A FIDO2 authentication system and method based on Internet network

Abstract

The present invention relates to a FIDO2 authentication system and method based on the Internet network. The system includes a mobile terminal APP (i.e., a FIDO authenticator) for FIDO authentication, a PC-side driver (driver) for forwarding FIDO authentication requests, and a message service for communication between the mobile terminal APP and the PC-side driver. The method includes the steps of: initializing the driver, generating a public key 1 and a private key 1 respectively by calling a keychain or a trusted platform module (Trusted Platform Module, TPM), applying for a message ID 1 from a back-end message service, and communicating and connecting based on WebSocket, etc. The FIDO2 authentication method implemented based on the Internet of the present invention is suitable for various devices, does not require additional hardware support, and supports remote login. In addition, the encryption of communication at both ends realizes a high level of security, and it takes a short time to establish authentication, which is more convenient and quick to operate, thereby improving the efficiency of authentication.

Description

Technical Field

[0001] The present invention relates to the field of digital identity authentication, and in particular to a FIDO2 authentication system and method implemented based on an Internet network. Background Art

[0002] The FIDO Alliance is a non-profit organization composed of multiple companies that aims to promote Internet identity authentication standards and privacy protection. The FIDO2 specification is composed of the W3C standard WebAuthn and the FIDO Client To Application Protocol (CTAP). Using authenticators and servers based on the FIDO2 specification can achieve secure and password-free authentication, thereby improving network security.

[0003] Currently, one of the mainstream login authentication methods for Internet accounts is account + password. In order to facilitate the management of multiple network accounts, most users will choose to use the same password or username. Users with strong network security awareness will use 3 to 5 unrelated account passwords at most, or use password management software. In addition, to ensure security, the relying party (RP) will also require the use of 2FA (two-step verification) to authenticate again, such as requiring users to verify their mobile phone number twice after entering the username and password. In addition to the low convenience of the above situation, there are also potential problems, such as the username and password method is easy to be leaked, stolen by attacks, forgotten, the password management software itself will also have loopholes, the mobile phone number is no longer used and cannot be verified twice, the company requires regular password changes that are easy to forget, and it is also prone to phishing risks.

[0004] To solve the above problems, FIDO came into being. It is based on the principle of cryptography and uses public and private key pairs to achieve password security. As the latest specification, FIDO2 has been implemented and applied by major operating systems and browser manufacturers, and has strong compatibility. Therefore, the demand for FIDO2-based authenticators has increased, but problems have also arisen. Hardware-based FIDO authenticators (such as security keys) have the disadvantages of high economic cost, difficult to update security vulnerabilities, easy to lose, fixed characteristics, and unfriendly to C-end users; while software authenticators based on the FIDO2 standard can solve the above problems well by upgrading using Over-the-Air Technology (OTA), but its mainstream solution is mainly to communicate using BLE, USB or NFC, which have problems such as long connection establishment time, low efficiency, and inability to log in remotely. In addition, there are currently devices that do not support the above three communication methods. Based on the above considerations, the present invention proposes a FIDO2 authentication system and method based on the Internet network. Summary of the invention

[0005] To address the deficiencies of current technologies, the present invention provides a FIDO2 authentication system and method based on the Internet.

[0006] The technical solution adopted by the present invention is:

[0007] A FIDO2 authentication system implemented based on the Internet network includes a mobile APP for FIDO authentication (i.e., a FIDO authenticator), a PC driver for forwarding FIDO authentication requests, and a message service for communication between the mobile APP and the PC driver, wherein the mobile APP, the message service, and the PC driver are connected in sequence.

[0008] The mobile APP includes a functional module, a user module, and a notification module. The three modules are connected to each other, and the notification module is connected to the back-end message service; the functional module includes FIDO2 protocol implementation, encryption algorithm implementation, credential management storage function implementation, communication with the security module (Secure Element, SE) component, control implementation of the user module, and input recognition implementation of the notification module; the driver is simulated as a FIDO authenticator by implementing the USB-HID driver of the operating system, and then forwards the user's FIDO authentication request on the PC side to the notification module of the mobile APP through the back-end message service; the back-end message service is mainly responsible for forwarding data between the FIDO authenticator and the driver, and pushing it to the FIDO authenticator, that is, the system notification of the mobile APP.

[0009] Preferably, the message service and the PC driver communicate via the Internet.

[0010] Preferably, the message service and the mobile APP communicate via the Internet.

[0011] A FIDO2 authentication method based on the Internet network is applied to a FIDO2 authentication system based on the Internet network, and the method comprises the following steps:

[0012] A FIDO2 authentication method based on the Internet network is applied to a FIDO2 authentication system based on the Internet network, and the method comprises the following steps:

[0013] S1, the driver is initialized, public key 1 and private key 1 are generated by calling keychain or Trusted Platform Module (TPM), and a message ID 1 is requested from the backend message service and a communication connection is established based on WebSocket;

[0014] S2, mobile APP is initialized, public key 2 and private key 2 are generated through KeyChain or KeyStore, and a message ID 2 is requested from the operating system.

