[0194] receiving an authentication request sent by the first communication device, where the authentication request carries an identifier of the first communication device;

[0195] Return challenge information to the first communication device, where the challenge information includes a second communication device identifier and a second key device identifier corresponding to the second communication device.

[0196] In a possible implementation, the challenge information includes a second communication device identifier, a second key device identifier corresponding to the second communication device, and the obtained first random factor;

[0197] The generating of first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device includes:

[0198] First authentication comparison data is generated based on the first random factor, a set authentication data encryption algorithm, and a key corresponding to the first target key identifier obtained from the second key device.

[0199] In one possible implementation, generating the second authentication data based on the second target key obtained from the second key device includes:

[0200] Second authentication data is generated based on the second target key obtained from the second key device, the second random factor received from the first communication device, and the set authentication data encryption algorithm.

[0201] In a possible implementation, before generating the first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, the method further includes:

[0202] A second key application is sent to the second key device, where the second key application carries the first key authorization code, the first target key identifier, and the second communication device identifier.

[0203] In a possible implementation, after the authentication is passed, the method further includes:

[0204] If the first target key and the second target key are different keys, a second key authorization code is generated based on the second target key, the first communication device identifier and the set key authorization code encryption algorithm, and the second key authorization code is sent to the first communication device.

[0205] Based on the same technical concept, the present application provides a two-way authentication method based on any of the above-described systems, the method being applied to a first key device. Referring to FIG8 , FIG8 shows a schematic diagram of a seventh two-way authentication process provided by some embodiments, the process comprising the following steps:

[0206] S801: Receive a first key application sent by a first communication device, where the first key application carries a first communication device identifier and a second key device identifier corresponding to a second communication device.

[0207] S802: Perform key distribution with the second key device corresponding to the second key device identifier to generate at least one target key.

[0208] S803: Based on the first communication device identifier, send any first target key and a first target key identifier to the first communication device.

[0209] In one possible implementation, the method further includes:

[0210] receiving a third key application sent by the first communication device, wherein the third key application carries the second key authorization code, the second target key identifier, and the first communication device identifier;

[0211] Based on the key corresponding to the second target key identifier, the first communication device identifier and the set key authorization code encryption algorithm, a second key authorization comparison code is generated. If the second key authorization comparison code is consistent with the second key authorization code, and the communication device identifier used to generate the second key authorization comparison code is the same as the identifier of the communication device that sends the third key application, the second target key identifier and the second target key are sent to the first communication device corresponding to the first communication device identifier.

[0212] In one possible implementation, sending the target key identifier and the target key to the first communication device includes:

[0213] The target key and the target key identifier are encrypted using a set first encryption algorithm, and the encrypted target key and the target key identifier are sent to the first communication device.

[0214] Based on the same technical concept, the present application provides a two-way authentication method based on any of the above-described systems, the method being applied to a second key device. Referring to FIG. 9 , FIG. 9 shows a schematic diagram of an eighth two-way authentication process provided by some embodiments, the process comprising the following steps:

[0215] S901: Receive a second key application sent by a second communication device, where the second key application carries a first key authorization code, a first target key identifier, and a second communication device identifier.

[0216] S902: Based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm, a first key authorization comparison code is generated. If the generated first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sends the second key application, the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

[0217] Example 7:

[0218] Based on the same technical concept, the present application provides a two-way authentication device based on any of the above-mentioned systems, which is applied to a first communication device. Referring to FIG10 , FIG10 shows a schematic diagram of a first two-way authentication device provided in some embodiments. The process includes the following steps:

[0219] The first sending module 101 is configured to send a first key application to a first key device, wherein the first key application carries a first communication device identifier and a second key device identifier corresponding to a second communication device; thereby enabling the first key device to perform key distribution with a second key device corresponding to the second key device identifier to generate at least one target key;

[0220] The first receiving module 102 is configured to receive a first target key and a first target key identifier sent by the first key device; generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device; cause the second communication device to generate first authentication comparison data based on the key of the first target key identifier obtained from the second key device, and cause the second communication device to authenticate the first communication device based on the first authentication comparison data and the first authentication data; if the authentication is successful, cause the second communication device to generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device;

[0221] The first authentication module 103 is used to receive the second authentication data and the second target key identifier sent by the second communication device, generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0222] In a possible implementation, the first sending module 101 is further configured to send an authentication request to the second communication device, where the authentication request carries the first communication device identifier.

