Multiple authentication identity authentication method, identity authentication device and identity authentication system

Abstract

The present invention provides a multi-authentication identity authentication method, identity authentication device, and identity authentication system. The multi-authentication identity authentication method obtains and outputs multiple authentication encryption information to each terminal based on the authentication device, so as to meet the application requirements of different authentication judgment pass conditions of different terminals, and effectively provide a convenient and safe identity authentication method. The identity authentication device effectively improves the portability and security of the device by setting up a non-built-in power supply. The identity authentication system, by combining the application of the identity authentication method and identity authentication device, and by setting up a terminal with a multi-authentication mechanism, effectively sets different security levels for applications according to different application situations, meets the flexibility requirements of identity authentication, and ensures the security requirements of the system.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to an identity authentication method, identity authentication equipment and an identity authentication system with multiple authentications. Background Art

[0002] In the prior art, there are various identity authentication methods, such as password-based (withdrawal password, account login password, etc.), biometric information (fingerprint, iris, sound wave, vein information, etc.), and physical information (key, smart card, NFC, etc.) verification applications; however, password-based verification is easily obtained by others through recording, monitoring, etc., and has low security; biometric information verification may be cracked by simulation and copying, and biometric information is mainly stored by a single department or terminal, and needs to be repeatedly entered when applied to different terminals, which is inconvenient to use; physical information verification is easily copied or stolen, or the application becomes invalid due to the loss of the corresponding verification tool; in summary, each identity authentication method in the prior art has certain technical defects, and the verification method has certain risks.

[0003] To this end, a multi-authentication identity authentication method, identity authentication device and identity authentication system can be designed to meet the user's needs for convenient and secure identity authentication. Summary of the invention

[0004] The purpose of the present invention is to provide a multi-authentication identity authentication method, identity authentication device and identity authentication system in order to overcome the deficiencies of the prior art.

[0005] The multi-factor authentication method includes the following steps:

[0006] S1. The verification device obtains original information, where the original information includes biological information, physical information, and mixed information, where the mixed information is a combination of the physical information and the biological information;

[0007] S2. The data storage network stores authentication encryption information. The terminal is linked to the data storage network to synchronize and obtain the authentication encryption information. Each terminal selects the corresponding authentication encryption information as the authentication pass condition based on its own security level setting.

[0008] S3, converting and encrypting the original information to generate verification encrypted information corresponding to the original information;

[0009] S4. The terminal obtains all the verification encryption information and selects and compares the verification encryption information according to the authentication judgment pass condition; when the selection and comparison results match, it is determined that the authentication is passed.

[0010] The application principle is as follows:

[0011] Each terminal should have a different authentication encryption information combination set according to its authentication judgment pass conditions, and obtain the corresponding authentication encryption information through the data storage network; multiple original information are obtained through the verification device, and each original information is converted and encrypted into a one-to-one corresponding verification encryption information. All the verification encryption information is obtained by the terminal at the same time, so that the different authentication judgment pass conditions of each terminal can select the input verification encryption information for authentication as needed, so that a single verification device can meet the authentication requirements of different authentication encryption information combinations in different terminals.

[0012] The one-to-one corresponding verification encryption information, that is, physical information conversion generates corresponding physical verification encryption information, biometric information conversion generates corresponding biometric conversion encryption information, and mixed information conversion generates corresponding mixed conversion encryption information, so as to meet the needs of identity authentication.

[0013] Furthermore, the verification device has independent physical information, and the step S1 includes the following steps:

[0014] S1-1, input biometric information into the verification device for identification and authentication;

[0015] S1-2, when the identification authentication is passed, the verification device obtains and records the biometric information;

[0016] S1-3. Process the biological information and physical information to generate mixed information, and record the mixed information.

[0017] First, the user inputs his or her specific biometric information into the biometric recognition module in the verification device to perform the first level of identification and authentication. After the identification and authentication is passed, the input biometric information is obtained and recorded. The verification device then contains biometric information, physical information, and mixed information generated by the biometric information and physical information, thereby meeting the flexibility requirements of identity authentication.

[0018] The independent physical information possessed by the verification device, that is, the unique physical information recorded in different verification devices respectively, is specifically selected to be applied as an independent digital certificate.

[0019] Furthermore, the data storage network is a blockchain network or a server network or a cloud storage network, which meets the needs of each terminal to effectively select and obtain corresponding authentication encryption information.

