CN104954129B

CN104954129B - Method for authenticating entities and device

Info

Publication number: CN104954129B
Application number: CN201410126144.1A
Authority: CN
Inventors: 杜志强; 胡亚楠; 李琴; 王月辉
Original assignee: China Iwncomm Co Ltd
Current assignee: China Iwncomm Co Ltd
Priority date: 2014-03-31
Filing date: 2014-03-31
Publication date: 2019-09-27
Anticipated expiration: 2034-03-31
Also published as: CN104954129A

Abstract

The present invention relates to method for authenticating entities and device, method includes: that entity A generates random number N_AAnd issue entity B；Entity B generates random number N_BAnd ZSEED_B, computation key MKA | | KEA | | KIA, ciphertext EncData_B, Message Authentication Code MAC_B, send N_B||N_A||EncData_B||MAC_BIt is verified to entity A；Entity A generates random number ZSEED_A, calculate ciphertext EncData_A, Message Authentication Code MAC_A, shared secret Z, master key MK, message identification mark MacTag_A, send N_A||N_B||EncData_A||MAC_A||MacTag_AIt is verified to entity B；Entity B calculates Z, MK, calculates MacTag_AAnd with the MacTag that receives_ACompare, if equal, then it is assumed that entity A is legal；Entity B calculates message identification mark MacTag_BAnd issue entity A；Entity A calculates MacTag_BAnd with the MacTag that receives_BCompare, if equal, then it is assumed that entity B is legal.The present invention identifies and establishes master key between realizing network entity, while determining the identity of other side.

Description

Method for authenticating entities and device

Technical field

The invention belongs to technical field of network security more particularly to method for authenticating entities and device.

Background technique

For communication network, such as local area network WLAN, wireless sensor network WSN, near-field communication NFC, radio frequency identification RFID, personal area network WPAN etc. are subject to the attack such as forge, eavesdrop, reset in communication, therefore must solve to lead to before a communication Believe that bipartite identity identifies problem, to ensure the legitimacy of communicating pair identity.Currently, based on cryptographic algorithm, especially It is not confirmed to the identity for identifying both sides in the authentication schemes based on symmetric cryptographic algorithm due to usual in discrimination process, And cause to identify even if identity and pass through, it can only also determine that other side possesses some shared secret, but actually cannot still determine Whom other side is actually, and there are some potential safety problemss.

Summary of the invention

In order to solve the above technical problems in background technology, it is necessary to which a kind of method for authenticating entities and dress are provided It sets.

A kind of method for authenticating entities, for having shared wildcard PSK and mutually knowing the entity A of other side's identity Identity identification is carried out between entity B, which is characterized in that the described method includes:

Step 1, entity A generate random number N_A, and it is sent to entity B.

Step 2, entity B receive N_AAfterwards, random number N is generated_BWith for the random number ZSEED as key seed_B, calculate Key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC(KEA,N_B||N_A||ID_B|| ID_A||ZSEED_B), calculate Message Authentication Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), entity B sends N_B||N_A|| EncData_B||MAC_BTo entity A, wherein MKA is authentication key, and KEA is Message Encryption key, and KIA is that message integrity is close Key, KDF1 are a kind of Key derivation algorithm, ID_AFor the identity of entity A, ID_BFor the identity of entity B, ENC is one kind Encryption Algorithm, MAC1 are a kind of Message Authentication Code calculation method；

Step 3, entity A receive N_B||N_A||EncData_B||MAC_BAfter verified, if verifying is incorrect, terminate mirror Not；

Step 4, entity A are generated for the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA,N_A||N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), meter Calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), send N_A||N_B||EncData_A||MAC_A||MacTag_AIt gives Entity B, wherein KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message SN, and " ⊕ " is indicated by bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm；

Step 5, entity B receive N_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, if verifying is incorrect, Then terminate identification；

Step 6, entity B calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A, ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if equal, then it is assumed that entity A identity is legal；If unequal, terminate and identify；Wherein, KDF2 is A kind of Key derivation algorithm；

Step 7, entity B calculate message identification mark MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A), and By MacTag_BIt is sent to entity A, wherein MsgID2 is a message SN；

Step 8, entity A receive MacTag_BAfterwards, message identification mark MacTag is calculated first_B=MAC2(MK,MsgID2|| ID_B||ID_A||N_B||N_A), the MacTag that then will be calculated_BWith the MacTag received_BIt is compared, if equal, recognizes It is legal for entity B identity.

When a kind of entity A and entity B carry out identity identification, the working method of entity A, wherein entity A has and entity B Between wildcard PSK and know the identity of entity B, which is characterized in that the described method includes:

Generate random number N_A, and it is sent to entity B；

Receive the N that entity B is sent_B||N_A||EncData_B||MAC_BAfter verified, if verifying is incorrect, terminate mirror Not；

It generates for the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC(KEA,N_A||N_B||ID_A ||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), calculating shared secret Z= ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2 (MK,MsgID1||ID_A||ID_B||N_A||N_B), send N_A||N_B||EncData_A||MAC_A||MacTag_ATo entity B；

Receive the MacTag that entity B is sent_BAfterwards, message identification mark MacTag is calculated first_B=MAC2(MK,MsgID2|| ID_B||ID_A||N_B||N_A), the MacTag that then will be calculated_BWith the MacTag received_BIt is compared, if equal, recognizes It is legal for entity B identity；

Wherein, ID_AFor the identity of entity A, ID_BFor the identity of entity B, ENC is a kind of Encryption Algorithm, MAC1 For a kind of Message Authentication Code calculation method, KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message SN, and " ⊕ " is indicated By bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm；Wherein, KDF2 is a kind of Key derivation algorithm, and MsgID2 is One message SN.

