CN116419205A

CN116419205A - Device authentication method and device and storage medium

Info

Publication number: CN116419205A
Application number: CN202111643295.0A
Authority: CN
Inventors: 乔光军
Original assignee: Beijing Xiaomi Mobile Software Co Ltd
Current assignee: Beijing Xiaomi Mobile Software Co Ltd
Priority date: 2021-12-29
Filing date: 2021-12-29
Publication date: 2023-07-11

Abstract

The disclosure provides a device authentication method and device and a storage medium. Wherein the method comprises the following steps: determining a first radio frequency fingerprint for identifying a second device while communicating with the second device using a digital key; and in response to determining that the first radio frequency fingerprint is consistent with the trusted radio frequency fingerprint of the second device, determining that the second device belongs to the trusted device. The method and the device can avoid being attacked by the relay equipment in the process of using the digital key, and improve the safety of the use process of the digital key.

Description

Device authentication method and device and storage medium

Technical Field

The disclosure relates to the field of digital keys, and in particular relates to a device authentication method and device and a storage medium.

Background

At present, a process of using a digital key is increasingly important for users to enter devices such as vehicles without sense. The premise of no induction is that the receiving end equipment receiving the digital key can accurately and safely determine the ranging result between the receiving end equipment and the transmitting end equipment transmitting the digital key.

In ranging, UWB (Ultra Wide Band) scheme based on STS (Scrambled Timestamp Sequence, scrambling time stamp sequence) and bluetooth scheme based on RSSI (Received Signal Strength Indication ) may be used. Among them, RSSI-based bluetooth is vulnerable to attack by relay devices.

Disclosure of Invention

In view of the above, the application discloses a device authentication method and device and a storage medium.

According to a first aspect of embodiments of the present disclosure, there is provided a device authentication method, the method being applied to a first device, the method further comprising:

determining a first radio frequency fingerprint for identifying a second device while communicating with the second device using a digital key;

and in response to determining that the first radio frequency fingerprint is consistent with the trusted radio frequency fingerprint of the second device, determining that the second device belongs to the trusted device.

Optionally, before determining the first radio frequency fingerprint for identifying the second device, the method further comprises:

during the process of creating the digital key with the second device, extracting a second radio frequency fingerprint of the second device based on a first extraction mode;

determining the second radio frequency fingerprint as the trusted radio frequency fingerprint of the second device;

storing the trusted radio frequency fingerprint of the second device to a secure storage area on the first device;

the determining a first radio frequency fingerprint for identifying the second device includes:

and extracting the first radio frequency fingerprint of the second device based on the first extraction mode.

Optionally, the method further comprises:

responsive to determining that the trusted radio frequency fingerprint of the second device is not stored on the first device, outputting prompt information for device authentication of the second device;

and determining that the second device belongs to the trusted device based on the received trusted device confirmation instruction.

Optionally, after determining that the second device belongs to a trusted device, the method further comprises:

extracting a second radio frequency fingerprint of the second device based on the first extraction mode;

storing the trusted radio frequency fingerprint of the second device to a secure storage area on the first device.

Optionally, the first extraction mode is determined by the first device.

Optionally, the method further comprises:

extracting a third radio frequency fingerprint of the first device based on a second extraction mode;

encrypting and signing the first association information; the first association information comprises the third radio frequency fingerprint and second extraction mode information;

and sending the encrypted and signed first association information to the second device.

Optionally, the extracting, based on the second extracting manner, a third radio frequency fingerprint of the first device includes:

according to a preset period, based on the second extraction mode, extracting a third radio frequency fingerprint of the first device;

said transmitting said encrypted and signed first association information to said second device, comprising:

and sending the first association information subjected to encryption and signature to the second equipment according to the preset period.

Optionally, the second extraction mode is determined by the first device.

Optionally, the method further comprises:

receiving second associated information which is sent by the second equipment and is encrypted and signed; the second association information comprises a fourth radio frequency fingerprint and third extraction mode information, wherein the fourth radio frequency fingerprint is a radio frequency fingerprint of the second device extracted by the second device based on a third extraction mode;

performing signature verification after decrypting the second associated information, and determining a verification result;

determining the fourth radio frequency fingerprint as the trusted radio frequency fingerprint of the second device if the second association information is successfully decrypted and the verification result indicates that verification is successful;

Storing the trusted radio frequency fingerprint and the second extraction mode information of the second device in a temporary storage area on the first device;

and extracting the first radio frequency fingerprint of the second device based on the third extraction mode.

Optionally, the method further comprises:

and updating the trusted radio frequency fingerprint and the third extraction mode information of the second device stored in the temporary storage area of the first device according to a preset period.

Optionally, the third extraction mode is determined by the second device.

Optionally, the first device is a transmitting end device for transmitting the digital key, and the second device is a receiving end device for receiving the digital key; or (b)

The first device is a receiving end device for receiving the digital key, and the second device is a transmitting end device for transmitting the digital key.

Optionally, the first radio frequency fingerprint comprises at least one of:

the center frequency corresponding to the target signal; wherein the target signal is a signal sent by the second device to the first device when the first device and the second device communicate using a digital key;

The frequency offset corresponding to the target signal;

a rising edge slope value of the target signal;

the falling edge slope value of the target signal.

