Trusted authentication method, secure authentication device, and user terminal

Abstract

The present application provides a trusted authentication method, a security authentication device, and a user terminal. The trusted authentication method is applied to a security authentication device, which can be installed on a user terminal. The public key and private key of the security authentication device are stored on the security authentication device. The method includes: sending a first secret key to the user terminal, the first secret key is used to construct a TLS secret key, and the TLS secret key is used to encrypt the web page data of the target website accessed by the user terminal; receiving the web page data encrypted by the TLS secret key sent by the user terminal; generating an authentication data packet, the authentication data packet containing the web page data and a digital signature for the web page data, the digital signature is generated based on the private key, and the digital signature is used for the authentication server storing the public key to perform trusted authentication on the web page data.

Description

Technical Field

[0001] The present application relates to the field of trusted authentication, and specifically to a trusted authentication method, a secure authentication device, and a user terminal. Background Art

[0002] Trusted authentication of web data has a wide range of applications. For example, when describing user information, conducting user-related risk assessments, and providing credit, third parties (such as banks) require users to provide trusted and authenticated web data for evaluation.

[0003] Existing technologies can perform trusted authentication of web page data based on TLSNotary. However, the authentication method of web page data based on TLSNotary requires the authentication server to participate in the TLS handshake process and authenticate the web page data online, resulting in low reliability and poor flexibility of the authentication process. For example, if the response speed of the authentication server may not meet the requirements, the authentication process may fail. For another example, the user may be unable to access the authentication server due to environmental isolation (for example, the user's network firewall may block some websites), and authentication cannot be achieved. Summary of the Invention

[0004] In view of this, the present application provides a trusted authentication method, a secure authentication device and a user terminal to solve the above problems.

[0005] In a first aspect, a trusted authentication method is provided, which is applied to a security authentication device, which can be installed on a user terminal, and the public key and private key of the security authentication device are stored on the security authentication device. The method includes: sending a first secret key to the user terminal, the first secret key is used to construct a TLS secret key, and the TLS secret key is used to encrypt web page data of a target website accessed by the user terminal; receiving the web page data encrypted by the TLS secret key sent by the user terminal; generating an authentication data packet, the authentication data packet including the web page data and a digital signature for the web page data, the digital signature being generated based on the private key, and the digital signature being used for the authentication server storing the public key to perform trusted authentication on the web page data.

[0006] In a second aspect, a trusted authentication method is provided, which is applied to a user terminal, and the user terminal can be installed with a security authentication device, and the public key and private key of the security authentication device are stored on the security authentication device. The method includes: receiving a first key sent by the security authentication device, the first key is used to construct a TLS key, and the TLS key is used to encrypt web page data of a target website accessed by the user terminal; receiving the web page data encrypted by the TLS key from the target website; sending the web page data encrypted by the TLS key to the security authentication device, so that the security authentication device generates an authentication data packet, the authentication data packet includes the web page data and a digital signature for the web page data, the digital signature is generated based on the private key, and the digital signature is used for the authentication server storing the public key to perform trusted authentication on the web page data.

[0007] According to a third aspect, a security authentication device is provided, which can be installed on a user terminal, and the public key and private key of the security authentication device are stored on the security authentication device. The security authentication device includes: a sending unit for sending a first key to the user terminal, the first key is used to construct a TLS key, and the TLS key is used to encrypt web page data of a target website accessed by the user terminal; a receiving unit for receiving the web page data encrypted by the TLS key and sent by the user terminal; a generating unit for generating an authentication data packet, the authentication data packet including the web page data and a digital signature for the web page data, the digital signature being generated based on the private key, and the digital signature being used for the authentication server storing the public key to perform trusted authentication on the web page data.

[0008] According to a fourth aspect, a user terminal is provided, which can be installed with a security authentication device, and the public key and private key of the security authentication device are stored on the security authentication device. The user terminal includes: a first receiving unit, used to receive a first key sent by the security authentication device, the first key is used to construct a TLS key, and the TLS key is used to encrypt web page data of a target website visited by the user terminal; a second receiving unit, used to receive the web page data encrypted by the TLS key from the target website; a sending unit, used to send the web page data encrypted by the TLS key to the security authentication device, so that the security authentication device generates an authentication data packet, the authentication data packet includes the web page data and a digital signature for the web page data, the digital signature is generated based on the private key, and the digital signature is used for the authentication server storing the public key to perform trusted authentication on the web page data.

