A digital certificate installation verification method and device

Abstract

The embodiment of the present invention provides a verification method and device for installing a digital certificate. The method includes a server receiving a verification request from a client, determining whether the terminal is a common device based on device information, and if so, verifying the SMS verification code, and after determining that the SMS verification code is successfully verified, determining whether the user identification card number of the terminal is consistent with the number for receiving the SMS verification code, and if so, issuing the digital certificate requested by the client to the client so that the client can install the digital certificate. Since even if the criminals obtain the SMS verification code, they will send the correct user identification card number to the server because they cannot obtain the user's mobile phone card, causing the server to verify that the user identification card number of the terminal is inconsistent with the number for receiving the SMS verification code, and therefore will not issue the digital certificate to the client, which can effectively prevent the risk of the digital certificate being counterfeited and installed by criminals, thereby improving the security of verification during the installation of the digital certificate.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of financial technology (Fintech), and in particular to a method and device for verifying the installation of a digital certificate. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. Traditional finance is gradually transforming to financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. In the financial field, mobile APP has become an important business channel for major financial institutions. A large number of transfer transactions are carried out on mobile APP. In order to control the security risks of large transfers, the use of digital certificates to perform security encryption and other verifications on large transfers to ensure the security of transfer transactions has become an indispensable part.

[0003] The existing digital certificate installation verification method mainly involves the application client sending a request to download the digital certificate to the server, and the server sending the verification factor (SMS verification code, transaction password, ID number or bank card number, etc.) to the client. After the user fills in the verification factor, it is sent to the server for verification. If the server passes the verification, it can send the digital certificate to the client so that the client can install it. However, in the process of sending the verification factor and verifying the verification factor on the server, it is extremely easy for criminals to steal it through Trojans or phishing attacks, resulting in the entire verification process being breached and the verification being invalid. The security of the verification during the digital certificate installation process cannot be guaranteed, which can easily lead to the theft of large amounts of user funds.

[0004] In summary, there is an urgent need for a digital certificate installation verification method to solve the problem of low security of verification during the digital certificate installation process in the prior art. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for verifying the installation of a digital certificate, so as to solve the problem of low security of verification in the process of installing a digital certificate in the prior art.

[0006] In a first aspect, an embodiment of the present invention provides a method for verifying the installation of a digital certificate, comprising:

[0007] The server receives a verification request from the client; the verification request includes a text message verification code and device information of the terminal where the client is located;

[0008] The server determines whether the terminal is a common device based on the device information, and if so, verifies the SMS verification code, and after determining that the SMS verification code verification is successful, determines whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code;

[0009] If so, the server sends the digital certificate requested by the client to the client, so that the client installs the digital certificate.

[0010] In the above technical solution, when the terminal is determined to be a commonly used device based on the device information, the SMS verification code is verified. After determining that the SMS verification code is successfully verified, it is determined whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code. When it is determined that the user identification card number of the terminal is consistent with the number receiving the SMS verification code, the digital certificate requested by the client is sent to the client so that the client can install the digital certificate. Since the user identification card number comparison method is adopted on the basis of determining that the user's terminal is a commonly used device, the interaction and verification between the commonly used device identification and the user identification card number comparison can be effectively improved, and the security of the verification during the digital certificate installation process can be ensured. In addition, during the SMS verification process, since the user identification card number is not easy to forge and cannot be controlled by criminals, even if criminals obtain the SMS verification code through Trojans or phishing, they will not be able to send the correct user identification card number to the server because they cannot obtain the user's mobile phone card, causing the server to verify that the user identification card number of the terminal is inconsistent with the number received for the SMS verification code. Therefore, the digital certificate will not be sent to the client, which can effectively prevent the risk of digital certificates being counterfeited and installed by criminals, thereby improving the security of verification during the installation of digital certificates, and further solving the problem of low security of verification during the installation of digital certificates in the prior art.

[0011] Optionally, the method further comprises:

[0012] When the server determines that the terminal is an uncommon device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, the server performs face recognition verification on the user of the terminal;

[0013] When the server determines that the face recognition verification is successful, the server sends the digital certificate to the client so that the client installs the digital certificate.

[0014] In the above technical solution, when it is determined that the terminal is not a common device or the SMS verification code verification fails or the terminal's user identification card number is inconsistent with the number receiving the SMS verification code, the user of the terminal is verified by face recognition, and when it is determined that the face recognition verification is successful, the digital certificate is sent to the client so that the client can install the digital certificate. Since verification is performed by using common device identification, user identification card number comparison and face recognition verification at the same time, the interaction and verification between common device identification, user identification card number comparison and face recognition verification can be effectively improved, and the security of verification during the installation of digital certificates can be improved, which also reflects the high efficiency and flexibility of the execution of verification during the installation of digital certificates.

