A method and device for storing large object data

Abstract

The present invention discloses a method and device for storing large object data, the method includes: a registration process and an authentication process, wherein the registration process includes: a client obtains a large object key, encrypts the large object data of the organization according to the large object key, and then processes to generate a large object data block, and updates the large object array obtained from the identity authenticator according to the large object data block and then stores it in the identity authenticator, and the authentication process includes: the client obtains the large object data from the identity authenticator, and performs identity authentication operations according to the large object data. Through this method, the use scenarios and industry uses of the identity authenticator under the framework of the FIDO protocol are expanded, thereby promoting the combination of the identity authenticator with various industry fields.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method and device for storing large object data. Background Art

[0002] In the existing technology, under the framework of the FIDO protocol, during the registration and authentication process, the client is only allowed to store credential data in the identity authenticator (such as a key device), and cannot store data associated with the credentials or certificate data in the identity authenticator, thereby limiting the expansion and use of the identity authenticator's usage scenarios. Summary of the Invention

[0003] The present invention provides a method and device for storing large object data, which solves the above technical problems.

[0004] The present invention provides a method for storing large object data, which includes: a registration process and an authentication process; the registration process includes:

[0005] Step 01: After the client determines that the identity authenticator supports the large object extension, it obtains the credential identifier generated by the identity authenticator and the large object key associated with the credential identifier, organizes the large object data, and encrypts the large object data using the large object key to obtain ciphertext data.

[0006] Step 02: The client sends a large object data read instruction to the identity authenticator;

[0007] Step 03: The identity authenticator returns a large object array to the client;

[0008] Step 04: The client generates a large object data block based on the ciphertext data in a predetermined format, encapsulates the large object data block into a large object array to generate a new large object array, and generates a set large object instruction based on the new large object array;

[0009] Step 05: The client sends the large object setting instruction to the identity authenticator;

[0010] Step 06: The identity authenticator parses the setting large object instruction to obtain a new large object array, and stores the new large object array as a large object array;

[0011] The certification process includes:

[0012] Step B1: After the client determines that the identity authenticator supports large object extension, it sends a credential verification instruction including a credential identifier to the identity authenticator;

[0013] Step B2: The identity authenticator obtains the credential based on the credential identifier, performs an authentication operation based on the credential to obtain an operation result, generates a credential verification instruction response based on the operation result, and sends the credential verification instruction response to the client;

[0014] In step B3, the client receives the credential verification instruction response and determines the operation result in the credential verification instruction response. If the operation result is a successful authentication, the client obtains the large object key in the credential verification instruction response and executes step B4. If the operation result is a failed authentication, the client reports an error and ends the process.

[0015] Step B4: The client sends a large object data read instruction to the identity authenticator;

[0016] Step B5: The identity authenticator returns a large object array to the client;

[0017] Step B6: The client traverses the large object data blocks in the large object array to find a large object data block that conforms to a predetermined format, parses the found large object data block to obtain a parsing result, and decrypts the parsing result using the large object key to obtain plaintext data.

[0018] Step B7: The client calculates the length of the plaintext data and determines whether the length of the plaintext data is legal. If so, the client obtains the large object data based on the plaintext data and executes step B8; if not, an error is reported.

[0019] Step B8: The client performs identity authentication based on the acquired large object data.

[0020] The present invention also provides a device for storing large object data, which includes at least one processor, a memory, and instructions stored in the memory and executable by the at least one processor. The at least one processor executes the instructions to implement the above-mentioned method for storing large object data.

[0021] The present invention also provides a computer-readable storage medium, which includes a computer program. When the computer program is run on a computer, the computer is caused to execute the above-mentioned method for storing large object data.

[0022] The present invention also provides a chip, which is coupled to a memory and is used to execute a computer program stored in the memory to execute the above method for storing large object data.

[0023] Beneficial effects of the present invention: The present invention provides a method and device for storing large object data, which can encapsulate data associated with credentials or certificate data as large object data and store them in an identity authenticator (such as a key device), thereby expanding the use scenarios and industry uses of identity authenticators under the framework of the FIDO protocol, thereby promoting the integration of identity authenticators with various industry fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 and Figure 2 A flow chart of a method for storing large object data provided in the first embodiment of the present invention;

[0025] Figure 3 and Figure 4 This is a flow chart of a method for storing large object data provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0027] Terminology Notes:

[0028] A large object is a large data object associated with the current credential. The data object can be certificate data, user privacy information, image information, or permission restrictions. Usually, a data object larger than 1KB is called a large data object.

