WO2022142718A1 - 一种认证器及其通信方法 - Google Patents

一种认证器及其通信方法 Download PDF

Info

Publication number
WO2022142718A1
WO2022142718A1 PCT/CN2021/128651 CN2021128651W WO2022142718A1 WO 2022142718 A1 WO2022142718 A1 WO 2022142718A1 CN 2021128651 W CN2021128651 W CN 2021128651W WO 2022142718 A1 WO2022142718 A1 WO 2022142718A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
authenticator
data
client
preset
Prior art date
Application number
PCT/CN2021/128651
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US18/034,684 priority Critical patent/US20230403749A1/en
Publication of WO2022142718A1 publication Critical patent/WO2022142718A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0637—Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/14—Direct-mode setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless

Definitions

  • the invention relates to an authenticator and a communication method thereof, belonging to the technical field of communication.
  • standard Bluetooth uses system-level pairing, that is, pairing between one Bluetooth device and another Bluetooth device.
  • This pairing method has the following defects: on the one hand, all applications on the paired device can use the other The data transmitted by the Bluetooth device makes the data insecure; on the other hand, it is very unfriendly to the application UI, the slave device is completely passively connected during the connection process, and the master device cannot be selected; in addition, there are some connections between Bluetooth devices The process does not even need to be paired to communicate. These connection methods can easily cause sensitive data to be stolen and have low security.
  • the purpose of the present invention is to provide an authenticator and a communication method thereof, which can ensure that data is not stolen during the transmission process, thereby improving the data security during the transmission process.
  • a communication method for an authenticator comprising:
  • Step S1) the authenticator is powered on and enters the connection mode
  • Step S2) the authenticator scans the broadcast data, obtains the first client identifier in the broadcast data, obtains the first key stored by itself, and verifies the first client identifier according to the first key, if If the verification is successful, step S3 is performed, and if the verification fails, the broadcast data is rescanned;
  • Step S3) the authenticator generates a second authenticator identifier according to the first key, obtains a second key corresponding to the first key, and generates a second session key according to the second key, Notify that the verification of the first client identifier is successful, stop scanning and broadcast broadcast data including the identifier of the second authenticator;
  • Step S4) the authenticator receives the request for establishing a Bluetooth connection sent by the client, establishes a Bluetooth connection with the client, waits to receive the handshake command sent by the client, and performs step S5 when receiving the handshake command;
  • Step S5 The authenticator obtains the client data and the client data digest value in the handshake command, obtains the second handshake key by calculating the second session key, and obtains the second handshake key through the second handshake key, the client The client data and the client data digest value are used to verify the client data. If the verification is successful, the authenticator data digest value is obtained by calculating the authenticator data through the second handshake key.
  • the handshake response of the authenticator data and the authenticator data digest value execute step S6;
  • Step S6 the authenticator waits to receive the operation command sent by the client, and when receiving the operation command, executes step S7;
  • Step S7) the authenticator obtains the encrypted data in the operation command, obtains the second encryption key by calculating the second session key, and decrypts the encrypted data through the second encryption key to obtain the operation data, Execute a corresponding operation according to the operation data to obtain operation result data, calculate the operation result data through the second encryption key to obtain operation response data, and send an operation response including the operation response data to the client.
  • an authenticator comprising:
  • the power-on processing module is used to power on and enter the connection mode
  • a scanning module used for scanning broadcast data to obtain the first client identifier in the broadcast data
  • an acquisition module for acquiring the first key stored by itself
  • a first verification module configured to verify the first client identifier according to the first key
  • a first generation module configured to generate a second authenticator identifier according to the first key
  • the obtaining module is further configured to obtain a second key corresponding to the first key
  • a second generating module configured to generate a second session key according to the second key
  • a notification module configured to notify that the verification of the first client identifier is successful
  • a broadcast module configured to stop scanning and broadcast broadcast data including the identifier of the second authenticator
  • the obtaining module is further configured to obtain the client data and the client data digest value according to the handshake command;
  • a third generating module configured to obtain a second handshake key by calculating the second session key
  • a second verification module configured to verify the client data according to the second handshake key, the client data and the client data digest value
  • a fourth generation module configured to calculate the authenticator data by using the second handshake key to obtain a digest value of the authenticator data
  • a sending module configured to send a handshake response including the authenticator data and a digest value of the authenticator data to the client;
  • an acquisition module also used to acquire encrypted data in the operation command
  • the fifth generation module for obtaining the second encryption key by calculating the second session key
  • a decryption processing module configured to decrypt the encrypted data through the second encryption key to obtain operation data, perform corresponding operations according to the operation data to obtain operation result data, and use the second encryption key to encrypt the operation result.
  • data is calculated to obtain operational response data;
  • the second sending module is further configured to send an operation response including the operation response data to the client.
  • an application-level Bluetooth pairing connection is established with the client through the authenticator, and the authenticator performs two-way broadcast scanning authentication during the connection process.
  • the encryption key is generated, and the data in the communication process is encrypted and transmitted by the encryption key, so as to ensure that the data is not stolen in the transmission process, and the method provided by the present invention improves the data security in the transmission process, thereby ensuring the user Interests.
  • FIG. 1 is a flowchart of a communication method for an authenticator provided in Embodiment 1 of the present invention
  • FIGS. 2 and 3 are flowcharts of a communication method for an authenticator provided in Embodiment 2 of the present invention.
  • FIG. 4 is a block diagram of an authenticator device according to Embodiment 3 of the present invention.
  • Embodiment 1 provides an authenticator communication method, which is applicable to a system including a client and an authenticator, wherein the client is an application installed in a mobile terminal with Bluetooth function, and the authenticator has Bluetooth function.
  • the method includes:
  • Step 101 the authenticator is powered on and enters the connection mode
  • Step 102 The authenticator scans the broadcast data, obtains the first client identifier in the broadcast data, obtains the first key stored by itself, and verifies the first client identifier according to the first key. If the verification is successful, perform step 103, If the verification fails, rescan the broadcast data;
  • Step 103 The authenticator generates a second authenticator ID according to the first key, obtains a second key corresponding to the first key, generates a second session key according to the second key, and notifies the verification of the first client ID. If successful, stop scanning and broadcast the broadcast data including the identification of the second authenticator;
  • Step 104 the authenticator receives the request for establishing a Bluetooth connection sent by the client, establishes a Bluetooth connection with the client, and waits to receive the handshake command sent by the client.
  • step 105 is performed;
  • Step 105 the authenticator obtains the second handshake key by calculating the second session key, obtains the client data and the client data digest value in the handshake command, and obtains the client data and the client data digest value in the handshake command, and obtains the second handshake key, the client data and the client data digest value through the second handshake key, the client data and the client data digest value.
  • the client data is verified, and if the verification is successful, the authenticator data is calculated by the second handshake key to obtain the authenticator data digest value, and a handshake response including the authenticator data and the authenticator data digest value is sent to the client;
  • Step 106 the authenticator waits for receiving the operation command sent by the client, and when receiving the operation command, executes step 107;
  • Step 107 The authenticator obtains the encrypted data in the operation command, obtains the second encryption key by calculating the second session key, decrypts the encrypted data through the second encryption key to obtain the operation data, and performs corresponding operations according to the operation data to obtain the operation data.
  • the operation result data is calculated by the second encryption key to obtain the operation response data, and the operation response including the operation response data is sent to the client.
  • the authenticator determines the startup mode, enters the connection mode when the startup mode is the first mode, and enters the pairing mode when the startup mode is the second mode;
  • the method further includes:
  • Step a1 the authenticator receives the extension item registration command sent by the client, obtains the client public key and the client version number in the extension item registration command, and generates the authenticator key pair, according to the client public key and the authenticator key pair.
  • the authenticator private key in generates the first parameter;
  • Step a2 the authenticator obtains the first preset data stored by itself, and generates an initial pairing according to the client public key, the authenticator public key in the authenticator key pair, the client version number, the first preset data and the first parameter key, split the initial pairing key to obtain the first key and the second key, and store the first key and the second key correspondingly;
  • Step a3 the authenticator sends an extension item registration response to the client, the response includes the authenticator public key and the client version number, and enters the connection mode.
  • the method before entering the pairing mode, further includes: establishing a Bluetooth connection between the authenticator and the mobile terminal where the client is located;
  • the method further includes: disconnecting the Bluetooth connection between the devices.
  • the acquired client identifier is verified according to the first key, specifically: the authenticator acquires the first preset field stored by itself, the first random number in the first client identifier and the first data, calculate the first preset field and the first random number with the first key according to the fourth preset algorithm to obtain the second data, and determine whether the second data is the same as the first data, if yes, the verification is successful, Otherwise validation fails.
  • the authenticator generates the second authenticator identifier according to the first key, specifically: the authenticator obtains the second preset field stored by itself, and combines the first client identifier with the second preset field.
  • the fields are sequentially spliced, the first client identifier and the second preset field are calculated by the first key according to the fourth preset algorithm to obtain fourth data, and the preset bytes in the fourth data are obtained as the second authenticator identifier.
  • generating the second session key according to the second key is specifically: the authenticator obtains the first preset data stored by itself and the first random number in the first client identifier, and according to The third preset algorithm calculates the first random number and the first preset data by using the second key to obtain the second session key.
  • the authenticator obtains the second handshake key by calculating the second session key, specifically: the authenticator obtains the second random number and the second preset data stored by itself, and according to the third preset It is assumed that the algorithm calculates the second random number and the second preset data through the second session key to obtain the second handshake key.
  • step 103 notifying that the verification of the first client identifier is successful, stopping scanning and broadcasting broadcast data including the identifier of the second authenticator, specifically including: the authenticator sends the client to establish a Bluetooth connection request, establish a Bluetooth connection with the client, and when the Bluetooth connection is disconnected, broadcast broadcast data including the identifier of the second authenticator.