[0015] Optionally, performing face recognition verification on the user of the terminal includes:

[0016] The server sends a face recognition verification request to the client, so that the client collects a face image of the user;

[0017] The server receives the facial image of the user sent by the client, compares the facial image of the user with the facial image of the corresponding user stored locally, and determines a similarity value between the facial image of the user and the facial image of the corresponding user stored locally;

[0018] If the similarity value is greater than a first preset threshold, the server determines that the face recognition verification is successful, otherwise it determines that the face recognition verification is unsuccessful.

[0019] In the above technical solution, when it is determined that the terminal is not a common device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number of the received SMS verification code, the face recognition verification can reflect the flexibility of the verification during the digital certificate installation process and further ensure the security of the verification during the digital certificate installation process. In addition, by receiving the user's face image collected by the client, the user's face image is compared with the face image of the corresponding user stored locally, and when it is determined that the similarity value between the user's face image and the face image of the corresponding user stored locally is greater than the first preset threshold, it is determined that the face recognition verification is successful, which can avoid the lack of security due to the low similarity value.

[0020] Optionally, the method further comprises:

[0021] When determining that the face recognition verification fails, the server determines whether the similarity value is greater than a second preset threshold and whether the current time is within a first preset time period; the first preset threshold is greater than the second preset threshold;

[0022] If so, the server performs remote audio and video verification on the user of the terminal, and when determining that the remote audio and video verification is successful, sends the digital certificate to the client so that the client installs the digital certificate.

[0023] In the above technical solution, since a high similarity value will lead to an increase in the failure rate of face recognition verification, when face recognition verification fails, remote audio and video verification is used so that the user can verify again. In addition, when it is determined that face recognition verification fails, it is determined that the similarity value is greater than the second preset threshold and less than the first preset threshold and the current moment is within the first preset time period, then the user of the terminal is remotely verified by audio and video, and when it is determined that the remote audio and video verification is successful, the digital certificate is sent to the client so that the client can install the digital certificate, which can effectively improve the interaction and verification between face recognition verification and remote audio and video verification, and at the same time can improve the security of verification during the installation of the digital certificate, and also reflects the efficiency and flexibility of the execution of verification during the installation of the digital certificate.

[0024] Optionally, the device information includes a device identification value;

[0025] The server determines whether the terminal is a common device according to the device information, including:

[0026] The server compares the device identification value of the terminal with the device identification value of the corresponding terminal stored locally;

[0027] If the device identification value of the terminal is consistent with the device identification value of the corresponding terminal stored locally, the server determines that the terminal is a commonly used device, otherwise, the server determines that the terminal is an uncommonly used device.

[0028] In the above technical scheme, by comparing the device identification value of the terminal with the device identification value of the corresponding terminal stored locally, it is possible to efficiently and quickly determine whether the terminal is a commonly used device or an uncommon device, so as to provide support for which verification method to use in the subsequent digital certificate installation process, which helps to improve the interaction and verification between multiple verification methods, and also reflects the efficiency and flexibility of verification execution during the digital certificate installation process.

[0029] Optionally, the terminal has multiple user identification card numbers;

[0030] The server determines whether the user identification card number of the terminal is consistent with the number for receiving the SMS verification code, including:

[0031] The server determines whether the timestamp corresponding to each of the multiple user identification card numbers collected by the client is within a second preset time period. If so, each of the multiple user identification card numbers is compared with the number receiving the SMS verification code in turn, and determines whether any user identification card number of the multiple user identification card numbers is consistent with the number receiving the SMS verification code. If so, it is determined that the user identification card number of the terminal is consistent with the number receiving the SMS verification code; otherwise, it is determined that the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code.

[0032] In the above technical solution, since there are multiple user identification card numbers in the terminal, it is determined whether the timestamp corresponding to each identification card number among the multiple user identification card numbers collected by the client is within the second preset time period. If so, the multiple user identification card numbers are compared with the number receiving the SMS verification code in sequence. It can be verified whether the number receiving the SMS verification code comes from any user identification card number among the multiple user identification card numbers of the terminal, thereby ensuring the security of verification during the digital certificate installation process.

[0033] Optionally, the server sends the digital certificate requested by the client to the client so that the client installs the digital certificate, including:

[0034] The server signs the digital certificate using the private key, and sends the signed digital certificate to the client, so that the client verifies and installs the signed digital certificate using the public key corresponding to the private key.

[0035] In the above technical scheme, by using a private key to sign the digital certificate, it is possible to prevent the digital certificate from being replaced or tampered with during the issuance process, and the signed digital certificate is issued to the client, so that the client uses the public key corresponding to the private key to verify and install the signed digital certificate, which can effectively ensure the security of the digital certificate during transmission.

