Abstract:
A system and method for performing mutual authentication verifies a username and a password of a handheld device by a server, and verifies an identity of the server by the handheld device if the handheld device passes the username and password verification. The system and method further verifies an identity of the handheld device by the server if the identity of the server is valid, and gives an access authority to the handheld device if the identity of the handheld device is valid.

Description:
BACKGROUND 
     1. Technical Field 
     Embodiments of the present disclosure relate to security authentication technology, and particularly to a system and method for performing mutual authentication between a handheld device and a server. 
     2. Description of Related Art 
     Authentication between a handheld device and a server is performed by verifying a username and a password of the handheld device. However, under the username and password authentication mechanism, security authentication of the server is not performed. Therefore, an efficient system and method for performing mutual authentication between a handheld device and a server is desired. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of one embodiment of a system for performing mutual authentication between a plurality of handheld devices and a server. 
         FIG. 2  is a block diagram of one embodiment of a handheld device and a server in  FIG. 1 . 
         FIG. 3  is a flowchart of one embodiment of a method for registering an identifier of a handheld device in a server. 
         FIG. 4  is a flowchart of one embodiment of a method for performing mutual authentication between a handheld device and a server. 
     
    
    
     DETAILED DESCRIPTION 
     All of the processes described below may be embodied in, and fully automated via, functional code modules executed by one or more general purpose electronic devices or processors. The code modules may be stored in any type of non-transitory readable medium or other storage device. Some or all of the methods may alternatively be embodied in specialized hardware. Depending on the embodiment, the non-transitory readable medium may be a hard disk drive, a compact disc, a digital video disc, a tape drive or other suitable storage medium. 
       FIG. 1  is a block diagram of one embodiment of a system  2  for performing mutual authentication (e.g., two-way authentication) between a plurality of handheld devices and a server. In one embodiment, the system  2  may be used to verify identities of the handheld devices and the server simultaneously. A detailed description will be given in the following paragraphs. 
     In one embodiment, the system  2  may include a plurality of handheld devices (e.g.,  10 ,  11 , and  12 ) and a server  20 . Each of the handheld devices is electronically connected to the server  20  through a network  30 . Depending on the embodiment, the network  30  may be an intranet, the Internet or other suitable communication networks. In one embodiment, the server  20  may be a cloud server with a cloud computing function. 
       FIG. 2  is a block diagram of one embodiment of a handheld device  10  and the server  20  in  FIG. 1 . In one embodiment, the handheld device  10  may include one or more modules, for example, a logging module  101 , a first encrypting module  102 , a first decrypting module  103 , and a first verifying module  104 . The one or more modules  101 - 104  may comprise computerized code in the form of one or more programs that are stored in a first storage device  105  (or memory) of the handheld device  10 . The computerized code includes instructions that are executed by the at least one processor  106  to provide functions for the one or more modules  101 - 104 . 
     In one embodiment, the server  20  may include one or more modules, for example, a second encrypting module  201 , a second decrypting module  202 , and a second verifying module  203 . The one or more modules  201 - 203  may comprise computerized code in the form of one or more programs that are stored in a second storage device  204  (or memory) of the server  20 . The computerized code includes instructions that are executed by the at least one processor  205  to provide functions for the one or more modules  201 - 203 . Detailed descriptions of the function of each of the plurality of modules  101 - 104  and  201 - 203  are given in  FIG. 3  and  FIG. 4 . 
       FIG. 3  is a flowchart of one embodiment of a method for registering an identifier of the handheld device  10  in the server  20 . Depending on the embodiment, additional blocks may be added, others removed, and the ordering of the blocks may be changed. 
     In block S 10 , the handheld device  10  registers an identifier of the handheld device  10  with a username and a password in the server  20 . In one embodiment, the identifier of the handheld device  10  may be a unique device identifier (UDID). 
     In block S 11 , the server  20  stores the username, the password, and the identifier of the handheld device  10  in the second storage device  204 . The second encrypting module  201  generates a first encrypted identifier “SID 1 ′” of the server  20  by encrypting an identifier “SID” of the server  20  with the identifier “UDID” of the handheld device  10 , and sends the first encrypted identifier “SID 1 ′” of the server  20  to the handheld device  10 . In one embodiment, the identifier of the server  20  may be a security identifier (SID). An example of an encryption formula is “SID 1 ′=encrypt (SID, UDID).” In one embodiment, the encryption function may be a triple data encryption standard (DES) method. 
     In block S 12 , the first decrypting module  103  generates a first decrypted identifier “SID 1 ″” of the server  20  by decrypting the first encrypted identifier “SID′” of the server  20  with the identifier “UDID” of the handheld device  10 , and stores the first decrypted identifier “SID 1 ″” of the server  20  in the first storage device  105 . An example of an encryption formula is “SID 1 ″=decrypt (SID 1 ′, UDID).” 
       FIG. 4  is a flowchart of one embodiment of a method for performing mutual authentication between the handheld device  10  and the server  20 . Depending on the embodiment, additional blocks may be added, others removed, and the ordering of the blocks may be changed. 
