CN103248487B - Near-field communication authentication method, certificate authority and near-field communication equipment - Google Patents

Abstract

The present invention provides a near-field communication authentication method, a certificate authorization center and a near-field communication device. The method includes: the certificate authorization center obtains the current dispersion factor of the near-field communication device, and the current dispersion factor includes the device identification and the near-field communication device. The current update identifier; using the local pre-stored master key and the current dispersion factor to obtain a plurality of current keys of the near field communication device; sending the plurality of current keys to the near field communication device to enabling the near field communication device to perform interactive authentication. In the present invention, the certificate authorization center obtains the current key of the near-field communication device according to the stored master key, and sends the current key to the near-field communication device, so that the near-field communication device communicates with other near-field communication devices based on multiple current keys. The solution for mutual authentication of devices solves the security problem caused by the easy cracking of the master key stored in the near field communication device in the prior art, thereby effectively improving the security of the near field communication.

Description

Near field communication authentication method, certificate authorization center and near field communication equipment

technical field

The invention relates to the communication field, in particular to a near-field communication authentication method, a certificate authorization center and near-field communication equipment.

Background technique

With the gradual popularization of devices with near-field communication functions, data transmission between devices through near-field communication becomes more and more frequent. How to ensure the security of near field communication is a problem that needs to be solved in the development of near field communication technology.

To this end, the existing solution is to store the master key in each device in advance through the dedicated equipment in the business hall. After that, when communication and interaction between devices are required, the The master key and the random number generated by the random number generator preset in the device generate a session key for each communication through a specific key distribution algorithm, so as to realize the encryption of communication data between devices, Ensure the security of near field communication.

However, in the above-mentioned existing solutions, the master key used to generate the session key for encrypting communication data is pre-stored locally in the device, and it is very likely to be cracked, that is, if the master key is cracked , then the security of the session key used for encrypting communication data generated according to the master key will also not be guaranteed. Therefore, there is still a great security risk in this scheme.

Contents of the invention

The invention provides a near-field communication authentication method, a certificate authorization center and a near-field communication device, which are used to solve the security problem caused by the master key in the near-field communication device being easily cracked in the existing near-field communication technology.

In one aspect, the present invention provides a near field communication authentication method, comprising:

The certificate authority obtains the current dispersion factor of the near field communication device, and the current dispersion factor includes the device identification and the current update identification of the near field communication device;

Obtaining a plurality of current keys of the near field communication device by using the locally pre-stored master key and the current dispersion factor;

Sending the multiple current keys to the near field communication device, so that the near field communication device performs mutual authentication with other near field communication devices according to the multiple current keys.

In another aspect, the present invention provides a certificate authority, including:

An obtaining module, configured to obtain a current dispersion factor of the near field communication device, the current dispersion factor including the device identification and the current update identification of the near field communication device;

The processing module is further configured to obtain a plurality of current keys of the near-field communication device by using the local pre-stored master key and the current dispersion factor;

A sending module, configured to send the multiple current keys to the near field communication device, so that the near field communication device performs mutual authentication with other near field communication devices according to the multiple current keys.

In yet another aspect, the present invention provides another near field communication authentication method, including:

The near-field communication device receives multiple current keys sent by the certificate authority, the multiple current keys are obtained by the certificate authority according to the local pre-stored master key and the current dispersion factor of the near-field communication device , the current dispersion factor includes a device identifier and a current update identifier of the near field communication device;

sending a second authentication request to another near field communication device, the second authentication request including one of the plurality of current keys and the device identification of the near field communication device, so that the other near field communication device The above-mentioned near-field communication device is authenticated.

In yet another aspect, the present invention provides a near field communication device, comprising:

A receiving module, configured to receive multiple current keys sent by the certificate authority, the multiple current keys are obtained by the certificate authority according to the local pre-stored master key and the current dispersion factor of the near field communication device Wherein, the current dispersion factor includes the device identification and the current update identification of the near field communication device;

A sending module, configured to send a second authentication request to another near-field communication device, where the second authentication request includes one of the plurality of current keys and the device identifier of the near-field communication device, so that another near-field communication device The field communication device authenticates the near field communication device.

In the near field communication authentication method, certificate authority center and near field communication device provided by the present invention, the master key used to obtain the current key of the near field communication device is stored in the certificate authority center, and the master key is obtained according to the master key. the current key of the near-field communication device, and send the current key to the near-field communication device, so that the near-field communication device performs mutual authentication with other near-field communication devices according to the plurality of current keys The technical solution solves the security problem caused by the easy cracking of the master key stored in the near-field communication device in the prior art, and effectively improves the security of the near-field communication.