[0036] In a second aspect, an embodiment of the present invention further provides a digital certificate installation verification device, comprising:

[0037] An acquisition unit, configured to receive a verification request from a client; the verification request includes a text message verification code and device information of a terminal where the client is located;

[0038] A processing unit is used to determine whether the terminal is a commonly used device based on the device information; if so, verify the SMS verification code, and after determining that the SMS verification code is successfully verified, determine whether the user identification card number of the terminal is consistent with the number for receiving the SMS verification code; if so, send the digital certificate requested by the client to the client so that the client can install the digital certificate.

[0039] Optionally, the processing unit is further configured to:

[0040] When it is determined that the terminal is not a common device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, performing face recognition verification on the user of the terminal;

[0041] When it is determined that the face recognition verification is successful, the digital certificate is issued to the client so that the client installs the digital certificate.

[0042] Optionally, the processing unit is specifically configured to:

[0043] Sending a face recognition verification request to the client so that the client can collect a face image of the user;

[0044] Receiving the facial image of the user sent by the client, comparing the facial image of the user with the facial image of the corresponding user stored locally, and determining a similarity value between the facial image of the user and the facial image of the corresponding user stored locally;

[0045] If the similarity value is greater than a first preset threshold, it is determined that the face recognition verification is successful, otherwise it is determined that the face recognition verification is unsuccessful.

[0046] Optionally, the processing unit is further configured to:

[0047] When it is determined that the face recognition verification fails, determining whether the similarity value is greater than a second preset threshold and whether the current moment is within a first preset time period; the first preset threshold is greater than the second preset threshold;

[0048] If so, remote audio and video verification is performed on the user of the terminal, and when it is determined that the remote audio and video verification is successful, the digital certificate is issued to the client so that the client installs the digital certificate.

[0049] Optionally, the device information includes a device identification value;

[0050] The processing unit is specifically used for:

[0051] Comparing the device identification value of the terminal with the device identification value of the corresponding terminal stored locally;

[0052] If the device identification value of the terminal is consistent with the device identification value of the corresponding terminal stored locally, the terminal is determined to be a commonly used device; otherwise, the terminal is determined to be an uncommonly used device.

[0053] Optionally, the terminal has multiple user identification card numbers;

[0054] The processing unit is specifically used for:

[0055] Determine whether the timestamp corresponding to each of the multiple user identification card numbers collected by the client is within a second preset time period; if so, compare each of the multiple user identification card numbers with the number for receiving the SMS verification code in turn, and determine whether any of the multiple user identification card numbers is consistent with the number for receiving the SMS verification code; if so, determine that the user identification card number of the terminal is consistent with the number for receiving the SMS verification code; otherwise, determine that the user identification card number of the terminal is inconsistent with the number for receiving the SMS verification code.

[0056] Optionally, the processing unit is specifically configured to:

[0057] The digital certificate is signed using a private key, and the signed digital certificate is sent to the client, so that the client uses the public key corresponding to the private key to verify and install the signed digital certificate.

[0058] In a third aspect, an embodiment of the present invention provides a computing device, including:

[0059] Memory for storing computer programs;

[0060] The processor is used to call the computer program stored in the memory and execute the verification method for digital certificate installation according to the obtained program.

[0061] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to enable a computer to execute a verification method for installing a digital certificate. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present invention;

[0064] Figure 2 A flowchart of a method for verifying the installation of a digital certificate provided by an embodiment of the present invention;

[0065] Figure 3 A schematic diagram of a flow chart of interaction and verification between multiple verification methods provided by an embodiment of the present invention;

[0066] Figure 4 A schematic diagram of the structure of a digital certificate installation verification device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] Figure 1 A system architecture is provided for an embodiment of the present invention. Figure 1 As shown, the system architecture may be a server 100 , including a processor 110 , a communication interface 120 , and a memory 130 .

[0069] The communication interface 120 is used to communicate with the terminal device, send and receive information transmitted by the terminal device, and realize communication.

[0070] The processor 110 is the control center of the server 100, and uses various interfaces and lines to connect various parts of the entire server 100, and executes various functions of the server 100 and processes data by running or executing software programs and / or modules stored in the memory 130, and calling data stored in the memory 130. Optionally, the processor 110 may include one or more processing units.

[0071] The memory 130 can be used to store software programs and modules. The processor 110 executes various functional applications and data processing by running the software programs and modules stored in the memory 130. The memory 130 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc.; the data storage area can store data created according to business processing, etc. In addition, the memory 130 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0072] It should be noted that the above Figure 1 The structure shown is only an example and is not limited to this embodiment of the present invention.

[0073] Based on the above description, Figure 2 The process of a digital certificate installation verification method provided by an embodiment of the present invention is exemplarily shown, and the process can be executed by a digital certificate installation verification device.

[0074] like Figure 2 As shown in the figure, the process specifically includes:

[0075] Step 201: The server receives a verification request from the client.

