Identity authentication method and system and computer equipment

Abstract

The invention relates to the technical field of information security, and provides an identity authentication method and system, and computer equipment. According to the method, password-free authentication is carried out through a fingerprint authentication mode of a fingerprint password key, and a user name and a password are only stored in the fingerprint password key; in the identity authentication process, the client encrypts a first random number generated by the fingerprint password key by using a public key of the server and then sends the encrypted first random number to the server, and the server encrypts the first random number obtained by decryption and a second random number generated by the server to obtain ciphertext data and sends the ciphertext data to the server. The client and the server perform bidirectional identity authentication by using the random numbers of both parties and combining the certificate, and the client and the server perform operation by using the first random number, the second random number and the feature code to obtain the transmission key, so that an attacker is prevented from stealing an authentication credential by using network monitoring or other modes; and the data is retransmitted to the authentication server for replay attack, so that the data transmission security in the authentication process is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an identity authentication method and system. Background Art

[0002] With the development of information technology, more and more attention is paid to system security issues. When users log in or access the system, they need to perform identity authentication methods. The commonly used access control method is to use passwords to confirm the legitimacy of users by matching passwords. The traditional password identity authentication method has security risks. Biometric technology refers to a technology that uses computers to use human physiological or behavioral characteristics for identity authentication. It is based on the inherent and unique physiological and behavioral characteristics of the human body, uses computers to perform image processing or pattern recognition, and then identifies and authenticates personal identities. Compared with traditional password identity authentication methods, biometric technology is safer and more reliable, and is not easy to forge or counterfeit.

[0003] The current identity authentication method based on digital certificates and biometrics usually requires the server or a third-party authoritative authentication center to request the input of biometric information during the process of verifying the user's identity, and store the biometric information in the server. At the same time, when the user logs in to the server, he needs to enter the biometric information again to verify the login. For example, the patent document with application number CN201210256168.X and name "Method for dual authentication based on digital certificates and biometric information" has a security risk. In addition, the user's biometric information is stored in the server database and cannot be effectively supervised and used, which may lead to the abuse of the user's biometric information.

[0004] In another authentication method, the user logs in on the authentication server with a user name and password. After the user successfully logs in, the authentication server calls the digital certificate from the user's certificate storage device according to the user's request. After receiving the call request from the authentication server, the certificate storage device requires the user to perform fingerprint recognition. The user scans the fingerprint through the fingerprint sensor and compares the fingerprint information obtained by the scan with the fingerprint information stored in the storage area. If the comparison is successful, the digital certificate data stored in the storage area is sent to the authentication server for certificate authentication. For example, the patent document with application number CN201010034386.X and name "Certificate Authentication System and Authentication Method Based on Certificate Storage Device with Fingerprint Recognition". This authentication method adds fingerprint authentication on the basis of the user password login method, which enhances the security of authentication to a certain extent. However, if the username and password are cracked or leaked, the digital certificate data returned after the successful fingerprint authentication is monitored or intercepted, and then repeatedly sent to the authentication server for authentication, there is a security risk of replay attack. Summary of the invention

[0005] In order to solve the above technical defects, the present invention provides an identity authentication method and system.

[0006] A first aspect of the present invention provides an identity authentication method, which is applied to a client and a server, and the method comprises:

[0007] The client generates a first random number through a fingerprint password key, encrypts the first random number using a public key of the server preset by the client to obtain first ciphertext data, and sends the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user name and password for the user to log in to the system;

[0008] The server uses the private key of the server to decrypt the received first ciphertext data to obtain a first random number, and uses the first random number to calculate to obtain a first key; the server generates a second random number, uses the first key and the second random number to perform encryption calculation to obtain second ciphertext data, and sends the second ciphertext data to the client;

[0009] The client uses the first random number operation to obtain a second key corresponding to the first key, uses the second key to decrypt the received second ciphertext data to obtain a second random number, uses the second random number operation to obtain a third key, and uses the third key and the second random number to perform encryption operation to obtain third ciphertext data;

[0010] The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server.

[0011] The client uses the first random number, the second random number and the client's characteristic code to perform calculations to obtain a transmission key, wherein the client's characteristic code is obtained by performing encryption calculations on the client using the certificate information of the fingerprint password key;

[0012] The client obtains the user name and password for logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server;

[0013] The server uses the second random number to calculate and obtain a fourth key corresponding to the third key, uses the fourth key to decrypt the received third ciphertext data to obtain a second random number, compares the decrypted second random number with the second random number generated by the server, and, if the comparison result is consistent, uses the first random number, the second random number and the feature code of the server to calculate and obtain the transmission key, wherein the feature code of the server is obtained by the server through encryption calculation using the certificate information of the received fingerprint password key;

[0014] The server uses the transmission key to decrypt the received final ciphertext data to obtain the user name and password, and searches for the user name and password in the server's database. If the user name and password are found, it is determined that the user's identity authentication for logging into the system is successful.

[0015] In an embodiment of the present invention, the method further includes:

[0016] After the server uses the first key and the second random number to perform encryption operation to obtain the second ciphertext data, it uses the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and sends the server certificate, the first signature value and the second ciphertext data to the client at the same time;

[0017] The client verifies the received server certificate and the first signature value using the root certificate.

[0018] In an embodiment of the present invention, the method further includes:

[0019] After the fingerprint entered by the user is authenticated by the fingerprint password key, the client uses the private key in the signature key to sign the third ciphertext data to obtain the second signature value, and sends the user certificate, the second signature value and the third ciphertext data to the server at the same time;

[0020] The server uses the root certificate to verify the received user certificate and the second signature value.

[0021] In the embodiment of the present invention, the feature code of the client and the feature code of the server are generated in the following manner:

[0022] Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key;

[0023] Performing a hash operation on the user region information to obtain a first hash value;

[0024] The user identity information is concatenated with the first hash value and then subjected to a hash operation to obtain a second hash value;

[0025] The issuer identity information is concatenated with the second hash value and then hashed to obtain a third hash value;

[0026] The name of the system to be logged in by the user is concatenated with the third hash value and then subjected to hash operation to obtain a fourth hash value, and the fourth hash value is used as a feature code;

[0027] Alternatively, the client's signature and the server's signature are generated in the following way:

[0028] Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key;

[0029] Get the name of the system the user wants to log in to;

[0030] The user's regional information, user identity information, issuer identity information, and the name of the system the user wants to log in are concatenated, and a hash operation is performed on the concatenated data to obtain a feature code.

[0031] In an embodiment of the present invention, the user name and password for logging into the system are stored in the fingerprint password key, including:

[0032] When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained;

[0033] Performing a first operation based on the serial number of the fingerprint password key to obtain first data;

[0034] Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext;

[0035] Performing a second operation based on the serial number of the fingerprint password key to obtain second data;

[0036] Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext;

[0037] Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data;

[0038] Store the user's ciphertext data in the fingerprint password key.

[0039] In an embodiment of the present invention, a first operation is performed based on the serial number of the fingerprint password key to obtain the first data, including: performing a hash operation on the serial number of the fingerprint password key, taking the first n bytes of data as initial data, inverting the first m bytes of data of the initial data and splicing them to obtain n bytes of first data, where m<n.

[0040] In an embodiment of the present invention, a second operation is performed based on the serial number of the fingerprint password key to obtain the second data, including: performing a hash operation on the serial number of the fingerprint password key, taking the first n bytes of data as initial data, inverting the last m bytes of data of the initial data and splicing them to obtain n bytes of second data, where m<n.

