TWI475866B - An authentication method of a chain structure - Google Patents

Description

Chain architecture authentication method

The present invention relates to an authentication method, and more particularly to a network type applied to a chain architecture, and the parties that need to perform authentication are authentication methods for generating data required for authentication by a third party.

According to the application field of cloud computing, vehicle-carried communication or mobile communication, when a requester (for example, a handheld device or a computer) needs to When a server (for example, a base station or a server, etc.) requests to provide a service (for example, data transmission, etc.), the requesting end and the server end need to perform an authentication operation, for example, using a conventional direct authentication or Indirect authentication method, after the identity of the requesting end is authenticated, the required service can be obtained.

For example, in a cloud computing environment, most community service websites such as Google, Yahoo, Twitter, or Facebook support OAuth or OpenID protocols as the basis for user authorization or authentication. Taking the OAuth protocol as an example, a user (User) applies for an account and a password before a service provider. When the user wants to access the user at a client, the user is stored in the OUSER protocol. When the resource of the service provider (for example, a business card, a preference, or an address book, etc.) is requested by the client to issue a request token (Request Token), after the service provider verifies the identity of the client, Granting the temporary token to the client, after obtaining the temporary token, the client directs the user to the authorization page (web) of the service provider to request authorization, and the temporary token and the client The return URL is sent to the service provider. After the user enters an account and password on the webpage of the service provider, and the resource requested by the client is authorized, the service provider redirects the user. Returning the webpage of the client, the client may request an access token from the service provider according to the temporary token, and the service provider according to the temporary token and the The user grants the access token to the client, and the client can use the access token to access the resource stored by the user on the service provider. Therefore, the OAuth protocol allows the user to authorize the client to query the service provider for his or her personal data under the protection of the password.

However, due to the cumbersome authentication and authorization procedures of the OAuth protocol, not only the authentication and authorization procedures are not efficient, but also the computational cost is high.

In addition, taking the OpenID protocol as an example, an End User only needs to register an identifier (for example, http://www.openid-provider.org) in advance with an identity provider (IdP) webpage (for example: http://www.openid-provider.org). Identifier) and a password, for example, the identifier is alice.openid-provider.org, and the password is 123. When the user wants to access a data supporting the OpenID protocol (Relying Party, RP), the user can input The identifier, and the relying end guides the user to return the login webpage of the identity provider. After the user inputs the password, the relying end redirects the user to return the use webpage of the relying end. Therefore, the OpenID protocol allows the user to log in to all the dependencies that support the OpenID protocol using the same set of identifiers and passwords.

However, because there are different levels of security loopholes in the identity providers provided by different vendors, when the identity provider and the relying party perform identity authentication of the user, they may be attacked, intercepted, eavesdropped or Deception and other security threats, and the rights of the user are damaged.

On the other hand, since the user must first authenticate with the identity provider, the service provided by the relying end can be obtained, and if the identity provider refuses to pass the identity of the user for any reason due to terrorist attacks or commercial interests. Certification will result in the user not being able to obtain the required services, thereby reducing the user's trust and usage.

In summary, when the traditional authentication method is used (for example, the network type applied to the chain architecture), it will cause doubts such as low performance, high cost, insufficient security, and monopoly services, and will be derived in actual use. Many limitations and shortcomings are inconvenient, and further improvements are needed to enhance their practicality.

The object of the present invention is to improve the above-mentioned shortcomings, and to provide a chain structure authentication method, which integrates the authentication materials required by the certification parties through a third party to improve performance and reduce costs.

A second object of the present invention is to provide a chain architecture authentication method, in which both parties authenticate and transmit data by using a shared key to improve data security.

Another object of the present invention is to provide a method for authenticating a chain architecture, which centrally controls the identity information and authentication materials of both parties through the third party, thereby avoiding monopolization of services.

The term "coupling" as used throughout the present invention refers to the transfer of data between two hardware modules by physical line electrical connection, wireless communication, or a combination thereof; or two software modules A software module or a software object transfers data to each other by means of data access or exchange for performing related operations of identity authentication, and the detailed operation thereof is common knowledge in the technical field to which the present invention pertains. Can understand.

"Linking" as used throughout the present invention means that two hardware modules are coupled to each other to form a chain. The detailed operation of the present invention is understood by those skilled in the art to which the present invention pertains.

The "Request End" as used throughout the present invention refers to a device (hereinafter referred to as a requesting device) for a user to issue an authentication request in a field of combining computing, telematics, or mobile communication, such as: A system composed of a computer, an On Board Unit (OBU), or a mobile device, and the requesting end may be constituted by a single requesting device, and the detailed operation thereof is in the technical field of the present invention. Usually the knowledge person can understand.

The "inquiry end" as used throughout the present invention refers to a device that requires authentication of a user (hereinafter referred to as an inquiry device) in the field of cloud computing, in-vehicle communication, or mobile communication, such as a servo. A system consisting of a server, a roadside unit (RSU), or a base station. The interrogation end can be composed of a single interrogating device, or can be linked by several interrogating devices. The operational situation is understood by those of ordinary skill in the art to which the present invention pertains.

The "Check End" as described in the full text of the present invention refers to a device that needs to cooperate to authenticate a user identity (hereinafter referred to as a search device) in the field of combining cloud computing, in-vehicle communication, or mobile communication. For example, a server (Server), a Road Side Unit (RSU), or a Visitor Location Register (VLR) system, the probe end can be composed of a single search device, or It is formed by linking several search devices to each other, and the detailed operation of the present invention can be understood by those having ordinary knowledge in the technical field to which the present invention pertains.

The "Response End" in the context of the present invention refers to a device (hereinafter referred to as a response device) that can store identity data and generate authentication data in a field of combining cloud computing, in-vehicle communication, or mobile communication. For example, an authentication server (AS), a service provider (SP), or a home location register (HLR) system, the response end can be composed of a single response device. The detailed operation of the present invention can be understood by those of ordinary skill in the art to which the present invention pertains.

A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal a response step; the response step is confirmed by the responding end that the request identity code and the query identity code are correct. After an authentication code is generated, the authentication code is first encrypted according to the key shared by the responding end and the requesting end, and Generating a request data, and encrypting the request data and the authentication code according to the key shared by the responding end and the querying end, generating an inquiry data, and transmitting the query data to the querying end; a notification step is performed by the The interrogating end decrypts the query data according to the key shared by the interrogating end and the responding end, and transmits the request data to the requesting end; and an authentication step is performed by the requesting end according to the gold shared by the requesting end and the responding end. The key decrypts the request data, and transmits the authentication code to the inquiry end, and the inquiry end confirms whether the authentication code and the authentication code of the inquiry data are the same.

A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; an inquiry step is performed by the query end Generating a challenge challenge code, and transmitting the request challenge code, the request identity code, the challenge challenge code, and an inquiry identity code to a response terminal; and a response step, the response terminal confirms the request identity code and the inquiry identity The code is correct. After an authentication code is generated, the authentication code and the request challenge code are encrypted according to the key shared by the responding end and the requesting end, and a request data is generated, and then the responding end is shared with the querying end according to the response end. The key encrypts the request data, the authentication code, the request challenge code and the challenge challenge code, generates an inquiry data, and transmits the inquiry data to the inquiry end; a notification step is performed by the inquiry end according to the inquiry end Decrypting the inquiry data with the key shared by the responding end, and after confirming that the inquiry challenge code of the inquiry data is correct, transmitting the request data to the requesting end; and an authentication step Decrypting the request data by the requesting end according to the key shared by the requesting end and the responding end. After confirming that the requesting challenge code of the requesting data is correct, the authentication code is transmitted to the querying end, and the interrogating end confirms the The authentication code is the same as the authentication code of the inquiry data.

A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal a response step, wherein the responding end confirms that the request identity code and the query identity code are correct. After an authentication code is generated, the authentication code is encrypted according to the key shared by the responding end and the querying end, and the authentication code is generated. Querying the information and transmitting the inquiry data to the inquiry end; in a notification step, the inquiry end first decrypts the inquiry data according to the key shared by the response end and the inquiry end, and then according to the inquiry end and the request end The shared key encrypts the authentication code, generates a request data, and transmits the request data to the requesting end; and an authentication step, the requesting end decrypts the request by the requesting end according to the key shared by the querying end and the requesting end And transmitting the authentication code to the inquiry end, and the inquiry end confirms whether the authentication code is the same as the authentication code of the inquiry data.