[0009] In a fifth aspect, a trusted authentication device is provided, comprising a memory and a processor, wherein the memory stores executable code, and the processor is configured to execute the executable code to implement the method as described in any one of the first and second aspects.

[0010] In a sixth aspect, a computer-readable storage medium is provided, on which executable code is stored. When the executable code is executed, the method described in any one of the first and second aspects can be implemented.

[0011] In a seventh aspect, a computer program product is provided, comprising an executable code, which, when executed, can implement the method as described in any one of the first and second aspects.

[0012] In this embodiment, a local security authentication device replaces the authentication server in the TLS handshake process and stores the web page data that requires authentication in the form of an authentication data packet. This allows the user terminal to complete the TLS handshake without having to interact with the authentication server in real time. Furthermore, the user can submit the web page data to the authentication server when they wish to authenticate it, improving the reliability and flexibility of the authentication process. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a diagram of the TLS interaction process.

[0014] Figure 2 This is a flowchart of a trusted authentication method provided in one embodiment of the present application.

[0015] Figure 3 This is a schematic diagram of the structure of a trusted authentication system provided in one embodiment of the present application.

[0016] Figure 4 This is a schematic diagram of the authentication process of a security authentication device provided in one embodiment of the present application.

[0017] Figure 5 This is a flow chart of a trusted authentication method provided in one embodiment of the present application.

[0018] Figure 6 It is a structural diagram of a security authentication device provided in one embodiment of the present application.

[0019] Figure 7 It is a structural diagram of a user terminal provided in one embodiment of the present application.

[0020] Figure 8 It is a structural diagram of a trusted authentication device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0021] The technical solution in this application will be described below with reference to the accompanying drawings.

[0022] To improve the reliability of network data transmission and prevent malicious attacks, most websites currently use the HTTPS protocol for communication. When a user terminal needs to obtain web page information from a website, it can initiate an HTTPS process to the website and request the website to send the required web page data.

[0023] In the embodiments of the present application, a user terminal refers to a device that can provide data connectivity for a user and can be used to connect people, objects, and machines. For example, it can be a handheld device or vehicle-mounted device that can connect to other devices via a network. In the embodiments of the present application, a user terminal can be a mobile phone, tablet computer, laptop computer, PDA, desktop computer, etc. A user terminal can interact with a website through an application (such as a browser) to obtain web page data provided by the website.

[0024] In an embodiment of the present application, a website may provide services to a user terminal, such as providing web page data to the user terminal, etc. In some embodiments, a website may refer to a website that supports HTTPS, such as GitHub, Taobao, etc.

[0025] The HTTPS protocol improves the confidentiality and security of web data transmission between user terminals and websites by integrating the TLS process into the HTTP protocol, protecting the data transmission process from attacks. However, the HTTPS protocol only protects the communication process from attacks; it cannot guarantee that the web data obtained by the user is authentic. In other words, it cannot prove that the web data has not been tampered with.

[0026] For ease of understanding, the following first Figure 1 Take TLS as an example to briefly introduce the TLS handshake process.

[0027] Figure 1 1 is a schematic diagram of the TLS interaction process. In some embodiments, the TLS interaction process can be performed after the user terminal initiates an HTTPS request message and completes a TCP handshake with the website.

[0028] like Figure 1 As shown, in step S110, the user terminal first sends a first message to start the TLS process. The first message may include the protocol version supported by the user terminal, the encryption algorithm, the first random number generated by the user terminal, etc.

[0029] In step S120, the target website sends a second message to the user terminal. The second message may include a protocol version determined by the website, an encryption algorithm, a second random number generated by the website, and the like.

[0030] In step S130, the user terminal generates a third random number based on the acquired target website information and sends it to the target website. In some embodiments, the third random number can be referred to as a pre-master secret or pre-master key. In some embodiments, the third random number sent by the user terminal is encrypted using the target website's public key.