[0041] In the embodiment of the present invention, the client obtains the user name and password of the user logging into the system from the fingerprint password key, including:

[0042] Get the serial number of the fingerprint password key;

[0043] Performing a first operation based on the serial number of the fingerprint password key to obtain first data;

[0044] Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext;

[0045] Performing a second operation based on the serial number of the fingerprint password key to obtain second data;

[0046] Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext;

[0047] Get user ciphertext data from fingerprint password key;

[0048] The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

[0049] A second aspect of the present invention provides an identity authentication method, applied to a client, the method comprising:

[0050] Generate a first random number through a fingerprint password key, encrypt the first random number using a public key of the server preset by the client to obtain first ciphertext data, and send the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user name and password for logging into the system;

[0051] The first random number is used to calculate and obtain a second key corresponding to the first key, the second key is used to decrypt the second ciphertext data from the server to obtain a second random number, the second random number is used to calculate and obtain a third key, and the third key and the second random number are used to perform encryption calculation to obtain third ciphertext data; the second ciphertext data is obtained by the server performing encryption calculation using the first key and the second random number, the second random number is generated by the server, and the first key is obtained by the server performing calculation using the first random number obtained by decrypting the first ciphertext data from the client using the private key of the server;

[0052] The fingerprint entered by the user is authenticated by the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server;

[0053] The transmission key is obtained by performing calculation using the first random number, the second random number and the characteristic code of the client, where the characteristic code of the client is obtained by performing encryption calculation using the certificate information of the fingerprint password key by the client;

[0054] The user name and password for logging into the system are obtained from the fingerprint password key, the user name and password are encrypted using the transmission key to obtain the final ciphertext data, and the final ciphertext data is sent to the server for identity authentication.

[0055] A third aspect of the present invention provides an identity authentication method, which is applied to a server, and the method comprises:

[0056] The first ciphertext data from the client is decrypted using the private key of the server to obtain a first random number, and the first key is obtained by using the first random number operation; the first ciphertext data is obtained by the client using the public key of the server preset by the client to encrypt the first random number generated by the fingerprint password key, the fingerprint password key is bound to the fingerprint information of the user, and the fingerprint password key stores the user name and password of the user logging into the system;

[0057] Generate a second random number, use the first key and the second random number to perform encryption operation to obtain second ciphertext data, and send the second ciphertext data to the client;

[0058] The fourth key corresponding to the third key of the client is obtained by using the second random number calculation, the third ciphertext data from the client is decrypted by using the fourth key to obtain the second random number, the second random number obtained by decryption is compared with the second random number generated by the server, and under the condition that the comparison result is consistent, the transmission key is obtained by using the first random number, the second random number and the feature code of the server to calculate, the feature code of the server is obtained by the server using the certificate information of the received fingerprint password key to perform encryption calculation; the third key is obtained by the client using the second key to decrypt the second ciphertext data from the server to calculate the second random number, the second key is obtained by the client using the first random number calculation; the third ciphertext data is obtained by the client using the third key and the second random number to perform encryption calculation; the third ciphertext data is sent to the server after the fingerprint entered by the user is authenticated by the client using the fingerprint password key;

[0059] The final ciphertext data from the client is decrypted using the transmission key to obtain the user name and password, and the user name and password are searched in the database of the server. Under the condition that the user name and password are found, it is determined that the identity authentication of the user logging into the system is successful; the final ciphertext data is obtained by the client obtaining the user name and password of the user logging into the system from the fingerprint password key, and encrypting the user name and password using the client's transmission key, and the client's transmission key is calculated by the client using the first random number, the second random number and the feature code agreed with the server.

[0060] A fourth aspect of the present invention provides an identity authentication system, comprising: a fingerprint password key, a client and a server;

[0061] The fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user's username and password for logging into the system;

[0062] The client generates a first random number using the fingerprint password key, encrypts the first random number using the public key of the server preset by the client to obtain first ciphertext data, and sends the first ciphertext data to the server;

[0063] The server uses the private key of the server to decrypt the received first ciphertext data to obtain a first random number, and uses the first random number to calculate to obtain a first key; the server generates a second random number, uses the first key and the second random number to perform encryption calculation to obtain second ciphertext data, and sends the second ciphertext data to the client;

[0064] The client uses the first random number operation to obtain a second key corresponding to the first key, uses the second key to decrypt the received second ciphertext data to obtain a second random number, uses the second random number operation to obtain a third key, and uses the third key and the second random number to perform encryption operation to obtain third ciphertext data;

[0065] The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server.

[0066] The client uses the first random number, the second random number and the client's characteristic code to perform calculations to obtain a transmission key, where the client's characteristic code is obtained by performing encryption calculations on the client using the certificate information of the fingerprint password key;

[0067] The client obtains the user name and password for logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server;

[0068] The server uses the second random number to calculate and obtain a fourth key corresponding to the third key, uses the fourth key to decrypt the received third ciphertext data to obtain a second random number, compares the decrypted second random number with the second random number generated by the server, and, if the comparison result is consistent, uses the first random number, the second random number and the feature code of the server to calculate and obtain the transmission key, where the feature code of the server is obtained by the server through encryption calculation using the certificate information of the received fingerprint password key;

[0069] The server uses the transmission key to decrypt the received final ciphertext data to obtain the user name and password, and searches for the user name and password in the server's database. If the user name and password are found, it is determined that the user's identity authentication for logging into the system is successful.

[0070] The present invention also provides a computer device, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned identity authentication method.

[0071] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned identity authentication method when executed by a processor.

[0072] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned identity authentication method is implemented.

[0073] On one hand, the present invention uses a fingerprint authentication method of a fingerprint password key to perform password-free authentication. The user name and password are only stored in the fingerprint password key. When the user logs in to the system, there is no need to manually enter the user name and password, thereby avoiding the risk of sensitive data such as the user name and password being monitored or leaked. On the other hand, during the identity authentication process, the client uses the public key of the server to encrypt the first random number generated by the fingerprint password key and sends it to the server. The server uses the first random number obtained by decryption and the second random number generated by the server to encrypt the ciphertext data and send it to the server. The client and the server use the random numbers of both parties and combine them with the certificate to perform two-way identity authentication. After the authentication is passed, the client and the server use the first random number, the second random number and the feature code to calculate to obtain the transmission key, and use the transmission key to encrypt and decrypt the data, thereby avoiding the attacker from stealing the authentication credentials by network monitoring or other methods, and then resending the data to the authentication server for replay attack. On the other hand, the client obtains the user name and password of the user logging in to the system from the fingerprint password key, and the client uses the transmission key to encrypt the user name and password and sends them to the server. The server uses the transmission key to decrypt, thereby realizing the identity authentication of the user logging in to the system, and further ensuring the data transmission security during the authentication process.

[0074] Other features and advantages of the technical solution of the present invention will be described in detail in the specific implementation section below. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0076] Figure 1 is a signal interaction process diagram of the identity authentication method provided by an embodiment of the present invention;

[0077] Figure 2 is a flow chart of an identity authentication method provided by a specific example of the present invention (upper part);

[0078] Figure 3 is a flow chart of an identity authentication method provided by a specific example of the present invention (lower part);

[0079] Figure 4 It is a flowchart of storing a user name and password in a fingerprint password key provided by a specific example of the present invention;

[0080] Figure 5 It is a flowchart of obtaining a user name and password from a fingerprint password key provided by a specific example of the present invention;

[0081] Figure 6 It is a block diagram of an identity authentication system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0082] In order to make the technical solutions and advantages of the embodiments of the present invention more clearly understood, the exemplary embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other without conflict.