When a kind of entity A and entity B carry out identity identification, the working method of entity B, wherein entity B has and entity A Between wildcard PSK and know the identity of entity A, which is characterized in that the described method includes:

Receive the N that entity A is sent_AAfterwards, random number N is generated_BWith for the random number ZSEED as key seed_B, calculate Key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC(KEA,N_B||N_A||ID_B|| ID_A||ZSEED_B), calculate Message Authentication Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), send N_B||N_A||EncData_B| |MAC_BTo entity A；

Receive the N that entity A is sent_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, if verifying is incorrect, Then terminate identification；

Calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculating disappears Cease identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), and with the MacTag that receives_AIt is compared, If unequal, terminate and identify；If equal, then it is assumed that entity A identity is legal, and calculates message identification mark MacTag_B= MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A), by MacTag_BIt is sent to entity A.

Wherein, MKA is authentication key, and KEA is Message Encryption key, and KIA is message integrity key, and KDF1 is a kind of close Key derives algorithm, ID_AFor the identity of entity A, ID_BFor the identity of entity B, ENC is a kind of Encryption Algorithm, and MAC1 is A kind of Message Authentication Code calculation method, KDF2 be a kind of Key derivation algorithm, MsgID1 be a message SN, " ⊕ " indicate by Bit exclusive or, MAC2 are a kind of Message Authentication Code generating algorithm, and KDF2 is a kind of Key derivation algorithm, and MsgID2 is a message sequence Row number.

A kind of device, for carrying out identity identification with another device, described device includes storage unit, processing unit and receipts Bill member, it is characterised in that:

Storage unit is used to store the identity of wildcard PSK and another device between another device Mark；

Processing unit is for generating random number N_A；

Transmit-Receive Unit is used for N_AIt is sent to another device, and for receiving the N that another device is sent_B||N_A| |EncData_B||MAC_B；

Processing unit is also used to the N sent to another device_B||N_A||EncData_B||MAC_BIt is verified, if testing It demonstrate,proves incorrect, then terminates identification；

Processing unit is also used to generate the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC(KEA, N_A||N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), it calculates shared Secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A =MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), generate N_A||N_B||EncData_A||MAC_A||MacTag_A；

Transmit-Receive Unit is also used to send N_A||N_B||EncData_A||MAC_A||MacTag_ATo another device, and it is used for Receive the MacTag that another device is sent_B；

Processing unit is also used to calculate message identification mark MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B|| N_A), the MacTag that then will be calculated_BThe MacTag sent with another device_BIt is compared, if equal, then it is assumed that Another device identity is legal；

Wherein, ID_AFor the identity of described device, ID_BFor the identity of another device, ENC is a kind of encryption Algorithm, MAC1 are a kind of Message Authentication Code calculation method, and KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message sequence Number, " ⊕ " indicates that, by bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm；Wherein, KDF2 is a kind of calculation of key derivation Method, MsgID2 are a message SN.

Transmit-Receive Unit is for receiving the N that another device is sent_A；

Processing unit is for generating random number N_BWith the random number ZSEED as key seed_B, computation key MKA | | KEA | |KIA=KDF1(N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC(KEA,N_B||N_A||ID_B||ID_A||ZSEED_B), Calculate Message Authentication Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), and generate N_B||N_A||EncData_B||MAC_B；

Transmit-Receive Unit is also used to send N to another device_B||N_A||EncData_B||MAC_B, and it is described for receiving The N that another device is sent_A||N_B||EncData_A||MAC_A||MacTag_A；

Processing unit is also used to the N sent to another device_A||N_B||EncData_A||MAC_A||MacTag_AIt is tested Card, if verifying is incorrect, terminates identification；

Processing unit is also used to calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z, ID_A,ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if unequal, terminate and identify；If equal, then it is assumed that another device identity is legal, and counts Calculate message identification mark MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A)；

Transmit-Receive Unit is also used to send MacTag to another device_B；

Wherein, MKA is authentication key, and KEA is Message Encryption key, and KIA is message integrity key, and KDF1 is a kind of close Key derives algorithm, ID_AFor the identity of another device, ID_BFor the identity of described device, ENC is a kind of encryption calculation Method, MAC1 are a kind of Message Authentication Code calculation method, and KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message SN, " ⊕ " is indicated by bit exclusive or, and MAC2 is a kind of Message Authentication Code generating algorithm, and KDF2 is a kind of Key derivation algorithm, MsgID2 For a message SN.

The present invention includes following advantage:

1) two-way identification between two network entities can be achieved and establish master key for protecting subsequent communications data；

2) identity of other side is determined while identifying.

Detailed description of the invention

Fig. 1 is the structural schematic diagram of solid identification system provided by the present invention；

Fig. 2 is the structural schematic diagram for corresponding to the device of entity A in the present invention；

Fig. 3 is the structural schematic diagram for corresponding to the device of entity B in the present invention.

Specific embodiment

Referring to Figure 1, the present invention provides a kind of method for authenticating entities, when this method is implemented, between entity A and entity B It has shared wildcard (Pre-Shared key, PSK) and has mutually known the identity of other side, the identity of entity A For ID_A, the identity of entity B is ID_B, method includes the following steps:

Step 1, entity A generate random number N_A, and it is sent to entity B.