[0029] Example 1

[0030] This embodiment provides a method for storing large object data, such as Figure 1 and Figure 2 As shown, including: registration process and certification process;

[0031] The registration process includes:

[0032] Step 101: After determining that the identity authenticator supports the large object extension, the client obtains the credential identifier generated by the identity authenticator and the large object key associated with the credential identifier, organizes the large object data, and encrypts the large object data using the large object key to obtain ciphertext data.

[0033] Step 102: The client sends a large object data read instruction to the identity authenticator;

[0034] Step 103: The identity authenticator returns a large object array to the client.

[0035] Step 104: The client generates a large object data block according to the ciphertext data in a predetermined format, encapsulates the large object data block into a large object array to generate a new large object array, and generates a set large object instruction according to the new large object array.

[0036] Step 105: The client sends a large object setting instruction to the identity authenticator;

[0037] Step 106: The identity authenticator parses the set large object instruction to obtain a new large object array, and stores the new large object array as a large object array.

[0038] The certification process includes:

[0039] Step B101: After determining that the identity authenticator supports large object extension, the client sends a credential verification instruction including a credential identifier to the identity authenticator.

[0040] In step B102, the identity authenticator obtains the credential based on the credential identifier, performs an authentication operation based on the credential to obtain an operation result, generates a credential verification instruction response based on the operation result, and sends the credential verification instruction response to the client;

[0041] In step B103, the client receives the credential verification instruction response and determines the operation result in the credential verification instruction response. If the operation result is a successful authentication, the client obtains the large object key in the credential verification instruction response and executes step B104. If the operation result is a failed authentication, the client reports an error and the process ends.

[0042] Step B104: The client sends a large object data read instruction to the identity authenticator;

[0043] Step B105: The identity authenticator returns a large object array to the client;

[0044] Step B106: The client traverses the large object data blocks in the large object array to find a large object data block that conforms to a predetermined format, parses the found large object data block to obtain a parsing result, and decrypts the parsing result using the large object key to obtain plaintext data.

[0045] Step B107: The client calculates the length of the plaintext data and determines whether the length of the plaintext data is legal. If so, the client obtains the large object data based on the plaintext data and executes step B108; if not, an error is reported.

[0046] Step B108: The client performs identity authentication based on the acquired large object data.

[0047] In a possible implementation, the client determines that the identity authenticator supports the large object extension by: the client obtains device information of the identity authenticator, and when the value of the extension field in the device information is a predetermined value, it is determined that the identity authenticator supports the large object extension.

[0048] In a possible implementation, after the client determines in step 101 that the identity authenticator supports large object extension, the method further includes: the client obtaining the maximum capacity of the large object array from the device information;

[0049] Specifically, step 104 includes: the client generates a large object data block according to the ciphertext data in a predetermined format, calculates the capacity of the new large object array, determines whether the capacity of the new large object array is greater than the maximum capacity of the large object array, and if so, reports an error; if not, encapsulates the large object data block into the large object array to generate a new large object array, and generates a set large object instruction based on the new large object array.

[0050] In a possible implementation, step B106 specifically includes:

[0051] Step m1: The client finds a large object data block from the large object array and uses it as the current large object data block.

[0052] Step m2: The client determines whether the format of the current large object data block is the same as the predetermined format. If yes, the client executes step m3; if not, the client executes step m4.

[0053] In step m3, the client parses the current large object data block to obtain ciphertext data, decrypts the ciphertext data using the large object key, and determines whether the decryption is successful. If yes, execute step B107; if not, execute step m4.

[0054] In step m4, the client determines whether the next untraversed large object data block can be found in the large object array. If so, the client uses the next untraversed large object data block as the current large object data block and executes step m2. If not, an error is reported.

[0055] In a possible implementation, in step 101, the large object data is organized and encrypted using the large object key to obtain ciphertext data:

[0056] The client organizes the large object data, compresses the large object data, and uses the compression result as the plaintext original data; obtains the length of the plaintext original data, and obtains the associated data based on the length of the plaintext original data; generates a random number; and encrypts the plaintext original data based on the random number, the associated data, and the large object key to obtain the ciphertext data;

[0057] In step B106, the large object data block in the same format as the predetermined format is parsed to obtain a parsing result, and the parsing result is decrypted using the large object key to obtain plaintext data. Specifically, the large object data block in the same format as the predetermined format is parsed to obtain ciphertext data, a random number, and the length of the original plaintext data, associated data is obtained based on the length of the original plaintext data, and the ciphertext data is decrypted using the random number, the associated data, and the large object key to obtain the plaintext data.