Description of drawings

FIG. 1 is a schematic flowchart of a near-field communication authentication method provided by Embodiment 1 of the present invention;

FIG. 2 is a schematic flowchart of a near-field communication authentication method provided in Embodiment 2 of the present invention;

FIG. 3 is a schematic flowchart of a near-field communication authentication method provided by Embodiment 3 of the present invention;

FIG. 4 is a schematic flowchart of a near-field communication authentication method provided in Embodiment 4 of the present invention;

FIG. 5 is a schematic structural diagram of a certificate authority center provided in Embodiment 6 of the present invention;

FIG. 6 is a schematic structural diagram of a near field communication device provided by Embodiment 7 of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention.

Fig. 1 is a schematic flowchart of a near-field communication authentication method provided in Embodiment 1 of the present invention. As shown in Fig. 1 , the method includes:

101. The certificate authority obtains the current dispersion factor of the near field communication device, where the current dispersion factor includes the device identification and the current update identification of the near field communication device.

Wherein, the current update ID is different at different times. Specifically, the current update ID may be an ID corresponding to the current time. For example, if the current time is 12 o'clock on February 21, 2013, the current update ID is 201302211200, for another example, if the current time is 11:40 on February 21, 2013, the current update ID is 201302211140; further, the current dispersion factor can be a simple combination of the device ID and the current update ID, for example, if If the device ID is abc123 and the current update ID is 201302211140, then the current dispersion factor obtained by the certificate authority may be abc123201302211140. The example given is only a specific implementation and does not limit other implementations.

Specifically, 101 may include: periodically obtaining the current dispersion factor of the near field communication device; or,

Obtain the current dispersion factor of the near field communication device according to the key request of the near field communication device.

The scenario of this embodiment is that the certificate authority periodically obtains the current dispersion factor of the near field communication device, or the certificate authority obtains the key request of the near field communication device according to the key request of the near field communication device The current dispersion factor, or further, on the basis of periodically obtaining the current dispersion factor of the near field communication device, the certificate authority may also obtain the near field communication device according to the key request of the near field communication device The current dispersion factor of the device.

It should be noted that, in the above-mentioned first scenario, the current update identifier in the current dispersion factor of the near field communication device and another near field communication device is the same, specifically, the execution cycle of step 101 can be determined according to work needs , for example, take the period as 30 minutes. It should also be noted that the obtaining of the current dispersion factor in each embodiment of the present invention means that the current dispersion factor is obtained according to the device identifier and the current update identifier, and optionally, the current update identifier corresponds to the current time.

102. Obtain multiple current keys of the near field communication device by using a locally pre-stored master key and the current dispersion factor.

Specifically, 102 may include: according to the master key and the current dispersal factor, perform two-stage dispersal operations through the standard China Financial Integrated Circuit Card Specification (PBOC2.0 for short) key divergence algorithm to obtain the near Multiple current keys for field communication devices.

103. Send the multiple current keys to the near field communication device, so that the near field communication device performs interactive authentication with other near field communication devices according to the multiple current keys.

Specifically, the sending the multiple current keys to the near-field communication device may include: sending the multiple current keys to the near-field communication device through an over-the-air technology (OvertheAirTechnology, OTA for short).

Wherein, the current dispersal factor obtained by the certificate authority according to the current update ID may be referred to as the current dispersal factor corresponding to the current update ID; correspondingly, the current key obtained according to the current dispersal factor may be referred to as the The current update identifies a corresponding current key.

The near field communication authentication method provided in this embodiment stores the master key used to obtain the current key of the near field communication device in the certificate authority, obtains the current key of the near field communication device according to the master key, and Sending the current key to the near-field communication device, so that the near-field communication device performs interactive authentication with other near-field communication devices according to the multiple current keys, solves the problem of storing The security problem caused by the master key in the near field communication device being easily cracked can effectively improve the security of the near field communication.

FIG. 2 is a schematic flowchart of a near field communication authentication method provided in Embodiment 2 of the present invention. As shown in FIG. 2 , according to the near field communication authentication method described in Embodiment 1, after step 103, it may further include:

201. Receive a first authentication request sent by the near field communication device, where the first authentication request is sent to the near field communication device by another near field communication device, and the first authentication request includes the first The key to be authenticated and the device identifier of the other near field communication device.