  • the authenticator after the authenticator establishes the Bluetooth connection with the client, it further includes: the authenticator sends the first unique identification address to the client, and receives the second unique identification address sent by the client;
  • the broadcast data further includes the first unique identification address and the second unique identification address.
  • step 103 notifying that the verification of the first client identifier is successful, specifically includes: the authenticator prompts the user to switch the broadcast state of the client to the scanning state through the prompting module.
  • This embodiment 2 provides a communication method for an authenticator, and the method is applicable to a system including a client and an authenticator, wherein the client is an application installed in a mobile terminal with a Bluetooth function, and the authenticator has a Bluetooth function;
  • the method includes:
  • Step 201 the authenticator is powered on, determines the startup mode, when the startup mode is the second mode, it enters the pairing mode, and executes step 202; when the startup mode is the first mode, it enters the connection mode, and executes step 206;
  • the authenticator is powered on specifically: when the button connected to the authenticator is pressed by the user, the authenticator is powered on;
  • the startup mode is specifically the type of key trigger
  • determining the startup mode specifically includes: the authenticator determines the key type, and if the key type is the first type, it enters the connection mode, and if the key type is the second type, it enters the pairing mode;
  • the key types include short keys and long keys; wherein, the short keys are the first type, and the long keys are the second type;
  • the authenticator judging the key type specifically includes: the authenticator judges the key type according to the key duration threshold and the duration of the key being pressed, if the duration of the key being pressed exceeds the key threshold, the key type is a long key, if If the duration of the button being pressed does not exceed the button threshold, the button type is a short button.
  • Step 202 the authenticator waits to receive the extension item registration command sent by the client, and performs step 203 when receiving the extension item registration command sent by the client;
  • step 202 further includes: the authenticator determines whether the received command is an extension item registration command, and if so, executes step 203, otherwise, does not perform any processing.
  • step 202 before step 202, it further includes that the authenticator establishes a Bluetooth connection between the devices with the mobile terminal where the client is located;
  • the extension item registration command received by the authenticator is data that conforms to the standard Bluetooth protocol, and is specifically sent by the client through the Bluetooth connection transport layer established by the mobile terminal where the client is located and the authenticator.
  • extension registration command is as follows:
  • Step 203 the authenticator obtains the client public key and the client version number in the extension item registration command, generates the authenticator key pair, and generates the first parameter according to the client public key and the authenticator private key in the authenticator key pair ;
  • generating the first parameter according to the client public key and the authenticator private key in the authenticator key pair specifically includes: the authenticator according to the second preset algorithm according to the client public key and the authenticator key pair The authenticator private key in generates the first parameter;
  • the authenticator generating the authenticator key pair is specifically: the authenticator generates the authenticator key pair according to the first preset algorithm; the authenticator key pair specifically includes the authenticator private key and the authenticator public key;
  • the first preset algorithm is specifically an algorithm for generating a key pair, and the authenticator and the client use the same algorithm to generate the key pair;
  • the second preset algorithm is specifically an ECDH algorithm
  • the authenticator generates the first parameter according to the client public key and the authenticator private key in the authenticator key pair according to the second preset algorithm. Specifically, the authenticator uses the authenticator private key and the client public key to multiply The operation obtains the product result, and the first 32 bytes in the product result are used as the first parameter;
  • the client public key is:
  • the client version number is: "00000001"
  • the first preset algorithm is: ECC-256;
  • the authenticator public key is:
  • the authenticator private key is:
  • the authenticator multiplies the authenticator's private key and the client's public key to obtain the result of the product:
  • the first parameter is:
  • Step 204 The authenticator obtains the first preset data stored by itself, and generates an initial pairing according to the client public key, the authenticator public key in the authenticator key pair, the client version number, the first preset data and the first parameter key, split the initial pairing key to obtain the first key and the second key, and store the first key and the second key correspondingly;
  • generating the initial pairing key according to the client public key, the authenticator public key in the authenticator key pair, the client version number, the first preset data and the first parameter is specifically:
  • the third preset algorithm generates an initial pairing key according to the client public key, the authenticator public key, the client version number, the first preset data and the first parameter;
  • the authenticator generates the initial pairing key according to the third preset algorithm according to the client public key, the authenticator public key, the client version number, the first preset data and the first parameter.
  • the authenticator is as follows: Obtain the first preset data, connect the client version number, the client public key and the authenticator public key in sequence, and perform hash digest calculation to obtain the salt value, and use the first parameter as the key to perform the salt value analysis according to the third preset algorithm Calculating with the first preset data to obtain the initial pairing key;
  • the authenticator stores the first key and the second key in the initial pairing key list correspondingly;
  • the length of the obtained initial pairing key is 32 bytes, the first 16 bytes are used as the first key, and the last 16 bytes are used as the second key;
  • the first preset data is the ASCII string "FIDO caBLE v1 pairing data"
  • the third preset algorithm is: (HKDF-SHA-256);
  • the authenticator concatenates the client version number, client public key, and authenticator public key sequentially as:
  • the first key obtained by splitting the initial pairing key is:
  • the second key obtained by splitting the initial pairing key is:
  • Step 205 the authenticator sends an extension item registration response to the client, enters the connection mode, and executes step 206;
  • the extension item registration response sent by the authenticator to the client includes the authenticator public key and the client version number
  • sending an extension registration response to the client is as follows:
  • the method before entering the connection mode, the method further includes: disconnecting the Bluetooth connection between the devices,
  • Step 206 The authenticator scans the broadcast data, obtains the first client identifier in the broadcast data, obtains the first key stored by itself, and verifies the first client identifier according to the first key. If the verification is successful, perform step 207, If the verification fails, rescan the broadcast data;
  • step 206 before step 206 is executed, it further includes: the authenticator starts scanning;
  • verifying the first client identifier according to the first key is specifically: the authenticator obtains the first preset field stored by itself, the first random number in the first client identifier and the first data, calculate the first preset field and the first random number with the first key according to the fourth preset algorithm to obtain the second data, and determine whether the second data is the same as the first data, if yes, the verification is successful, Otherwise validation fails.
  • the authenticator obtains the first preset field stored by itself, the first random number and the first data in the first client identifier, and uses the first key to pair the first preset field and the first data according to the fourth preset algorithm.
  • a random number is calculated to obtain the second data, and the determination of whether the second data is the same as the first data is as follows: the authenticator obtains the first 8 bytes of the first client identifier as the first random number, and obtains the last 8 bytes as the first random number.
  • step 206 specifically includes: the authenticator scans the broadcast data, obtains the first client identifier in the broadcast data, and sequentially obtains the first key in the initial pairing key list stored by itself, according to the obtained The first key to verify the first client identification, if the verification is successful, the second authenticator identification is generated according to the obtained first key that successfully verifies the first client identification, and the second authenticator identification is obtained and the first key is obtained. The second key corresponding to the key, the second session key is generated according to the second key, and step 303 is executed, if all the first keys in the initial pairing key list fail to verify the first client identifier then rescan the broadcast data;
  • the first client identifier clientEid is:
  • the first random number is: EB59387103AF03A5;
  • the first data is: 46D62B1364719F61;
  • the first preset field is: "client";
  • the fourth preset algorithm is specifically: (HMAC-SHA256);
  • Step 207 The authenticator generates a second authenticator ID according to the first key, obtains a second key corresponding to the first key, generates a second session key according to the second key, and notifies the verification of the first client ID If successful, stop scanning and broadcast the broadcast data including the identification of the second authenticator;
  • the authenticator generates the second authenticator identifier according to the first key, specifically: the authenticator obtains the second preset field stored by itself, and sequentially splices the first client identifier and the second preset field , according to the fourth preset algorithm, the first client identifier and the second preset field are calculated by the first key to obtain fourth data, and the preset byte in the fourth data is obtained as the second authenticator identifier;
  • acquiring the preset byte in the fourth data as the second authenticator identifier is specifically as follows: the authenticator acquires the first 16 bytes in the fourth data as the second authenticator identifier;
  • the second session key is generated according to the second key, specifically: the authenticator obtains the first preset data stored by itself, and uses the second key to pair the second session key according to the third preset algorithm. A random number and the first preset data are calculated to obtain the second session key.
  • step 207 notifying that the verification of the first client identifier is successful, stopping scanning and broadcasting broadcast data including the identifier of the second authenticator, specifically including: the authenticator sends the client to establish a Bluetooth connection request, establish a Bluetooth connection with the client, and when the Bluetooth connection is disconnected, broadcast broadcast data including the identifier of the second authenticator.
  • the authenticator after the authenticator establishes the Bluetooth connection with the client, it further includes: the authenticator sends the first unique identification address to the client, and receives the second unique identification address sent by the client;
  • the broadcast data further includes the first unique identification address and the second unique identification address.
  • the authenticator when the Bluetooth connection is disconnected, specifically: the authenticator sends a request to disconnect the Bluetooth connection to the client, and receives a disconnection response;
  • the authenticator when the Bluetooth connection is disconnected, the authenticator receives the disconnection request sent by the client and returns a disconnection response to the client;
  • step 207 notifying that the verification of the first client identifier is successful, specifically includes: the authenticator prompts the user to switch the broadcast state of the client to the scanning state through the prompting module.
  • the authenticator broadcasts the data according to the preset broadcast format, and specifically, the second authenticator identifier is stored in the data item of the broadcast data, and is specifically stored in the Service Data item;
  • the second preset field is: "authenticator”
  • the second authenticator identifier authenticatorEid is:
  • the second session key sessionPreKey is:
  • Step 208 the authenticator receives the request for establishing a Bluetooth connection sent by the client, establishes a Bluetooth connection with the client, waits to receive the handshake command sent by the client, and executes step 209 when receiving the handshake command;
  • step 208 before step 208, it specifically includes: the client stops broadcasting, starts scanning the broadcast data including the first unique identifier address and the second unique identifier address, and parses the scanned broadcast data to obtain the first address. Second authenticator identification, verify the second authenticator identification, if the verification succeeds, send a request to establish a Bluetooth connection to the authenticator, and establish a Bluetooth connection with the authenticator, and end if the verification fails.