A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; an inquiry step is performed by the query end Generating a challenge challenge code, and transmitting the request challenge code, the request identity code, the challenge challenge code, and an inquiry identity code to a response terminal; and a response step, the response terminal confirms the request identity code and the inquiry identity The code is correct. After an authentication code is generated, the authentication code, the challenge challenge code and the request challenge code are encrypted according to the key shared by the responding end and the querying end, and an inquiry data is generated, and the inquiry data is transmitted to the code. The inquiry end; the notification step is performed by the inquiry end first decrypting the inquiry data according to the key shared by the inquiry end and the response end, and after confirming that the inquiry challenge code of the inquiry data is correct, according to the inquiry end and the request End-shared key encrypts the authentication code and the request challenge code, generates a request data, and transmits the request data to the requesting end; and an authentication step is performed by the The requesting end decrypts the request data according to the key shared by the requesting end and the interrogating end. After confirming that the requesting challenge code of the requesting data is correct, the authentication code is transmitted to the interrogating end, and the interrogating end confirms the authentication code and the Ask if the authentication code of the data is the same.

A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal The detecting end transmits a request identity code, the inquiry identity code and a search identity code to a response terminal, and a response step confirms the request identity code by the response terminal The inquiry identity code and the inspection identity code are correct. After an authentication code is generated, the authentication code is first encrypted according to the key shared by the response end and the requesting end, and a request data is generated, and then according to the response end. The probe shared by the probe end encrypts the request data and the authentication code, and generates a probe data, and transmits the probe data to the probe terminal; and a delivery step is performed by the probe terminal according to the response The key shared by the search end decrypts the search data, and then encrypts the request data and the authentication code according to the key shared by the search end and the inquiry end, generates an inquiry data, and transmits the inquiry data. To the inquiry a notification step, the inquiry end decrypts the inquiry data according to the key shared by the inquiry end and the inquiry end, and transmits the request data to the requesting end; and an authentication step is performed by the requesting end The responding party decrypts the request data with the key shared by the requesting end, and transmits the authentication code to the querying end, and the interrogating end confirms whether the authentication code and the authentication code of the query data are the same.

A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; an inquiry step is performed by the query end Generating a challenge challenge code, and transmitting the request challenge code, the request identity code, the challenge challenge code, and a query identity code to a probe terminal; and a query step, the probe terminal generates a probe challenge code And transmitting the request challenge code, the request identity code, the challenge challenge code, the query identity code and the search challenge code and a search identity code to a response end; a response step is confirmed by the response terminal The request identity code, the query identity code, and the query identity code are correct. After an authentication code is generated, the authentication code and the request challenge code are encrypted according to the key shared by the responding end and the requesting end, and a request is generated. And generating, according to the key shared by the responding end and the detecting end, the request data, the authentication code, the request challenge code, the query challenge code, and the search challenge code, to generate a search data, and Sending the search data to the detecting end; in a transmitting step, the detecting end first decrypts the detecting data according to the key shared by the detecting end and the responding end, and confirms the detecting of the detecting data After the challenge code is correct, the request data, the authentication code, the request challenge code and the challenge challenge code are encrypted according to the key shared by the probe end and the query end, and an inquiry data is generated, and the inquiry data is transmitted to The inquiry end is a notification step, wherein the inquiry end decrypts the inquiry data according to the key shared by the inquiry end and the inquiry end, and after the inquiry challenge code of the inquiry data is confirmed to be correct, the request data is transmitted to the request. And an authentication step of decrypting the request data by the requesting end according to the key shared by the requesting end and the responding end, and after confirming that the requesting challenge code of the requested data is correct, transmitting the authentication code to the querying end, It is confirmed by the interrogating end whether the authentication code and the authentication code of the inquiry data are the same.

The above and other objects, features and advantages of the present invention will become more <RTIgt; The system architecture diagram of the first embodiment of the authentication method of the chain architecture of the present invention includes a request end 1, an inquiry end 2 and a response end 3, and the interrogation end 2 The requesting end 1 and the responding end 3 are coupled, wherein the responding end 3 and the interrogating end 2 share a key K (3, 2) for adding/decrypting the responding end 3 and the interrogating end 2 The data transmitted between the responder 3 and the requester 1 has a key K (3, 1) for adding/decrypting the data transmitted by the responder 3 to the requester 1 via the interrogator 2. Therefore, the requesting end 1, the interrogating end 2 and the responding end 3 together form a Wind-Bell Chain Structure. The interrogating device at the two ends is coupled to the requesting end 1 and the responding end 3, respectively, and the responding end 3 and the interrogating device are respectively owned by the interrogating device respectively. Different keys. For the convenience of the following description, only one interrogating device is used as the interrogating terminal 2, and the requesting end 1 and the responding end 3 are coupled as an implementation manner, but not limited thereto.

Referring to FIG. 2, it is an operational flowchart of the first embodiment of the authentication method of the chain architecture of the present invention, wherein the authentication method of the chain architecture sequentially performs a request step S1, an inquiry step S2, and a response. Step S3, a notification step S4 and an authentication step S5. In this embodiment, the request step S1, the query step S2, the response step S3, the notification step S4, and the authentication step S5 may be performed by using a one-way or two-way authentication process, as described later: the request step S1 is selectable. A one-way authentication process is performed, and the requesting end 1 transmits a request identity code to the interrogating end 2 to perform a one-way authentication process. Alternatively, the two-way authentication process is selected, and the requesting terminal 1 generates a request challenge code, and then transmits the request challenge code and the request identity code to the query terminal 2 to perform a two-way authentication process. The request identity code is a universal unique identifier sent by the responding end 3 to the requesting end 1 when the requesting end 1 registers with the responding end 3 in advance; the request challenge code can be selected as a randomly generated random number, A time stamp generated in time or a serial number generated in sequence. In this embodiment, when the requesting end 1 requests the interrogating end 2 to perform an authentication operation, for example, before the requesting end 1 requests the interrogating end 2 to provide a service, the requesting end 1 must first pass the identity authentication, and therefore, the requesting end 1 The requesting end 1 can transmit the request identity code to the interrogating end 2 as a basis for requesting the interrogating end 2 to perform an authentication operation. When the interrogating end 2 receives the requesting identity code, it can know that the requesting end 1 wants to perform The identity authentication operation; or the requesting end 1 can transmit the request challenge code and the request identity code to the interrogation end 2, wherein the requesting end 1 can store the request challenge code, and according to the request, the challenge code is correct. The ground is returned for the requester 1 to confirm the validity of the data it receives.

In the inquiry step S2, the one-way authentication process can be selected, and the requesting end 2 transmits the request identity code and a query identity code to the responding end 3. Alternatively, the two-way authentication process is selected, and the inquiry challenge 2 generates a challenge challenge code, and transmits the request challenge code, the request identity code, the challenge challenge code, and the inquiry identity code to the response terminal 3. Wherein, the inquiry identity code is a universal unique identification code sent by the response terminal 3 to the inquiry terminal 2 when the inquiry terminal 2 registers with the response terminal 3 in advance; the challenge challenge code can be selected as a randomly generated random number, A time stamp generated in time or a serial number generated in sequence. In this embodiment, after receiving the request identity code transmitted by the requesting end 1, the interrogating end 2 knows that the requesting end 1 requests the interrogating end 2 to perform an authentication operation, and then the interrogating end 2 will further request The responding end 3 assists in the authentication operation, and then transmits the request identity code and the inquiry identity code to the responding end 3 as a basis for requesting the responding end 3 to assist the authentication operation; on the other hand, if the requesting end 1 transmits the request The challenge code and the request challenge code are sent to the query terminal 2, and the query terminal 2 may first store the request challenge code, and then generate the challenge challenge code as a basis for the inquiry terminal 2 to confirm whether the received data is valid, and then the query The terminal 2 transmits the request challenge code, the request identity code, the challenge challenge code and the challenge identity code to the responding terminal 3.

In addition, if the interrogating end 2 is linked by a plurality of interrogating devices, in the inquiry step S2, each interrogating device may query the identity code and the received request identity code and the inquiry identity code (or include the Requesting the challenge code and the challenge challenge code) to transmit to the next inquiry device, and finally, transmitting the request identity code and the inquiry identity code (or including the request challenge code and the challenge challenge code) to the inquiry device coupled to the response terminal 3 to the In response to the terminal 3, the first embodiment of the present invention is applied to the authentication process of the multi-party authentication, which can be understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

In response to step S3, the one-way authentication process may be selected, and the responding end 3 confirms that the request identity code and the query identity code are correct. After an authentication code is generated, the responding terminal 3 is first shared with the requesting end 1 according to the responding end 3. The key K(3,1) encrypts the authentication code, generates a request data, and encrypts the request data and the authentication code according to the key K(3, 2) shared by the responding end 3 and the interrogating end 2, An inquiry data is generated, and the inquiry data is transmitted to the inquiry terminal 2. Alternatively, the two-way authentication process is selected, and the responding end 3 confirms that the request identity code and the query identity code are correct. After the authentication code is generated, the key K shared by the responding end 3 and the requesting end 1 is first used. 1) encrypting the authentication code and the request challenge code, generating the request data, and encrypting the request data, the authentication code, and the key according to the key K(3, 2) shared by the responding end 3 and the interrogating end 2 The challenge code and the challenge challenge code are requested, and the inquiry data is generated, and the inquiry data is transmitted to the inquiry terminal 2. The authentication code may be in the form of a session key, a signature, a ticket, or a credential. In this embodiment, the responding end 3 can accept the requesting end 1 and the interrogating end 2 to register in advance, and store the identity authentication data of the requesting end 1 and the interrogating end 2, for example, the request identity code and the query. The identity code, after the response terminal 3 receives the information transmitted by the inquiry terminal 2 (for example, the request identity code and the inquiry identity code), it is known that the inquiry terminal 2 requests the response terminal 3 to assist in the authentication operation. The responding end 3 will confirm whether the inquiry identity code and the request identity code are valid, for example, confirming whether the inquiry identity code and the request identity code have been stored in advance for identifying the identity of the inquiry terminal 2 and the requester 1 Whether it is a legal identity.