[0223] In a possible implementation, the first receiving module 102 is specifically configured to generate first authentication data based on the first target key, a first random factor received from the second communication device, and a set authentication data encryption algorithm.

[0224] In a possible implementation, the first authentication module 103 is further configured to send the obtained second random factor to the second communication device;

[0225] Second authentication comparison data is generated based on the second random factor, the set authentication data encryption algorithm, and the key corresponding to the second target key identifier obtained from the first key device.

[0226] In a possible implementation, the first authentication module 103 is further configured to generate a first key authorization code based on the first target key, the second communication device identifier, and a set key authorization code encryption algorithm, and send the first key authorization code to the second communication device.

[0227] Based on the same technical concept, the present application provides a two-way authentication device based on any of the above-mentioned systems, which is applied to a second communication device. Referring to FIG11 , FIG11 shows a schematic diagram of a second two-way authentication device provided in some embodiments. The process includes the following steps:

[0228] A second authentication module 111 is configured to generate first authentication comparison data based on a key corresponding to a first target key identifier obtained from a second key device, and authenticate the first communication device based on the first authentication comparison data and the first authentication data received from the first communication device;

[0229] The second sending module 112 is used to generate second authentication data based on the second target key obtained from the second key device if the authentication is passed, and send the second authentication data and the second target key identifier to the first communication device; enable the first communication device to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and enable the first communication device to authenticate the second communication device based on the second authentication comparison data and the second authentication data.

[0230] In a possible implementation, the second authentication module 111 is further configured to receive an authentication request sent by the first communication device, where the authentication request carries an identifier of the first communication device;

[0231] Return challenge information to the first communication device, where the challenge information includes a second communication device identifier and a second key device identifier corresponding to the second communication device.

[0232] In one possible embodiment, the second authentication module 111 is specifically used to generate first authentication comparison data based on the first random factor, the set authentication data encryption algorithm, and the key corresponding to the first target key identifier obtained from the second key device if the challenge information includes a second communication device identifier, a second key device identifier corresponding to the second communication device, and an obtained first random factor.

[0233] In a possible implementation, the second sending module 112 is specifically configured to generate second authentication data based on the second target key obtained from the second key device, the second random factor received from the first communication device, and a set authentication data encryption algorithm.

[0234] In a possible implementation, the second authentication module 111 is further configured to send a second key application to the second key device, where the second key application carries the first key authorization code, the first target key identifier, and the second communication device identifier.

[0235] Based on the same technical concept, the present application provides a two-way authentication device based on any of the above-mentioned systems, wherein the device is applied to a first key device. Referring to FIG12 , FIG12 shows a schematic diagram of a third two-way authentication device provided in some embodiments. The process includes the following steps:

[0236] The second receiving module 121 is configured to receive a first key application sent by a first communication device, where the first key application carries the first communication device identifier and a second key device identifier corresponding to a second communication device;

[0237] A key generation module 122, configured to perform key distribution with a second key device corresponding to the second key device identifier, and generate at least one target key;

[0238] The third sending module 123 is configured to send any first target key and a first target key identifier to the first communication device based on the first communication device identifier.

[0239] Based on the same technical concept, the present application provides a two-way authentication device based on any of the above-mentioned systems, wherein the device is applied to a second key device. Referring to FIG13 , FIG13 shows a schematic diagram of a fourth two-way authentication device provided in some embodiments. The process includes the following steps:

[0240] The third receiving module 131 is configured to receive a second key application sent by a second communication device, where the second key application carries a first key authorization code, a first target key identifier, and a second communication device identifier;

[0241] The comparison module 132 is used to generate a first key authorization comparison code based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm. If the generated first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device that sends the second key application, the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

[0242] Example 8:

[0243] Based on the same technical concept, the present application also provides an electronic device. FIG14 shows a schematic structural diagram of an electronic device provided in some embodiments. As shown in FIG14 , the electronic device includes: a processor 141, a communication interface 142, a memory 143, and a communication bus 144, wherein the processor 141, the communication interface 142, and the memory 143 communicate with each other via the communication bus 144;

[0244] The memory 143 stores a computer program. When the program is executed by the processor 141, the processor 141 executes the computer program stored in the memory to implement the steps of any of the above-mentioned two-way authentication methods, which will not be repeated here.