[0020] Furthermore, the terminal is set with independent identification information, and according to the authentication pass conditions of each terminal, the terminal binds the identification information to the corresponding authentication encryption information in the data storage network; during authentication, each terminal searches, selects and obtains the bound authentication encryption information in the data storage network based on its own identification information.

[0021] By binding the authentication encryption information in the data storage network with identification information, each terminal can quickly screen and find the bound authentication encryption information from the data storage network according to its independent identification information, synchronize and obtain it, thereby effectively improving the authentication speed.

[0022] The independent identification information set by the terminal, that is, the unique identification information set for different terminals respectively, is to meet the need of binding authentication encryption information.

[0023] Furthermore, the authentication judgment pass condition is generated by converting and encrypting authentication encryption information generated by a single authentication information; or multiple authentication encryption information is generated by converting and encrypting multiple authentication information (the authentication encryption information corresponds to the authentication information one by one), and is generated after a logical AND operation or a logical OR operation; the authentication information includes physical authentication information or biometric authentication information or mixed authentication information that can identify the user's identity; the verification encryption information is selected and compared for authentication through the authentication judgment pass condition to meet the need of applying the authentication method to different security level settings of each terminal.

[0024] The present invention also provides an identity authentication device applied to the multiple-authentication identity authentication method, comprising a biometric recognition module for acquiring external biometric information, a read-only storage unit recording independent physical information, a temporary storage unit, a processing unit and a data transmission module; the output end of the biometric recognition module is connected to the first input end of the processing unit; the output end of the read-only storage unit is connected to the second input end of the processing unit; the first output end of the processing unit is connected to the input end of the temporary storage unit, the second output end of the processing unit is connected to the data transmission module, and the output end of the temporary storage unit is connected to the data transmission module.

[0025] Here’s how it works:

[0026] The biometric identification module is used to identify and process biometric information; and the independent physical information of the identity authentication device, such as a digital certificate, is stored in a read-only storage unit; when in use, external specific biometric information is obtained through the biometric identification module, such as inputting iris information to obtain iris information, inputting fingerprint information to obtain fingerprint information, etc.; and the processing unit mixes the specific biometric information and physical information to generate mixed information, and the specific biometric information, physical information and mixed information are stored in a temporary storage unit. Under the control of the processing unit, the data transmission module outputs the various information stored in the temporary storage unit.

[0027] Furthermore, the biometric recognition module includes: at least one of: a fingerprint recognition module, a facial recognition module, an iris recognition module, a vein recognition module, and a palm print recognition module.

[0028] Furthermore, the read-only storage unit or temporary storage unit includes at least one of RAM, ROM, FlashROM, EEPROM, and DDR.

[0029] Furthermore, the processing unit includes: at least one of an MCU, a CPU, and a DSP.

[0030] Furthermore, the data transmission module is optionally applied as an electrical signal conversion module to convert the information stored in the temporary storage unit into a readable current, connect and send the readable current to the terminal for reading; or it can be optionally applied as at least one of a communication network module, an NFC module, a Bluetooth module, an RFID module, a WiFi module or a zigbee module to meet the need of the data transmission module to wirelessly transmit the information of the temporary storage unit to the terminal.

[0031] The present invention also provides an identity authentication system, including a verification device and a terminal, and the identity authentication system performs authentication through the multiple authentication identity authentication method as described above.

[0032] Furthermore, in the identity authentication system, the verification device is the identity authentication device described above to meet the requirement that the identity authentication system applies the multiple authentication identity authentication method.

[0033] Furthermore, the terminal includes a power supply unit, and a power supply output end of the power supply unit is connected to power input ends of the biometric recognition module, the read-only storage unit, the temporary storage unit, the processing unit, and the data transmission module.

[0034] The identity authentication device does not have a power supply, which can correspondingly improve the portability of the device; and when connected to the terminal application, the power supply unit of the terminal is used to power its own unit modules. Under the premise of the application of the identity authentication device, after each use, its temporary storage unit is restored to its initial state due to power cutoff to clear the output recorded information, thereby effectively improving the security of the identity authentication device.

[0035] Furthermore, the terminal includes an encryption unit, the input end of the encryption unit is connected to the output end of the data transmission module, the output end of the encryption unit is connected to a terminal processing unit, and the terminal processing unit is wirelessly connected to a data storage network; through the application of the encryption unit, various original information input by the identity authentication device is effectively encrypted to meet the requirements of converting and encrypting the original information.