According to a second aspect of embodiments of the present disclosure, there is provided a device authentication apparatus, the apparatus being applied to a first device, the apparatus comprising:

a first determining module for determining a first radio frequency fingerprint for identifying a second device when communicating with the second device using a digital key;

and the first equipment authentication module is used for determining that the second equipment belongs to the trusted equipment in response to determining that the first radio frequency fingerprint is consistent with the trusted radio frequency fingerprint of the second equipment.

According to a third aspect of embodiments of the present disclosure, there is provided a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the device authentication method of any one of the above.

According to a fourth aspect of embodiments of the present disclosure, there is provided a device authentication apparatus including:

a processor;

a memory for storing processor-executable instructions;

wherein the processor is configured to execute the executable instructions to implement the steps of the device authentication method of any one of the above.

The technical scheme provided by the embodiment of the disclosure can comprise the following beneficial effects:

in the embodiment of the disclosure, when the first device communicates with the second device by using the digital key, whether the first radio frequency fingerprint for identifying the second device is consistent with the trusted radio frequency fingerprint of the second device or not can be determined, and if so, the second device is determined to belong to the trusted device. The method and the device can avoid being attacked by the relay equipment in the process of using the digital key, and improve the safety of the use process of the digital key.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.

Fig. 1 is a schematic diagram of a relay device attack scenario in the related art;

FIG. 2 is a flow chart diagram illustrating a device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 3 is a flow chart illustrating another device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 4 is a flow chart of another device authentication method shown in accordance with an exemplary embodiment of the present disclosure;

FIG. 5 is a flow chart illustrating another device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 6 is a flow chart illustrating another device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 7 is a flow chart illustrating another device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 8 is a flow chart illustrating another device authentication method according to an exemplary embodiment of the present disclosure;

FIG. 9 is a block diagram of a device authentication apparatus according to an exemplary embodiment of the present disclosure;

fig. 10 is a schematic diagram of a device authentication apparatus according to an exemplary embodiment of the present disclosure;

fig. 11 is a schematic diagram of a structure of another device authentication apparatus according to an exemplary embodiment of the present disclosure.

Detailed Description

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, the same numbers in different drawings refer to the same or similar elements, unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with the invention. Rather, they are merely examples of apparatus and methods consistent with aspects of the invention as detailed in the accompanying claims.

Referring to fig. 1, taking a digital key as an example of a digital car key, a car owner device may be used as a transmitting device for transmitting the digital car key, a vehicle may be used as a receiving device for receiving the digital car key, and when the vehicle performs ranging in a bluetooth manner based on RSSI, if a relay device #1 and a relay device #2 perform signal amplification between the car owner device and the vehicle, that is, the use process of the digital key is attacked by the relay device #1 and the relay device #2, the vehicle easily misjudges the distance between the digital key and the car owner device, so that the vehicle performs operations such as opening a car door even if the car owner device is far from the vehicle, and the security is poor.

In order to solve this technical problem, the present disclosure provides the following device authentication method. The following description is made from the first device side.

Referring to fig. 2, fig. 2 is a flowchart illustrating a device authentication method according to an exemplary embodiment of the present disclosure, where the embodiment is described from a first device side, and it should be noted that the first device may be a transmitting end device that transmits a digital key, the transmitting end device may be a terminal device, the first device may also be a receiving end device that receives the digital key, and the receiving end device may be a vehicle, an intelligent door lock, or the like. As shown in fig. 2, the device authentication method may include the steps of:

In step 201, a first radio frequency fingerprint is determined for identifying a second device while communicating with the second device using a digital key.

In embodiments of the present disclosure, the first radio frequency fingerprint may include at least one type of radio frequency characteristics specific to the second device, including, but not limited to, frequency domain signal characteristics and/or time domain signal characteristics.

In one possible implementation, the first radio frequency fingerprint includes, but is not limited to, at least one of: the center frequency corresponding to the target signal; wherein the target signal is a signal sent by the second device to the first device when the first device and the second device communicate using a digital key; the frequency offset corresponding to the target signal; a rising edge slope value of the target signal; the falling edge slope value of the target signal.

The foregoing is merely exemplary, and it is within the scope of the present disclosure that the relevant rf characteristics capable of identifying the second device may be used as the first rf fingerprint of the second device.

It should be noted that the second device is a peer device of the first device, and if the first device is a transmitting device, the second device is a receiving device, whereas if the first device is a receiving device, the second device is a transmitting device.

In step 202, in response to determining that the first radio frequency fingerprint is consistent with the trusted radio frequency fingerprint of the second device, it is determined that the second device belongs to a trusted device.

In the embodiment of the disclosure, the first device may determine and store the trusted radio frequency fingerprint of the second device in advance, compare the first radio frequency fingerprint with the trusted radio frequency fingerprint of the second device, and if they are consistent, determine that the second device is a trusted device, so as to determine that the process of the first device and the second device using the digital key for communication is not attacked by the relay device.

In the above embodiment, the comparison between the first rf fingerprint capable of identifying the second device and the trusted rf fingerprint of the second device may be performed, and in the case where the first rf fingerprint and the trusted rf fingerprint are consistent, it is determined that the process of using the digital key to perform communication is not attacked by the relay device, thereby improving the security of the use process of the digital key.