[0058] The specific method of obtaining the large object data according to the plaintext data in B107 is: decompressing the plaintext data to obtain a decompression result, and using the decompression result as the large object data.

[0059] In a possible implementation, before step 101, the method further includes: the client obtaining a user PIN code identifier sent by the identity authenticator indicating that PIN code verification is set;

[0060] In step 101, obtaining the credential identifier generated by the identity authenticator and the large object key associated with the credential identifier specifically includes:

[0061] Step 101-1: The client sends a PIN code verification identifier and a PIN code verification protocol identifier to the identity authenticator;

[0062] In step 101-2, the identity authenticator calculates the PIN verification value based on the PIN verification protocol identifier and the PIN verification identifier, and determines whether the calculated PIN verification value is correct based on the PIN value stored in the identity authenticator. If so, the identity authenticator generates a credential identifier and a large object key associated with the credential identifier. If not, an error message is reported.

[0063] Example 2

[0064] This embodiment provides a method for storing large object data, including a registration process and an authentication process.

[0065] like Figure 3 As shown, the registration process includes the following steps:

[0066] Step 201: The client sends a device information acquisition instruction to the identity authenticator;

[0067] In this embodiment, the identity authenticator is specifically a FIDO identity authenticator.

[0068] Step 202: The identity authenticator returns a response to the instruction to obtain device information to the client.

[0069] In this embodiment, the response to the instruction to obtain device information may include a user PIN code identifier.

[0070] The user PIN code identifier is used to identify whether the identity authenticator is set with a PIN code. The value of the user PIN code identifier can be a first preset value or a second preset value.

[0071] In this embodiment, the first preset value is true and the second preset value is false;

[0072] For example, when the value of the user PIN code identifier is true, it indicates that the identity authenticator is set with a PIN code, and when the value of the user PIN code identifier is false, it indicates that the identity authenticator is not set with a PIN code.

[0073] The response to the instruction to obtain device information may further include a user presence verification identifier, which is used to identify whether a user key press is required for confirmation. The value of the user presence verification identifier may be a first preset value or a second preset value.

[0074] For example, when the value of the user presence verification flag is true, it means that the user needs to press a key to confirm; when the value of the user presence verification flag is false, it means that the user does not need to press a key to confirm;

[0075] The response to the instruction to obtain device information may further include a user biometric verification identifier, which is used to identify whether user fingerprint verification is required. The value of the user biometric verification identifier may be true or false.

[0076] For example, when the value of the user biometric verification identifier is true, it means that the user needs to verify the fingerprint, and when the value of the user verification identifier is false, it means that the user does not need to verify the fingerprint.

[0077] In the response to the Get Device Information command, the value of the user presence verification identifier is false, and the value of the user biometric verification identifier is true.

[0078] or

[0079] The value of the user presence verification flag is true, and the value of the user biometric verification flag is false.

[0080] In step 203, the client parses the response to the Get Device Information command to obtain a parsed result, and determines whether the authenticator supports the Large Object Key extension based on the parsed result. If so, the client proceeds to step 204; if not, the client proceeds to the conventional FIDO registration process without the Large Object Key extension.

[0081] Specifically, in this step, the client parses the response to the Get Device Information instruction and obtains the extensions-related field. The client determines whether the extensions-related field contains the Large Object Key extension item. If so, the client executes step 204. If not, the client executes the conventional FIDO registration process without the Large Object Key extension item.

[0082] The following is an example of this step. The response of the client to obtain device information instruction is:

[0083] The client performs CBOR decoding on the response to the device information command to obtain the following data: {1:["U2F_V2","FIDO_2_0","FIDO_2_1","FIDO_2_1_PRE"], 2:["credBlob","credProtect","hmac-secret","largeBlobKey","minPinLength"], 3:h'EE041BCE25E54CDB8F86897FD6418464', 4:{"ep":false","rk":true","up":true","plat":false","alwaysUv":false","credMgmt":tr ue, "authnrCfg": true, "clientPin": false, "largeBlobs": true, "pinUvAuthToken": true, "setMinPINLength": true, "makeCredUvNotRqd": true, "creden tialMgmtPreview":true}, 5:1400, 6:[1, 2], 7:6, 8:96, 9:["nfc", "usb"], 10:[{"alg":-7, "type":"public-key"}], 11:1024, 12:false, 13:4, 15:32, 16:3};

[0084] The client determines that field 2 of the decoded data contains a large object key field and field 4 contains a "largeBlobs":true field, indicating that the identity authenticator supports large object key extension, and then executes step 204.

