WO2013097598A1

WO2013097598A1 - Method, apparatus and system for entity authentication

Info

Publication number: WO2013097598A1
Application number: PCT/CN2012/086343
Authority: WO
Inventors: 杜志强; 侯宇; 铁满霞; 胡亚楠; 张国强; 李琴
Original assignee: 西安西电捷通无线网络通信股份有限公司
Priority date: 2011-12-27
Filing date: 2012-12-11
Publication date: 2013-07-04
Also published as: CN102497273A; CN102497273B

Abstract

A method, an apparatus and a system for entity authentication are provided in the present invention. The method comprises: an entity A sending an authentication request message to an entity B, wherein the authentication request message includes the result SN1 of XOR operation on PSK and the data N1 generated locally by the entity A, and the PSK is a key shared by the entity A and the entity B; the entity B receiving the authentication request message sent by the entity A, performing XOR operation on the SN1 in the authentication request message and the PSK, and performing XOR operation again on the PSK and the XOR operation result so as to obtain SON1 after processing the XOR operation result according to a convention rule, and then sending the SON1 to the entity A through an authentication response message; and the entity A receiving the authentication response message sent by the entity B and performing XOR operation on the SON1 in the authentication response message and the PSK, and comparing the result obtained by the XOR operation and the result obtained by processing the N1 according to a convention rule, and it is authenticated whether the entity B is legal or not according to the comparison result. According to the invention, calculation cost during the authentication process is effectively saved, and operation efficiency in the authentication process is also improved.

Description

The present invention claims to be submitted to the Chinese Patent Office on December 27, 2011, the application number is 201110445523.3, and the invention name is

The priority of the Chinese Patent Application, which is incorporated herein by reference. TECHNICAL FIELD The present application relates to the field of network security applications in information security technologies, and in particular, to an entity authentication method, apparatus, and system. BACKGROUND OF THE INVENTION Resource-limited wireless networks, including sensor networks (SN, Sensor Network), magnetic domain network (MFAN, Magnetic Field Identification Network), radio frequency identification (RFID, Radio Frequency Identification) networks, etc., in military, environmental monitoring, forests Fire protection, health care, logistics and other fields have broad application prospects and are playing an increasingly important role in these fields. Due to the wireless and broadcast characteristics of such networks, they are vulnerable to message eavesdropping, tampering, forgery, and entity capture, replication, etc., and need to introduce low-cost authentication and message confidentiality mechanisms to ensure such networks. The legitimacy of the entity and the confidentiality and integrity of the communication message.

However, the current authentication method is generally based on cryptographic operations, requiring entities in the network to preset the corresponding cryptographic algorithms, otherwise the authentication protocol cannot be executed; and even if the entity presets the cryptographic algorithm, such authentication protocols will also be executed. The computational overhead caused by entities in the network, such as the authentication methods based on symmetric and asymmetric cryptographic algorithms, requires the entity to perform encryption and decryption operations, thereby increasing the resource burden of the network entity. SUMMARY OF THE INVENTION The present application provides an entity authentication method and apparatus and system for saving computational overhead in an entity authentication process. The application provides an entity identification method, including:

Step 1: The entity A sends an authentication request message to the entity B, where the authentication request message includes a result of an exclusive OR operation between the data N1 and the PSK generated by the entity A, and the PSK is a key shared by the entity A and the entity B;

Step 2: The entity B receives the authentication request message sent by the entity A, and performs an exclusive OR operation on the SN1 and the PSK in the authentication request message, and processes the XOR operation result according to the agreed rule, and then performs an exclusive OR operation with the PSK to obtain SON1, and SON1 Sending to the entity A through the authentication response message;

Step 3: The entity A receives the authentication response message sent by the entity B, and performs an exclusive OR operation on the SON1 and the PSK in the authentication response message, and compares the result of the exclusive OR operation with the result of processing the N1 according to the agreed rule, according to the comparison result. Identifies whether entity B is legal.

The application also provides an entity authentication device, including:

a request message sending unit, configured to send an authentication request message to the entity B, where the authentication request message includes a result SN1 of an exclusive OR operation between the data N1 and the PSK generated by the entity authentication device, where the PSK is shared by the entity authentication device and the entity B. Key

An authentication unit, configured to receive an authentication response message sent by the entity B, perform an exclusive OR operation on the SON1 and the PSK in the authentication response message, and compare the result of the exclusive OR operation with the result of processing the N1 according to the agreed rule, according to the comparison result. It is determined whether the entity B is legal. The SON1 is a result obtained by the entity B to perform an exclusive OR operation between the SN1 and the PSK in the received authentication request message, and the XOR operation result is processed by the agreed rule and then XORed again with the PSK.