[0031] After receiving the third random number, the target website can generate the TLS key required for this TLS process. In some embodiments, the TLS key can be generated by using the encryption algorithm agreed upon in step S120, combining the first random number generated in step S110, the second random number generated in step S120, and the third random number.

[0032] In step S140 , the target website uses the generated TLS key to encrypt the web page data requested by the user terminal and transmits the encrypted data to the user terminal.

[0033] In some embodiments, the TLS process may further include step S150, where the user terminal calculates a hash value based on the received web page data and sends it to the target website.

[0034] The target website receives the hash value sent by the user terminal and compares it with the hash value calculated by the target website to confirm that the user terminal has received the correct data and ends the TLS process.

[0035] Based on the above analysis, it can be seen that although the TLS process encrypts the target web page data sent using the TLS key, this encryption process only improves the security of the communication process between the user terminal and the target website, preventing attacks on this communication process. However, the TLS process does not authenticate the communication process between the user terminal and the target website or the web page data ultimately obtained. Therefore, users cannot prove that the web page data submitted to a third party (such as a bank) for the third party to profile user information or conduct user risk assessments is authentic. In other words, users cannot prove that the web page data obtained through the user terminal has not been tampered with.

[0036] When a third party needs to evaluate a user's information (for example, a bank determines whether to grant a loan based on the user's bank statement data), it needs to ensure that the user's web page data (such as bank statements) obtained is credible. In some scenarios, the third party can use tools (such as crawler tools) to automatically obtain the required web page data from the target website. The third party believes that the web page data obtained through the tool is credible data. However, the tool cannot adapt to all scenarios (for example, pages that require the user to log in to be displayed cannot be obtained through the tool). For data that the tool cannot obtain, the third party requires the user to actively upload the web page data (such as a screenshot of the web page or HTML text) for evaluation.

[0037] However, web page data uploaded by users has the following problems:

[0038] First, web page data uploaded by users can be tampered with. For example, users can easily modify the HTML content on the browser to render different page content, thereby tampering with the data.

[0039] Secondly, third parties are generally unable to export user-uploaded information in real time. Web data can also be tampered with before it is exported. For example, web data uploaded by users and stored on centralized servers for evidence storage could be tampered with by administrators, resulting in inconsistent web data when users download it again.

[0040] The above problem makes it impossible for users to prove that the web data they uploaded is authentic. In other words, users cannot prove that the web data they uploaded has not been tampered with by themselves or the administrator.

[0041] Currently, some service providers offer a TLS-based online trusted authentication method, also known as TLSnotary. In this method, the service provider acts as a reviewer, authenticating the web page data requested by the user terminal to ensure the trustworthiness of the web page data.

[0042] The above-mentioned trusted authentication method cannot be applied to all scenarios. The reason is: on the one hand, this authentication method requires the user terminal to communicate with the authentication server (auditor) online in real time. The response speed of the authentication server may not meet the requirements, resulting in the failure of the authentication process. On the other hand, the user may not be able to access the authentication server due to environmental isolation (for example, the user's network firewall will block some websites), making it impossible to achieve authentication. In addition, the user may have privacy requirements for web page access and do not want all the pages visited to be monitored by the authentication server. In fact, users are usually not required to authenticate web page data in real time. Users can first generate authentication information locally, and upload the authenticated data to the authentication server for authentication when needed.

[0043] In view of this, the present application provides a trusted authentication method, a secure authentication device and a user terminal to solve the problem of authentication failure caused by using an authentication server to perform online trusted authentication in real time, thereby improving the reliability of the authentication process.

[0044] The following combination Figures 2 to 5 The authentication method provided in the embodiment of the present application is described in detail. Figure 2 This is a flowchart of an authentication method provided in one embodiment of the present application. Figure 2 The method is described from the perspective of the interaction between the user terminal and the security authentication device.

[0045] See also Figure 2 In step S210, the security authentication device sends a first secret key to the user terminal.

[0046] The security authentication device in the embodiments of the present application is a device that can be installed on a user terminal. In some embodiments, the security authentication device may include a secure storage device. The public key and private key of the security authentication device may be stored in the security authentication device. In some embodiments, the security authentication device may also store an authentication certificate. The authentication certificate may be a certificate issued by an authentication server. For example, the authentication server may authenticate the public key of the security authentication device and, if the authentication of the public key is successful, issue the authentication certificate to the security authentication device.