[0085] Step 204: The client obtains the maximum capacity of the large object array in the parsing result and saves it, and sends a credential registration instruction to the identity authenticator;

[0086] In this embodiment, in the data example obtained by performing CBOR decoding on the client's response to the device information instruction, field 11 is the maximum capacity of the large object array, that is, 1024.

[0087] In this step, the credential registration instruction includes the following parameters:

[0088] The key attribute that needs to be saved, and the value of the key attribute that needs to be saved is true;

[0089] Large object key identifier, and the value of the large object key identifier is true,

[0090] Relying party identification and user information.

[0091] In this embodiment, when the response to the instruction to obtain device information in step 202 includes a user PIN code identifier, and the value is the first preset value, the credential registration instruction in this step may also include the following parameters:

[0092] PIN code verification identifier, indicating the value of the PIN code;

[0093] and the PIN code verification protocol identifier, indicating the algorithm used for encryption and decryption of the PIN code.

[0094] In this embodiment, the credential registration instruction may also include the following parameters:

[0095] User presence verification flag, used to indicate whether the user needs to press a button to confirm.

[0096] For example, when the value of the user presence verification flag is true, it means that the user needs to press a key to confirm; when the value of the user presence verification flag is false, it means that the user does not need to press a key to confirm;

[0097] The user biometric verification identifier is used to indicate whether the user needs to verify the fingerprint.

[0098] For example, when the value of the user biometric verification identifier is true, it means that the user needs to verify the fingerprint, and when the value of the user verification identifier is false, it means that the user does not need to verify the fingerprint;

[0099] Step 205: The identity authenticator generates a credential ID and a large object key associated with the credential ID, and returns a response to the credential registration instruction including the credential ID and the large object key to the client.

[0100] In this step, the identity authenticator generates a corresponding credential ID based on the relying party identifier and user information, and generates a large object key associated with the credential ID.

[0101] The identity authenticator generates a corresponding credential ID based on the relying party identifier and user information, and generates a large object key associated with the credential ID as follows: the identity authenticator generates a random number, uses the random number as the large object key, and binds the large object key with the corresponding credential ID and the relying party identifier generated based on the relying party identifier and user information.

[0102] In this embodiment, when the credential registration instruction sent by the client to the identity authenticator includes a PIN code verification identifier and a PIN code verification protocol identifier, this step also includes the identity authenticator judging whether the value of the PIN code verification identifier is legal based on the PIN code verification identifier and the PIN code verification protocol identifier. If yes, execute step 205; if not, report an error.

[0103] The identity authenticator determines whether the value of the PIN code verification identifier is legal based on the PIN code verification identifier and the PIN code verification protocol identifier. Specifically, the identity authenticator operates on the value represented by the PIN code verification identifier according to the algorithm represented by the PIN code verification protocol identifier to obtain a PIN code verification value, and determines whether the PIN code verification value is the same as the PIN code value stored in itself. If so, it is legal and step 205 is executed. If not, it is illegal and an error is reported.

[0104] In this embodiment, when the credential registration instruction sent by the client to the identity authenticator also includes a user presence verification identifier and a user biometric verification identifier, the identity authenticator determines whether it is necessary to verify the user's presence or perform biometric verification on the user based on the values ​​of the user presence verification identifier and the user biometric verification identifier. If necessary, step 205 is executed after the verification is passed.

[0105] In step 206, the client parses the response to the credential registration instruction to obtain the credential ID and the large object key. The client organizes and compresses the large object data, using the compressed result as the plaintext original data. The client obtains the length of the plaintext original data and obtains the associated data based on the length of the plaintext original data. The client generates a random number. The client encrypts the plaintext original data using the random number, the associated data, and the large object key to obtain ciphertext data.

[0106] In this step, the associated data is obtained according to the length of the original plaintext data by concatenating the little-endian description length of the original data with the predetermined character string, and the concatenated result is used as the associated data;

[0107] In this step, generating a random number specifically includes: the client calls a random number generation function of the system to generate a random number, wherein the random number may be a random number of a predetermined length.