If the identity of the interrogating end 2 and the requesting end 1 are both legal, the responding end 3 will generate the authentication code for the interrogating end 2 and the requesting end 1 to perform subsequent authentication operations. Since the authentication code must be transmitted to the interrogating end 2, and then transmitted by the interrogating end 2 to the requesting end 1, in order to prevent the authentication code from being attacked, intercepted, and eavesdropped by a malicious attacker (for example, a hacker, Hacker) Or spoofing, etc., therefore, the responding end 3 first encrypts the authentication code according to the key K(3,1) shared by the responding end 3 and the requesting end 1, and generates the request data as the requesting end 1 for authentication. The information required for the process, the request data can be formed by means of data encryption by a key, as shown in the following formula (1):

D1=E _K(3,1) (R) (1)

Wherein D1 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3, 1) is a key shared by the responding end 3 with the requesting end 1; R is the authentication code.

Then, the responding end 3 encrypts the request data and the authentication code according to the key K (3, 2) shared by the responding end 3 and the interrogating end 2, and generates the query data to provide the query end 2 for authentication. The information required for the process can be formed by means of data encryption by a conventional key, as shown in the following formula (2):

D2=E _K(3,2) (R,D1) (2)

Wherein D2 is the query data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3, 2) is a key shared by the responding end 3 and the interrogating end 2; R is the authentication Code; D1 is the request data. Then, the responding end 3 transmits the query data to the interrogating end 2, since the authentication code and the request data are encrypted by using the key shared by the responding end 3 and the interrogating end 2, therefore, the The authentication code and the security of the request data during the transmission process.

In addition, since the request challenge code and the challenge challenge code can respectively confirm the correctness of the data by the requesting end 1 and the interrogating end 2, the responding end 3 can also separately transmit the request challenge code and the challenge challenge code to the request. End 1 and the interrogating end 2, and the authentication code must first be transmitted to the interrogating end 2, and then transmitted by the interrogating end 2 to the requesting end 1 to ensure the authentication code and request challenge code transmitted by the responding end 3. And querying the data security of the challenge code. Therefore, the responding end 3 first encrypts the authentication code and the request challenge code according to the key K (3, 1) shared by the responding end 3 and the requesting end 1 to generate the request. The data is used as information for providing the requesting end 1 for the authentication process, and the request data can be formed by using a data encryption method by a key, as shown in the following formula (3):

D3=E _K(3,1) (R,C ₁ ) (3)

Wherein D3 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3, 1) is a key shared by the responding end 3 with the requesting end 1; R is the authentication Code; C _{1 is} the request challenge code.

Then, the responding end 3 encrypts the request data, the authentication code, the request challenge code, and the challenge challenge code according to the key K(3, 2) shared by the responding end 3 and the interrogating end 2, and generates the query data as Providing the information required by the inquiry terminal 2 for the authentication process, the inquiry data can be formed by using a data encryption method by a key, as shown in the following formula (4):

_{D4 = E K (3,2) (} D3, R, C 1, C 2) (4)

Wherein D4 is the query data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3, 2) is a key shared by the responding end 3 and the interrogating end 2; D3 is the request Data; R is the authentication code; C _{1 is} the request challenge code; C _{2 is} the challenge challenge code. Thereafter, the response data is transmitted by the responding end 3 to the interrogating terminal 2.

In the notification step S4, the one-way authentication process may be selected, and the inquiry terminal 2 decrypts the inquiry data according to the key K(3, 2) shared by the response terminal 3 and the inquiry terminal 2, and transmits the request data to The request side is 1. Alternatively, the two-way authentication process is selected, and the interrogating end 2 decrypts the query data according to the key K(3, 2) shared by the responding end 3 and the interrogating end 2, and after the inquiry challenge code of the query data is confirmed to be correct, The request data is transmitted to the requesting end 1. In this embodiment, after the interrogating end 2 receives the inquiry data transmitted by the responding end 3, the interrogation data can be decrypted by using the key K(3, 2) shared by the responding end 3 and the interrogating end 2 The decryption mode is the corresponding decryption mode of the encryption mode used by the responding end 3, which is well understood by those skilled in the art and will not be described here. After the inquiry data is decrypted, the inquiry terminal 2 can obtain the authentication code and the request data included in the inquiry data, and if the inquiry data includes the request challenge code and the challenge challenge code, the inquiry terminal 2 will confirm the inquiry. The validity of the data, for example: only if the inquiry challenge code included in the inquiry data is the same as the inquiry challenge code transmitted by the inquiry terminal 2 to the response terminal 3; or, in addition, the inquiry is compared The request challenge code included in the data is the same as the request challenge code transmitted by the requester 1 to the interrogator 2 to increase the strength of the confirmation of the validity of the data. If the inquiry data is valid data, after the inquiry terminal 2 stores the authentication code, the request data included in the inquiry data may be further transmitted to the requesting end 1 for the requesting end 1 to perform a subsequent authentication process.

In addition, if the interrogating end 2 is formed by linking a plurality of interrogating devices to each other, in the notifying step S4, each interrogating device may directly transmit the interrogation data to the next interrogating device; or confirm that the interrogation data is valid. After the sex, the inquiry data is transmitted again, and there is no limit here. Finally, the inquiry device coupled to the requesting end 1 decrypts the inquiry data, and transmits the request data to the requesting end 1, and applies the first embodiment of the present invention to the authentication process of the multi-party authentication, which belongs to the technology of the present invention. Those who have the usual knowledge in the field can understand it and will not repeat them here.

In the authentication step S5, the one-way authentication process may be selected, and the requesting end 1 decrypts the request data according to the key K(3, 1) shared by the responding end 3 and the requesting end 1, and transmits the authentication code to The interrogating end 2, by the interrogating end 2, confirms whether the authentication code is identical to the authentication code of the interrogation data. Alternatively, the two-way authentication process is selected, and the requesting end 1 decrypts the request data according to the key K(3,1) shared by the responding end 3 and the requesting end 1. After the request challenge code of the request data is confirmed to be correct, The authentication code is transmitted to the interrogating end 2, and the interrogating end 2 confirms whether the authentication code is identical to the authentication code of the interrogation data. In this embodiment, after the requesting end 1 receives the request data transmitted by the interrogating end 2, the requesting end 3 can decrypt the requested data by using the key K(3, 1) shared by the responding end 3 and the requesting end 1. The decryption mode is the corresponding decryption mode of the encryption mode used by the responding end 3, which is well understood by those skilled in the art and will not be described here. After the request data is decrypted, the requesting end 1 can obtain the authentication code included in the request data, and if the request data includes the request challenge code, the requesting end 1 can confirm the request challenge code included in the request data. The request challenge code transmitted by the requesting end 1 to the interrogating end 2 is the same, ensuring that the requesting material is valid data, and then the requesting end 1 transmits the authentication code included in the requesting data to the interrogating end 2, that is, It can be confirmed by the interrogating terminal 2 whether the authentication code transmitted by the requesting end 1 is a valid authentication code, for example, whether the authentication code transmitted by the requesting end 1 and the authentication code previously stored by the interrogating end 2 are the same. If the comparison result is "identical", the authentication code transmitted by the requesting end 1 is a valid authentication code, and the interrogating end 2 will consider that the identity of the requesting end 1 has passed the authentication. Therefore, the authentication can be further performed after the authentication is passed. The job, for example, is provided by the interrogator 2 to the requester 1 and the like.

In addition, if the interrogating end 2 is linked by a plurality of interrogating devices, in the authentication step S5, each interrogating device can transmit the request data to the next interrogating device, and finally, the requesting end 1 needs to be authenticated. The inquiry device (for example, the inquiry device providing the service to the requesting end 1 or the like) confirms whether the authentication code transmitted by the requesting end 1 is a valid authentication code, and applies the first embodiment of the present invention to the authentication process of the multi-party authentication. It is understood by those of ordinary skill in the art to which the present invention pertains, and is not described herein.