The present application also provides another entity authentication device, including:

And a request message receiving unit, configured to receive an authentication request message sent by the entity A, where the authentication request message includes a result SN1 of the data N1 and the PSK exclusive-generated operation generated by the entity A, and the PSK is shared by the entity A and the entity authentication device. Key

The response message sending unit is configured to perform an exclusive OR operation on the SN1 and the PSK in the authentication request message, process the XOR operation result according to the contract rule, and perform an exclusive OR operation with the PSK to obtain SON1, and send the SON1 to the entity through the authentication response message. A.

The application also provides an entity authentication system, including entity A and entity B, where

The entity A sends an authentication request message to the entity B, where the authentication request message includes the result of the X2 and the PSK XOR generated by the entity A, and the PSK is the key shared by the entity A and the entity B;

The entity B receives the authentication request message sent by the entity A, and performs an exclusive OR operation on the SN1 and the PSK in the authentication request message, and processes the result of the exclusive OR operation according to the agreed rule, and then performs an exclusive OR operation with the PSK to obtain SON1, and passes the SON1 through the authentication response. The message is sent to entity A;

The entity A receives the authentication response message sent by the entity B, and performs an exclusive OR operation on the SON1 and the PSK in the authentication response message, compares the result of the exclusive OR operation with the result of processing the N1 according to the contract rule, and identifies the entity B according to the comparison result. is it legal.

The entity identification method and device and system provided by the application have the following beneficial effects: Lightweight entity identification is implemented based on the exclusive OR operation, and the efficiency of the exclusive OR operation is much higher than the symmetric or asymmetric encryption and decryption operation, therefore, The application effectively saves the computational overhead in the entity authentication process and improves the operational efficiency of the authentication process. BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a flowchart of a method for entity identification in an embodiment of the present application;

2 is a schematic diagram of a method for entity identification in an embodiment of the present application; 3 is a flowchart of an entity authentication method according to another embodiment of the present application;

4 is a structural diagram of an entity authentication apparatus in an embodiment of the present application;

FIG. 5 is a structural diagram of an entity authentication apparatus according to another embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The entity authentication method, apparatus and system provided by the present application will be described in more detail below with reference to the accompanying drawings and embodiments.

In order to solve the above-mentioned technical problems in the prior art, the present application provides a lightweight entity identification method, apparatus, and system. As shown in FIG. 1 and FIG. 2, the entity authentication method provided by the embodiment of the present application includes the following steps. Step 1: The entity A sends an authentication request message to the entity B, where the authentication request message includes a result SN1 of the data N1 and the PSK exclusive-generated operation generated by the entity A, and the PSK is a key shared by the A and the B;

In the embodiment of the present application, before the authentication, the key is shared between the entity A and the entity B. This embodiment is called a pre-shared key (PSK).

In this way, entity A can perform XOR operation directly using locally generated data: SN1=N1 ® PSK, where the symbol "®," represents a bitwise XOR operation, the same as below. The XOR operation mentioned in the embodiment of the present application Both refer to bitwise XOR operations.

Preferably, the data N1 generated by the entity A is a random number generated by the entity A, and of course, the data generated locally by the entity A by other methods.

In this embodiment, after receiving the authentication request message sent by the entity A, the entity B obtains the SN1 in the authentication request message, calculates the SN1 ® PSK, and processes the result of the SNl ® PSK according to the agreed rule, where the contract rule refers to the entity. A and entity B agree on the same operation rules that both parties must use, such as cyclic shift, adding a predetermined bit at a set position or adding an operation with a convention constant, etc. Preferably, the result of SM ® PSK in this embodiment is 0 "are added, and once again SON1 PSK exclusive oR operation, where O _n is the entity a and entity B agreed constant.

If the result of the XOR operation between the SON1 and the PSK in the authentication response message received by the entity A is the same as the result of processing the N1 according to the convention rule, the authentication result is the entity B legal. Otherwise, the authentication result is that the entity B is invalid.

Entity B and entity A use the same contract rules, then N1 is processed according to the agreed rules, which may be N1 and O _n phase force port.