[0076] In an embodiment of the present invention, the verification request may include a text message verification code and device information of the terminal where the client is located. The device information of the terminal where the client is located may include IMEI (International Mobile Equipment Identity), IMSI (International Mobile Subscriber Identification Number), UUID (Universally Unique Identifier), screen resolution, mobile phone model, etc. of Android devices, and IDFA (Identifier For Identifier), IDFV (Identifier For Vendor), UUID (Universally Unique Identifier), screen resolution, mobile phone model, etc. of iOS devices. In addition, when the server sends the verification code to the client, it will also send the RSA public key to the client. The RSA public key is mainly used for the subsequent client to encrypt the collected data and the client to verify the digital certificate, so as to ensure that the data and digital certificate are not replaced or tampered with during the transmission process.

[0077] In step 202, the server determines whether the terminal is a commonly used device based on the device information. If the terminal is determined to be a commonly used device, the SMS verification code is verified, and after determining that the SMS verification code is successfully verified, it is determined whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code.

[0078] In an embodiment of the present invention, the server compares the device identification value in the device information of the terminal with the device identification value of the corresponding terminal stored locally. If the device identification value of the terminal is consistent with the device identification value of the corresponding terminal stored locally, the terminal is determined to be a commonly used device, otherwise the terminal is determined to be an uncommon device. In addition, when the terminal is determined to be a commonly used device, the SMS verification code is verified, and after determining that the SMS verification code is successfully verified, it is determined whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code. If there are multiple user identification card numbers in the terminal, it is determined whether the timestamp corresponding to each of the multiple user identification card numbers collected by the client is within the second preset time period. If so, each of the multiple user identification card numbers is compared with the number receiving the SMS verification code in turn, and it is determined whether any of the multiple user identification card numbers is consistent with the number receiving the SMS verification code. If so, it is determined that the user identification card number of the terminal is consistent with the number receiving the SMS verification code, otherwise it is determined that the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code. Among them, the second preset time period can be set according to experience.

[0079] In addition, when the server determines that the terminal is a non-common device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, the server sends a face recognition verification request to the client so that the client can collect the user's face image. Then receive the user's face image sent by the client, compare the user's face image with the face image of the corresponding user stored locally, determine the similarity value between the user's face image and the face image of the corresponding user stored locally, and if the similarity value is greater than the first preset threshold, determine that the face recognition verification is successful, otherwise determine that the face recognition verification is unsuccessful. Wherein, when it is determined that the face recognition verification is successful, the digital certificate is sent to the client so that the client can install the digital certificate; when it is determined that the face recognition verification fails, determine whether the similarity value is greater than the second preset threshold and whether the current time is within the first preset time period, and the first preset threshold is greater than the second preset threshold. If so, perform remote audio and video verification on the user of the terminal, and when it is determined that the remote audio and video verification is successful, send the digital certificate to the client so that the client can install the digital certificate. Wherein, the first preset threshold, the second preset threshold and the first preset time period can be set according to experience.

[0080] In the specific implementation process, before judging whether a terminal is a commonly used device based on the device information, it is necessary to identify in which case the terminal is a commonly used device according to specific rules. For example, the server determines the unique device identification token through the Hash algorithm operation based on the device information of the mobile device where the client is located. The formula for calculating the token is: token = sha256 (IMEI + IMSI + mobile phone model). Then, if user A has a certain login cycle and transaction record on mobile device A, the terminal device A is considered to be a commonly used device of user A. Among them, the specific rules are as follows:

[0081] a. If user A logs in on mobile device A for three consecutive days and has one transaction record within a month, terminal device A is considered a frequently used device.

[0082] b. If user A has any 7-day login record and 1 transaction record on mobile device A in the past three months, terminal device A is considered to be a frequently used device.

[0083] c. If user A has more than three transaction records on mobile device A in the past three months, terminal device A is considered to be a frequently used device.

[0084] It should be noted that the client is an example of a financial application client. Since financial applications have transaction data, it is safer and faster to identify whether the terminal device is a commonly used device in combination with the transaction data. When terminal device A is determined to be a commonly used device of user A, the corresponding relationship between user A and terminal device A is recorded in the database table shown in Table 1.

[0085] Table 1

[0086]

[0087] After the client sends a request to the server to install a digital certificate, the server first calculates a token based on the collected device information of the mobile device, and then compares the token with the token in the database table. If the two tokens are consistent, the terminal device currently used by the user is considered to be a commonly used device, otherwise it is an uncommon device.