  • step 208 further includes: the authenticator determines whether the received command is a handshake command, and if so, executes step 209, otherwise, disconnects the Bluetooth connection.
  • Step 209 the authenticator obtains the client data and the client data digest value in the handshake command, obtains the second handshake key by calculating the second session key, and obtains the second handshake key by calculating the second handshake key, the client data and the client data digest value.
  • the client data is verified, and if the verification is successful, the authenticator data is calculated by the second handshake key to obtain the authenticator data digest value, and a handshake response including the authenticator data and the authenticator data digest value is sent to the client;
  • the authenticator obtains the second handshake key by calculating the second session key, specifically: the authenticator obtains the second random number and the second preset data stored by itself, and according to the third preset It is assumed that the algorithm calculates the second random number and the second preset data through the second session key to obtain the second handshake key.
  • the authenticator acquiring the second random number is specifically: the authenticator acquires the first random number as the second random number;
  • verifying the client data by using the second handshake key, the client data and the client data digest value is as follows: the authenticator calculates the client data through the handshake key according to the fourth preset algorithm to obtain the client data Digest value, judging whether the calculated client data digest value is the same as the received client data digest value, if yes, the verification succeeds, otherwise the verification fails;
  • calculating the authenticator data by using the second handshake key to obtain the digest value of the authenticator data is as follows: the authenticator generates a third random number, and the client version number, the authenticator preset field and the third The random number is used as the authenticator data, and the authenticator data digest value is obtained by calculating the authenticator data through the second handshake key according to the fourth preset algorithm;
  • the authenticator data includes: the client version, the authenticator preset field, and the 16-byte third random number generated by the authenticator;
  • the second preset data is the ASCII string "FIDO caBLE v1 handshakeKey"
  • the obtained second handshake key is:
  • the third random number is: 935337A931634E9C22C8EEB080827DF3;
  • the authenticator data is:
  • the authenticator data digest value is: 07808B071C8E69DF1F1BFD13D52F39B8;
  • Step 210 the authenticator waits for receiving the operation command sent by the client, and when receiving the operation command, executes step 211;
  • Step 211 The authenticator obtains the encrypted data in the operation command, obtains the second encryption key by calculating the second session key, decrypts the encrypted data through the second encryption key to obtain the operation data, and performs corresponding operations according to the operation data to obtain the operation data.
  • the operation result data is calculated by using the second encryption key to obtain the operation result response data, and the operation response including the operation response data is sent to the client.
  • the authenticator obtains the second encryption key by calculating the second session key, specifically: the authenticator obtains the first random number, the fourth random number in the client data, and the third preset stored by itself.
  • the data and the third random number are calculated according to the third preset algorithm and the second session key on the first random number, the fourth random number in the client data, the third random number and the third preset data to obtain the second random number.
  • the second encryption key is obtained by calculating the first random number, the fourth random number in the client data, the third random number and the third preset data with the second session key according to the third preset algorithm. It is: the authenticator performs hash calculation on the first random number, the fourth random number and the third random number in the client data to obtain a hash value, and the hash value calculated by the second session key is paired with the third pre-defined hash value. Set the data to calculate to obtain the second encryption key;
  • calculating the second encryption key by using the hash value calculated from the second session key pair and the third preset data is specifically: Calculate the hash value and the third preset data to obtain the second encryption key;
  • sending the operation response including the operation response data to the client specifically includes: the authenticator obtains the counter count value, generates a message random number, and uses the second encryption key to encrypt the message random number, the data to be encrypted, and the data header. Perform calculation to obtain encrypted data, combine the count value, data header, message random number and encrypted data to obtain operation result response data, and send the operation result response data to the client;
  • the authenticator uses the second encryption key to calculate the random number of the message, the data to be encrypted, and the data header to obtain the encrypted data. Specifically, the authenticator uses the second encryption key to encrypt the message according to the fifth preset algorithm. The random number, the data to be encrypted, and the data header are calculated to obtain the encrypted data;
  • the message random number is specifically: a combination of a first random number, a count value and a preset field counter;
  • the data header is specifically header, if the sender is a client, the data header header is specifically cmd, and if the sender is an authenticator, the data header header is specifically STAT; among them, STAT is specifically the STAT byte in the FIDO BLE transmission protocol;
  • the fifth preset algorithm is specifically: AES256-GCM;
  • the counter is specifically a 24-bit message counter; the counters on the client side and the authenticator side are initialized to zero, and increase at the same time after each message is sent;
  • the count value is: 0x00 (client) or 0x01 (authenticator);
  • sessionKey 6D0D20CDFB8A55613AF009D804262CC673A78E1E4293D1E1BF83BC7A54867ECC;
  • chiperdata 44 C6 F2 7E BC 14 9F 49 EE 88 29 DB 60 E4 70 D0;
  • the operation response data is obtained by combining the count value, data header, message random number and encrypted data: 0x01+cmd+messagenonce+chiperdata.
  • the connection is disconnected, and similarly, if the client cannot decrypt the encrypted data sent by the authenticator, the connection is disconnected.
  • the third preset data is: ASCII string "FIDO caBLE v1 sessionKey";
  • the second encryption key is:
  • Embodiment 3 of the present invention provides an authenticator, as shown in FIG. 4 , the authenticator includes:
  • the power-on processing module 11 is used to power on and enter the connection mode
  • the scanning module 12 is used to scan the broadcast data to obtain the first client identifier in the broadcast data
  • a first verification module 14 configured to verify the first client identifier according to the first key
  • a first generation module 15 configured to generate a second authenticator identifier according to the first key
  • the obtaining module 13 is further configured to obtain the second key corresponding to the first key
  • the second generation module 16 is used for generating the second session key according to the second key
  • a notification module 17, configured to notify that the verification of the first client identifier is successful
  • a broadcast module 18 configured to stop scanning and broadcast the broadcast data including the identifier of the second authenticator
  • the obtaining module 13 is also used to obtain the client data and the client data digest value according to the handshake command;
  • the third generation module 19 is used to obtain the second handshake key by calculating the second session key
  • the second verification module 20 is configured to verify the client data according to the second handshake key, the client data and the client data digest value;
  • the fourth generation module 21 is used to calculate the authenticator data through the second handshake key to obtain the authenticator data digest value
  • a sending module 22 configured to send a handshake response including the authenticator data and the digest value of the authenticator data to the client;
  • the obtaining module 13 is also used to obtain the encrypted data in the operation command;
  • the fifth generation module 23 is used to obtain the second encryption key by calculating the second session key
  • the decryption processing module 24 is used to decrypt the encrypted data through the second encryption key to obtain operation data, perform corresponding operations according to the operation data to obtain operation result data, and calculate the operation result data through the second encryption key to obtain operation response data ;
  • the second sending module 22 is further configured to send an operation response including the operation response data to the client.
  • the authenticator further includes:
  • the judgment processing module is used to judge the startup mode
  • the second acquisition and generation module is used to acquire the client public key and the client version number in the extension item registration command, generate the authenticator key pair, and generate the authenticator key pair according to the client public key and the authenticator private key in the authenticator key pair the second parameter;
  • the second acquisition and generation module is further configured to acquire the first preset data stored by itself, according to the client public key, the authenticator public key in the authenticator key pair, the client version number, the first preset data and the second preset data.
  • the parameters generate an initial pairing key, split the initial pairing key to obtain a first key and a second key, and store the first key and the second key correspondingly;
  • the sending module is also used to send an extension item registration response to the client, where the response includes the authenticator public key and the client version number.
  • the first verification module 14 is specifically configured to acquire the first preset field stored by itself, the first random number and the first data in the first client identifier, according to the fourth preset The algorithm calculates the first preset field and the first random number with the first key to obtain the second data, and determines whether the second data is the same as the first data.
  • the first generation module 15 is specifically configured to acquire the second preset field stored by itself, and splices the first client identifier and the second preset field in sequence, according to the fourth preset algorithm
  • the first client identifier and the second preset field are calculated by using the first key to obtain fourth data, and the preset byte in the fourth data is obtained as the second authenticator identifier.
  • the second generation module 16 is specifically configured to obtain the first preset data stored by itself and the first random number in the first client identifier, and use the second preset algorithm according to the third preset algorithm to obtain the first random number.
  • the key is calculated on the first random number and the first preset data to obtain the second session key.
  • the third generation module 19 is specifically configured to obtain the second random number and the second preset data stored by itself, and use the second session key to generate the second random number according to the third preset algorithm.
  • the number and the second preset data are calculated to obtain the second handshake key.
  • the notification module 17 is specifically configured to establish a Bluetooth connection with the client, and when the Bluetooth connection is disconnected, the second broadcast module is triggered.
  • the authenticator further includes a sending and receiving module; the sending and receiving module is configured to send the first unique identification address to the client, and receive the second unique identification address sent by the client;
  • the data broadcasted by the second broadcasting module further includes the first unique identification address and the second unique identification address.
  • the notification module 17 is specifically configured to prompt the user to switch the broadcasting state of the client to the scanning state through the prompting module.
  • the authenticator based on the Bluetooth connection between devices, the authenticator is used to establish an application-level Bluetooth pairing connection with the client, and the authenticator performs two-way broadcast scanning authentication during the connection process. After the authentication is successful, the connection is generated according to the negotiated key.
  • the encryption key is used to encrypt and transmit the data in the communication process to ensure that the data is not stolen in the transmission process.
  • the method provided by the present invention improves the data security in the transmission process, thereby ensuring the user's security. Benefit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种认证器的通信方法，该方法包括：认证器上电，进入连接模式；扫描广播数据，获取广播数据中的第一客户端标识，获取第一密钥对第一客户端标识进行验证，验证成功则生成第二认证器标识和第二会话密钥，通知对第一客户端标识验证成功，停止扫描并广播包括所述第二认证器标识的广播数据；认证器接收客户端发送的建立蓝牙连接请求，与客户端建立蓝牙连接，与客户端进行握手、加密通信操作。本发明能够确保传输过程中数据不被窃取，提高了传输过程中的数据安全性，从而保证了用户的利益。