The entity authentication method provided by the embodiment of the present application is based on the XOR operation of the symmetric or asymmetric encryption and decryption operation, so that the entity A completes the low overhead authentication of the entity B, and can be applied to the resource-limited network. . This application effectively saves the computational overhead in the entity authentication process and improves the operational efficiency of the authentication process.

Preferably, in step 1, the entity A resends the authentication request message to the entity B when the authentication response message sent by the entity B is not received within the preset time T1 after the authentication request message is sent;

After entity A resends the authentication request message for m times after the preset number of times, and does not receive the authentication response message sent by entity B, entity A considers that the authentication failed.

If entity A receives the authentication response message returned by entity B, the authentication result can be obtained without considering the authentication failure.

Preferably, in step 3, the method further includes:

The entity A sends the authentication result of the entity B to the entity B through the first authentication result message; if the entity A determines that the entity B is legal, the authentication result message includes the authentication success information; otherwise, the authentication result message includes the authentication failure information.

In step 2, the entity B resends the authentication response message to the entity A when the first authentication result message sent by the entity A is not received within the preset time T3 after the authentication response message is sent.

If the entity B does not receive the first authentication result message sent by the entity A after re-sending the authentication response message by the preset number of times q times, the entity B considers that the authentication fails, and if the first authentication result message is received, the authentication result may be obtained. I don't think the authentication failed.

In the resource-restricted network, the authentication between entities, some scenarios only need one-way authentication, and some scenarios require two-way authentication. Preferably, on the basis of the above-mentioned one-way authentication, to achieve low overhead between entity A and entity B. In the two-way authentication, in the second step, when the entity B receives the authentication request message sent by the entity A, the data N2 generated by the entity B is XORed with the PSK to obtain the SN2, and the entity B sends the authentication response message to the entity A. The SN2 is included. Preferably, the data N2 generated by the entity B is a random number generated by the entity B. Of course, the entity B can also generate local data by other methods. As shown in FIG. 3, the method further includes:

Step 4: The entity A performs an exclusive-OR operation on the SN2 and the PSK in the received authentication response message, and processes the XOR operation result according to the agreed rule, and then performs an exclusive OR operation with the PSK to obtain SON2, and sends the SON2 to the entity B through the authentication response confirmation message. ;

Step 5: The entity B receives the authentication response confirmation message sent by the entity A, and performs an exclusive OR operation between the SON2 and the PSK in the authentication response confirmation message, and compares the result of the exclusive OR operation with the result of processing the N2 according to the agreed rule, according to The comparison result identifies whether entity A is legal. Specifically, if the result of the comparison is equal, it is determined that the authentication result is that the entity A is legal, otherwise the authentication result is that the entity B is illegal.

In this embodiment, the agreed rules in steps 2 and 3 above must be the same, and the conventions in steps 4 and 5 are the same. The rules must be the same. Preferably, the two conventions are the same, and of course they can be different. Preferably, the agreed rules in steps 4 and 5 may also be an addition operation with 0 „.

Preferably, in step 2, when the entity B does not receive the authentication response confirmation message sent by the entity A within the preset time T2 after sending the authentication response message, the entity B resends the authentication response message to the entity A; the entity B is preset After the number of retransmissions of p times, the authentication response message sent by entity A has not been received, entity B considers that the authentication failed. Further preferably, the authentication response confirmation message may include an authentication result of the entity A to the entity B, that is, the first authentication result message is included, then T3 is equal to T2, and q is equal to p.

Preferably, in step 5, the method further includes:

The entity B sends the authentication result of the entity A to the entity A through the second authentication result message; if the entity B determines that the entity A is legal, the authentication result message includes the authentication success information; otherwise, the authentication result message includes the authentication failure information;

In step 3, the entity A resends the authentication response confirmation message to the entity B when the second authentication result message sent by the entity B is not received within the preset time T4 after the authentication response confirmation message is sent.

If entity A does not receive the second authentication result message sent by entity B after re-sending the authentication response confirmation message n times, the entity A considers that the authentication fails.

The preset time T1 used by the entity A and the preset time T2 used by the entity B are set by the entity A and the entity B, respectively, and may be the same or different. By increasing the above message timeout retransmission mechanism, the tolerance for packet loss of the communication process of the present application can be improved. In the case of returning results, T4 and T3 set by entity A and entity B may be the same or different. There is no limitation between the preset times mentioned above, and can be set to different values independently or set to the same value. There is no limit between the preset times mentioned above, and can be set independently or set to different values.