Step 2, entity B receive N_AAfterwards, random number N is generated_BWith for the random number ZSEED as key seed_B, calculate Key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC(KEA,N_B||N_A||ID_B|| ID_A||ZSEED_B), calculate Message Authentication Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), entity B sends N_B||N_A|| EncData_B||MAC_BTo entity A, wherein MKA is authentication key, and KEA is Message Encryption key, and KIA is that message integrity is close Key, KDF1 are a kind of Key derivation algorithm, and ENC is a kind of Encryption Algorithm, and MAC1 is a kind of Message Authentication Code calculation method.Here " | | " indicate the cascade between field, the sequencing of its not limited field, similarly hereinafter.In addition, by " | | " cascade in the present invention Field can be considered constituting one " field groups " afterwards, it should be noted that, " field groups " in the present invention are open, that is, remove " word Outside the field that section group " is included, however not excluded that other fields can also be included in " field groups ".

Step 3, entity A receive N_B||N_A||EncData_B||MAC_BAfter verified, if verifying is incorrect, terminate mirror Not.

Step 4, entity A are generated for the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA,N_A||N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), meter Calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B).Wherein, KDF2 is a kind of Key derivation algorithm, and MsgID1 is (it is predetermined that message SN can be both sides to one message SN, is also possible to both sides by interacting message to obtain ), " ⊕ " indicates that, by bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm.Entity A sends N_A||N_B||EncData_A| |MAC_A||MacTag_ATo entity B.

Step 5, entity B receive N_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, if verifying is incorrect, Then terminate identification.

Step 6, entity B calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A, ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if unequal, terminate and identify；If equal, then it is assumed that entity A identity is legal, and continues following Step.Wherein, KDF2 is a kind of Key derivation algorithm.

Step 7, entity B calculate message identification mark MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A), and By MacTag_BIt is sent to entity A, MsgID2 is that (it is predetermined that message SN can be both sides to a message SN, can also To be that both sides are obtained by interacting message).

Specifically, entity A receives N in above-mentioned steps 3_B||N_A||EncData_B||MAC_BAfter verified, comprising:

3.1, the N received is checked_AWith the N for being sent to entity B before_AIt is whether equal, it is unequal, it verifies incorrect；

3.2, computation key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), and calculate Message Authentication Code MAC_B= MAC1(KIA,N_B||N_A||EncData_B), compare the MAC being calculated_BWith the MAC received_BIt is whether equal, it is unequal, it verifies It is incorrect；

3.3, N is decrypted_A||N_B||ID_A||ID_B||ZSEED_B=DEC(KEA,EncData_B)；Check the ID that decryption obtains_AWith ID_BIt whether is really the identity of entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_AWith before It is sent to the N of entity B_AIt is whether equal, it is unequal, it verifies incorrect；Check the N that decryption obtains_BWith the N received_B||N_A|| EncData_B||MAC_BIn N_BIt is whether equal, it is unequal, it verifies incorrect.Wherein, DEC is decipherment algorithm.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that N is received to entity A_B||N_A||EncData_B||MAC_BVerification result is incorrect.

Specifically, entity B receives N in above-mentioned steps 5_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, Include:

5.1, the N received is checked_AWith the N for being sent to entity A before_AIt is whether equal, it is unequal, it verifies incorrect；

5.2, the N received is checked_BWith the N for being sent to entity A before_BIt is whether equal, it is unequal, it verifies incorrect；

5.3, Message Authentication Code MAC is calculated_A=MAC1(KIA,N_A||N_B||EncData_A), compare the MAC being calculated_AWith The MAC received_AIt is whether equal, it is unequal, it verifies incorrect；

5.4, N is decrypted_A||N_B||ID_A||ID_B||ZSEED_A=DEC(KEA,EncData_A)；Check the ID that decryption obtains_AWith ID_BIt whether is really the identity of entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_AAnd N_BWith It is sent to the N of entity A before_AAnd N_BIt is whether equal, it is unequal, it verifies incorrect.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that N is received to entity B_A||N_B||EncData_A||MAC_A||MacTag_AVerification result is incorrect.

Based on above-mentioned method for authenticating entities, the present invention also provides a kind of work of entity A for realizing the above method Method, comprising:

Generate random number N_A, and it is sent to entity B；

Receive the MacTag that entity B is sent_BAfterwards, message identification mark MacTag is calculated first_B=MAC2(MK,MsgID2|| ID_B||ID_A||N_B||N_A), the MacTag that then will be calculated_BWith the MacTag received_BIt is compared, if equal, recognizes It is legal for entity B identity.

Specifically, the above-mentioned N for receiving entity B and sending_B||N_A||EncData_B||MAC_BAfter verified, comprising:

Check the N received_AWith the N for being sent to entity B before_AIt is whether equal, it is unequal, it verifies incorrect；

Computation key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), and calculate Message Authentication Code MAC_B=MAC1 (KIA,N_B||N_A||EncData_B), compare the MAC being calculated_BWith the MAC received_BIt is whether equal, it is unequal, it verifies not just Really；

Decrypt N_A||N_B||ID_A||ID_B||ZSEED_B=DEC(KEA,EncData_B)；Check the ID that decryption obtains_AAnd ID_BIt is The no identity for entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_ABe sent to reality before The N of body B_AIt is whether equal, it is unequal, it verifies incorrect；Check the N that decryption obtains_BWith the N received_B||N_A||EncData_B|| MAC_BIn N_BIt is whether equal, it is unequal, it verifies incorrect.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that To the N received_B||N_A||EncData_B||MAC_BVerification result be it is incorrect.