Based on the device authentication method provided by the disclosure, it can be seen that determining whether the second device belongs to the trusted device is critical in determining the trusted radio frequency fingerprint of the second device. The present disclosure provides the following ways of determining a trusted radio frequency fingerprint of a second device:

in a first way, during the digital key creation phase, a trusted radio frequency fingerprint of the second device is determined.

Referring to fig. 3, fig. 3 is a flowchart illustrating a device authentication method according to an exemplary embodiment of the present disclosure, which may be applied to a first device, including the steps of:

in step 301, during creation of the digital key with the second device, a second radio frequency fingerprint of the second device is extracted based on the first extraction means.

In the embodiment of the disclosure, the digital key may be an asymmetric digital key, that is, two communication parties respectively encrypt and decrypt the digital key using different keys. In the process of creating the digital key with the second device, it may be determined that both communication parties are trusted devices, and accordingly, the first device may extract the second radio frequency fingerprint of the second device based on the first extraction manner.

In one possible implementation, the first extraction manner may be determined by the first device itself, i.e. the first device itself may determine which radio frequency features of the second device need to be extracted as the second radio frequency fingerprint of the second device. The radio frequency features included in the second radio frequency fingerprint may be similar to those included in the first radio frequency fingerprint, and will not be described again.

In another possible implementation manner, the first extraction manner may also be determined by the second device, where the second device needs to send the extraction manner information corresponding to the first extraction manner to the first device, in order to ensure that the extraction manner information is not acquired by an illegal user, the extraction manner information may be encrypted and signed, after the first device receives the information, the first device decrypts the information and verifies the signature by using the key of the digital key stored in the first device, and if the decryption is successful and the verification result indicates that the verification is successful, the second radio frequency fingerprint of the second device may be extracted based on the first extraction manner corresponding to the extraction manner information.

In step 302, the second radio frequency fingerprint is determined as the trusted radio frequency fingerprint of the second device.

In the embodiment of the disclosure, considering that both communication parties are trusted devices at this time, the first device may determine the extracted second radio frequency fingerprint as the trusted radio frequency fingerprint of the second device.

In step 303, the trusted radio frequency fingerprint of the second device is stored to a secure storage area on the first device.

In a semi-public embodiment, the Secure storage area includes, but is not limited to, a SE (Secure Element) to subsequently determine whether the process of using the digital key is being attacked by the relay device based on the trusted radio frequency fingerprint of the second device stored in the Secure storage area.

In the embodiment of the present disclosure, the steps 301 to 303 may be implemented separately, so as to achieve the purpose of extracting the trusted radio frequency fingerprint of the second device.

Or steps 301 to 303 may be performed in combination with steps 201 to 202. Specifically, in step 201, determining a first radio frequency fingerprint for identifying the second device may include: and extracting the first radio frequency fingerprint of the second device based on the third extraction mode.

After determining and storing the trusted radio frequency fingerprint of the second device based on the steps 301 to 303, the first device performs the step 201, and when communicating with the second device using the digital key, extracts the first radio frequency fingerprint for identifying the second device, and determines whether the first radio frequency fingerprint is consistent with the trusted radio frequency fingerprint of the second device, thereby determining whether the second device belongs to the trusted device.

In the embodiment, the trusted radio frequency fingerprint of the second device can be determined in the process of creating the digital key with the second device, so that the implementation is simple and convenient, and the availability is high. The subsequent attack by the relay equipment can be avoided in the process of using the digital key, and the safety of the digital key in the use process is improved.

And in a second mode, determining the trusted radio frequency fingerprint of the second device through a device authentication mode.

Referring to fig. 4, fig. 4 is a flowchart illustrating a device authentication method according to an exemplary embodiment of the present disclosure, which may be applied to a first device, including the steps of:

in step 401, in response to determining that the trusted radio frequency fingerprint of the second device is not stored on the first device, a hint information for device authentication of the second device is output.

In the embodiment of the disclosure, the digital key may be a symmetric digital key, that is, both parties of communication use the same key to encrypt and decrypt the digital key, and the digital key may be generally issued to the transmitting end device and the receiving end device by the server, so in the process of creating the digital key, there may be no direct communication between the first device and the second device, and accordingly, the first device may not determine the trusted rf fingerprint of the second device in the stage of creating the digital key. At this point, a device authentication manner may be employed to determine the trusted radio frequency fingerprint of the second device.

In the embodiment of the disclosure, the first device determines that the trusted radio frequency fingerprint of the second device is not stored, that is, the digital key is used for the first time, and at this time, the first device may temporarily interrupt the use process of the digital key and output a prompt message on the first device. The prompt prompts the user to perform device authentication on the second device.

In one possible implementation, the prompt may be "you are using the digital key to communicate with a device, please confirm whether the device is authorized to use the digital key", if the user determines that the second device belongs to the trusted device, the user may input a trusted device confirmation instruction on the first device, otherwise the user may choose to end the use of the digital key.

In one possible implementation, the first device is a transmitting device, for example, the first device is a terminal device, and the prompt information may be output on a terminal screen.

In another possible implementation manner, the first device is a receiving end device, for example, a vehicle or a smart door lock, and the first device may output the prompt information through a display screen on the vehicle or the smart door lock. Or the first device may output the prompt information through a display device to which the first device is connected.