[0047] In some embodiments, the security authentication device can be a USBKey. A USBKey is a hardware device with a USB interface. It has a built-in microcontroller or smart card chip and a certain amount of storage space for storing private keys and digital certificates. The USBKey can perform identity authentication using a public key algorithm. Because the private key of the security authentication device is stored in a combination lock and is theoretically unreadable by any means, using a USBKey as a security authentication device can ensure the security of data authentication.

[0048] In some embodiments, the authentication server may refer to a server provided by an authoritative third-party organization (e.g., a CA center). In some embodiments, the authentication certificate issued by the authentication server may be a text that is generated by a special encryption technique and cannot be forged or tampered with.

[0049] The first key is a key generated by a security authentication device. This first key can be used to construct a TLS key, which is used to encrypt web page data on the target website accessed by the user terminal. In some embodiments, to improve the security of the data transmission process, a new first key is generated during each TLS process.

[0050] The first key can be used to construct a TLS key using different encryption algorithms as needed. In some embodiments, the first key can be used directly to generate the TLS key. In other embodiments, the first key can be used to first generate a pre-master secret, which is then used to generate the TLS key.

[0051] The TLS key is used by the website to encrypt the web data being transmitted. In some embodiments, the TLS key is regenerated during each TLS handshake. In some embodiments, to increase data transmission speed and reduce the complexity of the data transmission process, the TLS key can be a symmetric key. That is, the website and the user terminal use the same TLS key to encrypt the transmitted data.

[0052] In step S220, the user terminal receives web page data encrypted by the TLS key from the target website.

[0053] In some embodiments, the target website is a website that can provide the user terminal with the requested webpage data. After receiving the request from the user terminal to transmit the webpage data, the target website encrypts the webpage data using the TLS key negotiated with the user terminal and transmits the encrypted data to the user terminal. The webpage data is webpage information containing the data requested by the user, such as HTML text.

[0054] In step S230, the user terminal sends the web page data encrypted by the TLS key to the security authentication device.

[0055] In step S240, the security authentication device generates an authentication data packet. In some embodiments, the authentication data packet includes the webpage data and a digital signature for the webpage data. The digital signature is generated based on the private key of the security authentication device. The digital signature is used by an authentication server that stores the public key of the security authentication device to authenticate the webpage data.

[0056] In some embodiments, the digital signature of the webpage data by the security authentication device may be a digital signature of the webpage data encrypted with the TLS key using the security authentication device's own private key. To further improve the reliability of the data authenticated by the security authentication device, in other embodiments, the digital signature of the webpage data by the security authentication device may also be a digital signature of the data transmitted during the entire TLS transmission process by the security authentication device.

[0057] In some embodiments, the authentication data packet may include TLS handshake information (eg, a TLS key), a digital signature of the security authentication device for the web page data, and the web page data encrypted using the TLS key.

[0058] In other embodiments, the authentication data packet may also include decrypted web page data and a digital signature of the decrypted web page data generated by the security authentication device using its own private key.

[0059] Because the authentication data packet contains a digital signature generated by the security authentication device using its own private key, the authentication server will fail authentication if the authentication data packet is tampered with. Therefore, the authentication data packet is trustworthy. It is understood that the storage location of the authentication data packet can be selected as needed based on its trustworthiness. For example, the authentication data packet can be stored in the security authentication device. To reduce the cost of the security authentication device, the authentication data packet can also be stored in the user terminal.

[0060] The authentication method provided in the embodiments of the present application uses a secure authentication device within the TLS process to digitally sign the acquired webpage data, ensuring that the authentication data packet is authentic and has not been tampered with. Furthermore, since users can achieve online access and offline authentication during the process of acquiring webpage data, using this trusted authentication method to authenticate webpage data can also meet users' needs for data privacy.

[0061] In some embodiments, before step S210, the authentication method may further include: generating a public key and a private key of a security authentication device, and sending the public key to the authentication server so that the authentication server authenticates the public key, obtains an authentication certificate, and stores the authentication certificate sent by the authentication server.