[0036] Furthermore, the terminal processing unit includes a data processing module and a terminal data receiving module connected to the data processing module, the data processing module includes at least one of MCU, CPU, and DSP; the terminal data receiving module is connected to the encryption unit, and the terminal data receiving module is connected to the data storage network; to meet the needs of the terminal to effectively select and obtain corresponding authentication encryption information.

[0037] The beneficial effects of the present invention compared with the prior art are:

[0038] 1. The multi-authentication identity authentication method outputs multiple verification encrypted information to each terminal at the same time to meet the application requirements of different authentication judgment pass conditions of different terminals, and effectively provides a convenient and safe identity authentication method.

[0039] 2. The multi-authentication identity authentication method uses a verification device with identification authentication to first perform a preliminary identification and authentication confirmation on the user's identity, thereby effectively reducing the number of communication applications of the verification device and increasing the authentication speed.

[0040] 3. The multi-authentication identity authentication method is applied to the blockchain network, so that any terminal connected to the blockchain network can synchronize data from the blockchain, so as to solve the shortcoming of the prior art that different terminals need to repeatedly enter data.

[0041] 4. The identity verification device, by not having a built-in power supply, effectively improves the portability and security of the device.

[0042] 5. The identity authentication system, by combining the application of the identity authentication method and the identity authentication device, and by setting up a terminal with a multiple authentication mechanism, can effectively set different security levels for applications according to different application situations, thereby meeting the flexibility needs of identity authentication while ensuring the security needs of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic diagram of the combination of the identity authentication system in the present invention;

[0044] Explanation of the reference numerals: 1-biometric recognition module, 2-read-only storage unit, 3-temporary storage unit, 4-processing unit, 5-data transmission module, 6-power supply unit, 7-terminal processing unit, 71-data processing module, 72-terminal data receiving module, 8-encryption unit. DETAILED DESCRIPTION

[0045] The multi-authentication identity authentication method of the present invention is combined with an identity authentication device to be set and applied in an identity authentication system.

[0046] Specifically, the identity authentication system includes a verification device 10 and multiple terminals 20, the verification device includes a biometric recognition module 1 for acquiring external biometric information, a read-only storage unit 2 recording independent physical information, a temporary storage unit 3, a processing unit 4 and a data transmission module 5; the output end of the biometric recognition module 1 is connected to the first input end of the processing unit 4; the output end of the read-only storage unit 2 is connected to the second input end of the processing unit 4; the first output end of the processing unit 4 is connected to the input end of the temporary storage unit 3, the second output end of the processing unit 4 is connected to the data transmission module 5, and the output end of the temporary storage unit 3 is connected to the data transmission module 5.

[0047] The biometric recognition module 1 is selected as a fingerprint recognition module and an iris recognition module, the read-only storage unit 2 is selected as a ROM, and the temporary storage unit 3 is selected as a Flash ROM; the processing unit 4 is selected as a CPU, and the data transmission module 5 is selected as an electrical signal conversion module.

[0048] The terminal includes a power supply unit 6, the power supply output end of the power supply unit 6 is connected to the power input end of the biometric module 1, the read-only storage unit 2, the temporary storage unit 3, the processing unit 4 and the data transmission module 5; the terminal also includes an encryption unit 88, the input end of the encryption unit 88 is connected to the output end of the data transmission module 5, the output end of the encryption unit 88 is connected to the terminal processing unit 7, and the terminal processing unit 7 is wirelessly connected to the data storage network.

[0049] The data storage network is preferably selected as a blockchain network.

[0050] The terminal processing unit 7 includes a data processing module 71 and a terminal data receiving module 72 connected to the data processing module 71 . The terminal data receiving module 72 is connected to the encryption unit 8 . The terminal data receiving module 72 is connected to the data storage network.

[0051] Here’s how it works:

[0052] The user inserts the verification device into the terminal, and the power supply unit 6 of the terminal outputs power and starts the verification device; the user inputs his biometric information into the biometric recognition module 1 for identification and authentication. If the identification and authentication fails, an error message is fed back to end the verification procedure; when the identification and authentication is passed, the biometric information is acquired and recorded, and the read-only storage unit 2 records the unique physical information of the verification device, and the physical information is a digital certificate. The processing unit 4 mixes the physical information and the biometric information to generate mixed information. The processing unit 4 stores the physical information, biometric information and mixed information in the temporary storage unit 3, and outputs them to the terminal through the data transmission module 5.