[0083] The identity authentication method provided by the embodiment of the present invention involves a fingerprint password key (fingerprint USBKey), a client and a server. The fingerprint password key (fingerprint USBKey) is a dedicated hardware device, which contains a computing chip, can complete various encryption and decryption operations, signature verification, and generate public key / private key pairs, and has a hardware random number generator. USBKEY can store signed digital certificates and private keys. The private key can only participate in the operation inside the USBKEY and cannot be read out. The fingerprint USBKey has the functions of fingerprint collection and fingerprint comparison. The server has a server for authentication, and the server has the functions of asymmetric key generation and storage, certificate storage, random number generation, signature verification, etc. User certificates and server certificates are both issued by root certificates, and user certificates and server certificates are certificates of the same level.

[0084] The initial conditions for identity authentication are: (1) The fingerprint USBKey generates a signature key pair, and uses this key pair to generate a certificate request file. The authentication center uses the root certificate to complete the user certificate issuance and store it in the fingerprint USBKey; (2) The user completes the USBKey fingerprint collection and entry (the fingerprint information is stored inside the USBKey, and the fingerprint password key is bound to the user's fingerprint information); (3) The server generates a signature key pair, and uses this key pair to generate a certificate request file. The authentication center uses the same root certificate to complete the server certificate issuance and store it in the server.

[0085] The technical solution of the present invention performs password-free authentication through the fingerprint authentication method of the fingerprint password key. The user name and password are only stored in the fingerprint password key. When the user logs in to the system, there is no need to manually enter the user name and password, thereby avoiding the risk of sensitive data such as the user name and password being monitored or leaked. In the identity authentication process, the client uses the public key of the server to encrypt the first random number generated by the fingerprint password key and sends it to the server. The server uses the first random number obtained by decryption and the second random number generated by the server to encrypt the ciphertext data and send it to the server. The client and the server use the random numbers of both parties and combine with the certificate to perform two-way identity authentication. After the authentication is passed, the client and the server use the first random number, the second random number and the feature code to calculate to obtain the transmission key, and use the transmission key to encrypt and decrypt the data, thereby avoiding the attacker from stealing the authentication credentials by network monitoring or other methods, and then resending the data to the authentication server for replay attack. The client obtains the user name and password of the user logging in to the system from the fingerprint password key, and the client uses the transmission key to encrypt the user name and password and sends them to the server. The server uses the transmission key to decrypt, thereby realizing the identity authentication of the user logging in to the system, and further ensuring the data transmission security during the authentication process.

[0086] Solution 1

[0087] Figure 1 is a signal interaction process diagram of the identity authentication method provided by an embodiment of the present invention. Figure 1 As shown, the identity authentication method provided in this embodiment involves a fingerprint password key, a client and a server. Before the client and the server perform identity authentication, the user name and password of the user logging into the system need to be stored in the fingerprint password key. Specifically, the user enters the user name and password for logging into the system and enters the fingerprint. The fingerprint password key verifies the fingerprint currently entered by the user. After the verification is passed, the user name and password for logging into the system are stored in the fingerprint password key.

[0088] The method for identity authentication between the client and the server includes the following steps:

[0089] The client generates a first random number R1 through the fingerprint password key, encrypts the first random number R1 using the public key of the server preset by the client to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server;

[0090] The server uses the server's private key to decrypt the received first ciphertext data Cipher1 to obtain the first random number R1, and uses the first random number R1 to calculate the first key Key; the server generates a second random number R2, uses the first key Key and the second random number R2 to perform encryption calculation to obtain the second ciphertext data Cipher2, and sends the second ciphertext data Cipher2 to the client;

[0091] The client uses the first random number R1 to calculate and obtain the second key Key' corresponding to the first key Key, uses the second key Key' to decrypt the received second ciphertext data Cipher2 to obtain the second random number R2, uses the second random number R2 to calculate and obtain the third key Key", and uses the third key Key" and the second random number R2 to perform encryption calculation to obtain the third ciphertext data Cipher3;

[0092] The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data Cipher3 and the certificate information of the fingerprint password key are sent to the server.

[0093] The client uses the first random number R1, the second random number R2 and the client's feature code to perform calculations to obtain the transmission key Key1;

[0094] The client obtains the user name and password of the user logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key Key1 to obtain the final ciphertext data, and sends the final ciphertext data to the server;

[0095] The server uses the second random number R2 to calculate and obtain the fourth key Key"' corresponding to the third key Key", uses the fourth key Key"' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2', compares the decrypted second random number R2' with the second random number R2 generated by the server, and when the comparison results are consistent, uses the first random number R1, the second random number R2 and the feature code of the server to calculate and obtain the transmission key Key1;

[0096] The server uses the transmission key Key1 to decrypt the received final ciphertext data to obtain the user name and login password, and finds the user name and login password in the server's database. Under the condition that the user name and login password are found, it is determined that the user's identity authentication for logging into the system is successful.

[0097] In a specific embodiment, the client uses the certificate information of the fingerprint cryptographic key to perform encryption operations to obtain the client's feature code; the server uses the received certificate information of the fingerprint cryptographic key to perform encryption operations to obtain the server's feature code. The client's feature code matches the server's feature code, which can realize the encryption and decryption of the transmission key. The certificate of the fingerprint cryptographic key is also used as the client's user certificate. The certificate contains the following information: version number, which identifies the version information of the certificate; serial number, which provides a unique identifier for the certificate; signature algorithm, which specifies the algorithm used to sign the certificate; issuer, including issuer's geographical information (such as province, city) and issuing agency information; certificate validity period, that is, the date and time when the certificate starts and ends; subject, including user geographical information (such as province, city), user identity information (such as department, sub-department, etc.); subject public key information, including public key algorithm and public key itself; issuer unique identity information and subject unique identity information; certificate signature algorithm and digital signature, using a specific algorithm to sign the certificate content to ensure the integrity and authenticity of the certificate.

[0098] In a specific example, the client's signature code and the server's signature code can be generated in the following way:

[0099] Extract user region information S, user identity information L and issuer identity information CN from the certificate information of the fingerprint password key;

[0100] Performing a hash operation SM3 on the user region information S to obtain a first hash value HASH1;

[0101] The user identity information L is concatenated with the first hash value HASH1 and then a hash SM3 operation is performed to obtain a second hash value HASH2;

[0102] The issuer identity information CN is concatenated with the second hash value HASH2 and then a hash SM3 operation is performed to obtain a third hash value HASH3;

[0103] The name M of the system that the user wants to log in to is concatenated with the third hash value HASH3, and then a hash SM3 operation is performed to obtain a fourth hash value HASH4, and the fourth hash value is used as the feature code.

[0104] In another specific example, the feature code of the client or server may be generated in the following manner:

[0105] Extract the user's region information S, user's identity information L and issuer's identity information CN from the certificate information of the fingerprint password key;

[0106] Get the name M of the system that the user wants to log in;

[0107] The user's regional information S, user's identity information L, issuer's identity information CN, and the name M of the system the user wants to log in are concatenated, and a hash SM3 operation is performed on the concatenated data to obtain a feature code.