In step 402, it is determined that the second device belongs to a trusted device based on the received trusted device confirmation instruction.

In the embodiment of the disclosure, if the first device receives the trusted device confirmation instruction, the second device may be directly determined to belong to the trusted device.

It should be noted that, steps 401 to 402 may be implemented separately, and when the first device and the second device use the digital key to communicate for the first time, it is determined whether the second device belongs to a trusted device through a device authentication method.

Or steps 401 to 402 may be combined with steps 201 to 202, and since the first device does not obtain the trusted radio frequency fingerprint of the second device at this time, the first device may continue to use steps 403 to 405 to obtain and store the trusted device fingerprint of the second device, and determine whether the first radio frequency fingerprint for identifying the second device is consistent with the trusted radio frequency fingerprint of the second device when the first device subsequently communicates with the second device using the digital key, so as to determine whether the second device belongs to the trusted device.

In step 403, a second radio frequency fingerprint of the second device is extracted based on the first extraction means.

The first extraction mode may be determined by the first device itself, that is, the first device itself may determine which radio frequency features of the second device need to be extracted as the second radio frequency fingerprint of the second device. Or the first extraction mode can also be determined by the second device, encrypted and signed and then sent to the first device. The radio frequency features included in the second radio frequency fingerprint may be similar to those included in the first radio frequency fingerprint, and will not be described again.

In step 404, the second radio frequency fingerprint is determined as the trusted radio frequency fingerprint of the second device.

In the embodiment of the disclosure, since the user has confirmed that the second device belongs to the trusted device, the extracted second radio frequency fingerprint of the second device may be used as the trusted radio frequency fingerprint of the second device.

In step 405, the trusted radio frequency fingerprint of the second device is stored to a secure storage area on the first device.

In a semi-public embodiment, the secure storage area includes, but is not limited to, a SE to subsequently determine whether the process of using the digital key was attacked by the relay device based on the trusted radio frequency fingerprint of the second device stored in the secure storage area.

In the above embodiment, the second device may be determined to belong to the trusted device based on the device authentication manner in the process that the first device and the second device use the digital key for the first time, and further, the second radio frequency fingerprint of the second device is extracted and used as the trusted radio frequency fingerprint of the second device, which is simple and convenient to implement and has high availability. The subsequent attack by the relay equipment can be avoided in the process of using the digital key, and the safety of the digital key in the use process is improved.

In the third mode, the first device and the second device respectively extract their own radio frequency fingerprints, encrypt and sign the fingerprints, and then send the fingerprints to the other side.

In some alternative embodiments, referring to fig. 5, fig. 5 is a flowchart of a device authentication method according to an exemplary embodiment of the present disclosure, where the method may be applied to a first device, and includes the following steps:

in step 501, a third radio frequency fingerprint of the first device is extracted based on the second extraction means.

In the embodiment of the disclosure, the second extraction manner may be determined by the first device itself, that is, the first device may determine which radio frequency features of itself need to be extracted as the third radio frequency fingerprint of itself. Of course, the second extraction mode may also be determined by the second device, and the second device may encrypt and sign the extraction mode information and then send the encrypted and signed extraction mode information to the first device. The radio frequency features included in the third radio frequency fingerprint may be similar to those included in the first radio frequency fingerprint, and will not be described here. The second extraction method may be the same as or different from the first extraction method described above, which is not limited in this disclosure.

In step 502, the first association information is encrypted and signed.

In an embodiment of the disclosure, the first association information may include, but is not limited to, the third radio frequency fingerprint and the second extraction mode information. The first device may encrypt the first associated information using a key of the digital key and sign the first associated information.

In step 503, the encrypted and signed first association information is sent to the second device.

In one possible implementation, a secure channel may be established between the first device and the second device during communication in which the first device and the second device use the digital key for non-inductive entry, and the encrypted and signed first association information may be sent to the second device through the secure channel.

In the embodiment of the present disclosure, after receiving the first association information that is encrypted and signed, the second device performs processes such as decryption, signature verification, temporary storage, and the like, and a specific implementation manner is similar to a manner that the first device described later performs decryption, signature verification, storage, and the like, on the received second association information, which is not described herein.

In the above embodiment, the first device may use the third radio frequency fingerprint and the second extraction mode information of the first device together as the first association information, and send the first association information to the second device after encrypting and signing, so as to ensure that the second device can obtain the trusted radio frequency fingerprint of the first device, and the implementation is simple and convenient, and the availability is high.

In some alternative embodiments, referring to fig. 6, fig. 6 is a flowchart of a device authentication method according to an exemplary embodiment of the present disclosure, where the method may be applied to a first device, and includes the following steps:

in step 601, according to a preset period, a third radio frequency fingerprint of the first device is extracted based on the second extraction mode.

In the embodiment of the present disclosure, considering that the characteristics of the rf fingerprint are easily affected by environmental factors, for example, are easily affected by temperature, humidity, aging conditions of devices, and the like, the characteristics of the third rf fingerprint of the first device may be changed, and in order to avoid the accuracy of the third rf fingerprint obtained by the second device, the first device may extract its own third rf fingerprint according to a preset period.