[0088] If the user performs certificate security on a commonly used device, SMS verification is preferred, mainly because the success rate of SMS verification is higher than that of face recognition verification, and the hardware requirements for mobile devices are lower; if the user performs certificate security on an uncommon device, face recognition verification is used for verification. In the process of the user installing a digital certificate, the user's mobile device is identified as a commonly used device by calculating the device information and login and transaction data of the user's mobile device, and the verification method of the user's installation of the digital certificate is effectively distinguished based on the commonly used device, which can ensure the security of the verification during the installation of the digital certificate and improve the execution efficiency of the verification. When the user uses the SMS verification code for verification, the server verifies the SMS verification code submitted by the user. If the verification passes, it is necessary to determine whether the user identification card number of the mobile device is consistent with the number receiving the SMS verification code. If the verification fails, face recognition verification is used for verification. When determining whether the user identification card number of the mobile device is consistent with the number receiving the SMS verification code, the client needs to collect the user identification card number of the mobile device, that is, the mobile phone number corresponding to the SIM card (Subscriber Identity Module) installed in the user's mobile device, wherein the method for obtaining the user identification card mobile phone number is:

[0089] TelephonyManager telmanger=

[0090] (TelephonyManager)this.getSystemService(Context.TELEPHONY_SERVICE);

[0091] String phone=telmanger.getLine1Number();

[0092] After obtaining the user identification card number, the obtained user identification card number and timestamp are spliced ​​together and the spliced ​​data is encrypted and transmitted to the server through the RSA public key issued by the server. If the mobile phone has multiple user identification card numbers, the multiple user identification card numbers and timestamps are arranged in order and then encrypted with the RSA public key and transmitted to the server. After that, the server decrypts the encrypted data through the RSA private key, and first checks the timestamp in the decrypted data to determine whether the timestamp in the decrypted data is within 10 minutes. If so, it continues to determine whether the user identification card number in the decrypted data is consistent with the number for SMS verification. If there are multiple user identification card numbers, they need to be compared one by one. As long as there is a user identification card number that is consistent with the number for SMS verification, it is sufficient. Then, after determining that the user identification card number is consistent with the number for SMS verification, the digital certificate requested by the client is issued to the client so that the client can install the digital certificate. Among them, during the SMS verification code verification process, the user identification card number is not easy to forge and cannot be controlled by criminals. In addition, during the data transmission process, RSA is used to encrypt the obtained user identification card number and timestamp, which effectively ensures the security of data transmission. Even if criminals obtain the user's SMS verification code through Trojans or phishing, they cannot send the correct user identification card number to the server because they cannot obtain the user's mobile phone card, resulting in verification failure, which effectively prevents the risk of digital certificates being counterfeited and installed by criminals. At the same time, during the digital certificate issuance process, the server uses the RSA private key to sign the digital certificate, and the client uses the issued RSA public key to verify the signed digital certificate, effectively ensuring that the digital certificate is not replaced or tampered with during the issuance process.

[0093] Furthermore, if the mobile device is not a common device or the SMS verification code verification fails or the verification mobile phone number of the SMS verification code is inconsistent with the user identification card number of the mobile terminal, in order to solve the security problem, a face recognition verification method is added, that is, the client enables the face recognition verification module, and the client SDK (Software Development Kit) is first used to perform liveness detection during face recognition verification. After the liveness detection passes, the client collects the face photo and performs base64 encoding and uses the RSA public key to encrypt the face picture collected during face recognition verification and transmit it to the server, and the server performs face comparison. In order to improve the security of face recognition, it is necessary to improve the similarity of face recognition here. The similarity exceeds a certain threshold (such as 80%) to pass, which can avoid the lack of security due to low similarity. If the face recognition verification passes, the digital certificate is issued to the client for installation. If the face recognition verification fails, in order to ensure that the face recognition achieves a higher security, the face recognition familiarity is strictly controlled, and the failure rate caused by the increase is supplemented by remote audio and video verification. Among them, liveness detection refers to a method of determining the real physiological characteristics of an object in some identity authentication scenarios. In face recognition applications, liveness detection can verify whether the user is a real living person through a combination of actions such as blinking, opening the mouth, shaking the head, and nodding, using technologies such as face key point positioning and face tracking. It can effectively resist common attack methods such as photos, face swapping, masks, occlusions, and screen reshoots, thereby helping users identify fraud and protect their interests.

[0094] As the similarity of face recognition increases, the failure rate of face recognition verification will inevitably increase. At this time, for users who still fail the face recognition verification, there needs to be another way for users to verify again, introducing the remote audio and video verification method. The client calls up the remote audio and video function, connects to the remote customer service platform, and confirms the user's information through the manual customer service. This method is similar to going to the counter in person, which can effectively ensure the security of identity authentication during the installation of the digital certificate. After the manual customer service confirms the customer information and passes the comparison, the server sends the digital certificate to the client for installation, otherwise, the digital certificate installation fails. Here, since remote audio and video requires the participation of manual customer service, it is necessary to set a threshold for face recognition similarity again (such as more than 40%) and start remote audio and video verification if it is not at night (24:00-8:00), otherwise the verification is rejected and the installation of the digital certificate fails.

