Granted Patent B2

US 12,407,492 · App. 18/027,727 · Granted Sep 2, 2025

Inventors: Zhou Lu (Beijing, CN); Huazhang Yu (Beijing, CN)

Assignee: Feitian Technologies Co., Ltd.

H04L9/0819H04L9/0861H04L9/14H04L9/3073H04W12/06

Abstract

Claims (79)

1. A method for communicating with an authenticator, comprising:

Step S 1 , obtaining, by a client, a first key stored in the client, generating a first client identification and a first authenticator identification according to the first key, obtaining a second key corresponding to the first key, generating a first session key according to the second key, and broadcasting data comprising the first client identification according to a preset time interval;

Step S 2 , scanning, by the authenticator, the broadcast data, obtaining the first client identification in the broadcast data, obtaining a third key stored in the authenticator, verifying the first client identification according to the third key, executing Step S 3 when the verifying of the first client identification is successful, rescanning the broadcast data when the verifying of the first client identification is failed;

Step S 3 , generating, by the authenticator, a second authenticator identification according to the third key, obtaining a fourth key corresponding to the third key, generating a second session key according to the fourth key, notifying that the verifying of the first client identification is successful, stopping scanning, and broadcasting broadcast data comprising the second authenticator identification;

Step S 4 , stopping, by the client, broadcasting from the client, starting to scan the broadcast data sent from the authenticator, parsing the broadcast data sent from the authenticator that obtained by scanning to obtain the second authenticator identification, and verifying the second authenticator identification, establishing a short-range communication connection with the authenticator and executing Step S 5 when the verifying of the second authenticator identification is successful, ending the method when the verifying of the second authenticator identification is failed;

Step S 5 , obtaining, by the client, a first handshake key by computation with the first session key, performing computation on client data with the first handshake key to obtain a client data digest value, and sending a handshake command comprising the client data and the client data digest value to the authenticator;

Step S 6 , obtaining, by the authenticator, the client data and the client data digest value according to the handshake command, obtaining a second handshake key by computation with the second session key, verifying the client data according to the second handshake key, the client data and the client data digest value, performing computation on authenticator data with the second handshake key to obtain an authenticator data digest value when the verifying of the client data is successful, and sending a handshake response comprising the authenticator data and the authenticator data digest value to the client;

Step S 7 , obtaining, by the client, the authenticator data and the authenticator data digest value according to the handshake response, and verifying the authenticator data according to the first handshake key, the authenticator data and the authenticator digest value, executing Step S 8 in case of a successful handshake when the verifying of the authenticator data is successful; otherwise, performing disconnection;

Step S 8 , obtaining, by the client, a first encryption key by computation with the first session key, performing computation on operating data with the first encryption key to obtain encryption data, and sending an operating command comprising the encryption data to the authenticator; and

Step S 9 , obtaining, by the authenticator, the encryption data in the operating command, obtaining a second encryption key by computation with the second session key, decrypting the encryption data with the second encryption key to obtain operating data, performing a corresponding operation according to the operating data to obtain operating result data, performing computation on the operating result data with the second encryption key to obtain operating response data, and sending an operating response comprising the operating response data to the client.

2. The method according to claim 1 , before Step S 1 , further comprising:

Step A 1 , generating, by the client, a client key pair, sending an extension register command to the authenticator, wherein the extension register command comprises a client version number and a client public key in the client key pair;

Step A 2 , obtaining, by the authenticator, the client public key and the client version number in the extension register command, generating an authenticator key pair, and generating a second parameter according to the client public key and an authenticator private key in the authenticator key pair;

Step A 3 , obtaining, by the authenticator, first preset data stored in the authenticator, generating a second initial pairing key according to the client public key, an authenticator public key in the authenticator key pair, the client version number, the first preset data stored in the authenticator and the second parameter, splitting the second initial paring key to obtain a third key and a fourth key, and storing the third key and the fourth key correspondingly;

Step A 4 , sending, by the authenticator, an extension register response to the client, wherein the extension register response comprises the authenticator public key and the client version number;

Step A 5 , obtaining, by the client, the authenticator public key and the client version number in the extension register response, and generating a first parameter according to a client private key in the client key pair and the authenticator public key; and

Step A 6 , obtaining, by the client, first preset data stored in the client, generating a first initial paring key according to the client public key, the authenticator public key, the client version number, the first preset data stored in the client and the first parameter, splitting the first initial paring key to obtain a first key and a second key, and storing the first key and the second key correspondingly.