202. Authenticate the other near-field communication device by detecting whether the first key to be authenticated is one of multiple current keys of the other near-field communication device, and obtain a first authentication result.

Wherein, multiple current keys of the other near field communication device may be pre-stored in the certificate authority, or the certificate authority may, upon receiving the first authentication request, A key and a current dispersion factor of the other near field communication device are obtained.

In the latter implementation manner, the implementation scenario of step 101 may be that the certificate authority periodically obtains the current dispersion factor of the near-field communication device, or the certificate authority, according to the key request of the near-field communication device, Obtain the current dispersal factor of the near field communication device, or further, on the basis of periodically obtaining the current dispersal factor of the near field communication device, the certificate authority may also use the key of the near field communication device Request to obtain the current dispersion factor of the near field communication device. Specifically, when the implementation scenario of 101 is the latter two implementation scenarios, in the latter implementation manner, the certificate authority can save the near-field communication device when obtaining the current dispersion factor of the near-field communication device. The current update identifier corresponding to the current dispersion factor of the communication device.

203. Return the first authentication result to the near field communication device.

Optionally, after 103, it may also include:

Initializing the count of the number of consecutive times that the first authentication result is an authentication failure;

Correspondingly, after 202, it may also include:

If the first authentication result is that the number of consecutive authentication failures is greater than a preset threshold value, then obtain the current dispersion factor of the other near-field communication device;

obtaining a plurality of current keys of the other near field communication device using the locally stored master key and the current dispersion factor of the other near field communication device;

Sending multiple current keys of the other near field communication device to the another near field communication device, and initializing the count of consecutive times that the first authentication result is an authentication failure.

The threshold value may be determined according to actual needs, for example, the threshold value is 5.

The application scenario of this embodiment is that if the certificate authorization center fails to authenticate a certain near-field communication device for a consecutive number of times greater than a certain value, it means that the current key of the near-field communication device may be attempted to be cracked. The center obtains the current dispersion factor of the near-field communication device, and obtains a current key according to the current dispersion factor and sends it to the near-field communication device.

The near field communication authentication method provided in this embodiment is passed. According to the received authentication request of the near field communication device, the certificate authority detects whether the key to be authenticated in the authentication request is a plurality of current keys of the near field communication device. One of the keys is to realize the authentication of the near-field communication device, and when the consecutive times of authentication failures are greater than the preset threshold value, the technical scheme of re-obtaining the current key of the near-field communication device effectively reduces the near-field communication The possibility of the key of the communication device being cracked, thereby further improving the security of the near field communication.

FIG. 3 is a schematic flowchart of a near field communication authentication method provided in Embodiment 3 of the present invention. As shown in FIG. 3 , according to the near field communication authentication method described in Embodiment 1, after step 103, it may further include:

301. Receive a key invocation request sent by the near field communication device, where the key invocation request is sent by the near field communication device after receiving a first authentication request sent by another near field communication device, the The first authentication request includes a first key to be authenticated and a device identifier of the other near field communication device;

302. Send the master key to the near field communication device, so that the near field communication device authenticates the other near field communication device according to the master key and the first authentication request.

Optionally, after 302, it can also include:

Receiving a key update request sent by the near field communication device and carrying the device identifier of the other near field communication device, where the key update request is an update request sent by the near field communication device to the another near field communication device Sent after the number of consecutive authentication failures is greater than the preset threshold;

Obtain the current dispersion factor of the other near field communication device according to the key update request;

obtaining a plurality of current keys of the other near field communication device using the locally stored master key and the current dispersion factor of the other near field communication device;

A plurality of current keys of the other near field communication device are sent to the other near field communication device.

The near field communication authentication method provided in this embodiment is passed. When the certificate authority receives the key invocation request sent by the near field communication device according to the received authentication request of another near field communication device, it sends the certificate to the near field communication device. sending the locally stored master key, so that the near field communication device authenticates another near field communication device, and after receiving the continuous When the number of times is greater than the preset threshold value, when a key update request including the device identification of the other near-field communication device is sent, the current key of the near-field communication device is obtained and sent to the other near-field communication device The technical solution of the field communication device effectively reduces the possibility that the key of the near field communication device is cracked, thereby further improving the security of the near field communication.

Optionally, according to the near field communication authentication method described in any of the above embodiments, before step 103, it may also include:

sending a key instruction to the near field communication device;

Correspondingly, 103 may specifically include:

If a key response returned by the near-field communication device according to the key instruction is received within a preset time after sending the key instruction, sending the plurality of current keys to the near-field communication device .