[0108] This embodiment generates the characteristic codes of the client and the server through the certificate information of the fingerprint password key. Users (client or server) in different regions or with different identities can obtain matching characteristic codes. The characteristic codes are used as distributed keys and participate in encryption operations together with random numbers to generate transmission keys for the client and the server, which increases the difficulty of cracking the transmission keys and improves the security of the keys.

[0109] In another embodiment, the above method also includes: after the server uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, it uses the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1, and at the same time sends the server certificate, the first signature value Signdata1 and the second ciphertext data Cipher2 to the client.

[0110] The client uses the root certificate to verify the received server certificate and the first signature value Signdata1. After the verification is passed, the client uses the first random number R1 to calculate and obtain the second key Key' corresponding to the first key Key.

[0111] After the client authenticates the fingerprint entered by the user through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2, and sends the user certificate, the second signature value Signdata2 and the third ciphertext data Cipher3 to the server.

[0112] The server uses the root certificate to verify the received user certificate and the second signature value Signdata2. After the verification is passed, the server uses the second random number R2 to calculate the fourth key Key"' corresponding to the third key Key", and uses the fourth key Key"' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2'.

[0113] In a specific example, if Figure 2 and Figure 3 As shown in the figure, the identity authentication process between the client and the server includes:

[0114] 1. The client generates a 16-byte first random number R1 through the fingerprint USBKey;

[0115] 2. The client uses the public key of the server preset by the client to encrypt the first random number R1 to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server (i.e., the server);

[0116] 3. The server uses the server's private key to decrypt the first ciphertext data Cipher1 to obtain the first random number R1;

[0117] 4. The server performs SM3 hash operation on the first random number R1 to obtain a 32-byte result, and XORs the first 16 bytes of data with the last 16 bytes of data to obtain a 16-byte first key Key;

[0118] 5. The server generates a second random number R2 and temporarily stores it;

[0119] 6. The server uses the SM4 algorithm, the key is the first key Key, and the symmetric encryption algorithm (ECB) to encrypt the second random number R2 to obtain the second ciphertext data Cipher2;

[0120] 7. The server uses the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1, and sends the server certificate, the second ciphertext data Cipher2, and the first signature value Signdata1 to the client;

[0121] 8. The client uses the root certificate to verify the validity of the server certificate and the correctness of the first signature value Signdata1;

[0122] 9. If the client verification fails, the authentication process ends; if the verification succeeds, the first random number R1 is subjected to SM3 hash operation to obtain a 32-byte result, and the first 16 bytes of data are XORed with the last 16 bytes of data to obtain a 16-byte second key Key';

[0123] 10. The client uses the SM4 algorithm, the key is the second key Key', and adopts a symmetric encryption algorithm to decrypt the received second ciphertext data Cipher2 to obtain a second random number R2;

[0124] 11. The client performs SM3 hash operation on the second random number R2 to obtain a 32-byte result, and performs XOR operation on the first 16 bytes of data and the last 16 bytes of data to obtain a 16-byte third key "Key";

[0125] 12. The client uses the SM4 algorithm, the key is the third key "Key", and adopts a symmetric encryption algorithm to encrypt the second random number R2 to obtain the third ciphertext data Cipher3;

[0126] 13. The client authenticates the fingerprint entered by the user through the fingerprint password key. If the fingerprint authentication fails, the process ends; if the fingerprint authentication succeeds, the third ciphertext data Cipher3 is signed with the private key in the signature key to obtain the second signature value Signdata2, and the user certificate, the third ciphertext data Cipher3, and the second signature value Signdata2 are sent to the server;

[0127] 14. The server uses the root certificate to verify the validity of the user certificate and the second signature value Signdata2;

[0128] 15. If the server-side verification fails, the authentication ends; if the verification passes, the SM3 hash operation is performed on the temporarily stored second random number R2 to obtain a 32-byte result, and the first 16 bytes of data are XORed with the last 16 bytes of data to obtain a 16-byte fourth key Key"';

[0129] 16. The server uses the SM4 algorithm with the fourth key Key'' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2';

[0130] 17. The server compares the decrypted second random number R2' with the second random number R2 temporarily stored on the server. If they are inconsistent, the authentication ends. If they are consistent, the client and server use the feature code, the first random number R1, and the second random number R2 to calculate and obtain 32 bytes of data, and take the last 16 bytes of data as the transmission key Key1.

[0131] 18. The client obtains the user name and password for logging into the system;

[0132] 19. The client uses the SM4 algorithm, the key is the transmission key Key1, and the symmetric encryption algorithm to encrypt the user name and password and then send it to the server;

[0133] 20. After receiving the ciphertext data, the server uses the transmission key Key1 to decrypt the ciphertext data and obtain the user name and password;

[0134] 21. The server searches the database for the username and password and compares them to see if the password is correct. If the username exists and the password is correct, the authentication is successful.

[0135] In one embodiment, storing the user name and password of the user logging into the system in the fingerprint password key includes the following steps:

[0136] When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained;

[0137] Performing a first operation based on the serial number of the fingerprint password key to obtain first data;

[0138] Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext;

[0139] Performing a second operation based on the serial number of the fingerprint password key to obtain second data;

[0140] Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext;

[0141] Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data;

[0142] Store the user's ciphertext data in the fingerprint password key.

[0143] In the above steps, the first operation based on the serial number of the fingerprint password key is performed to obtain the first data, which specifically includes: performing an SM3 hash operation on the serial number of the fingerprint password key, taking the first n bytes of data as initial data, and inverting the first m (m < n) bytes of data of the initial data and splicing them to obtain n bytes of first data. The second operation based on the serial number of the fingerprint password key is performed to obtain the second data, which specifically includes: performing an SM3 hash operation on the serial number of the fingerprint password key, taking the first n bytes of data as initial data, and inverting the last m (m < n) bytes of data of the initial data and splicing them to obtain n bytes of second data.

[0144] This embodiment uses the master key and serial number of the fingerprint password key to disperse the keys, uses the master key to encrypt and generate a first ciphertext, uses the first ciphertext to encrypt and generate a second ciphertext, and uses the second ciphertext to encrypt the user name and password. Compared with the method of directly using the master key to encrypt the user name and password, the security of user name and password storage is improved.

[0145] In a specific example, if Figure 4 As shown, the process of storing the user name and password in the fingerprint password key is:

[0146] (1) The user enters the username and password for logging into the system;

[0147] (2) Verify the fingerprint currently entered by the user. If the fingerprint verification fails, the process ends;

[0148] (3) If fingerprint verification succeeds, the serial number of the fingerprint USBKey is obtained. If the acquisition fails, the process ends;

[0149] (4) The fingerprint USBKey serial number is successfully obtained, the serial number is hashed by SM3, and the first 16 bytes of data are obtained;

[0150] (5) Take the first 8 bytes of data and invert them to get the new 8 bytes of data, and concatenate them to get the 16-byte data data1;

[0151] (6) Use the SM4 algorithm, USBKey master key, and ECB (symmetric encryption algorithm) mode to encrypt data1 and obtain the ciphertext Cipher';

[0152] (7) Take the 8 bytes after data and invert them to get the new 8 bytes, and concatenate them to get the 16-byte data data2;

[0153] (8) Use the SM4 algorithm, ciphertext Cipher' as the key, and ECB mode to encrypt data2 to obtain ciphertext Cipher".