[0245] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0246] The communication interface 142 is used for communication between the electronic device and other devices.

[0247] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. Alternatively, the memory may be at least one storage device located away from the processor.

[0248] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0249] Example 9:

[0250] Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements the steps of the two-way authentication method described in any of the above method embodiments, which will not be repeated here.

[0251] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CDs, DVDs, BDs, HVDs, etc., and semiconductor storage such as ROMs, EPROMs, EEPROMs, non-volatile memories (NAND FLASH), solid-state drives (SSDs), etc.

[0252] Based on the same technical concept, the present application provides a computer program product, which includes: computer program code, which, when executed on a computer, enables the computer to implement the steps of the two-way authentication evaluation method described in any of the above-mentioned method embodiments applied to electronic devices, which will not be repeated here.

[0253] The above embodiments may be implemented in whole or in part through software, hardware, firmware, or any combination thereof, and may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions that, when loaded and executed on a computer, fully or partially generate the processes or functions described in the embodiments of the present application.

[0254] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0255] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each flow and / or box in the flow chart and / or block diagram, as well as the combination of the flow chart and / or box in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more flow charts and / or one or more boxes in the block diagram.

[0256] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0257] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0258] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A two-way authentication system, the system comprising: The first communication device is configured to send a first key application to the first key device, wherein the first key application carries the first communication device identifier and the obtained second key device identifier corresponding to the second communication device; The first key device is used to perform key distribution with a second key device corresponding to the second key device identifier to generate at least one target key; and based on the first communication device identifier, send any first target key and the first target key identifier to the first communication device; The first communication device is further configured to generate first authentication data based on the first target key, and send the first authentication data and the first target key identifier to the second communication device; The second communication device is further configured to generate first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, authenticate the first communication device based on the first authentication comparison data and the first authentication data, and if the authentication is successful, generate second authentication data based on the second target key obtained from the second key device, and send the second authentication data and the second target key identifier to the first communication device; The first communication device is further used to generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

2. The system according to claim 1, wherein the first communication device is further configured to send an authentication request to the second communication device, wherein the authentication request carries the first communication device identifier; The second communication device is further configured to receive the authentication request and return challenge information to the first communication device, wherein the challenge information includes a second communication device identifier and a second key device identifier corresponding to the second communication device.

3. The system according to claim 1 or 2, wherein the second communication device is further configured to send the obtained first random factor to the first communication device; The first communication device is specifically configured to: The set authentication data encryption algorithm generates the first authentication data; The second communication device is specifically used to generate first authentication comparison data based on the first random factor, a set authentication data encryption algorithm, and a key corresponding to the first target key identifier obtained from the second key device.

4. The system according to claim 1 or 2, wherein the first communication device is further configured to send the obtained second random factor to the second communication device; The second communication device is specifically configured to generate second authentication data based on the second random factor, a set authentication data encryption algorithm, and a second target key obtained from the second key device; The first communication device is specifically used to generate second authentication comparison data based on the second random factor, a set authentication data encryption algorithm, and a key corresponding to the second target key identifier obtained from the first key device.

5. The system according to claim 1, wherein the first communication device is further configured to generate a first key authorization code based on the first target key, the second communication device identifier, and a set key authorization code encryption algorithm, and send the first key authorization code to the second communication device; The second communication device is further used to send a second key application to the second key device, where the second key application carries the first key authorization code, the first target key identifier, and the second communication device identifier; The second key device is also used to receive the second key application, and generate a first key authorization comparison code based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm. If the first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device sending the second key application, the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

6. According to the system of claim 1, the first target key and the second target key are the same key; or, the first target key and the second target key are different keys.