[0062] The public and private keys of a security authentication device are a pair of keys generated using specific cryptographic rules. This key pair can be used to encrypt and decrypt data. The private key is stored locally on the security authentication device and cannot be accessed by any third party. The security authentication device uses the private key to encrypt data for transmission. The receiving end can decrypt the data using the security authentication device's public key.

[0063] In order to improve the security of the private key, in some embodiments, the security authentication device may include a password lock in which the private key may be stored.

[0064] After receiving the public key of the security authentication device, the authentication server can save the public key of the security authentication device, use the public key to generate a certificate for the security authentication device, and issue it to the security authentication device.

[0065] In some embodiments, the authentication server can be a blockchain-based authentication server. The public key and authentication certificate of the security authentication device can be stored in the blockchain. The authentication server can issue certificates using, for example, blockchain smart contracts. A blockchain-based authentication server can further prevent data tampering by authentication server administrators, thereby enhancing the credibility of authentication.

[0066] In order to further ensure the security of user privacy and prevent malicious attacks, in some embodiments, before step S210, the trusted authentication method may further include: the user terminal verifies the legitimacy of the security authentication device.

[0067] In some embodiments, the security authentication device can actively send a certificate to the user terminal when it is installed on the user terminal. In other embodiments, the security authentication device can also passively send a certificate to the user terminal when the user terminal requests a certificate. After the user terminal receives the certificate from the security authentication device, it can verify the certificate to ensure that the security authentication device is not an attacker. To further improve the reliability of the security authentication device authentication process, in some embodiments, a blockchain smart contract can be used to authenticate the security authentication device.

[0068] In this embodiment, by adding authentication of the security authentication device, it is ensured that the security authentication device communicating with the user terminal is issued by an authority (such as a CA center) and not by an attacker, thereby effectively protecting the user's security.

[0069] The following are specific examples and Figure 3-5 , describes the embodiment of the present application in more detail. It should be noted that, Figure 3-5 The examples are only for helping those skilled in the art to understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to the specific numerical values ​​or specific scenarios illustrated. Figure 3-5 It is obvious that various equivalent modifications or changes can be made, and such modifications or changes also fall within the scope of the embodiments of the present application.

[0070] Figure 3 This is a schematic diagram of the structure of the authentication system provided by an embodiment of the present application. Figure 3 As shown, the authentication system provided in the embodiment of the present application includes a target website 1, a user terminal 2, a security authentication device 3 and an authentication server 4.

[0071] Figure 4 This is a schematic diagram of the authentication process of the security authentication device provided by an embodiment of the present application. Figure 4 As shown, the security authentication device 3 may be authenticated by the authentication server 4 before use to generate an authentication certificate.

[0072] Specifically, see Figure 4 In step S410, the security authentication device 3 generates a public key and a private key pair. The public key and private key pair may use an RSA2048 asymmetric key pair, for example.

[0073] In step S420, the security authentication device 3 uploads the generated public key to the authentication server 4 for authentication.

[0074] In step S430, after receiving the authentication request from the security authentication device 3, the authentication server 4 authenticates the public key of the security authentication device 3 and generates an authentication certificate. The authentication server 4 sends the generated authentication certificate to the security authentication device 3 and stores the public key of the security authentication device 3.

[0075] After authentication by authentication server 4, security authentication device 3 can authenticate webpage data obtained by the user terminal on behalf of authentication server 4. As long as the authentication server 4 that security authentication device 3 applies to is a trusted authentication server, the authentication service provided by security authentication device 3 is also trusted. In other words, the authentication data packet generated by digitally signing the webpage data using security authentication device 3, which has been authenticated by authentication server 4, is trusted data.

[0076] In some embodiments, a user can communicate with a target website through a browser installed on user terminal 2. Data exchange between user terminal 2 and security authentication device 3 can be performed through a browser plug-in. When a user requests webpage data that requires authentication, they first install security authentication device 3 on user terminal 2 and then open the browser plug-in to request authentication. The plug-in's function is to manage the user's current HTTPS request and perform TLS authentication by calling security authentication device 3 installed on user terminal 2.

[0077] To ensure that the security authentication device 3 installed on the user terminal 2 is indeed issued by an authoritative organization, each time the plug-in connects to the security authentication device 3, it is necessary to verify the certificate information of the security authentication device 3. The verification method can be completed using a smart contract on the blockchain, for example.