[0095] Step 203: If the server determines that the user identification card number of the terminal is consistent with the number for receiving the SMS verification code, the server sends the digital certificate requested by the client to the client so that the client installs the digital certificate.

[0096] In the embodiment of the present invention, if the server determines that the user identification card number of the terminal is consistent with the number for receiving the SMS verification code, the server uses the private key to sign the digital certificate, and sends the signed digital certificate to the client, so that the client uses the public key corresponding to the private key to verify and install the signed digital certificate. Specifically, in the process of the server sending the digital certificate to the client, the digital certificate is signed with the RSA private key, which can prevent the digital certificate from being replaced or tampered with during the sending process. After the client receives the digital certificate, it uses the RSA public key to verify the signed digital certificate, and installs it if the verification passes.

[0097] In order to better explain the embodiment of the interaction and verification between multiple verification modes of the present invention, the following describes a process of interaction and verification between multiple verification modes provided by an embodiment of the present invention through a specific implementation scenario.

[0098] like Figure 3 As shown, the process includes the following steps:

[0099] Step 301: The client initiates a request to install a digital certificate.

[0100] The client initiates a request to the server to install a digital certificate. After receiving the request to install a digital certificate, the server sends a text message verification code to the client.

[0101] Step 302: The server sends the RSA public key.

[0102] The server sends the RSA public key to the client, which is mainly used by the client to encrypt the collected data and verify the digital certificate.

[0103] Step 303 , determining whether the terminal is a common device based on the device information of the terminal where the client is located, if so, executing step 304 , if not, executing step 307 .

[0104] Before the client submits the SMS verification code to the server for verification, the server determines whether the terminal is a common device based on the collected device information of the terminal where the client is located.

[0105] Step 304, determine whether the SMS verification code verification is successful, if so, execute step 305, if not, execute step 307.

[0106] When determining to use the SMS verification code for verification, the server verifies the SMS verification code submitted by the user and determines whether the SMS verification code verification is successful.

[0107] Step 305: Collect the user identification card number of the mobile terminal.

[0108] After confirming that the SMS verification code is successfully verified, the server collects the user identification card number of the mobile terminal.

[0109] Step 306, determining whether the user identification card number is consistent with the number for SMS verification, if so, executing step 309, if not, executing step 307.

[0110] After determining that the SMS verification code has been successfully verified, the server determines whether the user identification card number is consistent with the number for SMS verification.

[0111] Step 307: Perform face recognition verification on the user.

[0112] When the server determines that the terminal is not a commonly used device or the SMS verification code verification fails or the user identification card number is inconsistent with the number for SMS verification, the server performs face recognition verification on the user.

[0113] Step 308 , determining whether the face recognition similarity value is greater than a first preset threshold, if so, executing step 309 , if not, executing step 310 .

[0114] The server compares the user's facial image with the facial image of the corresponding user stored locally to determine whether the facial recognition similarity value is greater than a first preset threshold.

[0115] Step 309: The server signs the digital certificate and sends it to the client.

[0116] Step 310 , whether the face recognition similarity value is greater than a second preset threshold and whether the current moment is within a first preset time period, if so, execute step 313 , if not, execute step 315 .

[0117] When determining that the face recognition similarity value is less than or equal to the first preset threshold, the server determines whether the face recognition similarity value is greater than a second preset threshold and whether the current time is within the first preset time period.

[0118] Step 311, determine whether the client successfully verifies the digital certificate. If so, execute step 312; if not, execute step 315.

[0119] After receiving the signed digital certificate, the client uses the issued RSA public key to verify the signed digital certificate and determine whether the client's verification of the digital certificate is successful.

[0120] Step 312: The digital certificate is installed successfully.

[0121] Step 313: remotely verify the user through audio and video.

[0122] When it is determined that face recognition verification has failed, remote audio and video verification is performed on the user.

[0123] Step 314, determine whether the user's information is accurate, if so, execute step 309, if not, execute step 315.

[0124] The client activates the remote audio and video function, connects to the remote customer service platform, confirms the user's information through manual customer service, and determines whether the user's information is accurate.

[0125] Step 315, digital certificate installation fails.