[0108] In this embodiment, the random number generation function of the system may be a rand function or a srand function.

[0109] In this step, the original plaintext data is encrypted according to the random number, associated data and key to obtain the ciphertext data. Specifically, the client calls the system's encryption function AEAD_AES_256_GCM function, and the parameters are the random number, original plaintext data, associated data and key. The call result obtained is the ciphertext data.

[0110] Step 207: The client sends a large object read instruction to the identity authenticator.

[0111] Step 208: The identity authenticator returns a response to the large object read instruction to the client, wherein the response includes the large object array;

[0112] In this embodiment, the large object array includes array data and verification data, wherein the verification data is the last 16 bytes of the large object array, specifically a hash value of the array data.

[0113] In this embodiment, the initial value of the large object array is preset, and the initial value of the large object array is the preset empty CBOR array (80) plus the hash value of the preset empty CBOR array (80) of 16 bytes.

[0114] Step 209: The client parses the response to the large object read instruction returned by the identity authenticator to obtain a large object array, and determines whether the large object array is legal. If so, step 210 is executed; if not, an error is reported.

[0115] This step is specifically as follows: the client parses the response to the read large object instruction returned by the identity authenticator to obtain a large object array, obtains the verification data in the large object array to verify the legitimacy of the large object array, and if it is legal, executes step 210; if it is illegal, reports an error.

[0116] Specifically, the legality of the large object array is verified as follows: the client performs a hash operation on the array data in the large object array to obtain a first hash value, and determines whether the first hash value is the same as the verification data in the large object array. If they are the same, it is legal; otherwise, it is illegal.

[0117] In step 210, the client encapsulates the ciphertext data, the random number, and the length of the plaintext original data into a large object data block according to a preset format; and modifies the large object array according to the assembled large object data block to obtain a new large object array.

[0118] In this embodiment, the preset format is a map format. The data in the map format includes three fields. The first field is ciphertext data, the second field is a random number, and the third field is the length of the plaintext original data.

[0119] In this step, the client encapsulates the ciphertext data, random number and length of the plaintext original data into a large object data block according to a preset format. Specifically, the client encapsulates the ciphertext data, random number and length of the plaintext original data into a large object data block according to a map format.

[0120] The new large object array is obtained by modifying the large object array according to the composed large object data blocks as follows: the composed large object data blocks are spliced ​​with the array data of the large object array to generate new large object array data, a hash operation is performed on the new large object array data to obtain new verification data, and the new large object array data and the new verification data are spliced ​​to generate a new large object array.

[0121] Step 211: The client determines whether the capacity of the new large object array is greater than the maximum capacity of the acquired large object array. If not, step 212 is executed. If yes, an error is reported.

[0122] Step 212: The client generates a set large object instruction based on the new large object array and sends the set large object instruction to the identity authenticator.

[0123] Step 213: The identity authenticator parses the received large object setting instruction to obtain a new large object array.

[0124] Step 214: The identity authenticator determines whether the new large object array is legal. If so, step 215 is executed; if not, step 216 is executed.

[0125] This step is specifically as follows: the identity authenticator performs a hash operation on the array data in the new large object array to obtain a second hash value, and determines whether the second hash value is the same as the verification data in the new large object array. If yes, execute step 215; if not, execute step 216.

[0126] Step 215: The identity authenticator saves the new large object array as a large object array and returns a response to the client indicating that the large object has been successfully set.

[0127] Step 216: The identity authenticator returns a response to the client indicating that the large object setting failed.

[0128] like Figure 4 As shown, the authentication process includes the following steps:

[0129] Step 301: The client sends a device information acquisition instruction to the identity authenticator;

[0130] Step 302: The identity authenticator returns a response to the instruction to obtain device information to the client.

[0131] In step 303, the client parses the response to the Get Device Information command to determine whether the authenticator supports the Large Object Key extension. If so, the client proceeds to step 304. If not, the client proceeds to the conventional FIDO authentication process without the Large Object Key extension.

[0132] Specifically, in this step, the client parses the response to the Get Device Information command to obtain the maximum value of the extensions field and the capacity of the large object array. The client then determines whether the extensions field contains the Large Object Key extension. If so, the client executes step 304. If not, the client executes the conventional FIDO authentication process without the Large Object Key extension.