[0078] Figure 5 This is a flowchart of an authentication method provided in one embodiment of the present application.

[0079] like Figure 5 As shown, in step S502, the user terminal sends a TLS request message to the target website. In some embodiments, the TLS request message may also be an HTTPS request message.

[0080] In step S504, the target website responds to the TLS request message.

[0081] In step S506 , the user terminal requests the first key from the security authentication device.

[0082] In step S508, the security authentication device generates a first key and sends it to the user terminal. Sending the first key can be completed by returning the first key to the browser plug-in. It should be noted that the first key generated during each TLS handshake is different.

[0083] In step S510, the user terminal generates TLS handshake information based on the first key and sends it to target website 1. The browser plug-in can use the first key to construct the pre-master secret required for TLS authentication. The browser sends this pre-master secret and the two random numbers generated during the TLS handshake as the relevant network request to the target website.

[0084] In step S512, the browser plug-in forwards the handshake confirmation information to the target website. After verification, the target website completes the TLS handshake process and uses the negotiated TLS key as the key for subsequent encryption of web page data. This TLS key is a symmetric key. At this point, the negotiated TLS key remains in the security authentication device and cannot be accessed by the browser or plug-in.

[0085] In step S514, the target website uses the TLS key to encrypt the web page data (such as HTML text) to be displayed, and sends the encrypted web page data to the user terminal.

[0086] In step S516, the user terminal sends the received web page data to the security authentication device.

[0087] In step S518, the security authentication device packages and generates an authentication data packet corresponding to the request. The authentication data packet includes the generated TLS handshake information (for example, it may include a TLS key for decrypting the web page data), a signature of the content using its own private key, and the encrypted web page data (for example, the encrypted HTML text).

[0088] In step S520, the security authentication device returns the TLS key currently operating to the plug-in / browser.

[0089] In step S522, the browser uses the TLS key to encrypt the HTML response text and sends it to the target website. The target website verifies that the response text is correct after decrypting it through TLS, and ends the TLS transmission.

[0090] When users need to authenticate the credibility of a previous web page data, they only need to submit Figure 5 The authentication data packet generated in step S518.

[0091] After receiving the authentication packet, the authentication server first uses the identifier to determine which security authentication device generated the packet. After identifying the specific security authentication device, it retrieves the previously stored public key for that device. Using the public key, it verifies the signature in the packet. If the signature verifies correctly, the authentication packet has indeed been authenticated by the security authentication device, indicating that the data has not been tampered with.

[0092] After confirming the data is authentic, the TLS key in the data packet is used to decrypt the HTML encrypted text to obtain the original text. Third parties can use the decrypted text content to conduct user information assessment and other operations without worrying about data tampering.

[0093] Combined with the above Figures 2 to 5 , describes the method embodiment of the present application in detail, and the following is combined with Figures 6 to 8 , the device embodiment of the present application is described in detail. It should be understood that the description of the method embodiment corresponds to the description of the device embodiment, so for parts not described in detail, reference can be made to the previous method embodiment.

[0094] Figure 6 It is a structural diagram of a security authentication device provided in one embodiment of the present application. Figure 6 The device shown can be used in the authentication method described above. Figure 6 The security authentication device 600 shown stores a public key and a private key of the security authentication device 600. The security authentication device 600 may include a sending unit 610, a receiving unit 620, and a generating unit 630. These units are described in detail below.

[0095] The sending unit 610 can be used to send a first key to the user terminal, where the first key is used to construct a TLS key, and the TLS key is used to encrypt web page data of a target website accessed by the user terminal.

[0096] The receiving unit 620 may be configured to receive webpage data encrypted with the TLS key and sent by the user terminal.

[0097] The generating unit 630 may be configured to generate an authentication data packet including the web page data and a digital signature for the web page data, wherein the digital signature is generated based on the private key and is used by an authentication server storing the public key to authenticate the web page data.

[0098] Optionally, in some embodiments, the web page data in the authentication data packet is web page data encrypted by the TLS key, and the authentication data packet also includes the TLS key; or, the web page data in the authentication data packet is web page data decrypted using the TLS key.