Description

一种认证器及其通信方法 技术领域
本发明涉及一种认证器及其通信方法，属于通信技术领域。
背景技术
现有技术中，标准蓝牙都采用系统级配对，即一方蓝牙设备与另一方蓝牙设备间的配对，这种配对方式主要存在以下缺陷：一方面，配对后设备上的所有应用都可以使用另一方蓝牙设备传输的数据，导致数据不安全；另一方面，对应用UI来说很不友好，连接过程中从设备完全是被动连接，没法选择主设备；此外，还存在有些蓝牙设备间的连接过程甚至不需要进行配对即可通信，这些连接方式极易造成敏感数据被窃取，安全性低。
发明内容
本发明的目的是提供一种认证器及其通信方法，其能够确保传输过程中数据不被窃取，从而提高传输过程中的数据安全性。
根据本发明的一个方面，提供了一种认证器的通信方法，该方法包括：
步骤S1)认证器上电，进入连接模式；
步骤S2)所述认证器扫描广播数据，获取广播数据中的第一客户端标识，获取自身存储的第一密钥，根据所述第一密钥对所述第一客户端标识进行验证，若验证成功则执行步骤S3，若验证失败则重新扫描广播数据；
步骤S3)所述认证器根据所述第一密钥生成第二认证器标识，获取与所述第一密钥对应的第二密钥，根据所述第二密钥生成第二会话密钥，通知对所述第一客户端标识验证成功，停止扫描并广播包括所述第二认证器标识的广播数据；
步骤S4)所述认证器接收客户端发送的建立蓝牙连接请求，与所述客户端建立蓝牙连接，等待接收所述客户端发送的握手命令，当接收到所述握手命令时，执行步骤S5；
步骤S5)所述认证器获取握手命令中的客户端数据和客户端数据摘要值，通过所述第二会话密钥计算得到第二握手密钥，通过所述第二握手密钥、所述客户端数据和所述客户端数据摘要值对所述客户端数据进行验证，验证成功则通过所述第二握手密钥对认证器数据进行计算得到认证器数据摘要值，向所述客户端发送包括所述认证器数据和所述认证器数据摘要值的握手响应，执行步骤S6；
步骤S6)所述认证器等待接收所述客户端发送的操作命令，当接收到所述操作命令时，执行步骤S7；以及
步骤S7)所述认证器获取所述操作命令中的加密数据，通过第二会话密钥计算得到第二加密密钥，通过所述第二加密密钥对所述加密数据进行解密得到操作数据，根据操作数据执行相应的操作得到操作结果数据，通过所述第二加密密钥对所述操作结果数据进行计算得到操作响应数据，向所述客户端发送包括所述操作响应数据的操作响应。
根据本发明的另一方面，提供了一种认证器，该认证器包括：
上电处理模块，用于上电，进入连接模式；
扫描模块，用于扫描广播数据，获取广播数据中的第一客户端标识；
获取模块，用于获取自身存储的第一密钥；
第一验证模块，用于根据所述第一密钥对所述第一客户端标识进行验证；
第一生成模块，用于根据所述第一密钥生成第二认证器标识；
所述获取模块，还用于获取与所述第一密钥对应的第二密钥；
第二生成模块，用于根据所述第二密钥生成第二会话密钥；
通知模块，用于通知对所述第一客户端标识验证成功；
广播模块，用于停止扫描并广播包括所述第二认证器标识的广播数据；
所述获取模块，还用于根据所述握手命令获取所述客户端数据和所述客户端数据摘要值；
第三生成模块，用于通过所述第二会话密钥计算得到第二握手密钥；
第二验证模块，用于根据所述第二握手密钥、所述客户端数据和所述客户端数据摘要值对所述客户端数据进行验证；
第四生成模块，用于通过所述第二握手密钥对认证器数据进行计算得到认证器数据摘要值；
发送模块，用于向所述客户端发送包括所述认证器数据和所述认证器数据摘要值的握手响应；
获取模块，还用于获取所述操作命令中的加密数据；
第五生成模块，用于通过所述第二会话密钥计算得到第二加密密钥；
解密处理模块，用于通过所述第二加密密钥对所述加密数据进行解密得到操作数据，根据操作数据执行相应的操作得到操作结果数据，通过所述第二加密密钥对所述操作结果数据进行计算得到操作响应数据；以及
所述第二发送模块，还用于向所述客户端发送包括所述操作响应数据的操作响应。
根据本发明，在设备间蓝牙连接的基础上，通过认证器与客户端建立应用级别的蓝牙配对连接，且在连接过程中认证器进行双向广播扫描认证，认证成功建立蓝牙连接后根据会话密钥生成加密密钥，通过加密密钥对通信过程中的数据进行加密传输，以确保传输过程中数据不被窃取，采用本发明提供的方法，提高了传输过程中的数据安全性，从而保证了用户的利益。
附图说明
图1是本发明实施例1提供的一种认证器的通信方法流程图；
图2、图3是本发明实施例2提供的一种认证器的通信方法流程图；
图4是本发明实施例3提供的一种认证器设备框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图，对本发明的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例1：
本实施例1提供一种认证器的通信方法，该方法适用于包括客户端和认证器的系统，其中，客户端为安装在具有蓝牙功能的移动终端中的应用程序，认证器具有蓝牙功能。
如图1所示，该方法包括：
步骤101、认证器上电，进入连接模式；
步骤102、认证器扫描广播数据，获取广播数据中的第一客户端标识，获取自身存储的第一密钥，根据第一密钥对第一客户端标识进行验证，若验证成功执行步骤103，若验证失败则重新扫描广播数据；
步骤103、认证器根据第一密钥生成第二认证器标识，获取与第一密钥对应的第二密钥，根据第二密钥生成第二会话密钥，通知对第一客户端标识验证成功，停止扫描并广播包括第二认证器标识的广播数据；
步骤104、认证器接收客户端发送的建立蓝牙连接请求，与客户端建立蓝牙连接，等待接收客户端发送的握手命令，当接收到握手命令时，执行步骤105；
步骤105、认证器通过第二会话密钥计算得到第二握手密钥，获取握手命令中的客户端数据和客户端数据摘要值，通过第二握手密钥、客户端数据和客户端数据摘要值对客户端数据进行验证，验证成功则通过第二握手密钥对认证器数据进行计算得到认证器数据摘要值，向客户端发送包括认 证器数据和认证器数据摘要值的握手响应；
步骤106、认证器等待接收客户端发送的操作命令，当接收到操作命令时，执行步骤107；
步骤107、认证器获取操作命令中的加密数据，通过第二会话密钥计算得到第二加密密钥，通过第二加密密钥对加密数据进行解密得到操作数据，根据操作数据执行相应的操作得到操作结果数据，通过第二加密密钥对操作结果数据进行计算得到操作响应数据，向客户端发送包括操作响应数据的操作响应。
可选地，在本实施例1中，进入连接模式之前还包括：认证器判断启动模式，当启动模式为第一模式则进入连接模式，当启动模式为第二模式则进入配对模式；
当进入配对模式时，该方法还包括：
步骤a1、认证器接收客户端发送的扩展项注册命令，获取扩展项注册命令中的客户端公钥和客户端版本号，生成认证器密钥对，根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数；
步骤a2、认证器获取自身存储的第一预置数据，根据客户端公钥、认证器密钥对中的认证器公钥、客户端版本号、第一预置数据和第一参数生成初始配对密钥，对初始配对密钥进行拆分得到第一密钥和第二密钥，并将第一密钥和第二密钥对应存储；
步骤a3、认证器向客户端发送扩展项注册响应，响应中包括认证器公钥和客户端版本号，进入连接模式。
优选地，在本实施例1中，进入配对模式之前还包括：认证器与客户端所在的移动终端建立设备间的蓝牙连接；
具体地，步骤a3中，进入连接模式之前还包括：断开设备间蓝牙连接。
优选地，在本实施例1中，根据第一密钥对获取的客户端标识进行验证，具体为：认证器获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过第一密钥对第一预设字段和第一随机数进行计算得到第二数据，判断第二数据与第一数据是否相同，是则验证成功，否则验证失败。
优选地，在本实施例1中，认证器根据第一密钥生成第二认证器标识，具体为：认证器获取自身存储的第二预设字段，将第一客户端标识和第二预设字段顺序拼接，按照第四预设算法通过第一密钥对第一客户端标识和第二预设字段进行计算得到第四数据，获取第四数据中预设字节作为第二认证器标识。
优选地，在本实施例1中，根据第二密钥生成第二会话密钥，具体为：认证器获取自身存储的第一预置数据和第一客户端标识中的第一随机数，按照第三预设算法通过第二密钥对第一随机数和第一预置数据进行计算得到第二会话密钥。
优选地，在本实施例1中，认证器通过第二会话密钥计算得到第二握手密钥，具体为：认证器获取第二随机数和自身存储的第二预置数据，按照第三预设算法通过第二会话密钥对第二随机数和第二预置数据进行计算得到第二握手密钥。
优选地，在本实施例1中，步骤103中，通知对第一客户端标识验证成功，停止扫描并广播包括第二认证器标识的广播数据，具体包括：认证器向客户端发送建立蓝牙连接请求，与客户端建立蓝牙连接，当蓝牙连接断开时，广播包括第二认证器标识的广播数据。
优选地，在本实施例1中，认证器与客户端建立蓝牙连接之后还包括：认证器将第一唯一标识地址发送给客户端，接收客户端发送的第二唯一标识地址；
其中，广播数据中还包括第一唯一标识地址和第二唯一标识地址。
优选地，在本实施例1中，步骤103中，通知对第一客户端标识验证成功，具体包括：认证器通过提示模块提示用户将客户端的广播状态切换为扫描状态。
实施例2：
本实施例2提供一种认证器的通信方法，该方法适用于包括客户端和认证器的系统，其中，客户端为安装在具有蓝牙功能的移动终端中的应用程序，认证器具有蓝牙功能；
如图2、3所示，该方法包括：
步骤201、认证器上电，判断启动模式，当启动模式为第二模式则进入配对模式，执行步骤202，当启动模式为第一模式则进入连接模式，执行步骤206；
在本实施例2中，认证器上电具体为：当认证器接的按键被用户按下时认证器上电；
其中，启动模式具体为按键触发的类型；
具体地，判断启动模式具体包括：认证器判断按键类型，若按键类型为第一类型则进入连接模式，若按键类型为第二类型则进入配对模式；
具体地，按键类型包括短按键和长按键；其中，短按键为第一类型，长按键为第二类型；
更具体地，认证器判断按键类型具体包括：认证器根据按键时长阈值和按键被按下的持续时长判断按键类型，若按键被按下的持续时长超过按键阈值，则按键类型为长按键，若按键被按下的持续时长未超过按键阈值，则按键类型为短按键。
步骤202、认证器等待接收客户端发送的扩展项注册命令，当接收到客户端发送的扩展项注册命令时，执行步骤203；
在本实施例2中，步骤202还包括：认证器判断接收到的命令是否为扩展项注册命令，如果是，执行步骤203，否则，不做任何处理。
在本实施例2中，202之前还包括，认证器与客户端所在的移动终端建立设备间的蓝牙连接；
在本实施例2中，认证器接收到的扩展项注册命令是符合标准蓝牙协议的数据，具体是客户端通过客户端所在的移动终端与认证器建立的蓝牙连接传输层进行发送的。