[0133] Step 304: The client sends a credential verification instruction including the credential ID to the identity authenticator;

[0134] In this step, the credential verification instruction includes the credential ID and the identifier of the large object key, wherein the value of the identifier of the large object key is true;

[0135] In this step, the credential verification instruction also includes the relying party identifier;

[0136] In this embodiment, the credential verification instruction may also include the following parameters:

[0137] User presence verification flag, used to indicate whether the user needs to press a button to confirm.

[0138] For example, when the value of the user presence verification flag is true, it means that the user needs to press a key to confirm; when the value of the user presence verification flag is false, it means that the user does not need to press a key to confirm;

[0139] User biometric verification identifier, used to indicate whether user fingerprint verification is required.

[0140] For example, when the value of the user biometric verification identifier is true, it means that the user needs to verify the fingerprint, and when the value of the user verification identifier is false, it means that the user does not need to verify the fingerprint;

[0141] In this embodiment, when the instruction to obtain device information in step 302 includes a user PIN code identifier and the value of the user PIN code identifier is true, the credential registration instruction in this step may also include the following parameters:

[0142] User presence verification flag, and the value of the user presence verification flag is true;

[0143] PIN code verification identifier, indicating the value of the PIN code;

[0144] and the PIN code verification protocol identifier, indicating the algorithm used for encryption and decryption of the PIN code.

[0145] In this embodiment, the credential verification instruction may also include the following parameters:

[0146] The user presence verification flag is false.

[0147] The user's biometric verification identifier and the value of the user's biometric verification identifier is true.

[0148] In step 305, the identity authenticator parses the credential verification instruction to obtain a credential ID, obtains the credential based on the credential ID, performs an authentication operation based on the credential to obtain an operation result, generates a credential verification instruction response based on the operation result, and returns the credential verification instruction response to the client.

[0149] In this step, authentication is performed based on the credentials. Specifically, the authentication operation is performed by executing the conventional FIDO authentication process without the Large Object Key extension based on the credentials.

[0150] This step is specifically as follows: the identity authenticator parses the credential verification instruction to obtain the credential ID and the relying party identifier, obtains the credential based on the credential ID, performs the conventional FIDO authentication process without the large object key extension based on the credential to perform the authentication operation, and obtains the operation result. When the operation result is a successful authentication operation result, the identity authenticator obtains the large object key associated with the credential ID and the relying party identifier stored in itself based on the credential ID and the relying party identifier, and returns a credential verification instruction response including the successful authentication operation result and the large object key to the client; when the operation result is an unsuccessful authentication operation result, the identity authenticator returns the credential verification instruction response including the unsuccessful authentication operation result to the client.

[0151] In this embodiment, when the credential verification instruction in step 304 includes a PIN code verification identifier and a PIN code verification protocol identifier, this step also includes, before which the identity authenticator determines whether the value of the PIN code verification identifier is legal based on the PIN code verification identifier and the PIN code verification protocol identifier. If so, step 305 is executed; if not, an error is reported.

[0152] The identity authenticator determines whether the value of the PIN code verification identifier is legal based on the PIN code verification identifier and the PIN code verification protocol identifier. Specifically, the identity authenticator calculates the value of the PIN code verification identifier according to the algorithm corresponding to the PIN code verification protocol identifier to obtain the PIN code value, and determines whether the PIN code value is the same as the PIN code value stored in itself. If so, it is legal and step 305 is executed. If not, it is illegal and an error is reported.

[0153] In this embodiment, when the credential registration instruction sent by the client to the identity authenticator also includes a user presence verification identifier and a user biometric verification identifier, the identity authenticator determines whether it is necessary to verify the user's presence or perform biometric verification on the user based on the values ​​of the user presence verification identifier and the user biometric verification identifier. After the verification is passed, step 305 is executed.

[0154] In step 306, the client receives the credential verification instruction response and determines the operation result in the credential verification instruction response. When the operation result is an authentication success, the client obtains the large object key in the credential verification instruction response and executes step 307. When the operation result is an authentication failure, the client reports an error and ends.

[0155] Step 307: The client sends a large object data read instruction to the identity authenticator.

[0156] Step 308: The identity authenticator returns a large object data read instruction response to the client, wherein the large object data read instruction response includes a large object array;

[0157] Step 309: The client parses the response to the instruction to read the large object data returned by the identity authenticator to obtain a large object array, and determines whether the large object array is legal. If so, step 310 is executed; if not, an error is reported.