7. The system according to claim 6, if the first target key and the second target key are different keys, the second communication device is further used to generate a second key authorization code based on the second target key, the first communication device identifier and the set key authorization code encryption algorithm, and send the second key authorization code to the first communication device; The first communication device is further used to send a third key application to the first key device, wherein the third key application carries the second key authorization code, the second target key identifier, and the first communication device identifier; The first key device is also used to receive the third key application, and generate a second key authorization comparison code based on the key corresponding to the second target key identifier, the first communication device identifier and the set key authorization code encryption algorithm. If the second key authorization comparison code is consistent with the second key authorization code, and the communication device identifier used to generate the second key authorization comparison code is the same as the identifier of the communication device sending the third key application, the second target key identifier and the second target key are sent to the first communication device corresponding to the first communication device identifier.

8. The system according to claim 1 or 6, wherein the first key device is specifically used to encrypt the target key and the target key identifier by using a set first encryption algorithm, and send the encrypted target key and the target key identifier to the first communication device; The first communication device is also used to receive the encrypted target key and target key identifier, use a first decryption algorithm corresponding to the first encryption algorithm to decrypt the encrypted target key and target key identifier, and obtain a decrypted target key and target key identifier.

9. A two-way authentication method based on the system according to any one of claims 1 to 8, the method being applied to a first communication device, the method comprising: Sending a first key application to the first key device, wherein the first key application carries the first communication device identifier and the obtained second key device identifier corresponding to the second communication device; Distribute keys between the first key device and a second key device corresponding to the second key device identifier to generate at least one target key; Receiving a first target key and a first target key identifier sent by the first key device; generating first authentication data based on the first target key, and sending the first authentication data and the first target key identifier to the second communication device; The second communication device is configured to receive the second The first communication device generates first authentication comparison data based on the key of the first target key identifier obtained from the key device, and enables the second communication device to authenticate the first communication device based on the first authentication comparison data and the first authentication data. If the authentication is successful, the second communication device generates second authentication data based on the second target key obtained from the second key device, and sends the second authentication data and the second target key identifier to the first communication device; Receive second authentication data and a second target key identifier sent by the second communication device, generate second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and authenticate the second communication device based on the second authentication comparison data and the second authentication data.

10. A two-way authentication method based on the system according to any one of claims 1 to 8, the method being applied to a second communication device, the method comprising: Generate first authentication comparison data based on the key corresponding to the first target key identifier obtained from the second key device, and authenticate the first communication device based on the first authentication comparison data and the first authentication data received from the first communication device; If the authentication is successful, generating second authentication data based on the second target key obtained from the second key device, and sending the second authentication data and the second target key identifier to the first communication device; The first communication device generates second authentication comparison data based on the key corresponding to the second target key identifier obtained from the first key device, and the first communication device authenticates the second communication device based on the second authentication comparison data and the second authentication data.

11. A two-way authentication method based on the system according to any one of claims 1 to 8, the method being applied to a first key device, the method comprising: Receiving a first key application sent by a first communication device, wherein the first key application carries a first communication device identifier and a second key device identifier corresponding to a second communication device; Perform key distribution with a second key device corresponding to the second key device identifier to generate at least one target key; Based on the first communication device identifier, any first target key and a first target key identifier are sent to the first communication device.

12. A two-way authentication method based on the system according to any one of claims 1 to 8, the method being applied to a second key device, the method comprising: Receive a second key application sent by a second communication device, where the second key application carries a first key authorization code, a first target key identifier, and a second communication device identifier; Based on the key corresponding to the first target key identifier, the second communication device identifier and the set key authorization code encryption algorithm, a first key authorization comparison code is generated; if the first key authorization comparison code is consistent with the first key authorization code, and the communication device identifier used to generate the first key authorization comparison code is the same as the identifier of the communication device sending the second key application, the first target key identifier and the first target key are sent to the second communication device corresponding to the second communication device identifier.

Images