Preferably, in step 3, when entity A authenticates that entity B is legal, entity A calculates a session key SK, and SK=N1 ten N2 ® PSK, and N2 is entity A, and SN2 in the authentication response message is The result of the PSK exclusive OR operation, that is, if the entity A authenticates the entity B, the result obtained by the entity A by the exclusive OR operation is equal to the data generated locally by the entity B. If the entity B is not legal, the authentication response message is ignored. Operation, the session key is used to protect the session message of the two, the operation of calculating the session key is an optional operation, and the entity A calculates the session key SK only when the session message with the entity B needs to be protected.

In step 5, when the entity B authenticates the entity A, the method further includes: the entity B calculates the session key SK between the entity A, SK=N1®N2®PSK, and N1 is the entity B to use the SN1 in the authentication request message. The result of the XOR operation with the PSK, that is, if the entity B authenticates the entity A, the result obtained by the entity B through the exclusive OR operation is equal to the data locally generated by the entity A. If entity A is not legal, entity B ignores the received authentication response confirmation message and does not perform key calculation. The operation of the entity B to authenticate the entity A to calculate the session key is optional, and the entity B calculates the session key SK only when it needs to protect the session message with the entity A.

The above embodiments of the present application implement mutual authentication between entities based on pre-shared keys. At the same time, entity A and entity B can also negotiate to identify the session key between the two parties, which provides a guarantee for secure communication between subsequent entities.

The present application provides a lightweight entity identification method based entirely on the exclusive OR operation. The efficiency of the exclusive OR operation is much higher than the symmetric or asymmetric encryption and decryption operation. Therefore, the application effectively saves the computational overhead in the entity authentication process. The operation efficiency of the authentication process is improved, and the present application implements two-way authentication between entities based on pre-shared keys, and simultaneously negotiates the session key between the two parties to provide secure communication for subsequent entities. . Therefore, the present application is applicable to a resource-limited network, and has the advantages of low overhead, high computational efficiency, safe operation and the like.

Based on the same inventive concept, an entity discriminating apparatus and system are also provided in the embodiment of the present application. Since the principle of solving the problem is similar to the method of the entity authentication method, the implementation of the device can refer to the implementation of the method, and the method is repeated. I won't go into details here.

An entity discriminating device provided by the embodiment of the present application, as shown in FIG. 4, includes:

The request message sending unit 401 is configured to send an authentication request message to the entity B, where the authentication request message includes a result SN1 of the data X1 and the PSK exclusive generated by the entity authentication device, and the PSK is shared by the entity authentication device and the entity B. Key

The determining unit 402 is configured to receive the authentication response message sent by the entity B, perform an exclusive OR operation on the SON1 and the PSK in the authentication response message, and compare the result of the exclusive OR operation with the result of processing the N1 according to the agreed rule, according to the comparison. As a result, it is determined whether the entity B is legal. The SON1 is a result obtained by the entity B to perform an exclusive OR operation between the SN1 and the PSK in the received authentication request message, and the XOR operation result is processed by the agreed rule and then XORed again with the PSK.

Preferably, the request sending unit 401 resends the authentication request message to the entity B when the authentication response message sent by the entity B is not received within the preset time T1 after sending the authentication request message; the device further includes the first The failure determining unit 403 is configured to: when the authentication response message sent by the entity B is not received after the retransmission of the preset number of times m times, the authentication is considered to be unsuccessful.

Preferably, the method further includes: an acknowledgment message sending unit 404, performing an exclusive OR operation on the SN2 and the PSK in the authentication response message, processing the XOR operation result according to the agreed rule, and performing an exclusive OR operation with the PSK to obtain SON2, and SON2 is authenticated. The response confirmation message is sent to the entity B, and the SN2 is a result obtained by the entity B performing an exclusive OR operation on the data N2 generated by itself and the PSK.

Preferably, the confirmation message sending unit 404 resends the authentication response confirmation message to the entity B when the second authentication result message sent by the entity B is not received within the preset time T4 after the authentication response confirmation message is sent; The determining unit 405 is configured to determine that the second authentication result message sent by the entity B has not been received after the re-sending of the authentication response confirmation message by the preset number of times n times, and the authentication is considered to be unsuccessful.

Preferably, the authentication unit 402 is configured to calculate a session key SK, SK=N1 ten N2 ® PSK, when the authentication entity B is legal, and the N2 is to perform an exclusive OR operation between the SN2 and the PSK in the authentication response message. the result of.