Therefore, the authentication process of the first embodiment of the authentication method of the chain architecture of the present invention only needs the request step S1, the query step S2, the response step S3, the notification step S4, and the authentication step S5 to complete the identity authentication of the requester 1 Further, the conventional authentication process is greatly simplified; further, the interrogating end 2 and the requesting end 1 can confirm the validity of the data by the query challenge code/request challenge code; and the responder 3 transmits to the interrogating end 2 and the request The data of the end 1 can also be encrypted/decrypted by the keys K(3, 2) and K(3, 1) to improve the security of data transmission.

Referring to FIG. 3, it is a system architecture diagram of a second embodiment of the authentication method of the chain architecture of the present invention, comprising a requesting end 1', a querying end 2' and a responding end 3', the interrogating end 2' The requesting end 1' and the responding end 3' are coupled, wherein the responding end 3' and the interrogating end 2' jointly have a key K(3', 2') for adding/decrypting the responding end 3 'The data passed between the interrogating end 2'; the interrogating end 2' and the requesting end 1' jointly have a key K(2', 1') for adding/decrypting the responding end 3' via The data sent by the interrogating end 2' to the requesting end 1'. Therefore, the requesting end 1', the interrogating end 2' and the responding end 3' together form a Swing Chain Structure. If the interrogating end 2' is linked by a plurality of interrogating devices, the interrogating devices at the two ends of the coupling are coupled to the requesting end 1' and the responding end 3', respectively. Devices have different keys together. For the convenience of the following description, only one interrogating device is used as the interrogating end 2', and the requesting end 1' and the responding end 3' are coupled to the embodiment, but not limited thereto.

Please refer to FIG. 2 , which is an operational flowchart of the second embodiment of the authentication method of the chain architecture of the present invention, wherein the authentication method of the chain architecture sequentially performs a request step S1 ′ and an inquiry step S2 ′. A response step S3', a notification step S4', and an authentication step S5'. In the present embodiment, the request step S1', the inquiry step S2', the response step S3', the notification step S4', and the authentication step S5' may be performed using a one-way or two-way authentication flow, as will be described later:

The requesting step S1' is optional to perform a one-way authentication process, and the requesting end 1' transmits the request identity code to the interrogating end 2' for performing a one-way authentication process. Alternatively, the two-way authentication process is selected, the request challenge code is generated by the requesting end 1', and the request challenge code and the request identity code are transmitted to the interrogating end 2' to perform a two-way authentication process. The request identity code is a universal unique identifier that is sent by the responding end 3' to the requesting end 1' when the requesting end 1' registers with the responding end 3'. In the present embodiment, the requesting step S1' is substantially the same as the requesting step S1 of the first embodiment, and details are not described herein.

The inquiry step S2' is optional to perform a one-way authentication process by which the request identity code and the challenge identity code are transmitted to the response terminal 3'. Alternatively, a two-way authentication process is selected, a challenge challenge code is generated by the interrogation terminal 2', and the request challenge code, the request identity code, the challenge challenge code, and the challenge identity code are transmitted to the response terminal 3'. The inquiry identity code is the universal unique identification code issued by the response terminal 3' to the inquiry terminal 2' when the inquiry terminal 2' registers with the response terminal 3' in advance. In the present embodiment, the inquiry step S2' is substantially the same as the inquiry step S2 of the first embodiment, and details are not described herein.

In addition, if the interrogating end 2' is formed by linking a plurality of interrogating devices, in the inquiry step S2', each interrogating device may query the identity code and the received request identity code and the inquiry identity code (or Transmitting the request challenge code and the challenge challenge code to the next inquiry device, and finally, transmitting the request identity code and the plurality of inquiry identity codes to the response terminal 3' by the inquiry device coupled to the response terminal 3', The second embodiment of the present invention is applied to the authentication process of the multi-party authentication, which can be understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

In response to step S3', the one-way authentication process may be selected, and the responding end 3' confirms that the request identity code and the query identity code are correct. After the authentication code is generated, according to the responding end 3' and the interrogating end 2' The shared key K(3', 2') encrypts the authentication code, generates the inquiry data, and transmits the inquiry data to the inquiry terminal 2'. Alternatively, selecting a two-way authentication process, the responding end 3' confirms that the request identity code and the query identity code are correct, and after the authentication code is generated, according to the key K shared by the responding end 3' and the interrogating end 2' (3', 2') encrypting the authentication code, the challenge challenge code, and the request challenge code, generating the inquiry material, and transmitting the inquiry data to the inquiry terminal 2'.

The authentication code is substantially the same as the authentication code of the first embodiment, and details are not described herein. In this embodiment, the responding end 3' can accept the requesting end 1' and the interrogating end 2' to register in advance, and store the identity authentication information of the requesting end 1' and the interrogating end 2', for example: the request The identity code and the inquiry identity code, after the response terminal 3' receives the request identity code transmitted by the inquiry terminal 2' and the inquiry identity code, it is learned that the inquiry terminal 2' requests the response terminal 3' to assist The authentication operation, at this time, the responding end 3' will confirm whether the inquiry identity code and the request identity code are valid, to identify whether the identity of the inquiry terminal 2' and the requesting terminal 1' is a legal identity.

If the identity of the interrogating end 2' and the requesting end 1' are both legal, the responding end 3' will generate the authentication code for the interrogating end 2' and the requesting end 1' to perform subsequent authentication operations. . Since the authentication code must be transmitted to the interrogating end 2', in order to prevent the authentication code from being attacked, intercepted, eavesdropped or deceived by a malicious attacker, the responding end 3 first depends on the responding end 3' and the interrogating end. 2' The shared key K(3', 2') encrypts the authentication code, and generates the inquiry data as the information required to provide the inquiry terminal 2' for the authentication process, and the inquiry data can be learned by the conventional use of gold. The key is formed by means of data encryption, as shown in the following formula (5):

D5=E _K(3',2') (R) (5)

Wherein D5 is the query data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; and K(3', 2') is a key shared by the responding end 3' and the interrogating end 2'; R is the authentication code. Then, the responding end 3' transmits the query data to the interrogating end 2', since the authentication code is encrypted by using the key shared by the responding end 3' and the interrogating end 2', thereby ensuring the The security of the authentication code during the transmission process.

In addition, since the request challenge code and the challenge challenge code are respectively used by the requesting end 1' and the interrogating end 2' to confirm the correctness of the data, the responding end 3' can also transmit the request challenge code and the challenge challenge code to The interrogating end 2' and the requesting end 1', wherein the authentication code must first be transmitted to the interrogating end 2', and then transmitted by the interrogating end 2' to the requesting end 1', to ensure that the responding end 3' The transmitted authentication code, the request challenge code, and the data security of the challenge code are requested. Therefore, the responder 3' encrypts according to the key K(3', 2') shared by the responder 3' and the challenger 2'. The authentication code, the challenge challenge code and the request challenge code are generated, and the inquiry data is generated as information required for providing the inquiry terminal 2' to perform an authentication process, and the inquiry data may be encrypted by using a key to learn data by using a key. The mode is formed as shown in the following formula (6):

D6=E _K(3',2') (R,C _1' ,C _2' ) (6)

Wherein D6 is the query data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; and K(3', 2') is a key shared by the responding end 3' and the interrogating end 2'; R is the authentication code; C _{1 'is} the request challenge code; C _{2 ' is} the challenge challenge code. Thereafter, the response data is transmitted by the responding end 3' to the interrogating end 2'.

In the notification step S4', the one-way authentication process may be selected, and the querying end 2' first decrypts the query data according to the key K(3', 2') shared by the responding end 3' and the interrogating end 2'. And encrypting the authentication code according to the key K' (2', 1') shared by the interrogating end 2' with the requesting end 1', generating a request data, and transmitting the request data to the requesting end 1'. Alternatively, the two-way authentication process is selected, and the querying end 2' first decrypts the query data according to the key K(3', 2') shared by the responding end 3' and the interrogating end 2', and the inquiry data is to be confirmed. After the challenge code is correct, the authentication code and the challenge code are encrypted according to the key K' (2', 1') shared by the inquiry end 2' with the requesting end 1', and the request data is generated, and the request is transmitted. Data to the requester 1'. In this embodiment, after the interrogating end 2' receives the inquiry data transmitted by the responding end 3', the key K(3', 2 shared by the responding end 3' and the interrogating end 2' can be utilized. ') Decrypt the query data, and the decryption mode is the corresponding decryption mode of the encryption mode used by the responding end 3', which is well understood by those skilled in the art and will not be described here. When the inquiry data is decrypted, the inquiry terminal 2 can obtain the authentication code included in the inquiry data.