The second extraction mode may be determined by the first device itself, i.e. the first device may determine which radio frequency features of itself need to be extracted as the third radio frequency fingerprint of itself. Of course, the second extraction mode may also be determined by the second device, and the second device may encrypt and sign the extraction mode information and then send the encrypted and signed extraction mode information to the first device. The radio frequency features included in the third radio frequency fingerprint may be similar to those included in the first radio frequency fingerprint, and will not be described here. The second extraction method may be the same as or different from the first extraction method described above, which is not limited in this disclosure.

In one possible implementation, the preset period may be each time, that is, each time the first device uses the digital key to communicate with the second device, the third rf fingerprint of the first device is extracted, so as to ensure that the second device may obtain the third rf fingerprint in real time, and the subsequent second device may use the third rf fingerprint as the trusted rf fingerprint of the first device.

In another possible implementation, the preset period may be expressed in terms of a length, which may be in units of seconds, minutes, hours, days, months, quarters, years, etc.

In another possible implementation manner, the first device may extract its own third radio frequency fingerprint based on the same or different second extraction manner in each preset period.

In step 602, the first association information is encrypted and signed.

In an embodiment of the disclosure, the first association information may include, but is not limited to, the third radio frequency fingerprint and the second extraction mode information. The first device may encrypt the first associated information using a key of the digital key and sign the first associated information. In the embodiment of the disclosure, the first device may encrypt and sign the first association information in each period.

In step 603, the encrypted and signed first association information is sent to the second device according to the preset period.

In one possible implementation manner, a secure channel may be established between the first device and the second device according to the preset period, and the encrypted and signed first association information is sent to the second device through the secure channel.

In the above embodiment, the first device may use the third rf fingerprint of the first device and the second extraction manner information together as the first association information, and after performing encryption and signing, send the first association information to the second device according to a preset period, so as to ensure that the second device can timely and accurately obtain the third rf fingerprint of the first device, and the subsequent second device may use the third rf fingerprint as the trusted rf fingerprint of the first device, thereby reducing the influence caused by environmental factors on the second terminal to store the trusted rf fingerprint of the first device for a long time, and having high availability.

In some alternative embodiments, referring to fig. 7, fig. 7 is a flowchart of a device authentication method according to an exemplary embodiment of the present disclosure, where the method may be applied to a first device, and includes the steps of:

in step 701, second association information sent by the second device and encrypted and signed is received.

In the embodiment of the disclosure, the second device may extract the fourth radio frequency fingerprint of the second device based on the third extraction mode, and further, the second device encrypts and signs the fourth radio frequency fingerprint and the third extraction mode information together as the second association information and sends the second association information to the first device.

In one possible implementation, the third extraction mode may be determined by the second device.

In another possible implementation manner, the third extraction manner may also be determined by the first device, and accordingly, the first device needs to inform the second device of the third extraction manner before the second device extracts the fourth radio frequency fingerprint, and the second device may not include the third extraction manner in the second association information sent by the second device.

In another possible implementation, a secure channel may be established between the first device and the second device during communication of the first device with the second device using the digital key for non-inductive entry, through which the first device receives the encrypted and signed second association information.

In step 702, signature verification is performed after the second association information is decrypted, and a verification result is determined.

In the embodiment of the disclosure, the first device may decrypt the second association information through the key of the digital key stored in the first device, and then perform signature verification.

In step 703, the fourth radio frequency fingerprint is determined to be the trusted radio frequency fingerprint of the second device if the second association information is successfully decrypted and the verification result indicates that verification is successful.

In an embodiment of the disclosure, if the first device successfully decrypts the second association information and the verification result indicates that the verification is successful, the first device may determine the fourth radio frequency fingerprint in the second association information as the trusted radio frequency fingerprint of the second device.

In step 704, the trusted radio frequency fingerprint and the third extraction mode information of the second device are stored in a temporary storage area on the first device.

In the embodiment of the present disclosure, the steps 701 to 704 may be implemented separately, so as to achieve the purpose of acquiring the trusted radio frequency fingerprint of the second device.

Or steps 701 to 704 may be implemented in combination with steps 201 to 202, specifically, in step 201, determining a first radio frequency fingerprint for identifying the second device, including: and extracting the first radio frequency fingerprint for identifying the second device based on the third extraction mode.

The first device may determine whether the first radio frequency fingerprint corresponds with a trusted radio frequency fingerprint of the second device, thereby determining whether the second device belongs to a trusted device.

In the above embodiment, the first device may decrypt and verify the signature after receiving the encrypted and signed second association information sent by the second device, so as to obtain the trusted radio frequency fingerprint of the second device, which has high availability. The subsequent attack by the relay equipment can be avoided in the process of using the digital key, and the safety of the digital key in the use process is improved.

In some alternative embodiments, referring to fig. 8, fig. 8 is a flowchart of a device authentication method according to an exemplary embodiment of the present disclosure, where the method may be applied to a first device, and includes the following steps:

in step 801, second association information sent by the second device and encrypted and signed is received.

In step 802, signature verification is performed after the second association information is decrypted, and a verification result is determined.

In step 803, the fourth radio frequency fingerprint is determined to be the trusted radio frequency fingerprint of the second device in case the second association information is successfully decrypted and the verification result indicates that verification is successful.