The embodiment of the present application further provides another entity authentication device, as shown in FIG. 5, including:

The request message receiving unit 501 is configured to receive an authentication request message sent by the entity A, where the authentication request message packet is The result SN1, PSK of the data N1 and the PSK XOR generated locally by the entity A is a key shared by A and the entity discriminating device;

The response message sending unit 502 is configured to perform an exclusive OR operation on the SN1 and the PSK in the authentication request message, process the XOR operation result according to the agreed rule, and perform an exclusive OR operation with the PSK to obtain SON1, and send the SON1 through the authentication response message to Entity A.

Preferably, the response message sending unit 502 resends the authentication response message to the entity A when the first authentication result message sent by the entity A is not received within the preset time T3 after the authentication response message is sent; the failure determining unit 503, After the first authentication result message sent by the entity A is not received after the retransmission by the preset number of times q times, the authentication is considered to be unsuccessful.

Preferably, the response message sending unit 502 is further configured to perform an exclusive OR operation of the data N2 generated by the entity discriminating device with the PSK to obtain the SN2, and the authentication response message sent to the entity A further includes the SN2; further comprising: The unit 504 is configured to receive an authentication response confirmation message sent by the entity A, perform an exclusive OR operation on the SON2 and the PSK in the authentication response confirmation message, and compare the result of the exclusive OR operation with the result of processing the N2 according to the agreed rule, according to The comparison result is to determine whether the entity A is legal. SON2 is the result of the XOR of the SN2 and the PSK in the authentication response message received by the entity A, and the XOR operation result is processed by the agreed rule and then XORed with the PSK again.

Preferably, when the authentication unit 504 authenticates that the entity A is legitimate, the session key SK, SK=N1®N2®PSK, which is the result of the exclusive-OR operation of the SN1 and the PSK in the authentication request message, is calculated.

An embodiment of the present application further provides an entity authentication system, including an entity A and an entity B, where

For a specific implementation manner in which the entity A and the entity B perform the identification, refer to the description of the foregoing embodiment, and details are not described herein. In the embodiment of the present application, the entity A may be a reader/writer or an electronic tag in a Radio Frequency Identification (RFID) system. When the entity A is a reader/writer, the entity B is an electronic tag; when the entity A is an electronic tag, , entity B is a reader. In the embodiment of the present application, the entity A may also be a coordinator or a common node in the MFAN (Magnetic Field Area Network). When the entity A is a coordinator, the entity B is a common node; when the entity A is a common node, , entity B is the coordinator. In addition to the RFID and MFAN fields, the present application can also be applied to a Sensor Network (SN) (eg, entity A is a cluster head node, and entity B is a common node). The area of the Wireless Personal Area Network (WPAN) (such as the entity A is the coordinator and the entity B is the device).

In summary, the present application implements low-overhead entity authentication based on XOR operations, and the field of application of the present application is also very extensive.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Thus, the application can be in the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the application can be in the form of a computer program product embodied on one or more computer-usable storage interfaces (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each process and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Although the preferred embodiment of the present application has been described, those skilled in the art can make additional changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It will be apparent to those skilled in the art that various modifications and changes can be made in the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the present invention.

Claims

Rights request

1. An entity authentication method, comprising:

2. The method of claim 1 wherein:

In step 1, when the entity A does not receive the authentication response message sent by the entity B within the preset time T1 after sending the authentication request message, the entity A resends the authentication request message to the entity B;

After entity A has not received the authentication response message sent by entity B after resending m times after the preset number of times, entity A considers that the authentication failed; and/or

In step 3, the method further includes:

Entity A sends the identification result of entity B to entity B through the first authentication result message;

If entity B does not receive the first authentication result message sent by entity A after resending a predetermined number of times q times, entity B considers that the authentication fails.

The method according to claim 1, wherein, in step 2, when the entity B receives the authentication request message sent by the entity A, the method further includes:

The data N2 generated by the entity B is XORed with the PSK to obtain the SN2, and the authentication response message sent by the entity B to the entity A further includes the SN2;

In step 3, when entity A determines that entity B is legal, it also includes:

Step 4: The entity A performs an exclusive-OR operation on the SN2 and the PSK in the authentication response message, processes the XOR operation result according to the agreed rule, and performs an exclusive OR operation with the PSK to obtain SON2, and sends the SON2 to the entity B through the authentication response confirmation message. ;

Step 5: The entity B receives the authentication response confirmation message sent by the entity A, and performs an exclusive OR operation between the SON2 and the PSK in the authentication response confirmation message, and compares the result of the exclusive OR operation with the result of processing the N2 according to the agreed rule, according to The comparison result identifies whether entity A is legal.