In this embodiment, when receiving the key response returned by the near-field communication device within a preset time after receiving the key instruction sent by the certificate authority, the current key is sent to the near-field communication device , the current sending and receiving status of the near field communication device is detected in advance, so as to effectively ensure the success rate of key sending.

FIG. 4 is a schematic flowchart of a near-field communication authentication method provided in Embodiment 4 of the present invention. As shown in FIG. 4, the method includes:

401. The near-field communication device receives multiple current keys sent by the certificate authority, where the multiple current keys are the certificate authority's local pre-stored master key and the current dispersion factor of the near-field communication device It is obtained that the current dispersion factor includes the device identifier and the current update identifier of the near field communication device.

In practical applications, the near field communication device may store the current key in the security module of its own device. It should be noted that different device types may have different security modules. For example, the The security module of the near field communication device may be a smart card set in the near field communication device.

402. Send a second authentication request to another near field communication device, where the second authentication request includes one of the multiple current keys and the device identifier of the near field communication device, so that the other near field communication device Authenticate the near field communication device.

Optionally, after 402, it can also include:

Receive a first authentication request sent by the other near field communication device that includes the first key to be authenticated and the device identifier of the other near field communication device, where the first authentication request is the other near field communication sent by the device after the device successfully authenticates the near-field communication device;

authenticating the other near field communication device according to the first authentication request;

If the authentication of the other near field communication device is successful, establish a connection with the other near field communication device.

Usually, two near field communication devices need to perform mutual authentication before establishing a connection, and if the mutual authentication is successful, the connection is established.

In an implementation manner of this embodiment, the authenticating the other near-field communication device according to the first authentication request may specifically include:

sending the first authentication request to the certificate authority, and receiving a first authentication result returned by the certificate authority, the first authentication result being that the certificate authority It is returned after another near-field communication device performs authentication.

Specifically, the specific process for the certificate authority to authenticate the near field communication device is similar to the relevant content in the first embodiment, and will not be repeated in this embodiment.

In another implementation manner of this embodiment, the authenticating the other near-field communication device according to the first authentication request may specifically include:

Sending a key invocation request to the certificate authority, and authenticating the other near-field communication device according to the master key returned by the certificate authority and the first authentication request.

Optionally, in this embodiment, the second authentication request may also include the current update identifier of the near field communication device, and the first authentication request may also include the current update ID of the other near field communication device. Identification; the authenticating the other near-field communication device according to the master key returned by the certificate authority and the first authentication request may specifically include:

Obtaining multiple current keys of the other near field communication device according to the master key returned by the certificate authority, the current update identifier of the other near field communication device, and the first authentication request, And by detecting whether the first key to be authenticated is one of multiple current keys of the other near field communication device, the other near field communication device is authenticated.

After step 401 in this embodiment, the near field communication device may also determine the current update identifier corresponding to the current key of itself according to the current time when the current key sent by the certificate authority is received. Further, when authenticating the other near-field communication device, use the current update identifier corresponding to its own current key as the current update identifier corresponding to the current key of the other near-field communication device. Wherein, the time when the near-field communication device receives the current key sent by the certificate authority corresponds to the current update identifier in the current dispersion factor used by the certificate authority to generate the current key of the near-field communication device There may be a certain time difference, that is, there is a certain error between the current update identifier corresponding to the current key determined by the near field communication device and the current update identifier actually corresponding to the current key of the near field communication device. Further, the time corresponding to the current update identifier in the current dispersion factor used by the certificate authority to generate the current key of the near-field communication device is the same as the current dispersion factor used to generate the current key of the other near-field communication device There may be a certain time difference between the time corresponding to the current update ID in the , that is, the current update ID actually corresponding to the current key of the near-field communication device and the current update ID actually corresponding to the current key of the other near-field communication device exist Therefore, in order to further improve the accuracy of authentication, a time window can be preset, that is, the error range of the current updated identification. Correspondingly, the authenticating the other near-field communication device according to the master key returned by the certificate authority and the first authentication request may specifically include:

Obtain a plurality of certifiable update identities according to the pre-stored current update identities of the near-field communication device and a preset time window, where the value of the certifiable update identities is not less than the time between the current update identities and the preset time window The difference between the windows is not greater than the sum of the current update identifier and the preset time window;

Obtain multiple certifiable current keys of the other near field communication device respectively according to the device identifier of the other near field communication device, the multiple certifiable update identities, and the master key, and pass the detection Whether the first key to be authenticated is one of a plurality of current verifiable keys of the other near field communication device, and authenticate the other near field communication device.