In step 804, the trusted radio frequency fingerprint and the third extraction mode information of the second device are stored in a temporary storage area on the first device.

In the embodiment of the present disclosure, the implementation manners of the above steps 801 to 804 are similar to the implementation manners of the above steps 701 to 704, and are not repeated here.

In step 805, the trusted rf fingerprint and the third extraction mode information of the second device stored in the temporary storage area of the first device are updated according to a preset period.

In one possible implementation manner, the preset period may be each time, that is, each time the first device uses the digital key to communicate with the second device, the trusted radio frequency fingerprint and the third extraction mode information of the second device stored in the temporary storage area of the first device are updated, so as to ensure that the first device obtains the trusted radio frequency fingerprint of the second device in real time.

In another possible implementation, the preset period may be expressed in terms of a time period, which may be in units of seconds, minutes, hours, days, months, quarters, years, etc. And the first equipment periodically updates the trusted radio frequency fingerprint and the second extraction mode information of the second equipment stored in the temporary storage area of the first equipment according to the duration corresponding to the preset period.

In the embodiment of the present disclosure, the steps 801 to 805 may be implemented separately, so as to achieve the purpose of periodically updating the trusted radio frequency fingerprint of the second device.

Or steps 801 to 805 may be implemented in combination with steps 201 to 202, specifically, in step 201, determining a first radio frequency fingerprint for identifying the second device includes: and extracting the first radio frequency fingerprint for identifying the second device based on the third extraction mode.

In the above embodiment, the first device may periodically update the trusted rf fingerprint and the third extraction mode information of the second device stored in the temporary storage area of the first device, so as to reduce the influence of environmental factors on the trusted rf fingerprint of the second device stored in the first device for a long time, and ensure the accuracy of the stored trusted rf fingerprint. The subsequent attack by the relay equipment can be avoided in the process of using the digital key, and the safety of the digital key in the use process is improved.

In some alternative embodiments, the first device is a transmitting device that transmits the digital key and the second device is a receiving device that receives the digital key.

Or the first device is a receiving end device for receiving the digital key, and the second device is a transmitting end device for transmitting the digital key.

The first device is used as a transmitting end device or a receiving end device, and whether the second device belongs to a trusted device or not can be authenticated in the mode.

Referring also to fig. 1, assuming that the first device is a vehicle owner device, i.e. a transmitting device, and the second device is a vehicle, i.e. a receiving device, if the first device directly communicates with the second device, the first device may extract a radio frequency fingerprint of the second device, compare the extracted radio frequency fingerprint with a trusted radio frequency fingerprint of the second device stored in a secure storage area of the first device, and if the two are consistent, determine that the second device is a trusted device. Likewise, the second device may also extract a radio frequency fingerprint of the first device, compare the radio frequency fingerprint with a trusted radio frequency fingerprint of the first device stored on a secure storage area of the second device, and determine that the first device is a trusted device if the radio frequency fingerprint is consistent.

By adopting the equipment authentication method provided by the invention, the two communication parties can determine whether the opposite terminal equipment belongs to the trusted equipment, so that the attack by the relay equipment is avoided in the process of using the digital key, and the safety of the use process of the digital key is improved.

It should be further noted that, if a relay device exists between the first device and the second device, for example, the relay device #1 and the relay device #2 in fig. 1, the first device extracts a radio frequency fingerprint of the relay device #1, and compares the extracted fingerprint with a trusted radio frequency fingerprint of the second device stored in the secure storage area of the first device, where the result is necessarily inconsistent, the first device may determine that the relay device #1 belongs to an untrusted device, and may output, on the first device, prompt information for prompting that there is a risk of attack of the relay device.

In the same manner, the second device extracts the radio frequency fingerprint of the relay device #2, compares the extracted fingerprint with the trusted radio frequency fingerprint of the first device stored in the second device secure storage area, and the result is also inconsistent, at this time, the second device can determine that the relay device #2 belongs to an untrusted device, and at this time, prompt information for prompting that the relay device attack risk exists can be output on the second device.

Through the process, the aim of avoiding being attacked by the relay equipment is fulfilled, and the safety of the digital key in the use process is improved.

Corresponding to the foregoing embodiment of the application function implementation method, the present disclosure further provides an embodiment of the application function implementation apparatus.

Referring to fig. 9, fig. 9 is a block diagram of a device authentication apparatus, which is applied to a first device, according to an exemplary embodiment, the apparatus includes:

a first determining module 901, configured to determine, when communicating with a second device using a digital key, a first radio frequency fingerprint for identifying the second device;

a first device authentication module 902, configured to determine, in response to determining that the first rf fingerprint is consistent with a trusted rf fingerprint of the second device, that the second device belongs to a trusted device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 2 and will not be described herein.

In some alternative embodiments, the apparatus further comprises: the first extraction module is used for extracting a second radio frequency fingerprint of the second equipment based on a first extraction mode in the process of creating the digital key with the second equipment; a second determining module configured to determine the second radio frequency fingerprint as the trusted radio frequency fingerprint of the second device; a first storage module for storing the trusted radio frequency fingerprint of the second device to a secure storage area on the first device;

the first determining module includes: and the first determining submodule is used for extracting the first radio frequency fingerprint of the second equipment based on the first extraction mode.