例如，扩展项注册命令具体为：
dictionary CableRegistrationData{
required sequence<long>versions；required BufferSource rpPublicKey；
}；
步骤203、认证器获取扩展项注册命令中的客户端公钥和客户端版本号，生成认证器密钥对，根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数；
在本实施例2中，根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数具体包括：认证器按照第二预设算法根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数；
在本实施例2中，认证器生成认证器密钥对具体为：认证器按照第一预设算法生成认证器密钥对；认证器密钥对具体包括认证器私钥和认证器公钥；
其中，第一预设算法具体为生成密钥对的算法，认证器和客户端使用相同的算法生成密钥对；
其中，第二预设算法具体为ECDH算法；
具体地，认证器按照第二预设算法根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数具体为：认证器使用认证器私钥与客户端公钥做相乘运算得到乘积结果，将乘积结果中的前32字节作为第一参数；
例如，客户端公钥为：
5F164D70138A35F67FAAEF38E7D4A8C9249A6C8830A4A46C9844B617E9AD15AD3E2BC019CB3984A24AB2173033C9615FBD58542739957227510060CA97F1A2E7；
客户端版本号为：“00000001”；
第一预设算法为：ECC-256；
认证器公钥为：
CCF146DD3FF87173845A576973664EB2BB80861CA10A656ADC526B4075FA06EE52B4A7C65B12CA572441D2354B08E8172BC296925ADEF8E898BCD5FA1189467B；
认证器私钥为：
4C5CD1D426794EB72CBE05D83B9799E48161D7FBFDE4D6B2FFB76A9662C5CFC5；
认证器使用认证器私钥与客户端公钥做相乘运算得到乘积结果为：
8BD9B24EE678018E1CC6C487A55FF3774765F8AB2AF43BDD101F03E172181D1718D86A26245A9808CA09E3048497939D1F314825660DCB14DBEF1F0F6EE619B9；
第一参数为：
8BD9B24EE678018E1CC6C487A55FF3774765F8AB2AF43BDD101F03E172181D17；
步骤204、认证器获取自身存储的第一预置数据，根据客户端公钥、认证器密钥对中的认证器公钥、客户端版本号、第一预置数据和第一参数生成初始配对密钥，对初始配对密钥进行拆分得到第一密钥和第二密钥，并将第一密钥和第二密钥对应存储；
在本实施例2中，根据客户端公钥、认证器密钥对中的认证器公钥、客户端版本号、第一预置数据和第一参数生成初始配对密钥具体为：认证器按照第三预设算法根据客户端公钥、认证器公钥、客户端版本号、第一预置数据和第一参数生成初始配对密钥；
在本实施例2中，认证器按照第三预设算法根据客户端公钥、认证器公钥、客户端版本号、第一预置数据和第一参数生成初始配对密钥具体为：认证器获取第一预置数据，将客户端版本号、客户端公钥和认证器公钥顺序连接并进行哈希摘要计算得到盐值，将第一参数作为密钥按照第三预设算法对盐值和第一预置数据进行计算得到初始配对密钥；
在本实施例2中，还包括：认证器将第一密钥和第二密钥对应存储在初始配对密钥列表中；
其中，得到的初始配对密钥的长度为32字节，将前16字节作为第一密钥，后16字节作为第二密钥；
例如，第一预置数据为ASCII字符串"FIDO caBLE v1 pairing data"；
第三预设算法为：(HKDF-SHA-256)；
认证器将客户端版本号、客户端公钥和认证器公钥顺序连接为：
000000015F164D70138A35F67FAAEF38E7D4A8C9249A6C8830A4A46C9844B617E9AD15AD3E2BC019CB3984A24AB2173033C9615FBD58542739957227510060CA97F1A2E7CCF146DD3FF87173845A576973664EB2BB80861CA10A656ADC526B4075FA06EE52B4A7C65B12CA572441D2354B08E8172BC296925ADEF8E898BCD5FA1189467B；
将第一参数作为密钥按照第三预设算法对盐值和第一预置数据进行计算得到初始配对密钥为：
8BD9B24EE678018E1CC6C487A55FF3774765F8AB2AF43BDD101F03E172181D17；
对初始配对密钥进行拆分得到第一密钥为：
039A77D14CD5077E9DEA7C5B344E1CB35A50433540E55792A2D64BE31571E883；
对初始配对密钥进行拆分得到第二密钥为：
B66209F7436B16AD3CA177970A266E89A3964B4DEFC9FB9A15665CC1C6C31087；
步骤205、认证器向客户端发送扩展项注册响应，进入连接模式，执行步骤206；
在本实施例2中，认证器向客户端发送的扩展项注册响应中包括认证器公钥和客户端版本号；
例如，向客户端发送扩展项注册响应具体为：
CableRegistration＝{
version:int,
maxVersion:int,
authenticatorPublicKey:bytes,
}；
在本实施例2中，进入连接模式之前还包括：断开设备间蓝牙连接，
步骤206、认证器扫描广播数据，获取广播数据中的第一客户端标识，获取自身存储的第一密钥，根据第一密钥对第一客户端标识进行验证，若验证成功执行步骤207，若验证失败则重新扫描广播数据；
在本实施例2中，执行步骤206之前还包括：认证器开启扫描；
优选地，在本实施例2中，根据第一密钥对第一客户端标识进行验证，具体为：认证器获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过第一密钥对第一预设字段和第一随机数进行计算得到第二数据，判断第二数据与第一数据是否相同，是则验证成功，否则验证失败。
具体地，认证器获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过第一密钥对第一预设字段和第一随机数进行计算得到第二数据，判断第二数据与第一数据是否相同具体为：认证器获取第一客户端标识的前8个字节作为第一随机数，获取后 8个字节作为第一数据，按照第四预设算法通过第一密钥对第一预设字段和第一随机数进行计算得到第二数据，判断第二数据与第一数据是否相同，是则验证成功，否则验证失败；
在本实施例2中，步骤206具体包括：认证器扫描广播数据，获取广播数据中的第一客户端标识，顺次获取自身存储的初始配对密钥列表中的第一密钥，根据获取到的第一密钥对第一客户端标识进行验证，若验证成功则根据获取到的对所述第一客户端标识验证成功的第一密钥生成第二认证器标识，获取与所述第一密钥对应的第二密钥，根据第二密钥生成第二会话密钥，执行步骤303，若初始配对密钥列表中的全部第一密钥对所述第一客户端标识进行验证均失败则重新扫描广播数据；
例如，第一客户端标识clientEid为：
EB59387103AF03A546D62B1364719F61；
第一随机数为：EB59387103AF03A5；
第一数据为：46D62B1364719F61；
第一预设字段为：“client”；
第四预设算法具体为：(HMAC-SHA256)；
步骤207、认证器根据第一密钥生成第二认证器标识，获取与第一密钥对应的第二密钥，根据第二密钥生成第二会话密钥，通知对第一客户端标识验证成功，停止扫描并广播包括第二认证器标识的广播数据；
在本实施例2中，认证器根据第一密钥生成第二认证器标识，具体为：认证器获取自身存储的第二预设字段，将第一客户端标识和第二预设字段顺序拼接，按照第四预设算法通过第一密钥对第一客户端标识和第二预设字段进行计算得到第四数据，获取第四数据中预设字节作为第二认证器标识；
具体地，获取第四数据中预设字节作为第二认证器标识具体为：认证器获取第四数据中的前16个字节作为第二认证器标识；
优选地，在本实施例2中，根据第二密钥生成第二会话密钥，具体为：认证器获取自身存储的第一预置数据，按照第三预设算法通过第二密钥对第一随机数和第一预置数据进行计算得到第二会话密钥。
优选地，在本实施例2中，步骤207中，通知对第一客户端标识验证成功，停止扫描并广播包括第二认证器标识的广播数据，具体包括：认证器向客户端发送建立蓝牙连接请求，与客户端建立蓝牙连接，当蓝牙连接断开时，广播包括第二认证器标识的广播数据。
优选地，在本实施例2中，认证器与客户端建立蓝牙连接之后还包括：认证器将第一唯一标识地址发送给客户端，接收客户端发送的第二唯一标识地址；
其中，广播数据中还包括第一唯一标识地址和第二唯一标识地址。
进一步优选地，当蓝牙连接断开时具体为：认证器向客户端发送断开蓝牙连接请求，接收断开响应；
进一步优选地，当蓝牙连接断开时具体为：认证器接收客户端发送的断开蓝牙连接请求，向客户端返回断开响应；
优选地，在本实施例2中，步骤207中，通知对第一客户端标识验证成功，具体包括：认证器通过提示模块提示用户将客户端的广播状态切换为扫描状态。
在本实施例2中，认证器按照预设广播格式进行广播数据，具体地，第二认证器标识是存放在广播数据的数据项中，具体存放在Service Data项中；
例如，第二预设字段为：“authenticator”；
第二认证器标识authenticatorEid为：
4C7202F777505528DDF467D11BA1CC5F；
第二会话密钥sessionPreKey为：
E93BCD54F6726C30DE871348C44C0D85726796900F8A2C035DF6CE7C11F4498E；
步骤208、认证器接收客户端发送的建立蓝牙连接请求，与客户端建立蓝牙连接，等待接收客 户端发送的握手命令，当接收到握手命令时，执行步骤209；
可选地，在本实施例2中，步骤208之前具体包括：客户端停止广播，开始扫描包括第一唯一标识地址和第二唯一标识地址的广播数据，对扫描到的广播数据进行解析获取第二认证器标识，对第二认证器标识进行验证，若验证成功则向认证器发送建立蓝牙连接请求，与认证器建立蓝牙连接，若验证失败则结束。