Then, in order to avoid the attack, interception, eavesdropping or spoofing by the malicious attacker during the transmission of the authentication code to the requesting end 1', the interrogating end 2' will follow the interrogating end 2' and the requesting end. 1' The shared key K(2', 1') encrypts the authentication code, and generates the request data as information required to provide the requesting end 1' to perform the authentication process, and the request data can be learned by the conventional use of gold. The key is formed by means of data encryption, as shown in the following formula (7):

D7=E _K(2',1') (R) (7)

Wherein D7 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; and K(2', 1') is a key shared by the interrogating end 2' and the requesting end 1'; R is the authentication code. Thereafter, the request data is transmitted from the interrogating end 2' to the requesting end 1', whereby the security of the authentication code during the transmission process can be ensured.

Furthermore, if the inquiry data includes the request challenge code, after the inquiry end 2' confirms that the inquiry data is valid, the inquiry end 2' may firstly share the gold with the request end 1' according to the inquiry end 2'. The key K(2', 1') encrypts the authentication code and requests the challenge code, and generates the request data as information required to provide the requesting end 1' to perform the authentication process, and the request data may be learned by using a key. The method of data encryption is formed as shown in the following formula (8):

D8=E _K(2',1') (R,C _1' ) (8)

Wherein D8 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; and K(2', 1') is a key shared by the interrogating end 2' and the requesting end 1'; R is the authentication code; C _{1 ' is} the request challenge code. Thereafter, the request data is transmitted to the requesting end 1' by the interrogating end 2'.

In addition, if the interrogating end 2' is formed by linking a plurality of interrogating devices, in the notifying step S4', each interrogating device may directly transmit the query data to the next interrogating device; or, confirm After the validity of the inquiry data, the inquiry data is transmitted again, and there is no limit here. Finally, the interrogation device coupled to the requesting end 1' decrypts the query data and transmits the request data to the requesting end 1', and the second embodiment of the present invention is applied to the authentication process of the multi-party authentication, which is the present invention Those skilled in the art can understand that it is not described here.

In the authentication step S5', the one-way authentication process may be selected, and the requesting end 1' decrypts the request data according to the key K(2', 1') shared by the interrogating end 2' and the requesting end 1'. And transmitting the authentication code to the query terminal 2', and the inquiry terminal 2' confirms whether the authentication code and the authentication code of the inquiry data are the same. Alternatively, the two-way authentication process is selected, and the requesting end 1' decrypts the request data according to the key K(2', 1') shared by the interrogating end 2' and the requesting end 1', and the request for confirming the request data is confirmed. After the challenge code is correct, the authentication code is transmitted to the inquiry terminal 2', and the inquiry terminal 2' confirms whether the authentication code and the authentication code of the inquiry data are the same. In this embodiment, after the requesting end 1' receives the request data transmitted by the interrogating end 2', the requesting end 2' can be utilized to share the key K(2', 1 with the requesting end 1'. ') Decrypt the request data, and the decryption mode is the corresponding decryption mode of the encryption mode used by the query terminal 2', which is well understood by those skilled in the art and will not be described here. After the request data is decrypted, if the request data includes the request challenge code, after confirming that the request data is valid, the requesting end 1' may transmit the authentication code included in the request data to the query terminal 2' The inquiry end 2' confirms whether the authentication code transmitted by the requesting end 1' is a valid authentication code as a basis for authenticating the identity of the requesting end 1'.

In addition, if the interrogating end 2' is formed by linking a plurality of interrogating devices to each other, in the authentication step S5', each interrogating device can transmit the request data to the next interrogating device, and finally, the request needs to be authenticated. The interrogating device of the terminal 1' (for example, the inquiry device providing the service to the requesting end 1', etc.) confirms whether the authentication code transmitted by the requesting end 1' is a valid authentication code, and applies the second embodiment of the present invention. The authentication process of the multi-party authentication can be understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

Therefore, the authentication process of the second embodiment of the authentication method of the chain architecture of the present invention only needs to complete the request by the request step S1', the query step S2', the response step S3', the notification step S4', and the authentication step S5'. Identity authentication of the terminal 1'; further, the query terminal 2' and the requesting terminal 1' can also confirm the validity of the data by using the challenge challenge code and requesting the challenge code; in addition, the response terminal 3' transmits to the query terminal The data of 2' and requester 1' can also be encrypted/decrypted by the keys K(3', 2') and K(2', 1') to improve the security of data transmission.

Referring to FIG. 4, it is a system architecture diagram of a third embodiment of the authentication method of the chain architecture of the present invention, including a requesting end 1", a querying end 2a, a detecting end 2b and a responding end 3", The interrogating end 2a is coupled to the requesting end 1", and the detecting end 2b is coupled to the interrogating end 2a and the responding end 3", wherein the responding end 3" and the requesting end 1" jointly own a key K ( 3", 1") for adding/decrypting the data of the responding end 3" to the requesting end 1" via the interrogating end 2a and the detecting end 2b; the responding end 3" is shared with the detecting end 2b There is a key K (3", 2b) for adding/decrypting the data transmitted between the responding end 3" and the detecting end 2b; the detecting end 2b and the interrogating end 2a jointly own a key K (2b, 2a) for encrypting/decrypting the data transmitted between the probe terminal 2b and the query terminal 2a. Therefore, the request terminal 1", the query terminal 2a, the probe terminal 2b, and the response terminal 3 "Hybrid Chain Structure" is formed together, wherein if the interrogating end 2a is interconnected by a plurality of interrogating devices, the interrogating devices at the two coupled ends are respectively coupled to the request 1" and the detecting end 2b; if the detecting end 2b is connected by a plurality of detecting devices, the detecting devices located at the two ends of the coupling are respectively coupled to the interrogating end 2a and the responding end 3" The key sharing form may be any combination of the wind chime chain and the swing chain of the present invention, for example, the responding end 3" shares different keys with different interrogating devices, or the responding end 3" and different detecting devices Different keys are shared separately, or any two interlinked query devices share different keys, or any two mutually linked search devices share different keys, etc., but not limited thereto. For the convenience of subsequent explanation, only one inquiry is provided. As the interrogating end 2a, the device is coupled to the requesting end 1" and a detecting end 2b, and a detecting device is used as the detecting end 2b, and the interrogating end 2a and the responding end 3" are coupled as an implementation manner. However, it is not limited to this.

Referring to FIG. 5, it is an operational flowchart of the third embodiment of the authentication method of the chain architecture of the present invention, wherein the authentication method of the chain architecture sequentially performs a request step S1", an inquiry step S2a, and a Step S2b, a response step S3a, a delivery step S3b, a notification step S4", and an authentication step S5". In this embodiment, the request step S1" may be performed using a one-way or two-way authentication procedure, and the inquiry step S2a, inquiry step S2b, response step S3a, delivery step S3b, notification step S4", and authentication step S5", respectively, as follows:

The requesting step S1" is optional to perform a one-way authentication process, and the requesting end 1" transmits a request identity code to the interrogating end 2a. Alternatively, selecting a two-way authentication process, the requesting end 1" generates a request challenge code, and transmitting the request challenge code and the request identity code to the interrogating end 2a. wherein the request identity code is the requesting end 1" When registering with the responding terminal 3", the responding terminal 3" issues a universal unique identifier to the requesting terminal 1". In the present embodiment, the requesting step S1" is substantially similar to the requesting step S1 of the first embodiment. The same, I will not repeat them here.

In the inquiry step S2a, the one-way authentication process can be selected, and the requesting end 2a transmits the request identity code and an inquiry identity code to the detecting end 2b. Alternatively, the two-way authentication process is selected, and the challenge challenge code is generated by the query terminal 2a, and the request challenge code, the request identity code, the challenge challenge code, and the challenge identity code are transmitted to the probe terminal 2b. The inquiry identity code is a universal unique identification code issued by the response terminal 3a to the inquiry terminal 2a when the inquiry terminal 2a registers with the response terminal 3" in advance. In this embodiment, after the interrogating end 2a receives the request identity code transmitted by the requesting end 1", the interrogating end 2a will further request the detecting end 2b to assist in the authentication operation, thereby transmitting the request identity code. And inquiring the identity code to the probe terminal 2b, or transmitting the request challenge code, requesting the identity code, querying the challenge code, and asking the identity code to the probe terminal 2b, as the query terminal 2a requests the probe terminal 2b to assist the authentication. The basis of the operation.