Optionally, the first extraction mode is determined by the first device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 3 and will not be described herein.

Optionally, the apparatus further comprises: the output module is used for outputting prompt information for carrying out equipment authentication on the second equipment in response to determining that the trusted radio frequency fingerprint of the second equipment is not stored on the first equipment; and the second equipment authentication module is used for determining that the second equipment belongs to the trusted equipment based on the received trusted equipment confirmation instruction.

Optionally, the apparatus further comprises: the second extraction module is used for extracting a second radio frequency fingerprint of the second device based on the first extraction mode; a third determining module configured to determine the second radio frequency fingerprint as the trusted radio frequency fingerprint of the second device; and the second storage module is used for storing the trusted radio frequency fingerprint of the second device to a safe storage area on the first device.

Optionally, the first extraction mode is determined by the first device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 4 and will not be described herein.

In some alternative embodiments, the method further comprises: the third extraction module is used for extracting a third radio frequency fingerprint of the first equipment based on the second extraction mode; the processing module is used for encrypting and signing the first association information; the first association information comprises the third radio frequency fingerprint and second extraction mode information; and the sending module is used for sending the first association information subjected to encryption and signature to the second equipment.

Optionally, the second extraction mode is determined by the first device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 5 and will not be described herein.

In some alternative embodiments, the third extraction module includes: the extraction submodule is used for extracting a third radio frequency fingerprint of the first equipment based on the second extraction mode according to a preset period;

the transmitting module includes: and the sending sub-module is used for sending the first association information subjected to encryption and signature to the second equipment according to the preset period.

Optionally, the second extraction mode is determined by the first device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 6 and will not be described herein.

In some alternative embodiments, the method further comprises: the receiving module is used for receiving second associated information which is sent by the second equipment and is encrypted and signed; the second association information comprises a fourth radio frequency fingerprint and third extraction mode information, wherein the fourth radio frequency fingerprint is a radio frequency fingerprint of the second device extracted by the second device based on a third extraction mode; the fourth determining module is used for performing signature verification after decrypting the second associated information and determining a verification result; a fifth determining module, configured to determine the fourth radio frequency fingerprint as the trusted radio frequency fingerprint of the second device if the second association information is successfully decrypted and the verification result indicates that verification is successful; a third storage module, configured to store the trusted radio frequency fingerprint and the second extraction mode information of the second device in a temporary storage area on the first device;

the first determining module includes: and the second determining submodule is used for extracting the first radio frequency fingerprint of the second equipment based on the third extraction mode.

Optionally, the third extraction mode is determined by the second device.

The detailed implementation refers to the implementation of the embodiment shown in fig. 7 and will not be described herein.

Optionally, the apparatus further comprises: and the updating module is used for updating the trusted radio frequency fingerprint and the third extraction mode information of the second device stored in the temporary storage area of the first device according to a preset period.

Optionally, the third extraction mode is determined by the second device.

The detailed implementation manner refers to the implementation manner of the embodiment shown in fig. 8 and will not be described herein.

Optionally, the first device is a transmitting end device for transmitting the digital key, and the second device is a receiving end device for receiving the digital key; or the first device is a receiving end device for receiving the digital key, and the second device is a transmitting end device for transmitting the digital key.

Optionally, the first radio frequency fingerprint comprises at least one of:

the center frequency corresponding to the target signal; wherein the target signal is a signal sent by the second device to the first device when the first device and the second device communicate using a digital key; the frequency offset corresponding to the target signal; a rising edge slope value of the target signal; the falling edge slope value of the target signal.

For the device embodiments, reference is made to the description of the method embodiments for the relevant points, since they essentially correspond to the method embodiments. The apparatus embodiments described above are merely illustrative, wherein the elements described above as separate elements may or may not be physically separate, and the elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the objectives of the disclosed solution. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

Accordingly, the present disclosure also provides a computer-readable storage medium storing a computer program for implementing the steps of the device authentication method according to any one of the above, when the computer program is executed by a processor.

Correspondingly, the disclosure also provides a device authentication apparatus, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the executable instructions to implement the steps of the device authentication method of any one of the above.

Fig. 10 is a block diagram of a device authentication apparatus according to an exemplary embodiment. For example, apparatus 1000 may be a first device, which may be a transmitting end device, including but not limited to a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, an exercise device, a personal digital assistant, and the like.

Referring to fig. 10, the apparatus 1000 may include one or more of the following components: a processing component 1002, a memory 1004, a power component 1006, a multimedia component 1008, an audio component 1010, an input/output (I/O) interface 1012, a sensor component 1016, and a communication component 1018.

The processing component 1002 generally controls overall operation of the apparatus 1000, such as operations associated with display, telephone calls, data communications, camera operations, and recording operations. The processing component 1002 can include one or more processors 1020 to execute instructions to perform all or part of the steps of the methods described above. Further, the processing component 1002 can include one or more modules that facilitate interaction between the processing component 1002 and other components. For example, the processing component 1002 can include a multimedia module to facilitate interaction between the multimedia component 1008 and the processing component 1002.

One of the processors 1020 in the processing component 1002 may be configured to perform any of the device authentication methods described above.

The memory 1004 is configured to store various types of data to support operations at the apparatus 1000. Examples of such data include instructions for any application or method operating on the device 1000, contact data, phonebook data, messages, pictures, videos, and the like. The memory 1004 may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.