Based on above-mentioned method for authenticating entities, the present invention also provides a kind of work of entity B for realizing the above method Method, comprising:

Specifically, the above-mentioned N for receiving entity A and sending_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, wrap It includes:

Check the N received_AWith the N for being sent to entity A before_AIt is whether equal, it is unequal, it verifies incorrect；

Check the N received_BWith the N for being sent to entity A before_BIt is whether equal, it is unequal, it verifies incorrect；

Calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), compare the MAC being calculated_AWith receive MAC_AIt is whether equal, it is unequal, it verifies incorrect；

Decrypt N_A||N_B||ID_A||ID_B||ZSEED_A=DEC(KEA,EncData_A)；Check the ID that decryption obtains_AAnd ID_BIt is The no identity for entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_AAnd N_BBe sent to before The N of entity A_AAnd N_BIt is whether equal, it is unequal, it verifies incorrect.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that To receiving N_A||N_B||EncData_A||MAC_A||MacTag_AVerification result be it is incorrect.

Referring to fig. 2, it is based on above-mentioned method for authenticating entities, the present invention also provides a kind of correspondences for realizing the above method In the device of entity A, including storage unit 11, processing unit 12, Transmit-Receive Unit 13, in which:

Storage unit 11 is used to store the identity of the wildcard PSK between entity B and entity B；

Processing unit 12 is for generating random number N_A；

Transmit-Receive Unit 13 is used for N_AIt is sent to entity B, and the N sent for receiving entity B_B||N_A||EncData_B|| MAC_B；

Processing unit 12 is also used to the N sent to entity B_B||N_A||EncData_B||MAC_BIt is verified, if verifying not just Really, then identification is terminated；

Processing unit 12 is also used to generate the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA,N_A||N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), meter Calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), generate N_A||N_B||EncData_A||MAC_A||MacTag_A；

Transmit-Receive Unit 13 is also used to send N_A||N_B||EncData_A||MAC_A||MacTag_ATo entity B, and for receiving reality The MacTag that body B is sent_B；

Processing unit 12 is also used to calculate message identification mark MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B|| N_A), the MacTag that then will be calculated_BThe MacTag sent with entity B_BIt is compared, if equal, then it is assumed that entity B body Part is legal.

Specifically, the N that above-mentioned processing unit 12 is also used to send entity B_B||N_A||EncData_B||MAC_BIt is tested Card, comprising:

Processing unit 12 checks the N received_AWith the N for being sent to entity B before_AIt is whether equal, it is unequal, it verifies not just Really；

12 computation key MKA of processing unit | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), and calculate message identification Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), compare the MAC being calculated_BWith the MAC received_BIt is whether equal, it is unequal It then verifies incorrect；

Processing unit 12 decrypts N_A||N_B||ID_A||ID_B||ZSEED_B=DEC(KEA,EncData_B)；Check what decryption obtained ID_AAnd ID_BIt whether is really the identity of entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_AWith It is sent to the N of entity B before_AIt is whether equal, it is unequal, it verifies incorrect；Check the N that decryption obtains_BWith the N received_B||N_A| |EncData_B||MAC_BIn N_BIt is whether equal, it is unequal, it verifies incorrect.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that The N that entity B is sent_B||N_A||EncData_B||MAC_BVerification result be it is incorrect.

Referring to Fig. 3, it is based on above-mentioned discrimination method, the present invention also provides a kind of corresponding in fact for realizing the above method The device of body B, including storage unit 21, processing unit 22, Transmit-Receive Unit 23, in which:

Storage unit 21 is used to store the identity of the wildcard PSK between entity A and entity A；

Transmit-Receive Unit 23 is used for the N that receiving entity A is sent_A；

Processing unit 22 is for generating random number N_BWith the random number ZSEED as key seed_B, computation key MKA | | KEA||KIA=KDF1(N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC(KEA,N_B||N_A||ID_B||ID_A|| ZSEED_B), calculate Message Authentication Code MAC_B=MAC1(KIA,N_B||N_A||EncData_B), and generate N_B||N_A||EncData_B|| MAC_B；

Transmit-Receive Unit 23 is also used to send N to entity A_B||N_A||EncData_B||MAC_B, and sent for receiving entity A N_A||N_B||EncData_A||MAC_A||MacTag_A；

Processing unit 22 is also used to the N sent to entity A_A||N_B||EncData_A||MAC_A||MacTag_AIt is verified, if It verifies incorrect, then terminates identification；

Processing unit 22 is also used to calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B, Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if unequal, terminate and identify；If equal, then it is assumed that entity A identity is legal, and calculates message mirror It Biao Shi not MacTag_B=MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A)；

Transmit-Receive Unit 23 is also used to send MacTag to entity A_B。

Specifically, above-mentioned processing unit 22 is used for the N sent to entity A_A||N_B||EncData_A||MAC_A||MacTag_A It is verified, comprising:

Processing unit 22 checks the N received_AWith the N for being sent to entity A before_AIt is whether equal, it is unequal, it verifies not just Really；

Processing unit 22 checks the N received_BWith the N for being sent to entity A before_BIt is whether equal, it is unequal, it verifies not just Really；

Processing unit 22 calculates Message Authentication Code MAC_A=MAC1(KIA,N_A||N_B||EncData_A), compare and is calculated MAC_AWith the MAC received_AIt is whether equal, it is unequal, it verifies incorrect；

Processing unit 22 decrypts N_A||N_B||ID_A||ID_B||ZSEED_A=DEC(KEA,EncData_A)；Check what decryption obtained ID_AAnd ID_BIt whether is really the identity of entity A and entity B, if not then verifying incorrect；Check the N that decryption obtains_AWith N_BWith the N for being sent to entity A before_AAnd N_BIt is whether equal, it is unequal, it verifies incorrect.

It should be noted that the above verification process has no stringent sequence requirement, and any one verifying is incorrect, then it is assumed that N is sent to entity A_A||N_B||EncData_A||MAC_A||MacTag_AVerification result be it is incorrect.