[0154] (9) Use the SM4 algorithm, ECB mode, and the key Cipher to encrypt the user and password to obtain the user ciphertext data Cipher';

[0155] (10) Store the user ciphertext data Cipher"' in the file of the fingerprint USBKey.

[0156] In one embodiment, the client obtains the user name and password of the user logging into the system from the fingerprint password key, including the following steps:

[0157] Get the serial number of the fingerprint password key;

[0158] Performing a first operation based on the serial number of the fingerprint password key to obtain first data;

[0159] Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext;

[0160] Performing a second operation based on the serial number of the fingerprint password key to obtain second data;

[0161] Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext;

[0162] Get user ciphertext data from fingerprint password key;

[0163] The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

[0164] In a specific example, if Figure 5 As shown in the figure, the process of the client obtaining the user name and password of the user logging into the system from the fingerprint password key is as follows:

[0165] (1) Obtain the fingerprint USBKey serial number. If the acquisition fails, the process ends;

[0166] (2) If the acquisition is successful, perform SM3 hash operation on the USBKey serial number and take the first 16 bytes of data;

[0167] (3) Take the first 8 bytes of data and invert them to get the new 8 bytes of data, and concatenate them to get the 16-byte data data1;

[0168] (4) Use the SM4 algorithm, USBKey master key, and ECB (symmetric encryption algorithm) mode to encrypt data1 and obtain the ciphertext Cipher';

[0169] (5) Take the 8 bytes after data and invert them to get the new 8 bytes, and concatenate them to get the 16-byte data data2;

[0170] (6) Use the SM4 algorithm, ciphertext Cipher' as the key, and ECB mode to encrypt data2 to obtain ciphertext Cipher".

[0171] (7) Obtain the user ciphertext data Cipher"' from the fingerprint USBKey. If the acquisition fails, the process ends;

[0172] (8) If the acquisition is successful, use the SM4 algorithm, the key is Cipher", and the ECB mode to decrypt the user's ciphertext data Cipher"' to obtain the user name and password.

[0173] Solution 2

[0174] The embodiment of the present invention also provides an identity authentication method applied to a client, which corresponds to the identity authentication method applied to a fingerprint password key, a client, and a server provided in the above embodiment. The identity authentication method applied to a client includes the following steps:

[0175] Generate a first random number R1 through the fingerprint password key, encrypt the first random number R1 using the public key of the server preset by the client to obtain the first ciphertext data Cipher1, and send the first ciphertext data Cipher1 to the server;

[0176] The first random number R1 is used to calculate the second key Key' corresponding to the first key Key, the second key Key' is used to decrypt the second ciphertext data Cipher2 from the server to obtain the second random number R2, the second random number R2 is used to calculate the third key Key", and the third key Key" and the second random number R2 are used to perform encryption calculation to obtain the third ciphertext data Cipher3; the second ciphertext data Cipher2 is obtained by the server using the first key Key and the second random number R2 for encryption calculation, the second random number R2 is generated by the server, and the first key Key is obtained by the server using the private key of the server to decrypt the first ciphertext data Cipher1 from the client and calculate the first random number R1;

[0177] The fingerprint entered by the user is authenticated by the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data Cipher3 and the certificate information of the fingerprint password key are sent to the server;

[0178] The transmission key Key1 is obtained by performing calculation using the first random number R1, the second random number R2 and the characteristic code of the client;

[0179] The user name and password for logging into the system are obtained from the fingerprint password key, and the user name and password are encrypted using the transmission key Key1 to obtain the final ciphertext data, which is then sent to the server for identity authentication.

[0180] In a specific embodiment, the client uses the certificate information of the fingerprint password key to perform encryption calculation to obtain the client's feature code. The client's feature code matches the server's feature code, which can realize the encryption and decryption of the transmission key. The specific generation method of the client's feature code can be understood by referring to the description in the above solution 1, and will not be repeated here.

[0181] In a specific embodiment, the method steps further include: the client uses the root certificate to verify the server certificate and the first signature value Signdata1 from the server. The first signature value Signdata1 is obtained by the server using the first key Key and the second random number R2 to perform encryption operation to obtain the second ciphertext data Cipher2, and then using the private key in the signature key to sign the second ciphertext data Cipher2; the server certificate and the first signature value Signdata1 are sent to the client at the same time as the second ciphertext data Cipher2.

[0182] In a specific embodiment, the above method steps also include: after the client authenticates the fingerprint entered by the user through the fingerprint password key, the third ciphertext data Cipher3 is signed using the private key in the signature key to obtain the second signature value Signdata2, and the user certificate, the second signature value Signdata2 and the third ciphertext data Cipher3 are sent to the server for verification.

[0183] In a specific embodiment, in the steps of the identity authentication method applied to the client, the user name and password for logging into the system need to be stored in the fingerprint password key, and then the client obtains the user name and password from the fingerprint password key. The specific process of storing the user name and password in the fingerprint password key and obtaining the user name and password from the fingerprint password key can be understood by referring to the above specific examples.

[0184] Option 3

[0185] The embodiment of the present invention also provides an identity authentication method applied to a server, which corresponds to the identity authentication method applied to a fingerprint password key, a client and a server provided in the above embodiment. The identity authentication method applied to a server includes:

[0186] The first ciphertext data Cipher1 from the client is decrypted using the private key of the server to obtain the first random number R1, and the first key Key is obtained by calculating the first random number R1; the first ciphertext data Cipher1 is obtained by encrypting the first random number R1 generated by the fingerprint password key by the client using the public key of the server preset by the client;

[0187] Generate a second random number R2, use the first key Key and the second random number R2 to perform encryption operation to obtain second ciphertext data Cipher2, and send the second ciphertext data Cipher2 to the client;

[0188] The fourth key Key'' corresponding to the third key Key'' of the client is obtained by calculation using the second random number R2, and the third ciphertext data Cipher3 from the client is decrypted using the fourth key Key'' to obtain the second random number R2, and the decrypted second random number R2 is compared with the second random number R2 generated by the server. Under the condition that the comparison result is consistent, the transmission key Key1 is obtained by calculation using the first random number R1, the second random number R2 and the feature code of the server; the third key Key' is obtained by calculation by the client using the second key Key' to decrypt the second ciphertext data Cipher2 from the server, and the second key Key' is obtained by calculation by the client using the first random number R1; the third ciphertext data Cipher3 is obtained by encryption calculation by the client using the third key Key' and the second random number R2; the third ciphertext data Cipher3 is sent to the server after the fingerprint entered by the user is authenticated by the fingerprint password key;

[0189] The final ciphertext data from the client is decrypted using the transmission key Key1 to obtain the user name and password, and the user name and password are searched in the database of the server. When the user name and password are found, it is determined that the identity authentication of the user logging into the system is successful; the final ciphertext data is obtained by the client obtaining the user name and password of the user logging into the system from the fingerprint password key, and encrypting the user name and password using the client's transmission key Key1; the client's transmission key Key1 is obtained by the client using the first random number R1, the second random number R2 and the client's feature code to perform calculations.

[0190] In a specific embodiment, the server uses the received certificate information of the fingerprint password key to perform encryption operation to obtain the server's feature code. The server's feature code matches the client's feature code, which can realize the encryption and decryption of the transmission key. The specific generation method of the server's feature code can be understood by referring to the description in the above solution one, which will not be repeated here.

[0191] In a specific embodiment, the above method steps also include: after the server uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, it uses the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1, and at the same time sends the server certificate, the first signature value Signdata1 and the second ciphertext data Cipher2 to the client for verification.