In addition, if the interrogating end 2a is linked by a plurality of interrogating devices, in the inquiry step S2a, each interrogating device may query the identity code and the received request identity code and the inquiry identity code (or include the same) Requesting the challenge code and querying the challenge code) to transmit to the next interrogation device, and finally, transmitting the request identity code and the inquiry identity code (or including the request challenge code and the challenge challenge code) to the interrogation device coupled to the probe terminal 2b to The Detecting End 2b, and the third embodiment of the present invention is applied to the authentication process of the multi-party authentication, which can be understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

In the detecting step S2b, the one-way authentication process may be selected, and the requesting end 2b transmits the request identity code, the query identity code and a search identity code to a responding end 3". Alternatively, the two-way authentication is selected. a process, a probe challenge code is generated by the probe terminal 2b, and the request challenge code, the request identity code, the challenge challenge code, the query identity code, the query challenge code, and the search identity code are transmitted to the Response 3". The check identity code is a universal unique identifier sent by the responder 3b to the probe terminal 2b when the probe terminal 2b registers with the responder 3" in advance. In this embodiment, after the probe terminal 2b receives the request identity code and the challenge identity code transmitted by the query terminal 2a, the probe terminal 2b further requests the response terminal 3" to assist in the authentication operation. Thus transmitting the request identity code, asking for the identity code and checking the identity code to the responding end 3"; or transmitting the request challenge code, requesting the identity code, asking for the challenge code, asking for the identity code, searching for the challenge code, and checking the identity The code is sent to the responding end 3" as the basis for the requesting end 2b to request the responding end 3" to assist the authentication operation.

In addition, if the detecting end 2b is formed by linking a plurality of detecting devices to each other, in the detecting step S2b, each detecting device can check the identity code and the received request identity code and query the identity. The code and the search identity code (or the request challenge code, the challenge challenge code and the search challenge code) are transmitted to the next search device, and finally, the request identity code is transmitted by the search device coupled to the responder 3" Invoking the identity code and the search identity code (or including the request challenge code, the challenge challenge code and the challenge challenge code) to the response terminal 3", and applying the third embodiment of the present invention to the authentication process of the multi-party authentication, It will be understood by those of ordinary skill in the art to which the present invention pertains, and is not described herein.

In the response step S3a, the one-way authentication process may be selected, and the responding end 3" confirms that the request identity code, the query identity code, and the search identity code are correct. After the authentication code is generated, the response end is firstly determined. 3" The key K(3", 1") shared with the requesting end 1" encrypts the authentication code, and generates a request data, and then according to the responding end 3", the key K shared with the detecting end 2b ( 3", 2b) encrypting the request data and the authentication code to generate a probe data, and transmitting the probe data to the probe terminal 2b. Alternatively, selecting a two-way authentication process, the response terminal 3" confirms the The request identity code, the inquiry identity code, and the inquiry identity code are correct. After an authentication code is generated, the key is first encrypted according to the key K(3", 1") shared by the responding end 3" and the requesting end 1". The authentication code and the request challenge code are generated, and the request data is generated, and the request data, the authentication code, and the request challenge are encrypted according to the key K(3", 2b shared by the responding end 3" and the detecting end 2b. The code, the challenge challenge code and the search challenge code, generate the search data, and transmit the search data To the search end 2b. In this embodiment, the responding end 3" can accept the requesting end 1", the interrogating end 2a and the detecting end 2b to register in advance, and store the requesting end 1", the interrogating end 2a and the detecting end. 2b identity authentication data, for example: the request identity code, the inquiry identity code and the search identity code, and the response terminal 3" receives the request identity code, the inquiry identity code and the search identity transmitted by the probe terminal 2b. After the code, it is known that the probe terminal 2b requests the responder 3" to assist in the authentication operation. At this time, the responder 3" will confirm whether the request identity code, the inquiry identity code and the search identity code are valid, for example, Confirming whether the request identity code, the inquiry identity code, and the search identity code have been stored in advance to identify whether the identity of the requester 1", the inquiry terminal 2a, and the inquiry terminal 2b are legal.

If the identity of the requesting end 1", the interrogating end 2a, and the detecting end 2b are all legal, the responding end 3" will generate the authentication code for the requesting end 1", the interrogating end 2a And the detecting end 2b performs a subsequent authentication operation. In addition, since the authentication code must be transmitted to the detecting end 2b and then transmitted to the requesting end 1 via the interrogating end 2a, in order to prevent the authentication code from being maliciously attacked, Therefore, the responding end 3" first encrypts the authentication code according to the key K(3", 1") shared by the responding end 3" with the requesting end 1", and generates the request data as the requesting end 1" The information required for the authentication process can be formed by using a data encryption method by a conventional key, as shown in the following formula (9):

D9=E _K(3",1") (R) (9)

Wherein D9 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3", 1") is a key shared by the responding end 3" and the requesting end 1"; R is the authentication code.

Then, the responding end 3" encrypts the request data and the authentication code according to the key K(3", 2b) shared by the responding end 3" and the detecting end 2b, and generates the detecting data as the providing The search end 2b performs the information required for the authentication process, and the search data can be formed by using a data encryption method by a conventional key, as shown in the following formula (10):

D10=E _K(3",2b) (R _a ,D9) (10)

Wherein D10 is the search data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3", 2b) is a key shared by the responder 3" and the probe end 2b; R _{a is} the authentication code; D9 is the request data. Then, the probe data is transmitted to the probe terminal 2b by the responder 3", since the authentication code and the request data are encrypted by using the key shared by the responder 3" and the probe terminal 2b. Therefore, it is possible to ensure the security of the authentication code and the requested data during the transmission process.

In addition, the responding end 3" may first encrypt the authentication code and the request challenge code according to the key K(3", 1") shared by the responding end 3" and the requesting end 1", and generate the request data. As the information required to provide the requesting end 1" for the authentication process, the request data may be formed by using a data encryption method by a key, as shown in the following formula (11):

D11=E _K(3",1") (R,C _1" ) (11)

Wherein D11 is the request data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3", 1") is a key shared by the responding end 3" and the requesting end 1"; R is the authentication code; C _{1" is} the request challenge code.

Then, the responding end 3" encrypts the request data, the authentication code, the request challenge code, the challenge challenge code, and the search challenge according to the key K(3", 2b) shared by the responder 3" with the probe terminal 2b. And generating the search data as the data required for the authentication process 2b to perform the authentication process, and the search data may be formed by using a data encryption method by a key, as shown in the following formula (12). :

D12=E _K(3",2b) (D11,R,C _1" ,C _2a ,C _2b ) (12)

Wherein D12 is the search data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(3", 2b) is a key shared by the responder 3" and the probe terminal 2b; D11 is the request data; R is the authentication code; C1 _{" is} the request challenge code; _{C2a is} the challenge challenge code; _{C2b is} the search challenge code. Then, the response terminal 3" is used for the check The probe data is transmitted to the probe terminal 2b.

In the transmitting step S3b, the one-way authentication process may be selected, and the detecting end 2b first decrypts the detecting data according to the key K(3", 2b) shared by the responding end 3" and the detecting end 2b. The request data and the authentication code are encrypted according to the key K (2b, 2a) shared by the query terminal 2b and the interrogating end 2a, and an inquiry data is generated, and the inquiry data is transmitted to the interrogation end 2a. Alternatively, the two-way authentication process is selected, and the querying end 2b first decrypts the search data according to the key K(3", 2b) shared by the responding end 3" and the detecting end 2b, and the detecting data is to be confirmed. After the challenge code is correct, the request data, the authentication code, the request challenge code and the challenge challenge code are encrypted according to the key K(2b, 2a) shared by the probe terminal 2b and the query terminal 2a. The inquiry data is generated, and the inquiry data is transmitted to the inquiry terminal 2a. In this embodiment, after the probe terminal 2b receives the probe data transmitted by the response terminal 3", the response key 3" can be utilized to share the key K(3) with the probe terminal 2b. 2b) Decrypting the search data, the decryption mode is the corresponding decryption mode of the encryption method used by the respondent 3", which is well understood by those skilled in the art and will not be described here. After the search data is decrypted, the search terminal 2b can obtain the authentication code and the request data included in the search data, and the search terminal 2b can store the authentication code for reference.

Then, the probe terminal 2b further encrypts the request data and the authentication code according to the key K (2b, 2a) shared by the probe terminal 2b and the query terminal 2a, and generates the query data as the query terminal 2a. The information required for the authentication process can be formed by using a data encryption method by a conventional key, as shown in the following formula (13):

D13=E _K(2b,2a) (R,D9) (13)

Wherein D1 is the query data; E is an encryption function, such as a symmetric encryption algorithm such as DES or 3DES; K(2b, 2a) is a key shared by the probe terminal 2b and the interrogation end 2a; R is the Authentication code; D9 is the request data. Then, the query data is transmitted to the query terminal 2a by the probe terminal 2b. Since the authentication code and the request data are encrypted by using the key shared by the probe terminal 2b and the query terminal 2a, Ensure that the authentication code and the requested data are secure during the transmission process.

Furthermore, the probe terminal 2b may further encrypt the request data, the authentication code, the request challenge code, and the challenge challenge code according to the key K(2b, 2a) shared by the probe terminal 2b and the query terminal 2a. The inquiry data is used as the information required to provide the inquiry terminal 2a for the authentication process, and the inquiry data can be formed by using a data encryption method by a key, as shown in the following formula (14):

D14=E _K(2b,2a) (D11,R,C _1" ,C _2a ) (14)

Wherein, D14 is the query data; E is an encryption function, for example, a symmetric encryption algorithm such as DES or 3DES; K(2b, 2a) is a key shared by the probe terminal 2b and the query terminal 2a; D11 is the key Requesting the data; R is the authentication code; C1 _{" is} the request challenge code; _{C2a is} the challenge challenge code. Thereafter, the query data is transmitted to the interrogation end 2a by the probe terminal 2b.