To sum up, the identity realized the present invention is based on symmetric cryptographic algorithm between the entity with key agreement function identifies, and fits It is very extensive with field.It present invention can be suitably applied to radio frequency discrimination RFID, sensor network WSN, near-field communication NFC are contactless The field that card, WLAN WLAN etc. are communicated based on air interface.Entity A and entity B can be in the field RFID Reader and label, the node in sensor network, the terminal device in the field NFC, the reading in contactless card technical field Card device and card, terminal and access point in WLAN etc..

In addition, when technical solution of the present invention is used for the field NFC, entity A is sent in better embodiment of the invention To the N of entity B_AIt is to be transmitted after being packaged using ACT_REQ protocol Data Unit, entity B is sent to the N of entity A_B||N_A| |EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES protocol Data Unit, entity A is sent to the N of entity B_A| |N_B||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ protocol Data Unit, entity B hair Give the MacTag of entity A_BIt is to be transmitted after being packaged using VFY_RES protocol Data Unit, wherein ACT_REQ, ACT_ RES, VFY_REQ and VFY_RES are the protocol data unit formats for complying with standard ISO/IEC13157-1 and defining.So encapsulation Afterwards, the compatibility of technical solution of the present invention and existing other security mechanisms of NFC is more excellent.

It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more, The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces The form of product.

The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates, Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or The function of being specified in multiple boxes.

These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one The step of function of being specified in a box or multiple boxes.

Although preferred embodiments of the present invention have been described, it is created once a person skilled in the art knows basic Property concept, then additional changes and modifications may be made to these embodiments.So it includes excellent that the following claims are intended to be interpreted as It selects embodiment and falls into all change and modification of the scope of the invention.

Obviously, various changes and modifications can be made to the invention without departing from essence of the invention by those skilled in the art Mind and range.In this way, if these modifications and changes of the present invention belongs to the range of the claims in the present invention and its equivalent technologies Within, then the present invention is also intended to include these modifications and variations.

Claims

1. a kind of method for authenticating entities, for have shared wildcard PSK and mutually know other side's identity entity A and Identity identification is carried out between entity B, which is characterized in that the described method includes:

Step 1, entity A generate random number N_A, and it is sent to entity B；

Step 2, entity B receive N_AAfterwards, random number N is generated_BWith for the random number ZSEED as key seed_B, computation key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC (KEA, N_B||N_A||ID_B|| ID_A||ZSEED_B), calculate Message Authentication Code MAC_B=MAC1 (KIA, N_B||N_A||EncData_B), entity B sends N_B||N_A|| EncData_B||MAC_BTo entity A, wherein MKA is authentication key, and KEA is Message Encryption key, and KIA is that message integrity is close Key, KDF1 are a kind of Key derivation algorithm, ID_AFor the identity of entity A, ID_BFor the identity of entity B, ENC is one kind Encryption Algorithm, MAC1 are a kind of Message Authentication Code calculation method, and " | | " indicates the cascade between field；

Step 3, entity A receive N_B||N_A||EncData_B||MAC_BAfter verified, if verifying is incorrect, terminate identification；

Step 4, entity A are generated for the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA, N_A ||N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1 (KIA, N_A||N_B||EncData_A), it calculates shared Secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A=MAC2 (MK, MsgID1 | | ID_A||ID_B||N_A||N_B), send N_A||N_B||EncData_A||MAC_A||MacTag_AIt gives Entity B, wherein KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message SN, and " ⊕ " is indicated by bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm；

Step 5, entity B receive N_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, if verifying is incorrect, eventually Only identify；

Step 6, entity B calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A, ID_B), calculate message identification mark MacTag_A=MAC2 (MK, MsgID1 | | ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if equal, then it is assumed that entity A identity is legal；If unequal, terminate and identify；Wherein, KDF2 is A kind of Key derivation algorithm；

Step 7, entity B calculate message identification mark MacTag_B=MAC2 (MK, MsgID2 | | ID_B||ID_A||N_B||N_A), and will MacTag_BIt is sent to entity A, wherein MsgID2 is a message SN；

Step 8, entity A receive MacTag_BAfterwards, message identification mark MacTag is calculated first_B=MAC2 (MK, MsgID2 | | ID_B| |ID_A||N_B||N_A), the MacTag that then will be calculated_BWith the MacTag received_BIt is compared, if equal, then it is assumed that real Body B identity is legal.

2. the method as described in claim 1, which is characterized in that in the step 3, entity A receives N_B||N_A||EncData_B|| MAC_BAfter verified, comprising:

3.3, N is decrypted_A||N_B||ID_A||ID_B||ZSEED_B=DEC (KEA, EncData_B)；Check the ID that decryption obtains_AWhether really The actually identity of entity A, if not then verifying incorrect；Check the ID that decryption obtains_BIt whether is really the identity of entity B Mark, if not then verifying incorrect；Check the N that decryption obtains_AWith the N for being sent to entity B before_AIt is whether equal, it is unequal then It verifies incorrect；Check the N that decryption obtains_BWith the N received_B||N_A||EncData_B||MAC_BIn N_BIt is whether equal, it is unequal It then verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that receives N to entity A_B||N_A||EncData_B||MAC_BVerification result is not Correctly.