[0126] The above embodiments show that by comparing the user identification card number based on determining that the user's terminal is a common device, the interaction and verification between common device identification and user identification card number comparison can be effectively improved, and the security of verification during the digital certificate installation process can be ensured. In addition, during the SMS verification process, since the user identification card number is not easy to forge and will not be controlled by criminals, even if criminals obtain the SMS verification code through Trojans or phishing, they will not be able to send the correct user identification card number to the server because they cannot obtain the user's mobile phone card, resulting in the server verifying that the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code. Therefore, the digital certificate will not be sent to the client, which can effectively prevent the risk of digital certificates being counterfeited and installed by criminals, thereby improving the security of verification during the installation of digital certificates. When it is determined that the terminal is a non-common device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, face recognition verification is performed on the user of the terminal, and when it is determined that the face recognition verification is successful, the digital certificate is sent to the client so that the client can install the digital certificate. When the face recognition verification fails, remote audio and video verification is used so that the user can verify again, and when it is determined that the remote audio and video verification is successful, the digital certificate is sent to the client so that the client can install the digital certificate. Since verification is performed by using common device identification, user identification card number comparison, face recognition verification and remote audio and video verification, the interaction and verification among common device identification, user identification card number comparison, face recognition verification and remote audio and video verification can be effectively improved, and the security of verification during the digital certificate installation process can be improved, which also reflects the high efficiency and flexibility of the execution of verification during the digital certificate installation process. In addition, the problem of low security of verification during the digital certificate installation process in the prior art can be solved.

[0127] Based on the same technical concept, Figure 4 An exemplary embodiment of the present invention shows a digital certificate installation verification device, which can execute the process of the digital certificate installation verification method.

[0128] like Figure 4 As shown, the device comprises:

[0129] The acquisition unit 401 is used to receive a verification request from a client; the verification request includes a text message verification code and device information of the terminal where the client is located;

[0130] The processing unit 402 is used to determine whether the terminal is a commonly used device based on the device information. If so, the SMS verification code is verified, and after determining that the SMS verification code is successfully verified, whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code; if so, the digital certificate requested by the client is sent to the client so that the client can install the digital certificate.

[0131] Optionally, the processing unit 402 is further configured to:

[0132] When it is determined that the terminal is not a common device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, performing face recognition verification on the user of the terminal;

[0133] When it is determined that the face recognition verification is successful, the digital certificate is issued to the client so that the client installs the digital certificate.

[0134] Optionally, the processing unit 402 is specifically configured to:

[0135] Sending a face recognition verification request to the client so that the client can collect a face image of the user;

[0136] Receiving the facial image of the user sent by the client, comparing the facial image of the user with the facial image of the corresponding user stored locally, and determining a similarity value between the facial image of the user and the facial image of the corresponding user stored locally;

[0137] If the similarity value is greater than a first preset threshold, it is determined that the face recognition verification is successful, otherwise it is determined that the face recognition verification is unsuccessful.

[0138] Optionally, the processing unit 402 is further configured to:

[0139] When it is determined that the face recognition verification fails, determining whether the similarity value is greater than a second preset threshold and whether the current moment is within a first preset time period; the first preset threshold is greater than the second preset threshold;

[0140] If so, remote audio and video verification is performed on the user of the terminal, and when it is determined that the remote audio and video verification is successful, the digital certificate is issued to the client so that the client installs the digital certificate.

[0141] Optionally, the device information includes a device identification value;

[0142] The processing unit 402 is specifically used for:

[0143] Comparing the device identification value of the terminal with the device identification value of the corresponding terminal stored locally;

[0144] If the device identification value of the terminal is consistent with the device identification value of the corresponding terminal stored locally, the terminal is determined to be a commonly used device; otherwise, the terminal is determined to be an uncommonly used device.

[0145] Optionally, the terminal has multiple user identification card numbers;

[0146] The processing unit 402 is specifically used for:

[0147] Determine whether the timestamp corresponding to each of the multiple user identification card numbers collected by the client is within a second preset time period; if so, compare each of the multiple user identification card numbers with the number for receiving the SMS verification code in turn, and determine whether any of the multiple user identification card numbers is consistent with the number for receiving the SMS verification code; if so, determine that the user identification card number of the terminal is consistent with the number for receiving the SMS verification code; otherwise, determine that the user identification card number of the terminal is inconsistent with the number for receiving the SMS verification code.

[0148] Optionally, the processing unit 402 is specifically configured to:

[0149] The digital certificate is signed using a private key, and the signed digital certificate is sent to the client, so that the client uses the public key corresponding to the private key to verify and install the signed digital certificate.

[0150] Based on the same technical concept, an embodiment of the present invention provides a computing device, including:

[0151] Memory for storing computer programs;

[0152] The processor is used to call the computer program stored in the memory and execute the verification method for digital certificate installation according to the obtained program.

[0153] Based on the same technical concept, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to enable a computer to execute a verification method for installing a digital certificate.