[0053] The terminal encrypts the input original information through the encryption unit 8 to generate verification encryption information; and in response to its different security level settings, the terminal synchronizes and obtains specific authentication encryption information in the data storage network through the terminal data receiving module 72 as an authentication pass condition, and under the application of the data processing module 71, the input verification encryption information is selected and compared with the authentication pass condition in the terminal for authentication; after the authentication is completed, the verification device can be disconnected from the terminal, and the power in the verification device is exhausted, and the temporary storage unit 3 automatically returns to its initial state.

[0054] Specifically, the multi-authentication identity authentication method of the present invention comprises the following steps:

[0055] S1. The verification device obtains original information, where the original information includes biological information, physical information, and mixed information, where the mixed information is a combination of the physical information and the biological information;

[0056] S2. The data storage network stores authentication encryption information. The terminal is linked to the data storage network to synchronize and obtain the authentication encryption information. Each terminal selects the corresponding authentication encryption information as the authentication pass condition based on its own security level setting.

[0057] S3, converting and encrypting the original information to generate verification encrypted information corresponding to the original information;

[0058] S4. The terminal obtains all the verification encryption information and selects and compares the verification encryption information according to the authentication judgment pass condition; when the selection and comparison results match, it is determined that the authentication is passed.

[0059] Wherein, the step S1 includes the following steps:

[0060] S1-1, input biometric information into the verification device for identification and authentication;

[0061] S1-2, when the identification authentication is passed, the verification device obtains and records the biometric information;

[0062] S1-3. Process the biological information and physical information to generate mixed information, and record the mixed information.

[0063] The terminal is set with independent identification information. According to the authentication pass conditions of each terminal, the terminal binds the identification information to the corresponding authentication encryption information in the data storage network. During authentication, each terminal searches, selects and obtains the bound authentication encryption information in the data storage network based on its own identification information.

[0064] The authentication pass condition is generated by converting and encrypting a single authentication information; or by converting and encrypting a plurality of authentication information and generating a plurality of corresponding authentication encrypted information, which are generated after a logic AND operation or a logic OR operation; the authentication information includes physical authentication information or biometric authentication information or mixed authentication information that can identify the user's identity.

[0065] The application principle is as follows:

[0066] The user will encrypt and convert data such as physical authentication information and biometric authentication information that can identify his or her user identity, as well as mixed authentication information of a specific combination of physical authentication information and biometric authentication information, to generate corresponding authentication encryption information (for example, when the data storage network is a blockchain network, it is hash conversion encryption), and upload it to the data storage network. Each terminal will synchronize with the data storage network in response to its own security level setting needs and obtain the corresponding authentication encryption information as a condition for authentication pass.

[0067] If it is to be used in situations with a low security level, such as public transportation payment, the terminal is set to only need to authenticate the physical information of the verification device (such as the unique digital certificate in the verification device) or biometric information (the user's fingerprint or iris information). When the verification device outputs the correct physical information or biometric information, the first-level security authentication is passed;

[0068] Specifically, if applied to public transportation payment, the payment terminal synchronizes and obtains the biometric authentication information of all eligible elderly people in the city. The user holds a corresponding verification device (such as a bus card), or the user holds any verification device to output his or her biometric information that meets the payment terminal's authentication requirements. In this way, the authentication of the terminal can be effectively passed.

[0069] If it is to be used in occasions with general security level, such as door lock access control, email login, etc.; the terminal is set to authenticate the physical information and biometric information of the verification device at the same time. If the physical information and biometric information output by the verification device are correct, the second-level security authentication is passed;

[0070] Specifically, if applied to home door locks; the door lock terminal synchronizes and obtains the physical information of the verification device that records all family members and their various biometric information. Then, when the user holds a verification device that can input iris information and fingerprint information, the user can enter iris information or any fingerprint information and pass the verification device's identification and authentication. The physical information and biometric information output by the verification device must match the records of the door lock terminal before the terminal authentication is valid.

[0071] If it is to be used in occasions with a high security level, such as laboratories, databases, etc., the terminal is set to generate mixed information based on the specific physical information of the verification device and the specific biometric information to be authenticated (such as the unique digital certificate output by the user's single verification device and the user's specific left thumb fingerprint). If the specific physical information and specific biometric information output by the verification device are correct, the third-level security authentication is passed.

[0072] Specifically, if applied to a database, the database door terminal synchronizes and obtains the user's specific biometric information (left thumb fingerprint information) and the physical information of his verification device (digital certificate); when the user holds a verification device that can input iris information and fingerprint information, if the user enters his iris information and passes the verification device recognition and authentication, the output information of his verification device cannot pass the terminal authentication. Only when the user enters his left thumb fingerprint information and passes the verification device recognition and authentication, the output information of his verification device can effectively pass the terminal authentication.