3. the method as described in claim 1, which is characterized in that in the step 5, entity B receives N_A||N_B||EncData_A|| MAC_A||MacTag_AAfter verified, comprising:

5.3, Message Authentication Code MAC is calculated_A=MAC1 (KIA, N_A||N_B||EncData_A), compare the MAC being calculated_AWith receive MAC_AIt is whether equal, it is unequal, it verifies incorrect；

5.4, N is decrypted_A||N_B||ID_A||ID_B||ZSEED_A=DEC (KEA, EncData_A)；Check the ID that decryption obtains_AWhether really The actually identity of entity A, if not then verifying incorrect；Check the ID that decryption obtains_BIt whether is really the identity of entity B Mark, if not then verifying incorrect；Check the N that decryption obtains_AAnd N_BWith the N for being sent to entity A before_AAnd N_BWhether correspond to It is equal, it is unequal, it verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that receives N to entity B_A||N_B||EncData_A||MAC_A||MacTag_AIt tests It is incorrect for demonstrate,proving result.

4. the method as described in any one of claim 1-3, which is characterized in that N_AIt is to utilize ACT_REQ data protocol unit It is transmitted after being packaged, N_B||N_A||EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES data protocol unit , N_A||N_B||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ data protocol unit, MacTag_BIt is to be transmitted after being packaged using VFY_RES data protocol unit, wherein ACT_REQ, ACT_RES, VFY_REQ And VFY_RES is the protocol data unit format for complying with standard ISO/IEC 13157-1 and defining.

5. a kind of entity A and entity B carry out identity identification, the working method of entity A, wherein entity A have and entity B it Between wildcard PSK and know the identity of entity B, which is characterized in that the described method includes:

Generate random number N_A, and it is sent to entity B；

Receive the N that entity B is sent_B||N_A||EncData_B||MAC_BAfter verified, if verifying is incorrect, terminate identification；

It generates for the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA, N_A||N_B||ID_A|| ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1 (KIA, N_A||N_B||EncData_A), calculate shared secret Z= ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A= MAC2(MK,MsgID1||ID_A||ID_B||N_A||N_B), send N_A||N_B||EncData_A||MAC_A||MacTag_ATo entity B；

Receive the MacTag that entity B is sent_BAfterwards, message identification mark MacTag is calculated first_B=MAC2 (MK, MsgID2 | | ID_B| |ID_A||N_B||N_A), the MacTag that then will be calculated_BWith the MacTag received_BIt is compared, if equal, then it is assumed that real Body B identity is legal；

Wherein, ID_AFor the identity of entity A, ID_BFor the identity of entity B, N_BFor entity B generate random number, EncData_BFor the ciphertext that entity B calculates, EncData_B=ENC (KEA, N_B||N_A||ID_B||ID_A||ZSEED_B), ZSEED_BFor reality Body B is generated as the random number of key seed, MAC_B=MAC1 (KIA, N_B||N_A||EncData_B), ENC is a kind of encryption calculation Method, KEA are Message Encryption key, and KIA is message integrity key, and MAC1 is a kind of Message Authentication Code calculation method, and KDF2 is A kind of Key derivation algorithm, MsgID1 are a message SN, and " ⊕ " indicates that, by bit exclusive or, MAC2 is a kind of Message Authentication Code Generating algorithm；Wherein, KDF2 is a kind of Key derivation algorithm, and MsgID2 is a message SN, and " | | " indicates between field Cascade.

6. method as claimed in claim 5, which is characterized in that the N for receiving entity B and sending_B||N_A||EncData_B|| MAC_BAfter verified, comprising:

Decrypt N_A||N_B||ID_A||ID_B||ZSEED_B=DEC (KEA, EncData_B)；Check the ID that decryption obtains_AWhether be really The identity of entity A, if not then verifying incorrect；Check the ID that decryption obtains_BIt whether is really the identity mark of entity B Know, if not then verifying incorrect；Check the N that decryption obtains_AWith the N for being sent to entity B before_AIt is whether equal, it is unequal, it tests It demonstrate,proves incorrect；Check the N that decryption obtains_BWith the N received_B||N_A||EncData_B||MAC_BIn N_BIt is whether equal, it is unequal then It verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that the N received_B||N_A||EncData_B||MAC_BVerification result be not Correctly.

7. such as method described in claim 5 or 6, which is characterized in that N_AIt is to be packaged using ACT_REQ data protocol unit It transmits afterwards, N_B||N_A||EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES data protocol unit, N_A||N_B ||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ data protocol unit, MacTag_BIt is benefit It is transmitted after being packaged with VFY_RES data protocol unit, wherein ACT_REQ, ACT_RES, VFY_REQ and VFY_RES are Comply with standard the protocol data unit format that ISO/IEC13157-1 is defined.

8. a kind of entity A and entity B carry out identity identification, the working method of entity B, wherein entity B have and entity A it Between wildcard PSK and know the identity of entity A, which is characterized in that the described method includes:

Receive the N that entity A is sent_AAfterwards, random number N is generated_BWith for the random number ZSEED as key seed_B, computation key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC (KEA, N_B||N_A||ID_B|| ID_A||ZSEED_B), calculate Message Authentication Code MAC_B=MAC1 (KIA, N_B||N_A||EncData_B), send N_B||N_A||EncData_B ||MAC_BTo entity A；

Receive the N that entity A is sent_A||N_B||EncData_A||MAC_A||MacTag_AAfter verified, if verifying is incorrect, eventually Only identify；

Calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message Identification mark MacTag_A=MAC2 (MK, MsgID1 | | ID_A||ID_B||N_A||N_B), and with the MacTag that receives_AIt is compared, such as Fruit is unequal, terminates and identifies；If equal, then it is assumed that entity A identity is legal, and calculates message identification mark MacTag_B= MAC2(MK,MsgID2||ID_B||ID_A||N_B||N_A), by MacTag_BIt is sent to entity A；