在本实施例2中，步骤208还包括：认证器判断接收到的命令是否为握手命令，如果是，执行步骤209，否则，断开蓝牙连接。
步骤209、认证器获取握手命令中的客户端数据和客户端数据摘要值，通过第二会话密钥计算得到第二握手密钥，通过第二握手密钥、客户端数据和客户端数据摘要值对客户端数据进行验证，验证成功则通过第二握手密钥对认证器数据进行计算得到认证器数据摘要值，向客户端发送包括认证器数据和认证器数据摘要值的握手响应；
优选地，在本实施例2中，认证器通过第二会话密钥计算得到第二握手密钥，具体为：认证器获取第二随机数和自身存储的第二预置数据，按照第三预设算法通过第二会话密钥对第二随机数和第二预置数据进行计算得到第二握手密钥。
在本实施例2中，认证器获取第二随机数具体为：认证器获取第一随机数作为第二随机数；
具体地，通过第二握手密钥、客户端数据和客户端数据摘要值对客户端数据进行验证具体为：认证器按照第四预设算法通过握手密钥对客户端数据进行计算得到客户端数据摘要值，判断计算得到的客户端数据摘要值与接收到的客户端数据摘要值是否相同，是则验证成功，否则验证失败；
在本实施例2中，通过第二握手密钥对认证器数据进行计算得到认证器数据摘要值具体为：认证器生成第三随机数，将客户端版本号、认证器预设字段和第三随机数作为认证器数据，按照第四预设算法通过第二握手密钥对认证器数据进行计算得到认证器数据摘要值；
具体地，认证器数据包括：客户端版本、认证器预设字段和认证器生成的16字节的第三随机数；
例如，第二预置数据为ASCII字符串"FIDO caBLE v1 handshakeKey"；
得到的第二握手密钥为：
31454C6E1BB6A9D64790C9B1FD1372F85F5DC09072B398317FF0760EACE009A5；
第三随机数为：935337A931634E9C22C8EEB080827DF3；
认证器预设字段为：
6361424C45763161757468656E74696361746F7268656C6C6F；
认证器数据为：
6361424C45763161757468656E74696361746F7268656C6C6F935337A931634E9C22C8EEB080827DF3；
认证器数据摘要值为：07808B071C8E69DF1F1BFD13D52F39B8；
步骤210、认证器等待接收客户端发送的操作命令，当接收到操作命令时，执行步骤211；
步骤211、认证器获取操作命令中的加密数据，通过第二会话密钥计算得到第二加密密钥，通过第二加密密钥对加密数据进行解密得到操作数据，根据操作数据执行相应的操作得到操作结果数据，通过第二加密密钥对操作结果数据进行计算得到操作结果响应数据，向客户端发送包括操作响应数据的操作响应。
在本实施例2中，认证器通过第二会话密钥计算得到第二加密密钥具体为：认证器获取第一随机数、客户端数据中的第四随机数、自身存储的第三预置数据和第三随机数，按照第三预设算法通过第二会话密钥对第一随机数、客户端数据中的第四随机数、第三随机数和第三预置数据进行计算得到第二加密密钥；
具体地，按照第三预设算法通过第二会话密钥对第一随机数、客户端数据中的第四随机数、第三随机数和第三预置数据进行计算得到第二加密密钥具体为：认证器对第一随机数、客户端数据中的第四随机数和第三随机数做哈希计算得到哈希值，通过第二会话密钥对计算得到的哈希值和第三预置数据计算得到第二加密密钥；
具体地，通过第二会话密钥对计算得到的哈希值和第三预置数据计算得到第二加密密钥具体为：认证器按照第三预设算法通过第二会话密钥对计算得到的哈希值和第三预置数据计算得到第二加密密钥；
在本实施例2中，向客户端发送包括操作响应数据的操作响应具体包括：认证器获取计数器计数值，生成消息随机数，通过第二加密密钥对消息随机数、待加密数据、数据头进行计算得到加密数据，将计数值、数据头、消息随机数和加密数据进行组合得到操作结果响应数据，将操作结果响应数据发送给客户端；
在本实施例2中，认证器通过第二加密密钥对消息随机数、待加密数据、数据头进行计算得到加密数据具体为：认证器按照第五预设算法通过第二加密密钥对消息随机数、待加密数据、数据头进行计算得到加密数据；
具体地，消息随机数具体为：第一随机数、计数值和预设字段counter的组合；
数据头具体为header，若发送方是客户端则数据头header具体为cmd，若发送方是认证器则数据头header具体为STAT；其中，STAT具体是FIDO BLE传输协议中的STAT字节；
第五预设算法具体为：AES256-GCM；
其中，计数器具体为24位消息计数器；客户端侧和认证器侧的计数器初始化均为零，每次发送消息后同时递增；
例如，计数值为：0x00(客户端)或者0x01(认证器)；
数据头header＝cmd，或者header＝STAT；
消息随机数messageNonce＝nonce(8bytes)||Sender(1byte)||Counter(3bytes)；
加密数据chiperDATA＝AES256-GCM(key＝sessionKey,nonce＝messageNonce,plaintext＝DATA',additionalData＝Header,taglength＝128)；
假设Plaintext＝0808080808080808，
messageNonce＝EB59387103AF03A501000001，
sessionKey＝6D0D20CDFB8A55613AF009D804262CC673A78E1E4293D1E1BF83BC7A54867ECC；
则计算得到chiperdata＝44 C6 F2 7E BC 14 9F 49 EE 88 29 DB 60 E4 70 D0；
将计数值、数据头、消息随机数和加密数据进行组合得到操作响应数据具体为：0x01+cmd+messagenonce+chiperdata。
在本实施例2中，若认证器无法解密客户端发送的加密数据则断开连接，同样地，若客户端无法解密认证器发送的加密数据则断开连接。
例如，第三预置数据为：ASCII字符串"FIDO caBLE v1 sessionKey"；
第二加密密钥为：
6D0D20CDFB8A55613AF009D804262CC673A78E1E4293D1E1BF83BC7A54867ECC。
实施例3：
本发明实施例3提供了一种认证器，如图4所示，该认证器包括：
上电处理模块11，用于上电，进入连接模式；
扫描模块12，用于扫描广播数据，获取广播数据中的第一客户端标识；
获取模块13，用于获取自身存储的第一密钥；
第一验证模块14，用于根据第一密钥对第一客户端标识进行验证；
第一生成模块15，用于根据第一密钥生成第二认证器标识；
获取模块13，还用于获取与第一密钥对应的第二密钥；
第二生成模块16，用于根据第二密钥生成第二会话密钥；
通知模块17，用于通知对第一客户端标识验证成功；
广播模块18，用于停止扫描并广播包括第二认证器标识的广播数据；
获取模块13，还用于根据握手命令获取客户端数据和客户端数据摘要值；
第三生成模块19，用于通过第二会话密钥计算得到第二握手密钥；
第二验证模块20，用于根据第二握手密钥、客户端数据和客户端数据摘要值对客户端数据进行验证；
第四生成模块21，用于通过第二握手密钥对认证器数据进行计算得到认证器数据摘要值；
发送模块22，用于向客户端发送包括认证器数据和认证器数据摘要值的握手响应；
获取模块13，还用于获取操作命令中的加密数据；
第五生成模块23，用于通过第二会话密钥计算得到第二加密密钥；
解密处理模块24，用于通过第二加密密钥对加密数据进行解密得到操作数据，根据操作数据执行相应的操作得到操作结果数据，通过第二加密密钥对操作结果数据进行计算得到操作响应数据；
第二发送模块22，还用于向客户端发送包括操作响应数据的操作响应。
在本实施例3中，可选地，该认证器还包括：
判断处理模块，用于判断启动模式；
第二获取生成模块，用于获取扩展项注册命令中的客户端公钥和客户端版本号，生成认证器密钥对，根据客户端公钥和认证器密钥对中的认证器私钥生成第二参数；
第二获取生成模块，还用于获取自身存储的第一预置数据，根据客户端公钥、认证器密钥对中的认证器公钥、客户端版本号、第一预置数据和第二参数生成初始配对密钥，对初始配对密钥进行拆分得到第一密钥和第二密钥，并将第一密钥和第二密钥对应存储；
发送模块，还用于向客户端发送扩展项注册响应，响应中包括认证器公钥和客户端版本号。
在本实施例3中，可选地，第一验证模块14具体用于获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过第一密钥对第一预设字段和第一随机数进行计算得到第二数据，判断第二数据与第一数据是否相同。
在本实施例3中，可选地，第一生成模块15具体用于获取自身存储的第二预设字段，将第一客户端标识和第二预设字段顺序拼接，按照第四预设算法通过第一密钥对第一客户端标识和第二预设字段进行计算得到第四数据，获取第四数据中预设字节作为第二认证器标识。
在本实施例3中，可选地，第二生成模块16具体用于获取自身存储的第一预置数据和第一客户端标识中的第一随机数，按照第三预设算法通过第二密钥对第一随机数和第一预置数据进行计算得到第二会话密钥。
在本实施例3中，可选地，第三生成模块19具体用于获取第二随机数和自身存储的第二预置数据，按照第三预设算法通过第二会话密钥对第二随机数和第二预置数据进行计算得到第二握手密钥。
在本实施例3中，可选地，通知模块17具体用于与客户端建立蓝牙连接，当蓝牙连接断开时，触发第二广播模块。
优选地，认证器还包括发送接收模块；发送接收模块用于将第一唯一标识地址发送给客户端，接收客户端发送的第二唯一标识地址；
第二广播模块广播的数据中还包括第一唯一标识地址和第二唯一标识地址。
在本实施例3中，可选地，通知模块17具体用于通过提示模块提示用户将客户端的广播状态切换为扫描状态。
根据本发明，基于设备间蓝牙连接的基础上，通过采用认证器与客户端建立应用级别的蓝牙配对连接，且在连接过程中认证器进行双向广播扫描认证，认证成功连接后根据协商密钥生成加密密钥，通过加密密钥对通信过程中的数据进行加密传输，以确保传输过程中数据不被窃取，采用本发明提供的方法，提高了传输过程中的数据安全性，从而保证了用户的利益。
以上对本发明所提供的一种认证器及其通信方法进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上各实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上，本说明书内容不应理解为对本发明的限制。