[0192] In a specific embodiment, the above method steps also include: the server uses the root certificate to verify the user certificate and the second signature value Signdata2 from the client. The second signature value Signdata2 is obtained by signing the third ciphertext data Cipher3 using the private key in the signature key after the client authenticates the fingerprint entered by the user through the fingerprint password key; the user certificate and the second signature value Signdata2 are sent to the server at the same time as the third ciphertext data Cipher3.

[0193] In a specific embodiment, in the steps of the identity authentication method applied to the server, the user name and password for logging into the system need to be stored in the fingerprint password key, and then the client obtains the user name and password from the fingerprint password key. The specific process of storing the user name and password in the fingerprint password key and obtaining the user name and password from the fingerprint password key can be understood by referring to the above specific examples.

[0194] Option 4

[0195] The embodiment of the present invention also provides an identity authentication system. Figure 6 As shown, the identity authentication system provided by the embodiment of the present invention includes: a fingerprint password key, a client and a server. The fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user's username and password for logging into the system. The client generates a first random number R1 through the fingerprint password key, encrypts the first random number R1 using the public key of the server preset by the client to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server.

[0196] The server uses the server's private key to decrypt the received first ciphertext data Cipher1 to obtain the first random number R1, and uses the first random number R1 to calculate the first key Key; the server generates a second random number R2, uses the first key Key and the second random number R2 to perform encryption calculations to obtain the second ciphertext data Cipher2, and sends the second ciphertext data Cipher2 to the client.

[0197] The client uses the first random number R1 to calculate the second key Key' corresponding to the first key Key, uses the second key Key' to decrypt the received second ciphertext data Cipher2 to obtain the second random number R2, uses the second random number R2 to calculate the third key Key", and uses the third key Key" and the second random number R2 to perform encryption calculation to obtain the third ciphertext data Cipher3. The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data Cipher3 and the certificate information of the fingerprint password key are sent to the server.

[0198] The client uses the first random number R1, the second random number R2 and the client's feature code to calculate and obtain the transmission key Key1. The client obtains the user name and password for logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key Key1 to obtain the final ciphertext data, and sends the final ciphertext data to the server.

[0199] The server uses the second random number R2 to calculate the fourth key Key' corresponding to the third key Key", uses the fourth key Key' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2, compares the decrypted second random number R2 with the second random number R2 generated by the server, and when the comparison result is consistent, uses the first random number R1, the second random number R2 and the server's feature code to calculate to obtain the transmission key Key1. The server uses the transmission key Key1 to decrypt the received final ciphertext data to obtain the user name and password, searches for the user name and password in the server's database, and when the user name and password are found, determines that the user's identity authentication for logging into the system is successful.

[0200] In a specific example, the client uses the certificate information of the fingerprint password key to perform encryption calculations to obtain the client's feature code; the server uses the received certificate information of the fingerprint password key to perform encryption calculations to obtain the server's feature code. The client's feature code matches the server's feature code, which can achieve encryption and decryption of the transmission key. The fingerprint password key certificate is also used as the client's user certificate, which contains user region information, user identity information, and issuer identity information. The feature code of the client and the feature code of the server can be generated in the following way: extract the user area information S, user identity information L and issuer identity information CN from the certificate information of the fingerprint password key; perform a hash SM3 operation on the user area information S to obtain a first hash value HASH1; concatenate the user identity information L with the first hash value HASH1 and perform a hash SM3 operation to obtain a second hash value HASH2; concatenate the issuer identity information CN with the second hash value HASH2 and perform a hash SM3 operation to obtain a third hash value HASH3; concatenate the name of the system to be logged in by the user with the third hash value HASH3 and perform a hash SM3 operation to obtain a fourth hash value HASH4, and use the fourth hash value as the feature code.

[0201] In another specific example, the feature code of the client or server may be generated in the following manner:

[0202] Extract the user's region information S, user's identity information L and issuer's identity information CN from the certificate information of the fingerprint password key;

[0203] Get the name M of the system that the user wants to log in;

[0204] The user's regional information S, user's identity information L, issuer's identity information CN, and the name M of the system the user wants to log in are concatenated, and a hash SM3 operation is performed on the concatenated data to obtain a feature code.

[0205] In another embodiment, after the server uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, it uses the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1, and sends the server certificate, the first signature value Signdata1 and the second ciphertext data Cipher2 to the client. The client uses the root certificate to verify the received server certificate and the first signature value Signdata1. After the client passes the fingerprint authentication of the user input through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2, and sends the user certificate, the second signature value Signdata2 and the third ciphertext data Cipher3 to the server. The server uses the root certificate to verify the received user certificate and the second signature value Signdata2.

[0206] In a specific embodiment, the above-mentioned identity authentication system also includes: a data operation and writing device. The data operation and writing device is used to: when the user enters the user name and password for the first time to log in to the system, use the fingerprint information pre-stored in the fingerprint password key to verify the fingerprint currently entered by the user, and after the fingerprint verification is passed, obtain the serial number of the fingerprint password key; perform a first operation based on the serial number of the fingerprint password key to obtain the first data; use the master key of the fingerprint password key to encrypt the first data to obtain the first ciphertext; perform a second operation based on the serial number of the fingerprint password key to obtain the second data; use the first ciphertext to encrypt the second data to obtain the second ciphertext; use the second ciphertext as the encryption key to encrypt the user name and password to obtain the user ciphertext data; store the user ciphertext data in the fingerprint password key.

[0207] Among them, performing a first operation based on the serial number of the fingerprint password key to obtain the first data specifically includes: performing a hash operation on the serial number of the fingerprint password key and taking the first n bytes of data as initial data, and inverting the first m bytes of data of the initial data and then splicing them to obtain n bytes of first data.

[0208] Among them, performing a second operation based on the serial number of the fingerprint password key to obtain the second data specifically includes: performing a hash operation on the serial number of the fingerprint password key and taking the first n bytes of data as initial data, and inverting the last m bytes of data of the initial data and then splicing them to obtain n bytes of second data.

[0209] In a specific embodiment, the client obtains the user name and password of the user logging into the system from the fingerprint password key, including the following process: obtaining the serial number of the fingerprint password key; performing a first operation based on the serial number of the fingerprint password key to obtain first data; using the master key of the fingerprint password key to encrypt the first data to obtain a first ciphertext; performing a second operation based on the serial number of the fingerprint password key to obtain second data; using the first ciphertext to encrypt the second data to obtain a second ciphertext; obtaining the user ciphertext data from the fingerprint password key; using the second ciphertext as a decryption key to decrypt the user ciphertext data to obtain the user name and password.

[0210] In the identity authentication system provided in this embodiment, the specific process of storing the user name and password in the fingerprint password key and obtaining the user name and password from the fingerprint password key can be understood by referring to the specific examples in the aforementioned identity authentication method.

[0211] An embodiment of the present invention further provides a computer device, including: a memory and a processor, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned identity authentication method.

[0212] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the above-mentioned identity authentication method when executed by a processor.

[0213] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned identity authentication method is implemented.

