TWI543015B - Near Field Communication Authentication System and Method Applied to Cloud Computing Environment - Google Patents

Description

Near field communication authentication system and method applied to cloud computing environment

The present invention relates to an authentication system and method, and more particularly to a near field communication authentication system and method suitable for mutual authentication between two parties in a cloud computing environment.

In the prior art, Near Field Communication (NFC) technology has three working modes: card mode, peer-to-peer mode, and card reader mode.

Common applications of card mode include e-wallet, leisure card and access control card; the common applications of peer-to-peer mode are the types of data transmission such as pictures, videos, music and contacts. A common application of the reader mode is to read the information stored in the NFC tag for smart posters, site navigation, and electronic verification.

Near field communication is in line with the existing cloud computing technology, which improves the applicability of NFC technology, such as classroom name system, medical information system and store POS system.

However, the cloud computing technology transmits the authentication data through the network. Therefore, when the NFC authentication data is transmitted, it is possible to steal and modify the data, causing the user data to be stolen, or further defrauding the control and communication of the server. Permissions, causing information security issues for certain programs.

To solve the above problems, the present invention discloses a near field communication authentication system and method applied to a cloud computing environment, by means of an interactive authentication mechanism to confirm that the interconnected devices are trusted communication devices.

The near field communication authentication system applied to the cloud computing environment disclosed by the present invention includes a client device and a cloud server device having the same security right threshold.

The client device outputs a client random number, and when obtaining a first servo authentication value and a servo random number, calculating a first client authentication value according to the client random number and the security right threshold value, When the first client authentication value is equal to the first servo authentication value, the second client authentication value is calculated according to the servo random number and the security right threshold. The cloud server device calculates the first servo authentication value according to the random number of the client and the security threshold, to output the first servo authentication value and the servo random number, and obtain the second client authentication value, according to the servo random number and The security right threshold hash calculates a second servo authentication value, and when the second client authentication value is equal to the second servo authentication value, it is determined that the authentication is completed.

The near field communication authentication method applied to the cloud computing environment disclosed in the present invention is applicable to a client device and a cloud server device having the same security right threshold. The method comprises the following steps: outputting a guest random number to the cloud server by the client device; calculating, by the cloud server device, a first servo authentication value according to the client random number and the security right threshold to output the first servo authentication Value and servo random number to the client device; when the client device obtains the first servo authentication value and the servo random number, the first client authentication value is calculated according to the client random number and the security right threshold; when the client device When determining that the first client authentication value is equal to the first server authentication value, calculating a second client authentication value according to the random number of the server and the security right threshold, and outputting the second client authentication value to the cloud server; when the cloud server is used When the second client authentication value is obtained, a second servo authentication value is calculated according to the servo random number and the security right threshold; and when the cloud server determines that the second client authentication value is equal to the second servo authentication value, determining the authentication carry out.

In some embodiments, in the system and method of the present invention, the cloud server device obtains a valid time value corresponding to the security right threshold, and determines that the security right threshold fails according to the effective time value, and the cloud server device regenerates the security. The weight is updated and updated to the client device, wherein the valid time value is at least one of the provided by the client device and pre-stored in the cloud server.

The system and method disclosed by the present invention have the following characteristics:

(1) The depreciation of the security right of both parties can be given in advance by various means, and in the verification process, the depreciation of the security right does not appear in the transmission data, only when the security rights of both parties have the same value. The same verification value will be generated to ensure that both parties that are connectable are indeed reliable connected objects.

(2) In this case, the mutual authentication of the two devices is adopted, and the authentication value is generated during the authentication period. It is not necessary to use the password table comparison in the cloud server. In addition to simplifying the authentication process, the security of the authentication and confidentiality is further maintained. Sex, also avoid the leakage of the password table Information security issues.

(3) Each time the two parties perform interactive authentication, different random numbers will be generated. Therefore, the authentication values used in each communication are different, and the incremental value interaction verification is performed, so there is no need to consider the time stamping time. The synchronization problem is also preventive for resend attacks, so it has high applicability.

(4) All authentication values are generated by random numbers and hash calculations. Therefore, the authentication values of each communication are different. Even if the transmission data is intercepted, it is impossible for the pirate to obtain the correct authentication through the analysis of accumulated data. The information further details the details of the device, or further the identity information of the user of the device.

(5) The conference key used by both parties to transmit data can be generated by the above-mentioned random number and security right depreciation, because the security right depreciation will not be transmitted during the authentication period, plus the random number used in each communication is Different, it helps to enhance the conference key, and the confidentiality of the communication data encrypted and decrypted by the conference key.