     In block S 20 , the handheld device  10  logs on the server  20  using the logging module  101 . 
     In block S 21 , the server  20  verifies the username and the password of the handheld device  10 . If the username and the password of the handheld device  10  are correct, the second encrypting module  201  reads the identifier of the handheld device  10  “UDID” from the second storage device  204 . If the username or the password of the handheld device  10  is incorrect, the server  20  rejects the access request of the handheld device  10 . 
     In block S 22 , the second encrypting module  201  generates an encrypted authentication token “Token′” of the server  20  and a second encrypted identifier “SID 2 ′” of the server  20  by encrypting an authentication token “Token” of the server  20  and the identifier “SID” of the server  20 , and sends the encrypted authentication token “Token′” of the server  20  and the second encrypted identifier “SID 2 ′” of the server  20  to the handheld device  10 . A detailed description is as follows. 
     First, the second encrypting module  201  generates an authentication token “Token” of the server  20  using random numbers, and generates an encrypted authentication token “Token′” of the server  20  by encrypting the authentication token “Token” of the server  20  with the identifier “UDID” of the handheld device  10 . An example of an encryption formula is “Token′=encrypt (Token, UDID).” 
     Second, the second encrypting module  201  generates a second encrypted identifier “SID 2 ′” of the server  20  by encrypting the identifier “SID” of the server  20  with the encrypted authentication token “Token′” of the server  20 . An example of an encryption formula is “SID 2 ′=encrypt (SID, Token′).” 
     In block S 23 , the first decrypting module  103  generates a decrypted authentication token “Token″” of the server  20  and a second decrypted identifier “SID 2 ″” of the server  20  by decrypting the encrypted authentication token “Token′” of the server  20  and the second encrypted identifier “SID 2 ′” of the server. A detailed description is as follows. 
     The first decrypting module  103  generates a decrypted authentication token “Token″” of the server  20  by decrypting the encrypted authentication token “Token′” of the server  20  with the identifier “UDID” of the handheld device  10 . An example of a decryption formula is “Token″=decrypt (Token′, UDID).” 
     The first decrypting module  103  generate a second decrypted identifier “SID 2 ″” of the server  20  by decrypting the second encrypted identifier “SID 2 ′” of the server  20  with the decrypted authentication token “Token″” of the server  20 . An example of a decryption formula is “SID 2 ″=decrypt (SID 2 ′, Token″).” 
     In block S 24 , the first verifying module  104  determines if the second decrypted identifier “SID 2 ″” of the server  20  is correct according to the first decrypted identifier “SID 1 ″” of the server  20  stored in the first storage device  105 . If the second decrypted identifier “SID 2 ″” of the server  20  matches the first decrypted identifier “SID 1 ″” of the server  20  stored in the first storage device  105  (e.g., SID 2 ″==SID 1 ″), the first verifying module  104  determines that the second decrypted identifier “SID 2 ″” of the server  20  is correct. If the second decrypted identifier “SID 2 ″” of the server  20  does not match the first decrypted identifier “SID 1 ″” of the server  20  stored in the first storage device  105  (e.g., SID 2 ″ !=SID 1 ″), the first verifying module  104  determines that the second decrypted identifier “SID 2 ″” of the server  20  is incorrect, the handheld device  10  stops the communication with the server  20 . 
     If the second decrypted identifier “SID 2 ″” of the server  20  is correct, the first encrypting module  102  generates an encrypted identifier “UDID′” of the handheld device  10  by encrypting the identifier “UDID” of the handheld device  10  with the decrypted authentication token “Token″” of the server  20 , and sends the encrypted identifier “UDID′” of the handheld device  10  to the server  20 . An example of an encryption formula is “UDID′=encrypt (UDID, Token″).” 
     In block S 25 , the second decrypting module  202  generates a decrypted identifier “UDID″” of the handheld device  10  by decrypting the encrypted identifier “UDID′” of the handheld device  10  with the authentication token “Token” of the server  20 . An example of an decryption formula is “UDID″=decrypt (UDID′, Token).” 
     In block S 26 , the second verifying module  203  determines if the decrypted identifier “UDID″” of the handheld device  10  is correct according to the identifier “UDID” of the handheld device  10  stored in the second storage device  204 . If the decrypted identifier “UDID″” of the handheld device  10  matches the identifier “UDID” of the handheld device  10  stored in the second storage device  204  (e.g., UDID″==UDID), the second verifying module  203  determines that the decrypted identifier “UDID″” of the handheld device  10  is correct. If the decrypted identifier “UDID″” of the handheld device  10  does not match the identifier “UDID” of the handheld device  10  stored in the second storage device  204  (e.g., UDID″ !=UDID), the second verifying module  203  determines that the decrypted identifier “UDID″” of the handheld device  10  is incorrect, the server  20  rejects the access request of the handheld device  10 . 
     If the decrypted identifier “UDID″” of the handheld device  10  is correct, the server  20  allocates an access authority to the handheld device  10 . The handheld device  10  receives the access authority, and begins to communicate with the server  20  through the network  30 . 
     It should be emphasized that the above-described embodiments of the present disclosure, particularly, any embodiments, are merely possible examples of implementations, merely set forth for a clear understanding of the principles of the disclosure. Many variations and modifications may be made to the above-described embodiment(s) of the disclosure without departing substantially from the spirit and principles of the disclosure. All such modifications and variations are intended to be included herein within the scope of this disclosure and the present disclosure and protected by the following claims.