[0214] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The schemes in the embodiments of the present invention may be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0215] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0216] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0217] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0218] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. An identity authentication method, applied to a client, characterized in that: The method comprises: Generate a first random number through a fingerprint password key, encrypt the first random number using a public key of the server preset by the client to obtain first ciphertext data, and send the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user name and password for logging into the system; The first random number is used to calculate and obtain a second key corresponding to the first key, the second key is used to decrypt the second ciphertext data from the server to obtain a second random number, the second random number is used to calculate and obtain a third key, and the third key and the second random number are used to perform encryption calculation to obtain third ciphertext data; the second ciphertext data is obtained by the server performing encryption calculation using the first key and the second random number, the second random number is generated by the server, and the first key is obtained by the server performing calculation using the first random number obtained by decrypting the first ciphertext data from the client using the private key of the server; The fingerprint entered by the user is authenticated by the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server; The transmission key is obtained by performing calculation using the first random number, the second random number and the characteristic code of the client, wherein the characteristic code of the client is obtained by performing encryption calculation using the certificate information of the fingerprint password key by the client; The user name and password for logging into the system are obtained from the fingerprint password key, the user name and password are encrypted using the transmission key to obtain the final ciphertext data, and the final ciphertext data is sent to the server for identity authentication.

2. The identity authentication method according to claim 1, characterized in that: The method further comprises: Use the root certificate to verify the server certificate and the first signature value from the server; The first signature value is obtained by the server using the first key and the second random number to perform encryption operation to obtain the second ciphertext data, and then using the private key in the signature key to sign the second ciphertext data; The server certificate and the first signature value are sent to the client simultaneously with the second ciphertext data.

3. The identity authentication method according to claim 2, characterized in that: The method further comprises: After the fingerprint entered by the user is authenticated through the fingerprint password key, the third ciphertext data is signed using the private key in the signature key to obtain the second signature value, and the user certificate, the second signature value and the third ciphertext data are sent to the server for verification. The user certificate is the certificate of the fingerprint password key.

4. The identity authentication method according to claim 1, characterized in that: The client's signature code is generated in the following manner: Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key; Performing a hash operation on the user region information to obtain a first hash value; The user identity information is concatenated with the first hash value and then hashed to obtain a second hash value; Concatenate the issuer identity information and the second hash value and perform a hash operation to obtain a third hash value; The name of the system that the user wants to log in to is concatenated with the third hash value and then subjected to a hash operation to obtain a fourth hash value, and the fourth hash value is used as the feature code.

5. The identity authentication method according to claim 1, characterized in that: The method further comprises: When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data; Store the user's ciphertext data in the fingerprint password key.

6. The identity authentication method according to claim 5, characterized in that: The method of obtaining the user name and password of the user logging into the system from the fingerprint password key includes: Get the serial number of the fingerprint password key; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Get user ciphertext data from fingerprint password key; The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

7. An identity authentication method, applied to a server, characterized in that: The method comprises: The first ciphertext data from the client is decrypted using the private key of the server to obtain a first random number, and the first key is obtained by using the first random number operation; the first ciphertext data is obtained by the client using the public key of the server preset by the client to encrypt the first random number generated by the fingerprint password key, the fingerprint password key is bound to the fingerprint information of the user, and the fingerprint password key stores the user name and password of the user logging into the system; Generate a second random number, use the first key and the second random number to perform encryption operation to obtain second ciphertext data, and send the second ciphertext data to the client; The fourth key corresponding to the third key of the client is obtained by using the second random number calculation, the third ciphertext data from the client is decrypted by using the fourth key to obtain the second random number, the second random number obtained by decryption is compared with the second random number generated by the server, and under the condition that the comparison result is consistent, the transmission key is obtained by using the first random number, the second random number and the feature code of the server to calculate; the feature code of the server is obtained by the server using the certificate information of the received fingerprint password key to perform encryption calculation; the third key is obtained by the client using the second key to decrypt the second ciphertext data from the server to calculate the second random number, and the second key is obtained by the client using the first random number calculation; the third ciphertext data is obtained by the client using the third key and the second random number to perform encryption calculation; the third ciphertext data is sent to the server after the fingerprint entered by the user is authenticated by the client through the fingerprint password key; The final ciphertext data from the client is decrypted using the transmission key to obtain the user name and password, and the user name and password are searched in the server's database. When the user name and password are found, it is determined that the identity authentication of the user logging into the system is successful; the final ciphertext data is obtained by the client obtaining the user name and password of the user logging into the system from the fingerprint password key, and encrypting the user name and password using the client's transmission key.

8. The identity authentication method according to claim 7, characterized in that: The method further comprises: After using the first key and the second random number to perform encryption operation to obtain the second ciphertext data, use the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and at the same time send the server certificate, the first signature value and the second ciphertext data to the client for verification; Verify the user certificate and the second signature value from the client using the root certificate, wherein the user certificate is a certificate of the fingerprint cryptographic key; The second signature value is obtained by signing the third ciphertext data using the private key in the signature key after the fingerprint entered by the user is authenticated by the client through the fingerprint password key; The user certificate and the second signature value are sent to the server simultaneously with the third ciphertext data.

9. The identity authentication method according to claim 7, characterized in that: The feature code of the server is generated in the following way: Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key; Performing a hash operation on the user region information to obtain a first hash value; The user identity information is concatenated with the first hash value and then hashed to obtain a second hash value; Concatenate the issuer identity information and the second hash value and perform a hash operation to obtain a third hash value; The name of the system that the user wants to log in to is concatenated with the third hash value and then subjected to a hash operation to obtain a fourth hash value, and the fourth hash value is used as the feature code.

10. The identity authentication method according to claim 7, characterized in that: The method further comprises: When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data; Store the user's ciphertext data in the fingerprint password key.

11. The identity authentication method according to claim 10, characterized in that: The client obtains the user name and password for logging into the system from the fingerprint password key, including: Get the serial number of the fingerprint password key; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Get user ciphertext data from fingerprint password key; The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

12. An identity authentication method, applied to a client and a server, characterized in that: The method comprises: The client generates a first random number through a fingerprint password key, encrypts the first random number using a public key of the server preset by the client to obtain first ciphertext data, and sends the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user name and password for the user to log in to the system; The server uses the private key of the server to decrypt the received first ciphertext data to obtain a first random number, and uses the first random number to calculate to obtain a first key; the server generates a second random number, uses the first key and the second random number to perform encryption calculation to obtain second ciphertext data, and sends the second ciphertext data to the client; The client uses the first random number operation to obtain a second key corresponding to the first key, uses the second key to decrypt the received second ciphertext data to obtain a second random number, uses the second random number operation to obtain a third key, and uses the third key and the second random number to perform encryption operation to obtain third ciphertext data; The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server. The client uses the first random number, the second random number and the client's characteristic code to perform calculations to obtain a transmission key, wherein the client's characteristic code is obtained by performing encryption calculations on the client using the certificate information of the fingerprint password key; The client obtains the user name and password for logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server; The server uses the second random number to calculate and obtain a fourth key corresponding to the third key, uses the fourth key to decrypt the received third ciphertext data to obtain a second random number, compares the decrypted second random number with the second random number generated by the server, and, if the comparison result is consistent, uses the first random number, the second random number and the feature code of the server to calculate and obtain the transmission key, wherein the feature code of the server is obtained by the server through encryption calculation using the certificate information of the received fingerprint password key; The server uses the transmission key to decrypt the received final ciphertext data to obtain the user name and password, and searches for the user name and password in the server's database. If the user name and password are found, it is determined that the user's identity authentication for logging into the system is successful.