100‧‧‧Client devices

101‧‧‧ Label Identification Information

102‧‧‧ Security rights depreciation

103‧‧‧ Effective time value

111‧‧‧ First client authentication value

112‧‧‧ second client authentication value

113‧‧‧Customer random number

200‧‧‧Cloud Servo

201‧‧‧ Rights and Values

211‧‧‧First servo authentication value

212‧‧‧Second servo authentication value

213‧‧‧Servo random number

S100-400‧‧‧Steps

FIG. 1 is a schematic diagram showing the system architecture of a near field communication authentication system according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing the overall flow of a near field communication authentication method according to an embodiment of the present invention.

FIG. 3 is a schematic diagram showing the detailed process of the near field communication authentication method according to the embodiment of the present invention.

The embodiments of the present invention are described in detail below with reference to the drawings.

1 is a schematic diagram of a system architecture of a near field communication authentication system according to an embodiment of the present invention. This embodiment is illustrated by a cloud server 200 connected to its network by a client device 100, which is suitable for the card mode, peer-to-peer mode and card reader mode previously described.

(1) Card mode: The client device 100 is an analog or smart card (IC card). A smart card, also known as a smart card, a smart card, an integrated circuit card, and an IC card, refers to a portable card plastic that is affixed or embedded with an integrated circuit chip. The card contains the microprocessor, I/O interface and memory, providing data calculation, access control and storage functions. Guest equipment Set 100 to have the necessary certification materials for certification. The cloud server 200 includes a data reader and data operator that can sense or read the data of the client device 100 and has the ability to cooperate with the client device 100 for authentication.

(2) Point-to-point mode: Both sides of the transmission are electronic devices with close-range data wireless transmission capability. The client device 100 stores the authentication data necessary for authentication. The cloud server 200 is also capable of sensing or reading the data of the client device 100 and authenticating the client device 100.

(3) Card reader mode: the client device 100 has a tag reading unit or component, and the tag reading unit stores the authentication data necessary for authentication, and can sense the near field communication tag to match the authentication data according to the tag information. Interact with the backend cloud server 200.

However, regardless of the above structure, it is applicable to the certification method disclosed in this case. Only the authentication of the client device 100 and the cloud server device 200 will be described below.

2 is a schematic diagram of the overall flow of the near field communication authentication method according to the embodiment of the present invention. Please refer to FIG. 1 for understanding. The entire authentication includes at least four steps: when the client device 100 performs near field communication with the cloud server 200, the client device 100 first provides the tag identification data 101 to the cloud server device 200 (step S100).

However, in the card mode and the peer-to-peer mode, the client device 100 includes the tag identification data 101 and the security right threshold 102. The tag identification data 101 and the security right threshold 102 are the proximity of the client device 100 to the cloud server 200. Obtained directly during field communication or indirectly through a third-party computing device. In the card reader mode, the client device 100 reads the data of the near field communication tag to obtain the tag identification data 101 and the security right value 102 stored by the cloud server 200 in the near field communication tag.

Regardless of the card mode, the peer-to-peer mode, or the card reader mode, the client device 100 must provide the tag identification data 101 according to the communication path provided by the third-party computing device, the cloud server 200, or the near field communication tag. The cloud server 200 can be used for subsequent authentication processes.

The cloud server 200 has a weight table 201 including the tag identification data 101 of the client device 100 and a security weight value 102 corresponding to each tag identification material 101. When the cloud server 200 obtains the tag identification data 101, the cloud identification device 101 first analyzes the tag identification data 101 and Whether the corresponding security right threshold 102 is available (step S200), and the analysis mode includes at least the following:

(1) Whether the weight threshold table 201 includes the acquired tag identification data 101.

(2) Each tag identification data 101 further corresponds to a valid time value 103. When the cloud server 200 determines that the acquired tag identification data 101 is present, it further analyzes the corresponding valid time value 103 to determine the communication. The client device 100 has its security right threshold 102 invalid.

(3) The client device 100 has a valid time value of 103. In the card mode and the peer-to-peer mode, the valid time value 103 is obtained directly by the client device 100 in near field communication with the cloud server 200, or indirectly by a third-party computing device. In the card reader mode, the client device 100 reads the tag identification data 101 of the near field communication tag to obtain the valid time value 103 stored by the cloud server 200 in the near field communication tag. The client device 100 transmits the valid time value 103 together with the tag identification data 101 to the cloud server device 200. The cloud server device 200 directly determines whether the security right threshold 102 is invalid according to the valid time value 103.