Wherein, MKA is authentication key, and KEA is Message Encryption key, and KIA is message integrity key, and KDF1 is that a kind of key pushes away Lead algorithm, ID_AFor the identity of entity A, ID_BFor the identity of entity B, ENC is a kind of Encryption Algorithm, and MAC1 is one kind Message Authentication Code calculation method, KDF2 are a kind of Key derivation algorithm, and MsgID1 is a message SN, and " ⊕ " is indicated by bit Exclusive or, MAC2 are a kind of Message Authentication Code generating algorithm, and KDF2 is a kind of Key derivation algorithm, and MsgID2 is a message sequence Number, " | | " indicates the cascade between field；

Wherein, N_AFor the random number that entity A generates, EncData_AFor the ciphertext that entity A calculates, EncData_A=ENC (KEA, N_A|| N_B||ID_A||ID_B||ZSEED_A), ZSEED_AThe random number of key seed, MAC are generated as entity A_A=MAC1 (KIA, N_A ||N_B||EncData_A)。

9. method according to claim 8, which is characterized in that the N for receiving entity A and sending_A||N_B||EncData_A|| MAC_A||MacTag_AAfter verified, comprising:

Calculate Message Authentication Code MAC_A=MAC1 (KIA, N_A||N_B||EncData_A), compare the MAC being calculated_AWith receive MAC_AIt is whether equal, it is unequal, it verifies incorrect；

Decrypt N_A||N_B||ID_A||ID_B||ZSEED_A=DEC (KEA, EncData_A)；Check the ID that decryption obtains_AWhether be really The identity of entity A, if not then verifying incorrect；Check the ID that decryption obtains_BIt whether is really the identity mark of entity B Know, if not then verifying incorrect；Check the N that decryption obtains_AAnd N_BWith the N for being sent to entity A before_AAnd N_BWhether phase is corresponded to Deng, it is unequal, it verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that receiving N_A||N_B||EncData_A||MAC_A||MacTag_AVerifying knot Fruit is incorrect.

10. method as claimed in claim 8 or 9, which is characterized in that N_AIt is to be packaged using ACT_REQ data protocol unit It transmits afterwards, N_B||N_A||EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES data protocol unit, N_A||N_B ||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ data protocol unit, MacTag_BIt is benefit It is transmitted after being packaged with VFY_RES data protocol unit, wherein ACT_REQ, ACT_RES, VFY_REQ and VFY_RES are Comply with standard the protocol data unit format that ISO/IEC13157-1 is defined.

11. a kind of solid identification device, for carrying out identity identification with another device, described device includes storage unit, processing Unit and Transmit-Receive Unit, it is characterised in that:

Storage unit is used to store the identity mark of wildcard PSK and another device between another device Know；

Processing unit is for generating random number N_A；

Transmit-Receive Unit is used for N_AIt is sent to another device, and for receiving the N that another device is sent_B||N_A|| EncData_B||MAC_B；

Processing unit is also used to the N sent to another device_B||N_A||EncData_B||MAC_BIt is verified, if verifying not just Really, then identification is terminated；

Processing unit is also used to generate the random number ZSEED as key seed_A, calculate ciphertext EncData_A=ENC (KEA, N_A| |N_B||ID_A||ID_B||ZSEED_A), calculate Message Authentication Code MAC_A=MAC1 (KIA, N_A||N_B||EncData_A), calculating is shared secret Close Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A,ID_B), calculate message identification mark MacTag_A =MAC2 (MK, MsgID1 | | ID_A||ID_B||N_A||N_B), generate N_A||N_B||EncData_A||MAC_A||MacTag_A；

Transmit-Receive Unit is also used to send N_A||N_B||EncData_A||MAC_A||MacTag_ATo another device, and for receiving The MacTag that another device is sent_B；

Processing unit is also used to calculate message identification mark MacTag_B=MAC2 (MK, MsgID2 | | ID_B||ID_A||N_B||N_A), so The MacTag that will be calculated afterwards_BThe MacTag sent with another device_BIt is compared, if equal, then it is assumed that described another One device identity is legal；

Wherein, ID_AFor the identity of described device, ID_BFor the identity of another device, ENC is a kind of encryption calculation Method, KEA are Message Encryption key, and KIA is message integrity key, and MAC1 is a kind of Message Authentication Code calculation method, and KDF2 is A kind of Key derivation algorithm, MsgID1 are a message SN, and " ⊕ " indicates that, by bit exclusive or, MAC2 is a kind of Message Authentication Code Generating algorithm；Wherein, KDF2 is a kind of Key derivation algorithm, and MsgID2 is a message SN, and " | | " indicates between field Cascade；

Wherein, N_BFor the random number that another device generates, EncData_BFor the ciphertext that another device calculates, EncData_B=ENC (KEA, N_B||N_A||ID_B||ID_A||ZSEED_B), ZSEED_BKey is generated as another device The random number of seed, MAC_B=MAC1 (KIA, N_B||N_A||EncData_B)。

12. device as claimed in claim 11, which is characterized in that the processing unit is also used to send out another device The N come_B||N_A||EncData_B||MAC_BIt is verified, comprising:

The N that processing unit inspection receives_AWith the N for being sent to another device before_AIt is whether equal, it is unequal, it verifies not just Really；

Processing unit computation key MKA | | KEA | | KIA=KDF1 (N_A,N_B,PSK,ID_A,ID_B), and calculate Message Authentication Code MAC_B =MAC1 (KIA, N_B||N_A||EncData_B), compare the MAC being calculated_BWith the MAC received_BIt is whether equal, it is unequal, it tests It demonstrate,proves incorrect；

Processing unit decrypts N_A||N_B||ID_A||ID_B||ZSEED_B=DEC (KEA, EncData_B), check the ID that decryption obtains_AIt is No be the identity of described device really, if not then verifying incorrect；Check the ID that decryption obtains_BIt whether is really described The identity of another device, if not then verifying incorrect；Check the N that decryption obtains_ABe sent to another dress before The N set_AIt is whether equal, it is unequal, it verifies incorrect；Check the N that decryption obtains_BWith the N received_B||N_A||EncData_B|| MAC_BIn N_BIt is whether equal, it is unequal, it verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that the N sent to another device_B||N_A||EncData_B||MAC_B's Verification result is incorrect.