[0073] If it is to be used in occasions with extremely high security levels, such as safes, banking services, etc., the terminal is set to simultaneously authenticate the physical information, biometric information and mixed information of the verification device (such as the need to input the digital certificate of the verification device held by an ordinary user and its corresponding biometric information, plus the mixed information of a specific user). When the physical information and biometric information output by the verification device of the ordinary user are combined with the specific physical information and specific biometric information output by the verification device held by the specific user and are correct, the fourth-level security authentication is passed.

[0074] Specifically, during the processing of banking services, the teller terminal synchronizes and obtains records of the physical information and biometric information of all users and the specific physical information and specific biometric information of the bank staff; when authentication with a level 4 security authentication terminal is required, the user must authenticate with his or her corresponding biometric information through his or her verification device, and then the bank staff must authenticate with their specific biometric information through their specific verification device. The authentication is only valid when all the information obtained by the terminal is correct.

[0075] The above description is only a preferred embodiment of the present invention. Those skilled in the art can still modify the embodiment without departing from the implementation principle of the present invention, and the corresponding modified scheme should also be regarded as the protection scope of the present invention.

Claims

1. A multi-authentication identity authentication method, characterized in that: The following steps are involved: S1. The verification device obtains original information, wherein the original information includes multiple biological information, multiple physical information, and mixed information, wherein the mixed information is composed of a combination of specific physical information and specific biological information; S2. The data storage network stores authentication encryption information. The terminal is linked to the data storage network to synchronize and obtain the authentication encryption information. Each terminal selects the corresponding authentication encryption information as the authentication pass condition based on its own security level setting. S3, converting and encrypting the original information to generate verification encrypted information corresponding to the original information; S4, the terminal obtains all the verification encryption information and selects and compares the verification encryption information for authentication under the authentication judgment pass condition; when the selection and comparison results match, it is determined that the authentication is passed; The terminal is set with independent identification information, and according to the authentication judgment pass condition of each terminal, the terminal binds the identification information to the corresponding authentication encryption information in the data storage network; during authentication, each terminal searches, selects and obtains the bound authentication encryption information in the data storage network based on its own identification information; The authentication judgment pass condition is a plurality of authentication encrypted information corresponding to each other generated by converting and encrypting a plurality of authentication information, and generated after a logic AND operation or a logic OR operation; the authentication information includes physical authentication information, biometric authentication information and mixed authentication information that can identify the identity of the user; Wherein, the verification device has independent physical information, and the step S1 comprises the following steps: S1-1, input biometric information into the verification device for identification and authentication; S1-2, when the identification authentication is passed, the verification device obtains and records the biometric information; S1-3. Process the biological information and physical information to generate mixed information, and record the mixed information.

2. The multi-authentication identity authentication method according to claim 1, characterized in that: The data storage network is a blockchain network, a server network, or a cloud storage network.

3. An identity verification device applied to the identity verification method of multiple authentications as claimed in claim 1, characterized in that: It includes a biometric identification module for acquiring external biological information, a read-only storage unit recording independent physical information, a temporary storage unit, a processing unit and a data transmission module; the output end of the biometric identification module is connected to the first input end of the processing unit; the output end of the read-only storage unit is connected to the second input end of the processing unit; the first output end of the processing unit is connected to the input end of the temporary storage unit, the second output end of the processing unit is connected to the data transmission module, and the output end of the temporary storage unit is connected to the data transmission module.

4. An identity authentication system, including a verification device and a terminal, characterized in that: Authentication is performed using the multiple authentication method as described in any one of claims 1 to 2.

5. The identity authentication system as claimed in claim 4, characterized in that: The verification device is the identity verification device as claimed in claim 3.

6. The identity authentication system as claimed in claim 5, characterized in that: The terminal includes a power supply unit, and a power supply output end of the power supply unit is connected to power supply input ends of the biometric recognition module, the read-only storage unit, the temporary storage unit, the processing unit, and the data transmission module.

7. The identity authentication system as claimed in claim 5, characterized in that: The terminal comprises an encryption unit, the input end of the encryption unit is connected to the output end of the data transmission module, the output end of the encryption unit is connected to a terminal processing unit, and the terminal processing unit is wirelessly connected to a data storage network.

Images