When the cloud server 200 analyzes the security right threshold 102 as a failure, the system will abandon the authentication or regenerate the security right threshold 102 to the client device 100 according to the design of the designer and the program function (step S210). The generation and provision of the security right threshold 102 includes at least the following modes:

(1) The cloud server 200 determines that the client device 100 has the authority to hold the related function, and recalculates the security right threshold 102 in conjunction with the acquired tag identification data 101, and provides it to the client device 100.

(2) The cloud server 200 determines that the client device 100 has the right to retain the relevant function, and provides the obtained tag identification data 101 to a third-party computing device, and obtains the security right threshold 102 from the third-party computing device, and then provides The client device 100 is provided.

(3) The cloud server 200 determines that the client device 100 has the right to retain the related function, and provides the obtained tag identification data 101 to a third-party computing device, and the third-party computing device obtains the application of the client device 100. This security right threshold 102 is provided to the client device 100.

Among them, the security right threshold 102 is generated by the following parameter hash calculation: Ki=h(IDi∥X∥LIFTTIMEi) Ki: the i-th security right threshold; h(): one-way hash function; X: the master key generated by the cloud server; IDi: the i-th near-field communication tag data generated by the cloud server; LIFTTIMEi: The effective time value of i security rights.

On the other hand, when the cloud server 200 analyzes the security right threshold 102 to be valid, the client device 100 is notified to start the authentication operation (step S220). Thereafter, the client device 100 and the cloud server device 200 perform a mutual authentication operation (step S300).

Please refer to FIG. 3, which is a detailed flow chart of the near field communication authentication method according to the embodiment of the present invention, and a detailed description of step S300. The flow includes at least the following steps: a client random number 113 is outputted by the client device 100 to the cloud server 200 (step S310). The value range and numerical format of the client number 113 depends on the needs of the designer. Secondly, the client device 100 can also provide the near field communication tag to the cloud server device 200 to assist subsequent calculation or data comparison of the cloud server device 200.

The first servo authentication value 211 is calculated by the cloud server 200 according to a guest random number 113 and the security weight threshold 102 to output the first servo authentication value 211 and the servo random number 213 to the client device 100 (step S320). . The numerical range and numerical format of the servo random number 213 depends on the needs of the designer. Under normal circumstances, when the cloud server 200 and the client device 100 are authenticated, the security weights 102 used should be the same. However, when the cloud server 200 and the client device 100 (or the near field communication tag) belong to a one-to-one or one-to-many relationship, the cloud server 200 obtains the request from the weight table 201 according to the near field communication tag. The security right threshold 102, and then the first servo authentication value 211 is calculated according to the security right threshold 102 and the client random number 113, and the calculation manner is as follows: v=HMAC(Ki, R1)v: first servo authentication value; HMAC (): hash operation message authentication code function; Ki: the i-th security right threshold; R1: the client random number.

When the client device 100 obtains the first servo authentication value 211 and the servo random number 213 At this time, a first guest authentication value 111 is calculated based on the guest random number 113 and the security right threshold 102 (step S330). In this step, the client device 100 calculates the first client authentication value 111 according to the security right threshold 102 and the client random number 113, and the calculation manner is as follows: v'=HMAC(Ki, R1)v': the first guest End authentication value; HMAC(): hash operation message authentication code function; Ki: i-th security right threshold; R1: guest random number.

When the client device 100 determines that the first client authentication value 111 is equal to the first server authentication value 211, the second client authentication value 112 is calculated by the servo random number 213 and the security right threshold 102, and the second client is output. The authentication value 112 is passed to the cloud server 200 (step S340). The second client authentication value 112 is calculated as follows: w=HMAC(Ki, R2)w: second client authentication value; HMAC(): hash operation message authentication code function; Ki: i-th security weight threshold; R2: Servo random number.

When the cloud server 200 obtains the second client authentication value 112, a second servo authentication value 212 is calculated by the servo random number 213 and the security right threshold 102 (step S350). The second servo authentication value 212 is calculated as follows: w'=HMAC(Ki, R2)w': second servo authentication value; HMAC(): hash operation message authentication code function; Ki: i-th security weight threshold; R2: Servo random number.

When the cloud server 200 determines that the second client authentication value 112 is equal to the second server authentication value 212, it is determined that the authentication is completed (step S360). That is to say, when the process of step S300 is completed, the client device 100 and the cloud server 200 can mutually recognize that the other party is the target device to be connected. In the previous process, as long as "tag identification data 101", "security rights" Mutual authentication is impossible when either of the value 102" and the "valid time value 103" is an error or invalid data.