13. The identity authentication method according to claim 12, characterized in that: The method further comprises: After the server uses the first key and the second random number to perform encryption operation to obtain the second ciphertext data, it uses the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and sends the server certificate, the first signature value and the second ciphertext data to the client at the same time; The client verifies the received server certificate and the first signature value using the root certificate.

14. The identity authentication method according to claim 13, characterized in that: The method further comprises: After the fingerprint entered by the user is authenticated by the fingerprint password key, the client uses the private key in the signature key to sign the third ciphertext data to obtain the second signature value, and sends the user certificate, the second signature value and the third ciphertext data to the server at the same time. The user certificate is the certificate of the fingerprint password key; The server uses the root certificate to verify the received user certificate and the second signature value.

15. The identity authentication method according to claim 12, characterized in that: The client's feature code and the server's feature code are generated in the following manner: Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key; Performing a hash operation on the user region information to obtain a first hash value; The user identity information is concatenated with the first hash value and then hashed to obtain a second hash value; Concatenate the issuer identity information and the second hash value and perform a hash operation to obtain a third hash value; The name of the system that the user wants to log in to is concatenated with the third hash value and then subjected to a hash operation to obtain a fourth hash value, and the fourth hash value is used as the feature code.

16. The identity authentication method according to claim 12, characterized in that: The client's feature code and the server's feature code are generated in the following manner: Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key; Get the name of the system the user wants to log in to; The user's regional information, user identity information, issuer identity information, and the name of the system the user wants to log in are concatenated, and a hash operation is performed on the concatenated data to obtain a feature code.

17. The identity authentication method according to claim 12, characterized in that: The user name and password for logging into the system are stored in the fingerprint password key, including: When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data; Store the user's ciphertext data in the fingerprint password key.

18. The identity authentication method according to claim 17, characterized in that: The first operation based on the serial number of the fingerprint password key to obtain the first data includes: After performing a hash operation on the serial number of the fingerprint password key, the first n bytes of data are taken as the initial data, and the first m bytes of data of the initial data are reversed and concatenated to obtain the first data of n bytes, where m<n; The second operation based on the serial number of the fingerprint password key to obtain the second data includes: After performing a hash operation on the serial number of the fingerprint password key, the first n bytes of data are taken as initial data, and the last m bytes of data of the initial data are inverted and concatenated to obtain n bytes of second data, where m<n.

19. The identity authentication method according to claim 17, characterized in that: The client obtains the user name and password for logging into the system from the fingerprint password key, including: Get the serial number of the fingerprint password key; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Get user ciphertext data from fingerprint password key; The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

20. An identity authentication system, characterized in that: include: Fingerprint password key, client and server; The fingerprint password key is bound to the user's fingerprint information, and the fingerprint password key stores the user's username and password for logging into the system; The client generates a first random number using the fingerprint password key, encrypts the first random number using the public key of the server preset by the client to obtain first ciphertext data, and sends the first ciphertext data to the server; The server uses the private key of the server to decrypt the received first ciphertext data to obtain a first random number, and uses the first random number to calculate to obtain a first key; The server generates a second random number, performs encryption operation using the first key and the second random number to obtain second ciphertext data, and sends the second ciphertext data to the client; The client uses the first random number operation to obtain a second key corresponding to the first key, uses the second key to decrypt the received second ciphertext data to obtain a second random number, uses the second random number operation to obtain a third key, and uses the third key and the second random number to perform encryption operation to obtain third ciphertext data; The client uses the fingerprint password key to authenticate the fingerprint entered by the user. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server. The client uses the first random number, the second random number and the client's characteristic code to perform calculations to obtain a transmission key, wherein the client's characteristic code is obtained by performing encryption calculations on the client using the certificate information of the fingerprint password key; The client obtains the user name and password for logging into the system from the fingerprint password key, encrypts the user name and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server; The server uses the second random number to calculate and obtain a fourth key corresponding to the third key, uses the fourth key to decrypt the received third ciphertext data to obtain a second random number, compares the decrypted second random number with the second random number generated by the server, and, if the comparison result is consistent, uses the first random number, the second random number and the feature code of the server to calculate and obtain the transmission key, wherein the feature code of the server is obtained by the server through encryption calculation using the certificate information of the received fingerprint password key; The server uses the transmission key to decrypt the received final ciphertext data to obtain the user name and password, and searches for the user name and password in the server's database. If the user name and password are found, it is determined that the user's identity authentication for logging into the system is successful.

21. The identity authentication system according to claim 20, characterized in that: After the server uses the first key and the second random number to perform encryption operation to obtain the second ciphertext data, it uses the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and sends the server certificate, the first signature value and the second ciphertext data to the client at the same time; The client verifies the received server certificate and the first signature value using the root certificate.

22. The identity authentication system according to claim 21, characterized in that: After the fingerprint entered by the user is authenticated by the fingerprint password key, the client uses the private key in the signature key to sign the third ciphertext data to obtain the second signature value, and sends the user certificate, the second signature value and the third ciphertext data to the server at the same time, where the user certificate is the certificate of the fingerprint password key; The server verifies the received user certificate and the second signature value using the root certificate.

23. The identity authentication system according to claim 20, characterized in that: The client's feature code and the server's feature code are generated in the following manner: Extract user region information, user identity information and issuer identity information from the certificate information of the fingerprint password key; Performing a hash operation on the user region information to obtain a first hash value; The user identity information is concatenated with the first hash value and then hashed to obtain a second hash value; Concatenate the issuer identity information and the second hash value and perform a hash operation to obtain a third hash value; The name of the system that the user wants to log in to is concatenated with the third hash value and then subjected to a hash operation to obtain a fourth hash value, and the fourth hash value is used as the feature code.

24. The identity authentication system according to claim 20, characterized in that: Also includes: Data operation writing device; The data operation writing device is used for: When the user enters the username and password for the first time to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the user name and password to obtain user ciphertext data; Store the user's ciphertext data in the fingerprint password key.

25. The identity authentication system according to claim 24, characterized in that: The first operation is performed based on the serial number of the fingerprint password key to obtain the first data, including: After performing a hash operation on the serial number of the fingerprint password key, the first n bytes of data are taken as initial data, and the first m bytes of data of the initial data are reversed and concatenated to obtain n bytes of first data.

26. The identity authentication system according to claim 24, characterized in that: The second operation is performed based on the serial number of the fingerprint password key to obtain the second data, including: After performing a hash operation on the serial number of the fingerprint password key, the first n bytes of data are taken as initial data, and the last m bytes of data of the initial data are inverted and concatenated to obtain n bytes of second data.

27. The identity authentication system according to claim 24, characterized in that: The client obtains the user name and password for logging into the system from the fingerprint password key, including: Get the serial number of the fingerprint password key; Performing a first operation based on the serial number of the fingerprint password key to obtain first data; Using the master key of the fingerprint cryptographic key to perform encryption operation on the first data to obtain a first ciphertext; Performing a second operation based on the serial number of the fingerprint password key to obtain second data; Using the first ciphertext to perform encryption operation on the second data to obtain a second ciphertext; Get user ciphertext data from fingerprint password key; The second ciphertext is used as the decryption key to decrypt the user ciphertext data to obtain the user name and password.

28. A computer device, characterized in that: include: a memory storing a computer program; A processor, configured to execute the computer program to implement the identity authentication method according to any one of claims 1 to 19.

29. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the identity authentication method according to any one of claims 1 to 19.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the identity authentication method according to any one of claims 1 to 19.

Images