[0158] The process of determining whether the large object array is legal in this step is the same as the process of determining whether the large object array is legal in step 210, and will not be repeated here.

[0159] In step 310, the client traverses the large object data blocks in the large object array, finds a large object data block that matches the predetermined format, parses the found large object data block to obtain ciphertext data, a random number, and the length of the original plaintext data, obtains associated data based on the length of the original plaintext data, and decrypts the ciphertext data based on the random number, the associated data, and the large object key to obtain the plaintext data.

[0160] In this embodiment, this step is specifically as follows:

[0161] Step m1: The client finds a large object data block from the large object array and uses it as the current large object data block.

[0162] Step m2: The client determines whether the format of the current large object data block is the same as the preset format. If yes, execute step m3; if not, execute step m4.

[0163] This step is specifically as follows: the client determines whether the format of the current large object data block is map format. If yes, execute step m3; if not, execute step m4;

[0164] In step m3, the client parses the current large object data block to obtain the ciphertext data, the random number, and the length of the original plaintext data. The client obtains the associated data based on the length of the original plaintext data, decrypts the ciphertext data based on the random number, the associated data, and the large object key, and determines whether the decryption is successful. If so, the client executes step 311; if not, the client executes step m4.

[0165] In step m4, the client determines whether the next untraversed large object data block can be found in the large object array. If so, the client uses the next untraversed large object data block as the current large object data block and executes step m2. If not, an error is reported.

[0166] Step 311: The client calculates the length of the plaintext data and determines whether the length of the plaintext data is the same as the length of the original plaintext data. If so, step 312 is executed; if not, an error is reported.

[0167] In step 312, the client decompresses the plaintext data and uses the decompression result as the large object data.

[0168] In this embodiment, step 205 may also be: the identity authenticator generates a certificate request and a large object key, and returns a response to the credential registration instruction including the certificate request and the large object key to the client;

[0169] In this embodiment, the large object data specifically includes: a certificate issued by an e-commerce certification authority (CA) associated with the client;

[0170] After step 312, the client also performs an identity authentication operation based on the read large object data (ie, the certificate issued by the CA).

[0171] In this embodiment, the large object data may also include, but is not limited to, user privacy data associated with the credential, stored user identity information, permission scope, or personalized customization information, and the client may perform identity authentication operations based on the large object data.

[0172] Optionally, embodiments of the present application further provide a device for storing large object data, comprising at least one processor, a memory, and instructions stored in the memory and executable by the at least one processor, wherein the at least one processor executes the instructions to implement a method for storing large object data in the above-described embodiments. When the device is a chip system, it may be composed of a chip or may include a chip and other discrete devices, which is not specifically limited in the embodiments of the present application; the chip is coupled to the memory and is configured to execute a computer program stored in the memory to perform the method for storing large object data disclosed in the above-described embodiments.

[0173] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed, the process or function described in the embodiment of the present application is generated in whole or in part. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one base station, server or data center to another base station, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by the device of the present invention or a data storage device such as a server or data center that includes one or more servers that can be integrated with the medium. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0174] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art can understand and implement other changes to the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0175] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for storing large object data, characterized in that: The method comprises: a registration process and an authentication process; The registration process includes: Step 01, after determining that the identity authenticator supports large object extension, the client obtains the credential identifier generated by the identity authenticator and the large object key associated with the credential identifier, organizes the large object data, and uses the large object key to encrypt the large object data to obtain ciphertext data; Step 02, the client sends a large object data read instruction to the identity authenticator; Step 03, the identity authenticator returns a large object array to the client; Step 04, the client generates a large object data block according to the ciphertext data in a predetermined format, encapsulates the large object data block into the large object array to generate a new large object array, and generates a large object setting instruction according to the new large object array; Step 05, the client sends the large object setting instruction to the identity authenticator; Step 06, the identity authenticator parses the setting large object instruction to obtain the new large object array, and stores the new large object array as the large object array; The authentication process includes: Step B1, after the client determines that the identity authenticator supports large object extension, it sends a credential verification instruction including a credential identifier to the identity authenticator; Step B2, the identity authenticator obtains the credential according to the credential identifier, performs an authentication operation according to the credential to obtain an operation result, generates a credential verification instruction response according to the operation result, and sends the credential verification instruction response to the client; Step B3, the client receives the credential verification instruction response, and determines the operation result in the credential verification instruction response. When the operation result is an operation result of successful authentication, the client obtains the large object key in the credential verification instruction response and executes step B4. When the operation result is an operation result of failed authentication, the client reports an error and ends. Step B4, the client sends a large object data read instruction to the identity authenticator; Step B5, the identity authenticator returns a large object array to the client; Step B6, the client traverses the large object data blocks in the large object array to find the large object data blocks that conform to the predetermined format, parses the found large object data blocks to obtain parsing results, and uses the large object key to decrypt the parsing results to obtain plaintext data; Step B7, the client calculates the length of the plaintext data and determines whether the length of the plaintext data is legal. If so, the client obtains the large object data according to the plaintext data and executes step B8; if not, an error is reported; Step B8, the client performs an identity authentication operation according to the acquired large object data; The identity authenticator is specifically an identity authenticator under the FIDO protocol framework; the large object data is specifically object data larger than 1k and associated with the credential.