[0154] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0155] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0156] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0157] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0158] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0159] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of this application and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for verifying the installation of a digital certificate, characterized in that: include: The server receives the client's authentication request; The verification request includes a text message verification code and device information of the terminal where the client is located; The server determines whether the terminal is a common device based on the device information, and if so, verifies the SMS verification code, and after determining that the SMS verification code verification is successful, determines whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code; If yes, the server sends the digital certificate requested by the client to the client, so that the client installs the digital certificate; The user identification card number of the terminal is the mobile phone number corresponding to the SIM card installed in the terminal, and the determining whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code includes: Obtaining encrypted data of the terminal; The server decrypts the encrypted data of the terminal by using the encryption algorithm private key to obtain the decrypted data to be encrypted, wherein the encrypted data of the terminal is obtained by concatenating the mobile phone number to be verified with a timestamp after the terminal obtains the mobile phone number to be verified, and encrypting the data to be encrypted by using the encryption algorithm public key issued by the server; Verifying whether the timestamp in the decrypted data to be encrypted is within a preset time range; If so, determine whether the mobile phone number to be verified is consistent with the number that receives the SMS verification code.

2. The method according to claim 1, characterized in that The method further comprises: When the server determines that the terminal is an uncommon device or the SMS verification code verification fails or the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code, the server performs face recognition verification on the user of the terminal; When the server determines that the face recognition verification is successful, the server sends the digital certificate to the client so that the client installs the digital certificate.

3. The method according to claim 2, characterized in that The performing face recognition verification on the user of the terminal includes: The server sends a face recognition verification request to the client, so that the client collects a face image of the user; The server receives the facial image of the user sent by the client, compares the facial image of the user with the facial image of the corresponding user stored locally, and determines a similarity value between the facial image of the user and the facial image of the corresponding user stored locally; If the similarity value is greater than a first preset threshold, the server determines that the face recognition verification is successful, otherwise it determines that the face recognition verification is unsuccessful.

4. The method according to claim 3, characterized in that The method further comprises: When determining that the face recognition verification fails, the server determines whether the similarity value is greater than a second preset threshold and whether the current time is within a first preset time period; the first preset threshold is greater than the second preset threshold; If so, the server performs remote audio and video verification on the user of the terminal, and when determining that the remote audio and video verification is successful, sends the digital certificate to the client so that the client installs the digital certificate.

5. The method according to claim 1, characterized in that The device information includes a device identification value; The server determines whether the terminal is a common device according to the device information, including: The server compares the device identification value of the terminal with the device identification value of the corresponding terminal stored locally; If the device identification value of the terminal is consistent with the device identification value of the corresponding terminal stored locally, the server determines that the terminal is a commonly used device, otherwise, the server determines that the terminal is an uncommonly used device.

6. The method according to claim 1, characterized in that The terminal has multiple user identification card numbers; The server determines whether the user identification card number of the terminal is consistent with the number for receiving the SMS verification code, including: The server determines whether the timestamp corresponding to each of the multiple user identification card numbers collected by the client is within a second preset time period. If so, each of the multiple user identification card numbers is compared with the number receiving the SMS verification code in turn, and determines whether any user identification card number of the multiple user identification card numbers is consistent with the number receiving the SMS verification code. If so, it is determined that the user identification card number of the terminal is consistent with the number receiving the SMS verification code; otherwise, it is determined that the user identification card number of the terminal is inconsistent with the number receiving the SMS verification code.

7. The method according to any one of claims 1 to 6, characterized in that: The server sends the digital certificate requested by the client to the client so that the client installs the digital certificate, including: The server signs the digital certificate using the private key, and sends the signed digital certificate to the client, so that the client verifies and installs the signed digital certificate using the public key corresponding to the private key.

8. A digital certificate installation verification device, characterized in that: include: An acquisition unit, used for receiving a verification request from a client; The verification request includes a text message verification code and device information of the terminal where the client is located; a processing unit, configured to determine whether the terminal is a common device according to the device information, and if so, verify the SMS verification code, and after determining that the SMS verification code is successfully verified, determine whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code; If yes, issuing the digital certificate requested by the client to the client so that the client can install the digital certificate; The user identification card number of the terminal is the mobile phone number corresponding to the SIM card installed in the terminal, and the determining whether the user identification card number of the terminal is consistent with the number receiving the SMS verification code includes: Obtaining encrypted data of the terminal; The server decrypts the encrypted data of the terminal by using the encryption algorithm private key to obtain the decrypted data to be encrypted, wherein the encrypted data of the terminal is obtained by encrypting the data to be encrypted by using the encryption algorithm public key issued by the server after the terminal obtains the mobile phone number to be verified, concatenating the mobile phone number to be verified with a timestamp; Verifying whether the timestamp in the decrypted data to be encrypted is within a preset time range; If so, determine whether the mobile phone number to be verified is consistent with the number that receives the SMS verification code.

9. A computing device, characterized in that include: Memory for storing computer programs; A processor, configured to call a computer program stored in the memory, and execute the method according to any one of claims 1 to 7 according to the obtained program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer-executable program, and the computer-executable program is used to enable a computer to execute the method according to any one of claims 1 to 7.

Images