Wherein, the time window can be determined according to work needs. For example, if the time window is set to 2 minutes, if the current update ID of the near-field communication device is 201302211200, multiple certifiable update IDs including 201302211158 and 201302211159 can be obtained. , 201302211200, 201302211201, and 201302211202.

Optionally, after authenticating the other near field communication according to the master key returned by the certificate authority and the first authentication request, the method may further include:

If the result of the authentication of the other near field communication is that the consecutive number of authentication failures is greater than the preset threshold value, send a key update carrying the device identification of the other near field communication device to the certificate authority request, so that the certificate authority updates the current key of the other near field communication device according to the key update request.

Wherein, the second authentication request may further include the current update identifier of the near field communication device, and the first authentication request may further include the current update identifier of the other near field communication device.

The application scenario of the above steps may be that if the number of consecutive failures of the near field communication device to authenticate another near field communication device is greater than the preset threshold value, it means that the current key of the other near field communication device has been tried to crack If possible, the near field communication device requests the certificate authority to update the current key of the other near field communication device.

Optionally, in an implementation manner, before 401, it may also include:

Receive the key instruction sent by the certificate authority, and return a key response to the certificate authority.

Optionally, in another implementation manner, before 401, it may also include:

Sending a key request to the certificate authority, so that the certificate authority obtains the current dispersion factor of the near field communication device according to the key request.

In the above two implementation modes, the second authentication request in this embodiment may also include the current update ID of the near field communication device, and the first authentication request may also include the other near field communication device The current update ID for .

In the near field communication authentication method provided in this embodiment, before the near field communication device establishes a connection with another near field communication device, it sends to another near field communication device including any current key received in advance from the certificate authority. authentication request, and after receiving the authentication request returned by the other near-field communication device, a technical solution for authenticating the other near-field communication device, so as to realize interactive authentication before the near-field communication device establishes a connection , so as to effectively improve the security of near field communication.

Embodiment 5 of the present invention provides another near-field communication authentication method. According to the near-field communication authentication method described in Embodiment 4, before 402, it may also include:

receiving a first authentication request sent by another near field communication device that includes a first key to be authenticated and a device identifier of the another near field communication device;

authenticating the other near field communication device according to the first authentication request;

Correspondingly, 402 specifically includes:

If the authentication of the another near field communication device succeeds, sending the second authentication request to the another near field communication device.

Specifically, the above steps may be performed before 401, or after 401 and before 402, which is not limited in this embodiment. Wherein, the specific method for authenticating the other near-field communication device according to the first authentication request is similar to the relevant content in Embodiment 4, so it will not be repeated here.

Optionally, in this implementation manner, after authenticating the other near-field communication device according to the master key returned by the certificate authority and the first authentication request, the method may further include:

If the first authentication result is that the number of consecutive authentication failures is greater than the threshold value, send a key update request carrying the device identification of the other near-field communication device to the certificate authorization center, so that the certificate authorization The center updates the current key of the other near field communication device according to the key update request.

The specific process of each implementation manner in this embodiment is similar to the related content in the foregoing embodiments, and will not be repeated in this embodiment.

In the near-field communication authentication method provided in this embodiment, after the near-field communication device successfully authenticates the other near-field communication device according to the authentication request sent by another near-field communication device, according to the certificate received locally from the certificate authority The current key, sending an authentication request including any of the current keys to the other near-field communication device, so as to realize the technical solution of interactive authentication of the near-field communication device by the other near-field communication device, Effectively improve the security of near field communication.

Fig. 5 is a schematic structural diagram of a certificate authority center provided in Embodiment 6 of the present invention. As shown in Fig. 5, the certificate authority center includes:

An obtaining module 51, configured to obtain a current dispersion factor of the near field communication device, where the current dispersion factor includes a device identification and a current update identification of the near field communication device;

The processing module 52 is further configured to obtain a plurality of current keys of the near field communication device by using the local pre-stored master key and the current dispersion factor;

The sending module 53 is configured to send the multiple current keys to the near field communication device, so that the near field communication device performs interactive authentication with other near field communication devices according to the multiple current keys.

Optionally, in an implementation manner of this embodiment, the certificate authority may further include:

A first receiving module, configured to receive a first authentication request sent by the near field communication device, the first authentication request is sent to the near field communication device by another near field communication device, the first authentication request including the first key to be authenticated and a device identifier of the other near field communication device;

An authentication module, configured to authenticate the other near-field communication device by detecting whether the first key to be authenticated is one of a plurality of current keys of the other near-field communication device, and obtain first authentication result;

The sending module 53 is further configured to return the first authentication result to the near field communication device.