In addition, if the detecting end 2b is formed by linking a plurality of detecting devices to each other, in the transmitting step S3b, each detecting device may directly transmit the detecting data to the next detecting device; or, confirm After the validity of the investigation data, the inspection data is transmitted again, and there is no limit here. Finally, the search device coupled to the interrogating end 2a decrypts the search data, generates and transmits the query data to the interrogating end 2a, and applies the third embodiment of the present invention to the authentication process of the multi-party authentication. It will be understood by those of ordinary skill in the art that the invention is not described herein.

The notification step S4" is optional to perform a one-way authentication process, and the interrogating end 2a decrypts the query data according to the key K(2b, 2a) shared by the interrogating end 2b and the interrogating end 2a, and transmits the request. Data to the requester 1". Alternatively, the process of performing the two-way authentication process is performed, and the querying end 2a decrypts the query data according to the key K(2b, 2a) shared by the querying end 2b and the interrogating end 2a, and the inquiry challenge code of the inquiry data is confirmed to be correct. And transmitting the request data to the requesting end 1". In detail, when the interrogating end 2a receives the inquiry data transmitted by the detecting end 2b, the detecting end 2b can be shared with the interrogating end 2a by using the detecting end 2b. The key K(2b, 2a) decrypts the query data, and the decryption mode is the corresponding decryption mode of the encryption mode used by the search terminal 2b, which is well understood by those skilled in the art, and is not described here. After the data is decrypted, the inquiry end 2a can obtain the authentication code and the request data included in the inquiry data. If the inquiry data includes the request challenge code and the challenge challenge code, the inquiry data can be confirmed to be valid, and the authentication is stored. After the code is checked, the request data included in the inquiry data can be further transmitted to the requesting end 1" for the requesting end 1" to perform the subsequent authentication process.

In addition, if the interrogating end 2a is linked by a plurality of interrogating devices, in the notifying step S4", each interrogating device may directly transmit the query data to the next interrogating device; or, confirm the inquiry data. After the validity, the inquiry data is transmitted again, and there is no limitation here. Finally, the inquiry data coupled to the requesting end 1" decrypts the inquiry data, and transmits the request data to the requesting end 1", and The third embodiment of the present invention is applied to the authentication process of the multi-party authentication, which can be understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

The authentication step S5" is optional to perform a one-way authentication process, and the requesting end 1" decrypts the requested data according to the key K(3", 1") shared by the responding end 3" with the requesting end 1". And transmitting the authentication code to the inquiry terminal 2a, and the inquiry terminal 2a confirms whether the authentication code and the authentication code of the inquiry data are the same. Alternatively, the two-way authentication process is selected, and the requesting end 1" decrypts the request data according to the key K(3", 1") shared by the responding end 3" with the requesting end 1", and the request for confirming the request data is confirmed. After the challenge code is correct, the authentication code is transmitted to the interrogating end 2a, and the interrogating end 2a confirms whether the authentication code is identical to the authentication code of the query data. In detail, when the requesting end 1" receives the interrogating end 2a After the transmitted request data, the request data can be decrypted by using the key K(3", 1") shared by the responding end 3" and the requesting end 1", and the decryption mode is the encryption mode adopted by the responding end 3. The corresponding decryption method is well understood by those skilled in the art and will not be described here. After the request data is decrypted, the requesting end 1" can obtain the authentication code included in the request data, and if the request data includes the request challenge code, the validity of the requested data can be confirmed, and then the authentication code is Transmitted to the interrogating end 2a, the interrogating end 2a is the same as the authentication code transmitted by the requesting end 1" and the authentication code previously stored by the interrogating end 2a. If the comparison result is "identical", then the The inquiry terminal 2 will consider that the identity of the requester 1 has been authenticated, and therefore, the job after the authentication is passed can be further performed.

In addition, if the interrogating end 2a is linked by a plurality of interrogating devices, in the authentication step S5", each interrogating device can transmit the request data to the next interrogating device, and finally, the requesting end needs to be authenticated. The inquiry device of 1" (for example, the inquiry device providing the service to the requester 1), etc.) confirms whether the authentication code transmitted by the requester 1" is a valid authentication code, and applies the third embodiment of the present invention to multiple parties. The authentication process of the authentication is understood by those having ordinary knowledge in the technical field to which the present invention pertains, and is not described herein.

Therefore, the authentication process of the third embodiment of the authentication method of the chain architecture of the present invention can be extended to multi-party authentication, and in combination with the advantages of the first embodiment and the second embodiment of the present invention, the request challenge code, Ask the challenge code and check the challenge code to confirm the correctness of the data, and add/decrypt the keys K(3", 1"), K(3", 2b) and K(2b, 2a) to improve The security of data transmission.

The main features of the authentication method of the chain architecture disclosed by the present invention are as follows: The authentication code is generated by the responding end, and the requesting end, the interrogating end and the detecting end perform subsequent authentication operations. The interrogating end only needs to obtain the authentication code from the data received by the responding end or the inquiring end, and store the check code. After receiving the data transmitted by the requesting end, the authentication code transmitted by the requesting end can be obtained therefrom. By confirming whether the authentication code transmitted by the requesting end is the same as the authentication code stored in the standby, it is determined whether the requesting end passes the authentication. In other words, the authentication materials (ie, the authentication code) required by the authentication parties (ie, the requesting end and the interrogating end) are generated centrally by the third party (ie, the responding end), and the authentication parties only need to verify whether the authentication materials are the same or not. The complicated certification process can complete the certification, and the certification can be completed efficiently even if the two parties are in different fields and network environments. Therefore, the user can perform authentication in a high-performance and low-cost manner in the application field of cloud computing, in-vehicle communication, or mobile communication through the request side, which is an effect of the present invention.

Furthermore, the response end and the requesting end, the requesting end and the interrogating end, the interrogating end and the responding end, the responding end and the detecting end or the detecting end and the interrogating end may each have a shared key, and The shared key is used to encrypt/decrypt the transmission data (for example, the authentication code) to improve the security of the data. Moreover, the party receiving the authentication data (for example, the inquiring terminal, the interrogating end or the requesting end) can also send the challenge code, and when the transmission data is received, the transmission data can be confirmed by whether the challenge code is correctly returned or not. Whether it is valid information. Therefore, the present invention adopts a dual security mechanism of shared key and challenge code, which can effectively ensure the security and effectiveness of data, so as to avoid data security threats such as attack, interception, eavesdropping or fraud during the authentication process, and let the user The rights of the invention are impaired, which is the effect of the present invention.

In addition, the respondent centrally confirms the identity of the requesting end, the interrogating end and the inquiring end, and the responding end can be centrally controlled by an organ with impartiality and independence to avoid the situation in which the identity is tampered with or the service is monopolized. Moreover, if the requesting end has the requirement for identity authentication, and the interrogating end refuses to pass the authentication without any reason, the requesting end can prove the record according to the identity end of the responding end, thereby improving the user's authentication process. Reliability.

In summary, the authentication method of the chain architecture of the present invention can simplify the authentication process between the requesting end and the interrogating end, and eliminate the "low performance", "high cost", and "insufficient security" caused by the conventional authentication method. And other doubts such as "monopoly services", which in turn increase the user's trust in the authentication process, which is the many enhancements of the authentication method of the chain architecture of the present invention.

While the invention has been described in connection with the preferred embodiments described above, it is not intended to limit the scope of the invention. The technical scope of the invention is protected, and therefore the scope of the invention is defined by the scope of the appended claims.

[this invention]

1,1’,1”...request side

2,2’,2a. . . Interrogation

2b. . . Checkpoint

3,3’,3”...response

K(3,1). . . Key

K(3,2). . . Key

K(3’, 2’). . . Key

K(2',1’). . . Key

K(3", 1"). . . Key

K(3", 2b)...key

K(2b, 2a). . . Key

S1, S1', S1"... request step

S2, S2', S2a. . . Inquiry step

S2b. . . Exploration step

S3, S3', S3a. . . Response step

S3b. . . Passing step

S4, S4', S4"... notification step

S5, S5', S5"... authentication steps

Figure 1 is a system architecture diagram of a first embodiment of the authentication method of the chain architecture of the present invention.

Figure 2 is a flow chart showing the operation of the first and second embodiments of the authentication method of the chain architecture of the present invention.

Figure 3 is a diagram showing the system architecture of the second embodiment of the authentication method of the chain architecture of the present invention.

Figure 4 is a diagram showing the system architecture of the third embodiment of the authentication method of the chain architecture of the present invention.