The power supply component 1006 provides power to the various components of the device 1000. The power components 1006 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device 1000.

The multimedia component 1008 includes a screen between the device 1000 and the user that provides an output interface. In some embodiments, the screen may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensor may sense not only the boundary of a touch or sliding action, but also the duration and pressure associated with the touch or sliding operation. In some embodiments, the multimedia assembly 1008 includes a front-facing camera and/or a rear-facing camera. The front camera and/or the rear camera may receive external multimedia data when the apparatus 1000 is in an operation mode, such as a photographing mode or a video mode. Each front camera and rear camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

The audio component 1010 is configured to output and/or input audio signals. For example, the audio component 1010 includes a Microphone (MIC) configured to receive external audio signals when the device 1000 is in an operational mode, such as a call mode, a recording mode, and a speech recognition mode. The received audio signals may be further stored in the memory 1004 or transmitted via the communication component 1018. In some embodiments, the audio component 1010 further comprises a speaker for outputting audio signals.

The I/O interface 1012 provides an interface between the processing assembly 1002 and peripheral interface modules, which may be a keyboard, click wheel, buttons, and the like. These buttons may include, but are not limited to: homepage button, volume button, start button, and lock button.

The sensor assembly 1016 includes one or more sensors for providing status assessment of various aspects of the device 1000. For example, the sensor assembly 1016 may detect an on/off state of the device 1000, a relative positioning of the components, such as a display and keypad of the device 1000, the sensor assembly 1016 may also detect a change in position of the device 1000 or a component of the device 1000, the presence or absence of user contact with the device 1000, an orientation or acceleration/deceleration of the device 1000, and a change in temperature of the device 1000. The sensor assembly 1016 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 1016 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1016 may also include an acceleration sensor, a gyroscopic sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

The communication component 1018 is configured to facilitate communication between the apparatus 1000 and other devices in a wired or wireless manner. The apparatus 1000 may access a wireless network based on a communication standard, such as WiFi,3G,4G,5G,6G or a combination thereof. In one exemplary embodiment, the communication component 1018 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component 1018 further comprises a Near Field Communication (NFC) module to facilitate short range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.

In an exemplary embodiment, the apparatus 1000 may be implemented by one or more Application Specific Integrated Circuits (ASICs), digital Signal Processors (DSPs), digital Signal Processing Devices (DSPDs), programmable Logic Devices (PLDs), field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic elements for executing the methods described above.

In an exemplary embodiment, a non-transitory computer readable storage medium is also provided, such as memory 1004, including instructions executable by processor 1020 of apparatus 1000 to perform the above-described method. For example, the non-transitory computer readable storage medium may be ROM, random Access Memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

As shown in fig. 11, fig. 11 is a schematic diagram illustrating a structure of a device authentication apparatus 1100 according to an exemplary embodiment. The apparatus 1100 may be provided as a first device, which may be a receiving end device, including but not limited to a vehicle, a smart door lock, etc. Referring to fig. 11, the apparatus 1100 includes a processing component 1122, a wireless transmit/receive component 1124, an antenna component 1126, and a signal processing portion specific to a wireless interface, which processing component 1122 may further include one or more processors.

One of the processors in processing component 1122 can be configured to perform any of the device authentication methods described above.

It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any adaptations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

It is to be understood that the present disclosure is not limited to the precise arrangements and instrumentalities shown in the drawings, and that various modifications and changes may be effected without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method of device authentication, the method being applied to a first device, the method further comprising:

2. The method of claim 1, wherein prior to determining the first radio frequency fingerprint for identifying the second device, the method further comprises:

3. The method according to claim 1, wherein the method further comprises:

4. A method according to claim 3, wherein after determining that the second device belongs to a trusted device, the method further comprises:

5. The method of any of claims 2-4, wherein the first extraction mode is determined by the first device.

6. The method according to claim 1, wherein the method further comprises:

7. The method of claim 6, wherein the extracting a third radio frequency fingerprint of the first device based on the second extraction means comprises:

8. The method according to claim 6 or 7, characterized in that the second extraction means is determined by the first device.

9. The method according to claim 1, wherein the method further comprises:

storing the trusted radio frequency fingerprint and the third extraction mode information of the second device in a temporary storage area on the first device;

10. The method according to claim 9, wherein the method further comprises:

11. The method according to claim 9 or 10, characterized in that the third extraction means is determined by the second device.

12. The method of claim 1, wherein the first device is a transmitting device that transmits the digital key and the second device is a receiving device that receives the digital key; or (b)

13. The method of claim 1, wherein the first radio frequency fingerprint comprises at least one of:

The frequency offset corresponding to the target signal;

a rising edge slope value of the target signal;

the falling edge slope value of the target signal.

14. A device authentication apparatus, the apparatus being applied to a first device, the apparatus comprising:

15. A computer readable storage medium having stored thereon a computer program, characterized in that the computer program, when executed by a processor, implements the steps of the device authentication method of any of claims 1-13.

16. A device authentication apparatus, comprising:

a processor;

a memory for storing processor-executable instructions;

wherein the processor is configured to execute the executable instructions to implement the steps of the device authentication method of any one of claims 1-13.