Claims (18)

  1. 一种认证器的通信方法，其特征在于，所述方法包括以下步骤：
    S1)认证器上电，进入连接模式；
    S2)所述认证器扫描广播数据，获取广播数据中的第一客户端标识，获取自身存储的第一密钥，根据所述第一密钥对所述第一客户端标识进行验证，若验证成功则执行步骤S3，若验证失败则重新扫描广播数据；
    S3)所述认证器根据所述第一密钥生成第二认证器标识，获取与所述第一密钥对应的第二密钥，根据所述第二密钥生成第二会话密钥，通知对所述第一客户端标识验证成功，停止扫描并广播包括所述第二认证器标识的广播数据；
    S4)所述认证器接收客户端发送的建立蓝牙连接请求，与所述客户端建立蓝牙连接，等待接收所述客户端发送的握手命令，当接收到所述握手命令时，执行步骤S5；
    S5)所述认证器获取握手命令中的客户端数据和客户端数据摘要值，通过所述第二会话密钥计算得到第二握手密钥，通过所述第二握手密钥、所述客户端数据和所述客户端数据摘要值对所述客户端数据进行验证，验证成功则通过所述第二握手密钥对认证器数据进行计算得到认证器数据摘要值，向所述客户端发送包括所述认证器数据和所述认证器数据摘要值的握手响应，执行步骤S6；
    S6)所述认证器等待接收所述客户端发送的操作命令，当接收到所述操作命令时，执行步骤S7；以及
    S7)所述认证器获取所述操作命令中的加密数据，通过第二会话密钥计算得到第二加密密钥，通过所述第二加密密钥对所述加密数据进行解密得到操作数据，根据所述操作数据执行相应的操作得到操作结果数据，通过所述第二加密密钥对所述操作结果数据进行计算得到操作响应数据，向所述客户端发送包括所述操作响应数据的操作响应。
  2. 根据权利要求1所述的方法，其特征在于，进入连接模式之前，所述方法还包括：
    所述认证器判断启动模式，当启动模式为第一模式则进入连接模式，当启动模式为第二模式则进入配对模式；
    所述进入配对模式时，所述方法还包括以下步骤：
    A1)所述认证器接收客户端发送的扩展项注册命令，获取扩展项注册命令中的客户端公钥和客户端版本号，生成认证器密钥对，根据客户端公钥和认证器密钥对中的认证器私钥生成第一参数；
    A2)所述认证器获取自身存储的第一预置数据，根据所述客户端公钥、所述认证器密钥对中的认证器公钥、所述客户端版本号、所述第一预置数据和所述第一参数生成初始配对密钥，对所述初始配对密钥进行拆分得到第一密钥和第二密钥，并将所述第一密钥和所述第二密钥对应存储；以下
    A3)所述认证器向所述客户端发送扩展项注册响应，所述响应中包括所述认证器公钥和所述客户端版本号，进入连接模式。
  3. 根据权利要求1所述的方法，其特征在于，所述根据所述第一密钥对所述第一客户端标识进行验证，具体为：所述认证器获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过所述第一密钥对所述第一预设字段和所述第一随机数进行计算得到第二数据，判断所述第二数据与所述第一数据是否相同，是则验证成功，否则验证失败。
  4. 根据权利要求1所述的方法，其特征在于，所述认证器根据所述第一密钥生成第二认证器标识，具体为：所述认证器获取自身存储的第二预设字段，将所述第一客户端标识和所述第二预设字段顺序拼接，按照第四预设算法通过所述第一密钥对所述第一客户端标识和所述第二预设字段进行计算得到第四数据，获取所述第四数据中预设字节作为第二认证器标识。
  5. 根据权利要求1所述的方法，其特征在于，所述根据所述第二密钥生成第二会话密钥，具 体为：所述认证器获取自身存储的第一预置数据和第一客户端标识中的第一随机数，按照第三预设算法通过所述第二密钥对所述第一随机数和所述第一预置数据进行计算得到第二会话密钥。
  6. 根据权利要求1所述的方法，其特征在于，所述通过所述第二会话密钥计算得到第二握手密钥，具体为：所述认证器获取第二随机数和自身存储的第二预置数据，按照第三预设算法通过所述第二会话密钥对所述第二随机数和所述第二预置数据进行计算得到第二握手密钥。
  7. 根据权利要求1所述的方法，其特征在于，所述步骤S3中，所述通知对所述第一客户端标识验证成功，停止扫描并广播包括所述第二认证器标识的广播数据，具体包括：所述认证器向客户端发送建立蓝牙连接请求，与所述客户端建立蓝牙连接，当蓝牙连接断开时，广播包括所述第二认证器标识的广播数据。
  8. 根据权利要求7所述的方法，其特征在于，所述与所述客户端建立蓝牙连接之后还包括：所述认证器将第一唯一标识地址发送给所述客户端，接收所述客户端发送的第二唯一标识地址；
    所述广播数据中还包括第一唯一标识地址和第二唯一标识地址。
  9. 根据权利要求1所述的方法，其特征在于，所述步骤S3中，所述通知对所述第一客户端标识验证成功，具体包括：所述认证器通过提示模块提示用户将所述客户端的广播状态切换为扫描状态。
  10. 一种认证器，其特征在于，所述认证器包括：
    上电处理模块，用于上电，进入连接模式；
    扫描模块，用于扫描广播数据，获取广播数据中的第一客户端标识；
    获取模块，用于获取自身存储的第一密钥；
    第一验证模块，用于根据所述第一密钥对所述第一客户端标识进行验证；
    第一生成模块，用于根据所述第一密钥生成第二认证器标识；
    所述获取模块，还用于获取与所述第一密钥对应的第二密钥；
    第二生成模块，用于根据所述第二密钥生成第二会话密钥；
    通知模块，用于通知对所述第一客户端标识验证成功；
    广播模块，用于停止扫描并广播包括所述第二认证器标识的广播数据；
    所述获取模块，还用于根据所述握手命令获取所述客户端数据和所述客户端数据摘要值；
    第三生成模块，用于通过所述第二会话密钥计算得到第二握手密钥；
    第二验证模块，用于根据所述第二握手密钥、所述客户端数据和所述客户端数据摘要值对所述客户端数据进行验证；
    第四生成模块，用于通过所述第二握手密钥对认证器数据进行计算得到认证器数据摘要值；
    发送模块，用于向所述客户端发送包括所述认证器数据和所述认证器数据摘要值的握手响应；
    获取模块，还用于获取所述操作命令中的加密数据；
    第五生成模块，用于通过所述第二会话密钥计算得到第二加密密钥；
    解密处理模块，用于通过所述第二加密密钥对所述加密数据进行解密得到操作数据，根据所述操作数据执行相应的操作得到操作结果数据，通过所述第二加密密钥对所述操作结果数据进行计算得到操作响应数据；以及
    所述第二发送模块，还用于向所述客户端发送包括所述操作响应数据的操作响应。
  11. 根据权利要求10所述的认证器，其特征在于，所述认证器还包括：
    判断处理模块，用于判断启动模式；
    第二获取生成模块，用于获取扩展项注册命令中的客户端公钥和客户端版本号，生成认证器密钥对，根据所述客户端公钥和所述认证器密钥对中的认证器私钥生成第二参数；
    所述第二获取生成模块，还用于获取自身存储的第一预置数据，根据所述客户端公钥、所述认证器密钥对中的认证器公钥、所述客户端版本号、所述第一预置数据和所述第二参数生成初始配对密钥，对所述初始配对密钥进行拆分得到第一密钥和第二密钥，并将所述第一密钥和所述第二密钥对应存储；
    所述发送模块，还用于向所述客户端发送扩展项注册响应，所述响应中包括所述认证器公钥 和所述客户端版本号。
  12. 根据权利要求10所述的认证器，其特征在于，所述第一验证模块具体用于获取自身存储的第一预设字段、第一客户端标识中的第一随机数和第一数据，按照第四预设算法通过所述第一密钥对所述第一预设字段和所述第一随机数进行计算得到第二数据，判断所述第二数据与所述第一数据是否相同。
  13. 根据权利要求10所述的认证器，其特征在于，所述第一生成模块具体用于获取自身存储的第二预设字段，将所述第一客户端标识和所述第二预设字段顺序拼接，按照第四预设算法通过所述第一密钥对所述第一客户端标识和所述第二预设字段进行计算得到第四数据，获取所述第四数据中预设字节作为第二认证器标识。
  14. 根据权利要求10所述的认证器，其特征在于，所述第二生成模块具体用于获取自身存储的第一预置数据和第一客户端标识中的第一随机数，按照第三预设算法通过所述第二密钥对所述第一随机数和所述第一预置数据进行计算得到第二会话密钥。
  15. 根据权利要求10所述的认证器，其特征在于，所述第三生成模块具体用于获取第二随机数和自身存储的第二预置数据，按照第三预设算法通过所述第二会话密钥对所述第二随机数和所述第二预置数据进行计算得到第二握手密钥。
  16. 根据权利要求10所述的认证器，其特征在于，所述通知模块具体用于与所述客户端建立蓝牙连接，当蓝牙连接断开时，触发所述第二广播模块。
  17. 根据权利要求16所述的认证器，其特征在于，所述认证器还包括发送接收模块；所述发送接收模块用于将第一唯一标识地址发送给所述客户端，接收所述客户端发送的第二唯一标识地址；以及
    所述第二广播模块广播的数据中还包括第一唯一标识地址和第二唯一标识地址。
  18. 根据权利要求10所述的认证器，其特征在于，所述通知模块具体用于通过提示模块提示用户将所述客户端的广播状态切换为扫描状态。
PCT/CN2021/128651 2020-12-31 2021-11-04 一种认证器及其通信方法 WO2022142718A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/034,684 US20230403749A1 (en) 2020-12-31 2021-11-04 Authenticator and communication method therefor