[0099] Optionally, in some embodiments, the generation unit 630 may also be configured to generate a public key and a private key for the security authentication device. The security authentication device 600 may further include an authentication unit 640. The authentication unit 640 is configured to send the public key to the authentication server so that the authentication server authenticates the public key, obtains an authentication certificate, and stores the authentication certificate sent by the authentication server.

[0100] Optionally, in some embodiments, the authentication server is a blockchain-based authentication server, the public key and the authentication certificate are stored in the blockchain, and the authentication of the public key is completed by calling a smart contract of the blockchain.

[0101] Optionally, in some embodiments, the security authentication device is a USB key.

[0102] Figure 7 It is a structural diagram of a user terminal provided in one embodiment of the present application. Figure 7 The dotted lines in the figure indicate that the unit or module is optional. The user terminal 700 can be used for the method described in the above method embodiment. The user terminal 700 includes a first receiving unit 710, a second receiving unit 720, and a sending unit 730.

[0103] The first receiving unit 710 may be configured to receive a first key sent by the security authentication device, where the first key is used to construct a TLS key.

[0104] The second receiving unit 720 may be configured to receive webpage data encrypted by the TLS key from a target website.

[0105] The sending unit 730 can be configured to send the webpage data encrypted by the TLS key to the security authentication device so that the security authentication device generates an authentication data packet. The authentication data packet includes the webpage data and a digital signature for the webpage data, the digital signature being generated based on the private key and used by the authentication server to authenticate the webpage data.

[0106] Optionally, in some embodiments, the web page data in the authentication data packet is web page data encrypted by the TLS key, and the authentication data packet also includes the TLS key; or, the web page data in the authentication data packet is web page data decrypted using the TLS key.

[0107] Optionally, in some embodiments, the security authentication device 600 stores an authentication certificate generated by the authentication server after authenticating the public key, and the user terminal 700 further includes a verification unit 740. The verification unit 740 is configured to verify the reliability of the authentication certificate when the security authentication device 600 is installed on the user terminal 700.

[0108] Optionally, in some embodiments, the security authentication device is a USB key.

[0109] Figure 8 8 is a schematic diagram of the structure of a trusted authentication device provided in one embodiment of the present application. The trusted authentication device 800 may be, for example, a user terminal or a security authentication device. The trusted authentication device 800 may include a memory 810 and a processor 820. The memory 810 may be used to store executable code. The processor 820 may be used to execute the executable code stored in the memory 810 to implement the steps in the various methods described above. In some embodiments, the trusted authentication device 800 may also include a network interface 830, through which data exchange between the processor 820 and an external device may be implemented.

[0110] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0111] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present disclosure is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0112] Those skilled in the art will appreciate that the units and algorithm steps of the various examples described in conjunction with the embodiments of the present disclosure can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0113] In the several embodiments provided in the present disclosure, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0115] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0116] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A trusted authentication method, wherein the trusted authentication method is applied to a security authentication device, wherein the security authentication device can be installed on a user terminal, and wherein the public key and private key of the security authentication device are stored on the security authentication device. The method comprises: Sending a first key to the user terminal, where the first key is used to construct a TLS key, and the TLS key is used to encrypt webpage data of a target website accessed by the user terminal; Receiving the webpage data encrypted by the TLS key sent by the user terminal; Generate an authentication data packet, the authentication data packet including the web page data and a digital signature for the web page data, the digital signature being generated based on the private key, the digital signature being used for the authentication server storing the public key to authenticate the web page data. The web page data in the authentication data packet is web page data encrypted by the TLS key.

2. According to the trusted authentication method according to claim 1, the authentication data packet further includes the TLS key; or, the web page data in the authentication data packet is the web page data decrypted using the TLS key.

3. The trusted authentication method according to claim 1, before sending the first secret key to the user terminal, the authentication method further comprises: Generate a public key and a private key for the security authentication device; Sending the public key to the authentication server so that the authentication server authenticates the public key and obtains an authentication certificate, The authentication certificate sent by the authentication server is stored.

4. The trusted authentication method according to claim 3, wherein the authentication server is a blockchain-based authentication server, the public key and the authentication certificate are stored in the blockchain, and the authentication of the public key is completed by calling the smart contract of the blockchain.