Figure 5 is a flow chart showing the operation of the third embodiment of the authentication method of the chain architecture of the present invention.

S1, S1’. . . Request step

S2, S2’. . . Inquiry step

S3, S3’. . . Response step

S4, S4’. . . Notification step

S5, S5’. . . Certification step

Claims (14)

A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal a response step; the response step is confirmed by the responding end that the request identity code and the query identity code are correct. After an authentication code is generated, the authentication code is first encrypted according to the key shared by the responding end and the requesting end, and Generating a request data, and encrypting the request data and the authentication code according to the key shared by the responding end and the querying end, generating an inquiry data, and transmitting the query data to the querying end; a notification step is performed by the The interrogating end decrypts the query data according to the key shared by the interrogating end and the responding end, and transmits the request data to the requesting end; and an authentication step is performed by the requesting end according to the gold shared by the requesting end and the responding end. Decrypting the request data, and transmitting the authentication code to the querying end, the inquiry end confirming whether the authentication code is the same as the authentication code of the query data; wherein the requesting end, End of the inquiry and response to end together form a chain of chimes architecture. A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; An inquiry step is to generate a query challenge code by the query end, and transmit the request challenge code, the request identity code, the challenge challenge code, and a query identity code to a response end; a response step is performed by the response end Confirming that the request identity code and the query identity code are correct. After an authentication code is generated, the authentication code and the request challenge code are encrypted according to the key shared by the responding end and the requesting end, and a request data is generated, and then The responding end encrypts the request data, the authentication code, the request challenge code and the challenge challenge code with the key shared by the responding end, generates an inquiry data, and transmits the inquiry data to the inquiry end; a notification step, Decrypting the query data by the interrogating end according to the key shared by the interrogating end and the responding end, and after confirming that the query challenge code of the query data is correct, transmitting the request data to the requesting end; and an authentication step is performed by The requesting end decrypts the request data according to the key shared by the requesting end and the responding end, and after confirming that the requesting challenge code of the requested data is correct, transmitting the authentication code to the Q. end, the inquiry confirmed by the end of the authentication code authentication code is the same as the data of inquiry; wherein the request end, and the end of the inquiry in response to the end together form a chain of chimes architecture. A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal a response step; the response step confirms the request identity code and the query by the responder The identity code is correct. After an authentication code is generated, the authentication code is encrypted according to the key shared by the responding end and the interrogating end, and an inquiry data is generated, and the inquiry data is transmitted to the inquiry end; The interrogating end first decrypts the query data according to the key shared by the responding end and the interrogating end, and then encrypts the authentication code according to the key shared by the interrogating end and the requesting end, generates a request data, and transmits the request data. To the requesting end; and an authentication step, the requesting end decrypts the request data according to the key shared by the querying end and the requesting end, and transmits the authentication code to the querying end, and the querying end confirms the authentication code Whether the authentication code of the inquiry data is the same; wherein the requesting end, the interrogating end and the responding end together form an autumn chain structure. A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; an inquiry step is performed by the query end Generating a challenge challenge code, and transmitting the request challenge code, the request identity code, the challenge challenge code, and an inquiry identity code to a response terminal; and a response step, the response terminal confirms the request identity code and the inquiry identity The code is correct. After an authentication code is generated, the authentication code, the challenge challenge code and the request challenge code are encrypted according to the key shared by the responding end and the querying end, and an inquiry data is generated, and the inquiry data is transmitted to the code. An interrogating end; a notification step is performed by the interrogating end according to the interrogating end and the responding end The shared key decrypts the inquiry data, and after confirming that the inquiry challenge code of the inquiry data is correct, the request code is generated by encrypting the authentication code and the request challenge code according to the key shared by the inquiry end and the requesting end, And transmitting the request data to the requesting end; and an authentication step, the requesting end decrypts the request data according to the key shared by the requesting end and the querying end, and after the request challenge code of the requesting data is confirmed to be correct, transmitting The authentication code is sent to the inquiry end, and the inquiry end confirms whether the authentication code and the authentication code of the inquiry data are the same; wherein the requesting end, the interrogating end and the responding end together form an autumn chain structure. A method for authenticating a chain architecture includes: a request step of transmitting a request identity code to a query terminal by a requesting terminal; and an inquiry step of transmitting the request identity code and a query identity code to the query terminal The detecting end transmits a request identity code, the inquiry identity code and a search identity code to a response terminal, and a response step confirms the request identity code by the response terminal The inquiry identity code and the inspection identity code are correct. After an authentication code is generated, the authentication code is first encrypted according to the key shared by the response end and the requesting end, and a request data is generated, and then according to the response end. The probe shared by the probe end encrypts the request data and the authentication code, and generates a probe data, and transmits the probe data to the probe terminal; and a delivery step is performed by the probe terminal according to the response The key shared by the terminal and the probe end decrypts the search data, and then according to the query end and the query The terminal shared key encrypts the request data and the authentication code, and generates an inquiry data, and transmits the inquiry data to the inquiry end; a notification step is shared by the inquiry end according to the inquiry end and the inquiry end The key decrypts the query data, and transmits the request data to the requesting end; and an authentication step, the requesting end decrypts the request data according to the key shared by the responding end and the requesting end, and transmits the authentication code to The interrogating end confirms whether the authentication code and the authentication code of the query data are the same; wherein the requesting end, the interrogating end, the detecting end and the responding end together form a hybrid chain architecture. A method for authenticating a chain architecture includes: a requesting step of generating a request challenge code by a requesting end, and transmitting the request challenge code and a request identity code to a query end; an inquiry step is performed by the query end Generating a challenge challenge code, and transmitting the request challenge code, the request identity code, the challenge challenge code, and a query identity code to a probe terminal; and a query step, the probe terminal generates a probe challenge code And transmitting the request challenge code, the request identity code, the challenge challenge code, the query identity code and the search challenge code and a search identity code to a response end; a response step is confirmed by the response terminal The request identity code, the query identity code, and the query identity code are correct. After an authentication code is generated, the authentication code and the request challenge code are encrypted according to the key shared by the responding end and the requesting end, and a request is generated. Data, and encrypting the request data, the authentication code, and the request according to the key shared by the responding end and the detecting end The challenge code, the challenge challenge code and the search challenge code, generate a search data, and transmit the search data to the search end; a transfer step is performed by the search terminal according to the search end The key shared by the responding end decrypts the search data, and after confirming that the search challenge code of the search data is correct, the request data, the authentication code, and the authentication code are encrypted according to the key shared by the search end and the query end. The request challenge code and the challenge challenge code are generated to generate an inquiry data, and the inquiry data is transmitted to the inquiry end; a notification step is performed by the inquiry end according to the key shared by the inquiry end and the inquiry end Querying the data, after confirming that the inquiry challenge code of the inquiry data is correct, transmitting the request data to the requesting end; and an authentication step, the requesting end decrypting the request data by the requesting end according to the key shared by the requesting end and the responding end After the request challenge data of the request data is confirmed to be correct, the authentication code is transmitted to the inquiry end, and the inquiry end confirms whether the authentication code and the authentication code of the inquiry data are the same; wherein the request end, the inquiry End, which identify the end and the end respond together to form a mixed chain architecture. The method for authenticating a chain architecture as described in claim 2, wherein the step of notifying is performed by the interrogating end confirming that the query challenge code and the request challenge code of the query data are correct, and then transmitting the request data to the requesting end. . The method for authenticating a chain architecture according to claim 4, wherein the step of notifying is performed by the interrogating end after the inquiry challenge code and the request challenge code of the inquiry data are correct, according to the inquiry end and the request end. The shared key encrypts the authentication code and the request challenge code to generate the request Data, and then transmit the request data to the requesting end. The method for authenticating a chain structure as described in claim 6 wherein the step of transmitting is performed by the inquiring terminal after confirming that the search challenge code, the challenge challenge code, and the request challenge code are correct. The probe share the key shared with the interrogating end to encrypt the request data, the authentication code, the request challenge code and the challenge challenge code, and generate the query data, and then transmit the query data to the query end. For example, in the method for authenticating the chain structure described in claim 6, wherein the step of notifying the inquiry challenge code and the request challenge code of the inquiry data is confirmed by the inquiry end, and then transmitting the request data to the requesting end. The method for authenticating a chain architecture as described in claim 2, 4 or 6, wherein the request challenge code is a randomly generated random number, a time stamp generated over time, or a sequence number sequentially generated. The authentication method of the chain architecture as described in claim 2, 4 or 6, wherein the challenge challenge code is a randomly generated random number, a time stamp generated over time, or a sequence number sequentially generated. The method for authenticating a chain architecture as described in claim 6, wherein the challenge challenge code is a randomly generated random number, a time stamp generated over time, or a sequence number sequentially generated. The authentication method of the chain architecture as described in claim 1, 2, 3, 4, 5 or 6, wherein the authentication code is a communication key, a signature, a license or a voucher.