3. The method according to claim 1 , wherein the verifying the first client identification according to the third key specifically is: obtaining, by the authenticator, a first preset field stored in the authenticator, a first random number and first data in the first client identification, performing computation on the first preset field and the first random number with the third key according to a fourth preset algorithm to obtain second data, determining whether the second data is identical to the first data, when the second data is identical to the first data, the verifying of the first client identification is successful, otherwise, the verifying of the first client identification is failed.

4. The method according to claim 3 , wherein the generating the second session key according to the fourth key specifically is: obtaining, by the authenticator, first preset data stored in the authenticator, and performing computation on the first random number and the first preset data stored in the authenticator with the fourth key according to a third preset algorithm to obtain the second session key.

5. The method according to claim 1 , wherein the generating, by the authenticator, the second authenticator identification according to the third key specifically is: obtaining, by the authenticator, a second preset field stored in the authenticator, concatenating the first client identification and the second preset field in sequence, performing computation on the first client identification and the second preset field with the third key according to a fourth preset algorithm to obtain fourth data, and obtaining a preset byte in the fourth data as the second authenticator identification.

6. The method according to claim 1 , wherein the verifying the second authenticator identification specifically is: comparing, by the client, the second authenticator identification with the first authenticator identification, wherein the verifying of the second authenticator identification is successful when there is consistent comparison, otherwise, the verifying of the second authenticator identification is failed.

7. The method according to claim 1 , wherein the obtaining, by the client, the first handshake key by computation with the first session key specifically is: obtaining, by the client, a second random number and second preset data stored in the client, and performing computation on the second random number and the second preset data stored in the client with the first session key according to a third preset algorithm to obtain the first handshake key.

8. The method according to claim 1 , wherein the obtaining the second handshake key by computation with the second session key specifically is: obtaining, by the authenticator, a fourth random number and second preset data stored in the authenticator, performing computation on the fourth random number and the second preset data stored in the authenticator with the second session key according to a third preset algorithm to obtain the second handshake key.

9. The method according to claim 1 , wherein in Step S 3 , the notifying that the verifying of the first client identification is successful, stopping scanning, and broadcasting the broadcast data comprising the second authenticator identification specifically is: establishing, by the authenticator, the short-range communication connection with the client, broadcasting the broadcast data comprising the second authenticator identification when the short-range communication connection is disconnected.

10. The method according to claim 9 , after the establishing, by the authenticator, the short-range communication connection with the client, further comprising: sending, by the authenticator, a first unique identification address to the client, and receiving a second unique identification address sent from the client;

wherein the broadcast data sent from the authenticator further comprises the first unique identification address and the second unique identification address;

Step S 4 specifically comprises: stopping, by the client, broadcasting, starting to scan the broadcast data sent from the authenticator comprising the first unique identification address and the second unique identification address, parsing the broadcast data sent from the authenticator obtained by scanning to obtain the second authenticator identification, and verifying the second authenticator identification, establishing the short-range communication connection with the authenticator and executing Step S 5 when the verifying of the second authenticator identification is successful, ending the procedure when the verifying of the second authenticator identification is failed.

11. A system for communicating with an authenticator, comprising a client and an authenticator, wherein the client comprises a first processor and a first memory, the authenticator comprises a second processor and a second memory, wherein the first memory and the second memory store computer programs that are executed by the first processor and the second processor;

the first processor is configured to:

obtain a first key stored in the client;

generate a first client identification and a first authenticator identification according to the first key;

obtain a second key corresponding to the first key;

generate a first session key according to the second key;

broadcast data comprising the first client identification according to a preset time interval;

stop broadcasting, start to scan broadcast data sent from the authenticator, and parse the broadcast data sent from the authenticator that obtained by scanning;

verify a second authenticator identification;

obtain a first handshake key by computation with the first session key, and perform computation on the client data with the first handshake key to obtain a client data digest value;

send a handshake command comprising the client data and the client data digest value to the authenticator;

obtain authenticator data and a authenticator digest value according to a handshake response;

verify the authenticator data according to the first handshake key, the authenticator data and the authenticator digest value;

obtain a first encryption key by computation with the first session key, and perform computation on operating data with the first encryption key to obtain encryption data; and

send an operating command comprising the encryption data to the authenticator;

the second processor is configured to:

scan the broadcast data sent from the client and obtain the first client identification from the broadcast data sent from the client;