13. the device as described in claim 11 or 12, which is characterized in that N_AIt is to be sealed using ACT_REQ data protocol unit It is transmitted after dress, N_B||N_A||EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES data protocol unit, N_A|| N_B||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ data protocol unit, MacTag_BIt is It is transmitted after being packaged using VFY_RES data protocol unit, wherein ACT_REQ, ACT_RES, VFY_REQ and VFY_RES It is the protocol data unit format for complying with standard ISO/IEC 13157-1 and defining.

14. a kind of solid identification device, for carrying out identity identification with another device, described device includes storage unit, processing Unit and Transmit-Receive Unit, it is characterised in that:

Transmit-Receive Unit is for receiving the N that another device is sent_A；

Processing unit is for generating random number N_BWith the random number ZSEED as key seed_B, computation key MKA | | KEA | | KIA =KDF1 (N_A,N_B,PSK,ID_A,ID_B), calculate ciphertext EncData_B=ENC (KEA, N_B||N_A||ID_B||ID_A||ZSEED_B), meter Calculate Message Authentication Code MAC_B=MAC1 (KIA, N_B||N_A||EncData_B), and generate N_B||N_A||EncData_B||MAC_B；

Transmit-Receive Unit is also used to send N to another device_B||N_A||EncData_B||MAC_B, and for receiving another dress Set the N sent_A||N_B||EncData_A||MAC_A||MacTag_A；

Processing unit is also used to the N sent to another device_A||N_B||EncData_A||MAC_A||MacTag_AIt is verified, If verifying is incorrect, identification is terminated；

Processing unit is also used to calculate shared secret Z=ZSEED_A⊕ZSEED_B, calculate master key MK=KDF2 (N_A,N_B,Z,ID_A, ID_B), calculate message identification mark MacTag_A=MAC2 (MK, MsgID1 | | ID_A||ID_B||N_A||N_B), and with receive MacTag_AIt is compared, if unequal, terminate and identify；If equal, then it is assumed that another device identity is legal, and counts Calculate message identification mark MacTag_B=MAC2 (MK, MsgID2 | | ID_B||ID_A||N_B||N_A)；

Transmit-Receive Unit is also used to send MacTag to another device_B；

Wherein, MKA is authentication key, and KEA is Message Encryption key, and KIA is message integrity key, and KDF1 is that a kind of key pushes away Lead algorithm, ID_AFor the identity of another device, ID_BFor the identity of described device, ENC is a kind of Encryption Algorithm, MAC1 is a kind of Message Authentication Code calculation method, and KDF2 is a kind of Key derivation algorithm, and MsgID1 is a message SN, " ⊕ " It indicates by bit exclusive or, MAC2 is a kind of Message Authentication Code generating algorithm, and KDF2 is a kind of Key derivation algorithm, MsgID2 mono- Message SN, " | | " indicate the cascade between field；

Wherein, N_AFor the random number that another device generates, EncData_AFor the ciphertext that another device calculates, EncData_A=ENC (KEA, N_A||N_B||ID_A||ID_B||ZSEED_A), ZSEED_AKey is generated as another device The random number of seed, MAC_A=MAC1 (KIA, N_A||N_B||EncData_A)。

15. device as claimed in claim 14, which is characterized in that the processing unit is also used to send out another device The N come_A||N_B||EncData_A||MAC_A||MacTag_AIt is verified, comprising:

The N that processing unit inspection receives_BWith the N for being sent to another device before_BIt is whether equal, it is unequal, it verifies not just Really；

Processing unit calculates Message Authentication Code MAC_A=MAC1 (KIA, N_A||N_B||EncData_A), compare the MAC being calculated_AWith The MAC received_AIt is whether equal, it is unequal, it verifies incorrect；

Processing unit decrypts N_A||N_B||ID_A||ID_B||ZSEED_A=DEC (KEA, EncData_A)；Check the ID that decryption obtains_AIt is No be the identity of another device really, if not then verifying incorrect；Check the ID that decryption obtains_BWhether be really The identity of described device, if not then verifying incorrect；Check the N that decryption obtains_AAnd N_BIt is described another with being sent to before The N of device_AAnd N_BWhether it is equal to each other, it is unequal, it verifies incorrect；Wherein, DEC is decipherment algorithm；

Wherein, any one verifying is incorrect, then it is assumed that sends N to another device_A||N_B||EncData_A||MAC_A|| MacTag_AVerification result be it is incorrect.

16. the device as described in claims 14 or 15, which is characterized in that N_AIt is to be sealed using ACT_REQ data protocol unit It is transmitted after dress, N_B||N_A||EncData_B||MAC_BIt is to be transmitted after being packaged using ACT_RES data protocol unit, N_A|| N_B||EncData_A||MAC_A||MacTag_AIt is to be transmitted after being packaged using VFY_REQ data protocol unit, MacTag_BIt is It is transmitted after being packaged using VFY_RES data protocol unit, wherein ACT_REQ, ACT_RES, VFY_REQ and VFY_RES It is the protocol data unit format for complying with standard ISO/IEC 13157-1 and defining.