The method of claim 3, wherein, in step 5, the method further comprises:

Entity B sends the authentication result of entity A to entity A through the second authentication result message;

If the entity A does not receive the second authentication result message sent by the entity B after the retransmission of the preset number of times, the entity A considers that the authentication fails.

The method according to claim 3, wherein, in step 3, when the entity A authenticates the entity B, the method further includes:

The entity A calculates the session key between the entity B and the entity B. SK, SK=N1 ® N2 ® PSK, and N2 is the entity A. The result of the exclusive-OR operation of the SN2 and the PSK in the authentication response message;

In step 5, when entity B authenticates entity A, it further includes:

The entity B calculates the session key between the entity A and the entity A. SK, SK=N1 ® N2 ® PSK, and N1 is the result of the exclusive-OR operation of SN1 and PSK in the authentication request message.

6. The method of any one of claims 1-5 claims, characterized in that the process according to the agreed rule specifically to perform an addition operation and O _{_n,} O _n of the entity A and entity B agreed constant;

The data N1 generated locally by the entity A is a random number generated by the entity A;

The data N2 generated locally by the entity B is a random number generated by the entity B.

7. An entity authentication device, comprising:

8. The apparatus according to claim 7, further comprising:

The acknowledgment message sending unit performs an exclusive OR operation on the SN2 and the PSK in the authentication response message, processes the XOR operation result according to the contract rule, and performs an exclusive OR operation with the PSK to obtain SON2, and sends the SON2 to the entity B through the authentication response confirmation message. The SN2 is a result obtained by the entity B performing an exclusive OR operation on the data N2 generated by itself and the PSK.

9. Apparatus according to claim 8 wherein:

The request message sending unit resends the authentication request message to the entity B when the authentication response message sent by the entity B is not received within the preset time T1 after the authentication request message is sent;

The method further includes: a first failure determining unit, configured to not receive the entity B after resending m times after the preset number of times When the authentication response message is sent, the authentication is considered to have failed;

If the acknowledgment message sending unit identifies the response confirmation message to the entity B, the acknowledgment message sending unit does not receive the second authentication result message sent by the entity B within the preset time T4 after sending the authentication response confirmation message. Entity B resends the authentication response confirmation message;

The second failure determining unit is configured to determine that after the re-sending of the authentication response confirmation message after the preset number of times, the second authentication result message sent by the entity B is not received, and the authentication is considered to be unsuccessful.

The device according to claim 8, wherein the authentication unit is further configured to calculate a session key SK, SK=N1®N2® PSK, and N2 when the entity B is authenticated. The result of the XOR operation of the SN2 and the PSK in the authentication response message.

11. An entity authentication device, comprising:

The device according to claim 11, wherein the response message sending unit sends the first authentication result message sent by the entity A to the entity A within a preset time T3 after the authentication response message is sent. Resending the authentication response message;

And the failure determining unit is configured to: when the first authentication result message sent by the entity A is not received after the retransmission by the preset number of times q times, the authentication is considered to be unsuccessful.

The apparatus according to claim 11, wherein the response message sending unit is further configured to perform an exclusive OR operation of the data N2 generated by the entity discriminating device with the PSK to obtain an SN2, and the authentication response message sent to the entity A. Also including the SN2;

The method further includes: an authentication unit, configured to receive an authentication response confirmation message sent by the entity A, perform an exclusive OR operation on the SON2 and the PSK in the authentication response confirmation message, and perform the result of the exclusive OR operation and the result of processing the N2 according to the agreed rule Comparing, according to the comparison result, it is determined whether the entity A is legal. SON2 is the result that the entity A will perform an exclusive OR operation on the received SN2 and the PSK in the authentication response message, and the XOR operation result is processed by the agreed rule and then XORed with the PSK again.

The apparatus according to claim 13, wherein when the authenticating unit authenticates that the entity A is legal, the session key SK, SK=N1®N2®PSK, is calculated with the entity A, and the N1 is the authentication request. The result of the XOR operation of SN1 and PSK in the message.

15. An entity authentication system, comprising: entity A and entity B, wherein

Entity A sends an authentication request message to entity B, where the authentication request message includes data generated locally by entity A. The result of X2 and PSK XOR operation SN1, PSK is the key shared by entity A and entity B;