In this embodiment, the processing module 52 is further configured to initialize the count of the number of consecutive times that the first authentication result is an authentication failure;

The obtaining module 51 is further configured to obtain the current dispersion factor of the other near-field communication device if the first authentication result is that the number of consecutive authentication failures is greater than a preset threshold value;

The processing module 52 is further configured to obtain a plurality of current keys of the other near field communication device by using the locally stored master key and the current dispersion factor of the other near field communication device;

The sending module 53 is further configured to send a plurality of current keys of the another near field communication device to the other near field communication device, and initialize a count of consecutive times that the first authentication result is an authentication failure.

Optionally, in another implementation manner of this embodiment, the certificate authority may further include: a second receiving module, configured to receive a key invocation request sent by the near-field communication device, and the key The call request is sent by the near field communication device after receiving a first authentication request sent by another near field communication device, and the first authentication request includes the first key to be authenticated and the other near field communication device equipment identification;

The sending module 53 is further configured to send the master key to the near-field communication device, so that the near-field communication device can communicate with the other near-field communication device according to the master key and the first authentication request. The device is authenticated.

In this embodiment, the second receiving module is further configured to receive a key update request sent by the near field communication device and carrying the device identifier of the other near field communication device, the key update request is sent by the near field communication device after the consecutive number of authentication failures of the other near field communication device is greater than a preset threshold;

The obtaining module 51 is further configured to obtain the current dispersion factor of the another near-field communication device according to the key update request;

The processing module 52 is further configured to obtain a plurality of current keys of the other near field communication device by using the locally stored master key and the current dispersion factor of the other near field communication device;

The sending module 53 is further configured to send multiple current keys of the other near field communication device to the other near field communication device.

Optionally, in any of the above embodiments, the sending module 53 is further configured to send a key instruction to the near-field communication device; the certificate authority further includes: a third receiving module, configured to receive the near-field communication device The key response returned by the field communication device according to the key instruction; the sending module 53 is also used to receive the key response from the near field communication device according to the key instruction within the preset time after sending the key instruction. The returned key response is used to send the multiple current keys to the near field communication device.

Optionally, the obtaining module 51 is specifically configured to periodically obtain the current dispersion factor of the near field communication device; or, obtain the current dispersion factor of the near field communication device according to the key request of the near field communication device factor.

The certificate authority provided by this embodiment stores the master key used to obtain the current key of the near-field communication device in the certificate authority, and the certificate authority obtains the certificate of the near-field communication device according to the master key. current key, and send the current key to the near-field communication device, so that the near-field communication device performs interactive authentication with other near-field communication devices according to the multiple current keys, solving The security problem caused by the easy cracking of the master key stored in the near-field communication device in the prior art is solved, and the security of the near-field communication is effectively improved.

FIG. 6 is a schematic structural diagram of a near-field communication device provided in Embodiment 7 of the present invention. As shown in FIG. 6, the near-field communication device includes:

The receiving module 61 is configured to receive a plurality of current keys sent by the certificate authority, where the plurality of current keys are based on the local pre-stored master key and the current dispersion factor of the near field communication device by the certificate authority obtained, the current dispersion factor includes the device identifier and the current update identifier of the near field communication device;

A sending module 62, configured to send a second authentication request to another near-field communication device, where the second authentication request includes one of the plurality of current keys and the device identifier of the near-field communication device, so that another The near field communication device authenticates the near field communication device.

Optionally, the receiving module 61 is further configured to receive a first authentication request sent by the other near field communication device that includes the first key to be authenticated and the device identifier of the other near field communication device, the second An authentication request is sent by the another near field communication device after the near field communication device is successfully authenticated;

Correspondingly, the near field communication device further includes:

an authentication module, configured to authenticate the other near-field communication device according to the first authentication request;

A processing module, configured to establish a connection with the other near field communication device if the authentication of the other near field communication device is successful.

In any of the above embodiments, the receiving module 61 is also used to receive the key instruction sent by the certificate authority; the sending module 62 is also used to return the key to the certificate authority according to the key instruction response.

In any of the above implementation manners, the sending module 62 is further configured to send a key request to the certificate authority, so that the certificate authority obtains the current dispersion factor of the near field communication device according to the key request.