2. The method according to claim 1, characterized in that The client determines that the identity authenticator supports the large object extension specifically by: the client obtains the device information of the identity authenticator, and when the value of the extension field in the device information is a predetermined value, determines that the identity authenticator supports the large object extension.

3. The method according to claim 2, characterized in that After the client determines in step 01 that the identity authenticator supports large object extension, the method further includes: the client obtaining the maximum value of the capacity of the large object array from the device information; The step 04 is specifically as follows: the client generates a large object data block according to the ciphertext data in a predetermined format, encapsulates the large object data block into a large object array to generate a new large object array, calculates the capacity of the new large object array, and determines whether the capacity of the new large object array is greater than the maximum capacity of the large object array. If so, an error is reported; if not, a large object setting instruction is generated according to the new large object array.

4. The method according to claim 1, characterized in that The step B6 specifically includes: Step m1, the client finds a large object data block from the large object array as the current large object data block; Step m2, the client determines whether the format of the current large object data block is the same as the predetermined format, if yes, executes step m3, if no, executes step m4; Step m3, the client parses the current large object data block to obtain ciphertext data, decrypts the ciphertext data according to the large object key, and determines whether the decryption is successful. If yes, execute step B7; if not, execute step m4; Step m4, the client determines whether the next untraversed large object data block can be found in the large object array. If so, the next untraversed large object data block is used as the current large object data block and step m2 is executed. If not, an error is reported.

5. The method according to claim 1, characterized in that In step 01, the large object data is organized, and the ciphertext data obtained after the large object data is encrypted using the large object key is specifically: The client organizes the large object data, compresses the large object data, and uses the compression result as the plaintext original data; obtains the length of the plaintext original data, and obtains the associated data according to the length of the plaintext original data; Generate random numbers; Encrypt the plaintext original data according to the random number, the associated data and the large object key to obtain the ciphertext data; In step B6, the large object data block is parsed to obtain a parsing result, and the large object key is used to decrypt the parsing result to obtain plaintext data. Specifically, the large object data block is parsed to obtain ciphertext data, a random number, and the length of the original plaintext data, associated data is obtained according to the length of the original plaintext data, and the ciphertext data is decrypted according to the random number, the associated data, and the large object key to obtain the plaintext data; The step of obtaining the large object data according to the plaintext data in B7 specifically includes: decompressing the plaintext data to obtain a decompression result, and using the decompression result as the large object data.

6. The method according to claim 1, characterized in that The step 01 also includes: the client obtaining a user PIN code identifier sent by the identity authenticator indicating that PIN code verification is set; The step 01 of obtaining the credential identifier generated by the identity authenticator and the large object key associated with the credential identifier specifically includes: Step 01-1, the client sends a PIN code verification identifier and a PIN code verification protocol identifier to the identity authenticator; Step 01-2, the identity authenticator calculates the PIN code verification value according to the PIN code verification protocol identifier and the PIN code verification identifier, and determines whether the calculated PIN code verification value is correct according to the PIN code value stored in itself. If so, the identity authenticator generates a credential identifier and a large object key associated with the credential identifier. If not, an error is reported.

7. A device for storing large object data, characterized in that: The device includes at least one processor, a memory, and instructions stored in the memory and executable by the at least one processor, and the at least one processor executes the instructions to implement the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium comprises a computer program, and when the computer program is run on a computer, the computer is caused to perform the method according to any one of claims 1 to 6.

9. A chip, characterized in that: The chip is coupled to a memory and is used to execute a computer program stored in the memory to perform the method according to any one of claims 1 to 6.

Images