Finally, the client device 100 and the cloud server device 200 each construct a conference key, and use the conference key to add and decrypt the transmission data (step S400). In this step, the security right threshold 102, the servo random number 213, and the guest random number 113 known by the client device 100 and the cloud server 200 should be the same, so the two parties will construct the same. The conference key is calculated as follows: E=h(Ki∥R1∥R2)h(): one-way hash function; Ki: the i-th security weight ;; R1: guest random number; R2: servo mess number.

In the above, it is merely described that the present invention is an implementation or an embodiment of the technical means for solving the problem, and is not intended to limit the scope of the invention. That is, the equivalent changes and modifications made in accordance with the scope of the patent application of the present invention or the scope of the invention are covered by the scope of the invention.

S310~S360‧‧‧Steps

Claims (10)

A near field communication authentication system applied to a cloud computing environment, comprising: a client device, comprising a security right threshold for outputting a guest random number, obtaining a first servo authentication value and a servo random number Calculating a first client authentication value according to the client random number and the security right threshold, and determining that the first client authentication value is equal to the first server authentication value, according to the server random number and the security right Depreciating and outputting a second client authentication value; and a cloud server device, including the security right threshold, calculating the first servo authentication value according to the client random number and the security weight threshold to output The first servo authentication value and the servo random number, and when the second client authentication value is obtained, a second servo authentication value is calculated according to the servo random number and the security right threshold, and the second client authentication is performed on the second client authentication value. When the value is equal to the second servo authentication value, it is judged that the authentication is completed. The near field communication authentication system applied to the cloud computing environment according to claim 1, wherein the cloud server device includes a weight threshold table, and the client device transmits a label identification data, the cloud server The device compares the tag identification data with the weight threshold table, obtains the security right value corresponding to the tag identification data, and returns the security value to the client device. The near field communication authentication system applied to the cloud computing environment according to claim 1, wherein the cloud server device obtains the tag identification data of the client device, and identifies the tag according to a master key value. The data is hashed with a valid time value to calculate the security weight and passed back to the client device. The near field communication authentication system applied to the cloud computing environment according to claim 1, wherein the cloud server device obtains the right to security And determining, by the cloud server, the security right threshold is updated and updated on the client device, wherein the valid time value is The client device provides and stores at least one of the cloud server devices. The near field communication authentication system applied to the cloud computing environment according to claim 1, wherein the client device and the cloud server device encrypt and decrypt the transmission data through a conference key, wherein the conference The key is obtained by hashing the client random number, the servo random number and the security right threshold. A near field communication authentication method applied to a cloud computing environment, which is applicable to a client device and a cloud server device, the client device and the cloud server device having a security right threshold, the method comprising the following steps: by the guest The terminal device outputs a client random number to the cloud server device; the cloud server device calculates a first servo authentication value according to the client random number and the security weight threshold to output the first servo authentication value and a Serving a random number to the client device; when the client device obtains the first servo authentication value and the servo random number, calculating a first client authentication value according to the client random number and the security right threshold; When the client device determines that the first client authentication value is equal to the first server authentication value, calculating a second client authentication value according to the servo random number and the security right threshold, and outputting the second client authentication a value to the cloud server; when the cloud server obtains the second client authentication value, calculating a second servo authentication value according to the servo random number and the security right threshold; and When the cloud server determines that the second client authentication value is equal to the second server authentication value, it is determined that the authentication is completed. The near field communication authentication method applied to the cloud computing environment according to claim 6, wherein the cloud server device includes a weight value table, and the client device transmits a tag identification data, the cloud server The device compares the tag identification data with the weight threshold table, obtains the security right value corresponding to the tag identification data, and returns the security value to the client device. The near field communication authentication method applied to the cloud computing environment according to claim 6, wherein the cloud server device obtains the tag identification data of the client device, and identifies the tag according to a master key value. The data is hashed with a valid time value to calculate the security weight and passed back to the client device. The near field communication authentication method applied to the cloud computing environment according to claim 6, wherein the cloud server device obtains a valid time value corresponding to the security right threshold, and determines the valid time value according to the effective time value. When the security right threshold expires, the security threshold is regenerated by the cloud server and updated to the client device, wherein the valid time value is at least provided by the client device and pre-stored in the cloud server device. One. The near field communication authentication method applied to the cloud computing environment according to claim 6, wherein the client device and the cloud server perform encryption and decryption operations on the transmission data through a conference key, wherein the conference The key is obtained by hashing the client random number, the servo random number and the security right threshold.