The near field communication device provided in this embodiment, before the near field communication device establishes a connection with another near field communication device, sends to another near field communication device including any current password received in advance from a certificate authority. Key authentication request, and after receiving the authentication request returned by the other near-field communication device, the technical solution for authenticating the other near-field communication device, so as to realize the interaction before the near-field communication device establishes a connection Authentication, thereby effectively improving the security of near-field communication.

Embodiment 8 of the present invention provides another near field communication device, according to the near field communication device described in Embodiment 7,

The receiving module 61 is further configured to receive a first authentication request sent by another near-field communication device, including the first key to be authenticated and the device identification of the other near-field communication device;

The near field communication device further includes: an authentication module, configured to authenticate the other near field communication device according to the first authentication request;

The sending module 62 is specifically configured to send the second authentication request to the other near field communication device if the authentication of the other near field communication device is successful.

According to the near field communication device described in Embodiment 7 or Embodiment 8, the authentication module may specifically include:

A first sending unit, configured to send the first authentication request to a certificate authority, so that the certificate authority authenticates the other near-field communication device according to the first authentication request;

A first receiving unit, configured to receive a first authentication result returned by the certificate authority after authenticating the other near-field communication device according to the first authentication request;

Or, the authentication module may specifically include:

a second sending unit, configured to send a key invocation request to the certificate authority;

a second receiving unit, configured to receive the master key returned by the certificate authority;

An authentication unit, configured to authenticate the other near field communication device according to the master key returned by the certificate authority and the first authentication request.

In the latter implementation manner, the second sending unit is further configured to send a certificate carrying the other certificate to the certificate authority if the first authentication result is that the number of consecutive authentication failures is greater than the threshold value. A key update request of the device identification of the field communication device, so that the certificate authority updates the current key of the other near field communication device according to the key update request.

The near-field communication device provided in this embodiment, through the near-field communication device according to the authentication request sent by another near-field communication device, after successfully authenticating the other near-field communication device, according to the locally received certificate from the certificate authorization center the current key, and send an authentication request including any of the current keys to the other near-field communication device, so as to realize the technical solution that the other near-field communication device performs interactive authentication on the near-field communication device , effectively improving the security of near-field communication.

It should be noted that both the certificate authority and the near-field communication device provided in the above embodiments can implement the steps of the near-field communication authentication method provided in any embodiment of the present invention, and the specific implementation method will not be repeated here.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (14)