obtain a third key stored in the authenticator;

verify the first client identification according to the third key;

generate a second authenticator identification according to the third key;

obtain a fourth key corresponding to the third key;

generate a second session key according to the fourth key;

notify that the verifying of the first client identification is successful;

stop scanning and broadcast the broadcast data sent from the authenticator comprising the second authenticator identification;

obtain the client data and the client data digest value according to the handshake command;

obtain a second handshake key by computation with the second session key;

verify the client data according to the second handshake key, the client data and the client data digest value;

perform computation on the authenticator data with the second handshake key to obtain an authenticator data digest value;

send the handshake response comprising the authenticator data and the authenticator data digest value to the client;

obtain the encryption data in the operating command;

obtain a second encryption key by computation with the second session key;

decrypt the encryption data with the second encryption key to obtain operating data, perform a corresponding operation according to the operating data to obtain operating result data, and perform computation on the operating result data with the second encryption key to obtain operating response data; and

send an operating response comprising the operating response data to the client.

12. The system according to claim 11 , wherein the first processor is further configured to:

generate a client key pair, send an extension register command to the authenticator, wherein the extension register command comprises a client version number and a client public key in the client key pair;

obtain an authenticator public key and a client version number in an extension register response, and generate a first parameter according to a client private key in the client key pair and the authenticator public key; and

obtain first preset data stored in the client, generate a first initial paring key according to the client public key, the authenticator public key, the client version number, the first preset data stored in the client and the first parameter, split the first initial paring key to obtain a first key and a second key, and store the first key and the second key correspondingly;

the second processor is further configured to:

obtain the client public key and the client version number in the extension register command, generate an authenticator key pair, and generate a second parameter according to the client public key and an authenticator private key in the authenticator key pair;

obtain first preset data stored in the authenticator, generate a second initial pairing key according to the client public key, an authenticator public key in the authenticator key pair, the client version number, the first preset data stored in the authenticator and the second parameter, split the second initial paring key to obtain a third key and a fourth key, and store the third key and the fourth key correspondingly; and

send the extension register response to the client, wherein the extension register response comprises the authenticator public key and the client version number.

13. The system according to claim 11 , wherein the second processor is further configured to obtain a first preset field stored in the authenticator, a first random number and first data in the first client identification, perform computation on the first preset field and the first random number with the third key according to a fourth preset algorithm to obtain second data, determine whether the second data is identical to the first data.

14. The system according to claim 13 , wherein the second processor is further configured to obtain first preset data stored in the authenticator, and perform computation on the first random number and the first preset data stored in the authenticator with the fourth key according to a third preset algorithm to obtain the second session key.

15. The system according to claim 11 , wherein the second processor is further configured to obtain a second preset field stored in the authenticator, concatenate the first client identification and the second preset field in sequence, perform computation on the first client identification and the second preset field with the third key according to a fourth preset algorithm to obtain fourth data, and obtain a preset byte in the fourth data as the second authenticator identification.

16. The system according to claim 11 , wherein the first processor is further configured to compare the second authenticator identification with the first authenticator identification, wherein the verifying of the second authenticator is successful when there is consistent comparison, otherwise, the verifying of the second authenticator is failed.

17. The system according to claim 11 , wherein the first processor is further configured to obtain a second random number and second preset data stored in the client, and perform computation on the second random number and the second preset data stored in the client with the first session key according to a third preset algorithm to obtain the first handshake key.

18. The system according to claim 11 , wherein the second processor is further configured to obtain a fourth random number and second preset data stored in the authenticator, and perform computation on the fourth random number and the second preset data stored in the authenticator with the second session key according to a third preset algorithm to obtain the second handshake key.

19. The system according to claim 11 , wherein the second processor is further configured to establish a short-range communication connection with the client, and broadcast the broadcast data comprising the second authenticator identification when the short-range communication connection is disconnected.

20. The system according to claim 19 , wherein the second processor is further configured to send a first unique identification address to the client, and receive a second unique identification address sent from the client;

wherein the broadcast data sent from the authenticator further comprises the first unique identification address and the second unique identification address;

the client is further configured to stop broadcasting, start to scan the broadcast data sent from the authenticator comprising the first unique identification address and the second unique identification address, and parse the broadcast data sent from the authenticator obtained by scanning; and

the client is further configured to verify the second authenticator identification, and establish the short-range communication connection with the authenticator when the verifying of the second authenticator identification is successful.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (24)