5. The trusted authentication method according to claim 4, wherein the security authentication device is a USB key.

6. A trusted authentication method, the authentication method being applied to a user terminal, the user terminal being equipped with a security authentication device, the security authentication device storing the public key and private key of the security authentication device, The method comprises: Receiving a first secret key sent by the security authentication device, where the first secret key is used to construct a TLS secret key, and the TLS secret key is used to encrypt webpage data of a target website accessed by the user terminal; Receiving the webpage data encrypted by the TLS key from the target website; Sending the web page data encrypted by the TLS key to the security authentication device so that the security authentication device generates an authentication data packet, wherein the authentication data packet includes the web page data and a digital signature for the web page data, wherein the digital signature is generated based on the private key and is used for the authentication server storing the public key to authenticate the web page data. The web page data in the authentication data packet is web page data encrypted by the TLS key.

7. The trusted authentication method according to claim 6, wherein the authentication data packet further includes the TLS key; or the web page data in the authentication data packet is the web page data decrypted using the TLS key.

8. The trusted authentication method according to claim 6, wherein the security authentication device stores an authentication certificate generated by the authentication server after authenticating the public key. Before receiving the first secret key sent by the security authentication device, the method further includes: When the security authentication device is installed on the user terminal, the reliability of the authentication certificate is verified.

9. The trusted authentication method according to claim 6, wherein the security authentication device is a USB key.

10. A security authentication device, which can be installed on a user terminal, wherein the public key and private key of the security authentication device are stored on the security authentication device, and the security authentication device comprises: a sending unit, configured to send a first key to the user terminal, where the first key is used to construct a TLS key, and the TLS key is used to encrypt webpage data of a target website accessed by the user terminal; a receiving unit, configured to receive the webpage data encrypted by the TLS key and sent by the user terminal; a generating unit, configured to generate an authentication data packet, wherein the authentication data packet includes the web page data and a digital signature for the web page data, wherein the digital signature is generated based on the private key and is used for the authentication server storing the public key to authenticate the web page data. The web page data in the authentication data packet is web page data encrypted by the TLS key.

11. The security authentication device according to claim 10, wherein the authentication data packet further comprises the TLS key; or the web page data in the authentication data packet is the web page data decrypted using the TLS key.

12. The security authentication device according to claim 10, wherein the generating unit is further configured to generate a public key and a private key of the security authentication device; The security authentication device further includes: an authentication unit, configured to send the public key to the authentication server so that the authentication server authenticates the public key and obtains an authentication certificate, The authentication certificate sent by the authentication server is stored.

13. According to the security authentication device according to claim 12, the authentication server is a blockchain-based authentication server, the public key and the authentication certificate are stored in the blockchain, and the authentication of the public key is completed by calling the smart contract of the blockchain. The security authentication device according to claim 10 , wherein the security authentication device is a USB key.

15. A user terminal, wherein a security authentication device can be installed, wherein the security authentication device stores a public key and a private key of the security authentication device, and the user terminal comprises: a first receiving unit, configured to receive a first key sent by the security authentication device, wherein the first key is used to construct a TLS key, and the TLS key is used to encrypt webpage data of a target website accessed by the user terminal; A second receiving unit, configured to receive the webpage data encrypted by the TLS key from the target website; A sending unit is used to send the web page data encrypted by the TLS secret key to the security authentication device, so that the security authentication device generates an authentication data packet, the authentication data packet includes the web page data and a digital signature for the web page data, the digital signature is generated based on the private key, and the digital signature is used to perform trusted authentication on the web page data by an authentication server storing the public key, wherein the web page data in the authentication data packet is the web page data encrypted by the TLS secret key.

16. The user terminal according to claim 15, wherein the authentication data packet further includes the TLS key; or the web page data in the authentication data packet is the web page data decrypted using the TLS key.

17. The user terminal according to claim 15, wherein the security authentication device stores an authentication certificate generated by the authentication server after authenticating the public key, and the user terminal further comprises: A verification unit is used to verify the reliability of the authentication certificate when the security authentication device is installed on the user terminal.

18. The user terminal according to claim 15, wherein the security authentication device is a USB key.

Images