1. A near-field communication authentication method, characterized in that, comprising: The certificate authority obtains the current dispersion factor of the near field communication device, and the current dispersion factor includes the device identification and the current update identification of the near field communication device; Obtaining a plurality of current keys of the near field communication device by using the locally pre-stored master key and the current dispersion factor; Sending the multiple current keys to the near field communication device, so that the near field communication device performs mutual authentication with other near field communication devices according to the multiple current keys. 2. The method according to claim 1, characterized in that, after sending the plurality of current keys to the near-field communication device, further comprising: Receive a first authentication request sent by the near field communication device, the first authentication request is sent to the near field communication device by another near field communication device, the first authentication request includes a first key to be authenticated and a device identification of said other near field communication device; Authenticating the other near-field communication device by detecting whether the first key to be authenticated is one of a plurality of current keys of the other near-field communication device, and obtaining a first authentication result; returning the first authentication result to the near field communication device. 3. The method according to claim 1 or 2, wherein after sending the multiple current keys to the near field communication device, further comprising: receiving a key invocation request sent by the near field communication device, the key invocation request is sent by the near field communication device after receiving a first authentication request sent by another near field communication device, the first The authentication request includes the first key to be authenticated and the device identifier of the other near field communication device; Sending the master key to the near field communication device, so that the near field communication device authenticates the other near field communication device according to the master key and the first authentication request. 4. A near-field communication authentication method, characterized in that, comprising: The near-field communication device receives multiple current keys sent by the certificate authority, the multiple current keys are obtained by the certificate authority according to the local pre-stored master key and the current dispersion factor of the near-field communication device , the current dispersion factor includes a device identifier and a current update identifier of the near field communication device; sending a second authentication request to another near field communication device, the second authentication request including one of the plurality of current keys and the device identification of the near field communication device, so that the other near field communication device The above-mentioned near-field communication device is authenticated. 5. The method according to claim 4, characterized in that, after sending the second authentication request to another near-field communication device, further comprising: Receive a first authentication request sent by the other near field communication device that includes the first key to be authenticated and the device identifier of the other near field communication device, where the first authentication request is the other near field communication sent by the device after the device successfully authenticates the near-field communication device; authenticating the other near field communication device according to the first authentication request; If the authentication of the other near field communication device is successful, establish a connection with the other near field communication device. 6. The method according to claim 4, characterized in that before sending the second authentication request to another near field communication device, further comprising: receiving a first authentication request sent by another near field communication device that includes a first key to be authenticated and a device identifier of the another near field communication device; authenticating the other near field communication device according to the first authentication request; The sending the second authentication request to another near field communication device specifically includes: If the authentication of the another near field communication device succeeds, sending the second authentication request to the another near field communication device. 7. The method according to claim 5 or 6, wherein the authenticating the other near-field communication device according to the first authentication request specifically comprises: sending the first authentication request to the certificate authority, and receiving a first authentication result returned by the certificate authority, the first authentication result being that the certificate authority Returned after authentication by another NFC device; or, Sending a key invocation request to the certificate authority, and authenticating the other near-field communication device according to the master key returned by the certificate authority and the first authentication request. 8. A certificate authority, characterized in that it comprises: An obtaining module, configured to obtain a current dispersion factor of the near field communication device, where the current dispersion factor includes a device identification and a current update identification of the near field communication device; The processing module is further configured to obtain a plurality of current keys of the near-field communication device by using the local pre-stored master key and the current dispersion factor; A sending module, configured to send the multiple current keys to the near field communication device, so that the near field communication device performs mutual authentication with other near field communication devices according to the multiple current keys. 9. The certificate authority according to claim 8, wherein the certificate authority further comprises: A first receiving module, configured to receive a first authentication request sent by the near field communication device, the first authentication request is sent to the near field communication device by another near field communication device, the first authentication request including the first key to be authenticated and the device identification of the other near field communication device; An authentication module, configured to authenticate the other near-field communication device by detecting whether the first key to be authenticated is one of a plurality of current keys of the other near-field communication device, and obtain first authentication result; The sending module is further configured to return the first authentication result to the near field communication device. 10. The certificate authority according to claim 8 or 9, wherein the certificate authority further comprises: The second receiving module is configured to receive the key invocation request sent by the near field communication device, the key invocation request is after the near field communication device receives the first authentication request sent by another near field communication device sent, the first authentication request includes the first key to be authenticated and the device identifier of the other near field communication device; The sending module is further configured to send the master key to the near-field communication device, so that the near-field communication device can verify the other near-field communication device according to the master key and the first authentication request. The communication device is authenticated. 11. A near-field communication device, comprising: A receiving module, configured to receive multiple current keys sent by the certificate authority, the multiple current keys are obtained by the certificate authority according to the local pre-stored master key and the current dispersion factor of the near field communication device Wherein, the current dispersion factor includes the device identification and the current update identification of the near field communication device; A sending module, configured to send a second authentication request to another near-field communication device, where the second authentication request includes one of the plurality of current keys and the device identifier of the near-field communication device, so that another near-field communication device The field communication device authenticates the near field communication device. 12. The near field communication device according to claim 11, wherein the receiving module is further configured to receive the first key to be authenticated and the other near field communication device sent by the other near field communication device. A first authentication request of the device identification of the field communication device, where the first authentication request is sent by the other near field communication device after the authentication of the near field communication device is successful; The near field communication device also includes: an authentication module, configured to authenticate the other near-field communication device according to the first authentication request; A processing module, configured to establish a connection with the other near field communication device if the authentication of the other near field communication device is successful. 13. The near field communication device according to claim 11, characterized in that, The receiving module is further configured to receive a first authentication request sent by another near-field communication device that includes a first key to be authenticated and a device identifier of the other near-field communication device; The near field communication device also includes: An authentication module, configured to authenticate the other near-field communication device according to the first authentication request; The sending module is specifically configured to send the second authentication request to the other near field communication device if the authentication of the other near field communication device is successful. 14. The near field communication device according to claim 12 or 13, wherein the authentication module specifically comprises: a first sending unit, configured to send the first authentication request to the certificate authority; A first receiving unit, configured to receive a first authentication result returned by the certificate authority center, where the first authentication result is that the certificate authority center authenticates the other near field communication device according to the first authentication request returned after; Or, the authentication module specifically includes: a second sending unit, configured to send a key invocation request to the certificate authority; a second receiving unit, configured to receive the master key returned by the certificate authority; An authentication unit, configured to authenticate the other near field communication device according to the master key returned by the certificate authority and the first authentication request.