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011619762.1A CN112291773B (zh) 2020-12-31 2020-12-31 一种认证器及其通信方法
CN202011619762.1 2020-12-31

Publications (1)

Publication Number Publication Date
WO2022142718A1 true WO2022142718A1 (zh) 2022-07-07

Family

ID=74425340

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/128651 WO2022142718A1 (zh) 2020-12-31 2021-11-04 一种认证器及其通信方法

Country Status (3)

Country Link
US (1) US20230403749A1 (zh)
CN (1) CN112291773B (zh)
WO (1) WO2022142718A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112311544B (zh) * 2020-12-31 2021-03-16 飞天诚信科技股份有限公司 一种服务器与认证器进行通信的方法及系统
CN112291773B (zh) * 2020-12-31 2021-04-06 飞天诚信科技股份有限公司 一种认证器及其通信方法
CN113596827B (zh) * 2021-07-29 2024-02-13 Oppo广东移动通信有限公司 密钥生成方法、装置、电子设备及存储介质
CN113473459A (zh) * 2021-08-09 2021-10-01 北京国民安盾科技有限公司 移动端应用级别蓝牙配对方法和系统
CN113965361B (zh) * 2021-10-12 2024-02-27 广州市国金软件科技有限公司 一种用于服务器间的通信方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104821930A (zh) * 2014-02-03 2015-08-05 塔塔咨询服务公司 计算机实施的物联网数据报传输轻型认证系统和方法
CN107919963A (zh) * 2017-12-27 2018-04-17 飞天诚信科技股份有限公司 一种认证器及其实现方法
WO2020249206A1 (en) * 2019-06-12 2020-12-17 Telefonaktiebolaget Lm Ericsson (Publ) Provision of application level identity
CN112291773A (zh) * 2020-12-31 2021-01-29 飞天诚信科技股份有限公司 一种认证器及其通信方法
CN112291774A (zh) * 2020-12-31 2021-01-29 飞天诚信科技股份有限公司 一种与认证器进行通信的方法及系统
CN112311544A (zh) * 2020-12-31 2021-02-02 飞天诚信科技股份有限公司 一种服务器与认证器进行通信的方法及系统

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1372201A (zh) * 2002-04-03 2002-10-02 张平 一种网络安全新方法
CN105162785B (zh) * 2015-09-07 2019-01-04 飞天诚信科技股份有限公司 一种基于认证设备进行注册的方法和设备
CN105187450B (zh) * 2015-10-08 2019-05-10 飞天诚信科技股份有限公司 一种基于认证设备进行认证的方法和设备
CN105450269B (zh) * 2015-12-21 2017-09-22 飞天诚信科技股份有限公司 一种实现蓝牙设备间安全交互配对认证的方法及装置
MY181840A (en) * 2016-11-04 2021-01-08 Thomson Licensing Devices and methods for client device authentication
CN107317606B (zh) * 2017-07-03 2020-05-19 飞天诚信科技股份有限公司 一种蓝牙防追踪的方法及设备
CN111355745B (zh) * 2020-03-12 2021-07-06 西安电子科技大学 基于边缘计算网络架构的跨域身份认证方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104821930A (zh) * 2014-02-03 2015-08-05 塔塔咨询服务公司 计算机实施的物联网数据报传输轻型认证系统和方法
CN107919963A (zh) * 2017-12-27 2018-04-17 飞天诚信科技股份有限公司 一种认证器及其实现方法
WO2020249206A1 (en) * 2019-06-12 2020-12-17 Telefonaktiebolaget Lm Ericsson (Publ) Provision of application level identity
CN112291773A (zh) * 2020-12-31 2021-01-29 飞天诚信科技股份有限公司 一种认证器及其通信方法
CN112291774A (zh) * 2020-12-31 2021-01-29 飞天诚信科技股份有限公司 一种与认证器进行通信的方法及系统
CN112311544A (zh) * 2020-12-31 2021-02-02 飞天诚信科技股份有限公司 一种服务器与认证器进行通信的方法及系统

Also Published As

Publication number Publication date
CN112291773B (zh) 2021-04-06
CN112291773A (zh) 2021-01-29
US20230403749A1 (en) 2023-12-14

Similar Documents

Publication Publication Date Title
WO2022142717A1 (zh) 一种服务器与认证器进行通信的方法及系统
WO2022142718A1 (zh) 一种认证器及其通信方法
WO2022142874A1 (zh) 一种与认证器进行通信的方法及系统
US11200012B2 (en) Terminal device, access point, communication device, and computer programs therefor
CN113099443B (zh) 设备认证方法、装置、设备和系统
JP5524157B2 (ja) プローブを使用する２つの装置間のセキュアなワイヤレスリンク
WO2017031674A1 (zh) 一种安全认证方法、配置方法以及相关设备
US20130227660A1 (en) Registration server, gateway apparatus and method for providing a secret value to devices
WO2019007172A1 (zh) 一种蓝牙防追踪的方法及设备
CN114125832B (zh) 一种网络连接方法及终端、待配网设备、存储介质
US10944555B2 (en) Secure methods and systems for identifying bluetooth connected devices with installed application
CN111726801B (zh) 一种网络安全控制方法
WO2015100676A1 (zh) 一种网络设备安全连接方法、相关装置及系统
CN104836784A (zh) 一种信息处理方法、客户端和服务器
WO2018152961A1 (zh) 一种信息传输方法及设备
CN107070917B (zh) 一种网络应用登陆方法和系统
CN111132163B (zh) 一种无线安全设备与应用程序的认证方法和系统
US11695804B2 (en) Method and apparatus for MoCA network with protected set-up
CN114584393B (zh) 一种自动选择加密协议的方法
CN114422999B (zh) 设备自动配对连接方法、装置、设备及存储介质
CN104935667A (zh) 一种基于drm的移动终端远程操作方法及系统
CN115361116A (zh) 公开环境中秘钥分发的方法、验证方法及相关设备
CN116032548A (zh) 物联网的接入认证方法、装置、终端设备及网关设备
WO2016187850A1 (zh) 无线通信网络中设备配置的方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913462

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21913462

Country of ref document: EP

Kind code of ref document: A1