[0015] S3, the driver displays the public key 1 information and the message ID 1 in the form of a QR code;

[0016] S4, the mobile APP scans the QR code and obtains the public key 1 and message ID 1;

[0017] S5, the mobile APP uses public key 1 to encrypt public key 2, message ID 2 and system platform information, and submits it to the backend message service, indicating that it will be bound to message ID 1 (that is, the driver). The backend message service queries the WebSocket connection and sends mobile data to the driver.

[0018] S6, the driver obtains the mobile data and decrypts it with private key 1 to obtain the mobile APP information, namely, message ID 2 and public key 2;

[0019] S7, the driver uses public key 2 to encrypt the message and responds to the message. The message response is a communication mechanism. After processing the message, it is returned through WebSocket, which also means that the binding is completed.

[0020] S8, the mobile APP gets the response and decrypts it with private key 2, and the binding is completed;

[0021] S9, the driver obtains the FIDO authentication request, packages the request data into message data, encrypts it using public key 2, and sends it to message ID 2;

[0022] S10, the backend message service calls the API of the corresponding system platform of the mobile terminal and the message ID2 to perform system notification and encrypt the message data and send it to the mobile terminal APP;

[0023] S11, the mobile APP receives the system notification and decrypts it using private key 2. If the decryption is successful, it means that the device is paired. If the decryption fails, the request is abandoned.

[0024] S12, the functional module of the mobile APP starts to parse the data and verify it through the FIDO protocol standard;

[0025] S13, after the mobile APP is successfully verified, the user is prompted to authenticate based on the user module;

[0026] S14, the user authenticates through biometrics or other means, indicating that he agrees to the FIDO authentication, encrypts the result with public key 1, and calls the API to return data;

[0027] S15, the backend message service queries the Websocket connection corresponding to message ID1 and sends the data to the driver;

[0028] S16, the driver uses private key 1 to decrypt the data and returns the authentication result to the relying party (RP).

[0029] Preferably, the message ID1 in the method can be obtained by using a public key SHA1 hash algorithm or by directly using a random number as the message ID1.

[0030] Preferably, the message ID2 in the method is obtained through a system notification API.

[0031] The beneficial effects of the present invention are:

[0032] Firstly, the method and system described in the present invention are expanded based on existing standards, so that they are applicable to various devices without the need for additional hardware support; secondly, the present invention implements the authentication process based on the Internet network, can support remote login, and the communication at both ends is encrypted to ensure communication security; finally, the scheme of the present invention can be used based on FIDO2, there is no binding relationship, and the authentication establishment time is short, the operation is more convenient and quick, and the authentication efficiency is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The specific implementation of the present invention will be further described below in conjunction with the accompanying drawings:

[0034] Figure 1 This is a system framework diagram of a FIDO2 authentication system implemented based on the Internet network provided by an embodiment of the present invention;

[0035] Figure 2 This is a method framework diagram of a FIDO2 authentication method implemented based on the Internet network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] Terminology explanation:

[0038] SE: Security Element, usually provided in chip form.

[0039] HID: Human Interface Devices.

[0040] TPM: Trusted Platform Module is an international standard for secure cryptographic processors.

[0041] RP: Relying Party.

[0042] like Figure 1 As shown, a FIDO2 authentication system implemented based on the Internet network includes a mobile APP for FIDO authentication (i.e., a FIDO authenticator), a PC-side driver for forwarding FIDO authentication requests, and a message service for communication between the mobile APP and the PC-side driver. The mobile APP, the message service, and the PC-side driver are connected in sequence, and the message service communicates with the PC-side driver and the mobile APP through the Internet.

[0043] The mobile APP includes a functional module, a user module, and a notification module. The three modules are connected to each other, and the notification module is connected to the back-end message service; the functional module includes FIDO2 protocol implementation, encryption algorithm implementation, credential management storage function implementation, communication with SE elements, control implementation of the user module, and input recognition implementation of the notification module; the driver is simulated as a FIDO authenticator by implementing the USB-HID driver of the operating system, and then forwards the user's FIDO authentication request on the PC side to the notification module of the mobile APP through the back-end message service; the back-end message service is mainly responsible for forwarding data between the FIDO authenticator and the driver, and pushing it to the FIDO authenticator, that is, the system notification of the mobile APP.

[0044] In this embodiment, the mobile APP takes a smartphone as an example, and the PC driver takes the Windows 10 system as an example.

[0045] like Figure 2 As shown, the present invention provides a FIDO2 authentication method implemented based on the Internet network, comprising the following steps:

[0046] S1, the driver is initialized, public key 1 and private key 1 are generated by calling keychain or TPM respectively, and a message ID 1 is requested from the backend message service and a communication connection is established based on WebSocket;

[0047] S2, mobile APP is initialized, public key 2 and private key 2 are generated through KeyChain or KeyStore, and a message ID 2 is requested from the operating system.

[0048] S3, the driver displays the public key 1 information and the message ID 1 in the form of a QR code;

[0049] S4, the mobile APP scans the QR code and obtains the public key 1 and message ID 1;

[0050] S5, the mobile APP uses public key 1 to encrypt public key 2, message ID 2 and system platform information, and submits it to the backend message service, indicating that it will be bound to message ID 1 (that is, the driver). The backend message service queries the WebSocket connection and sends mobile data to the driver.

[0051] S6, the driver obtains the mobile data and decrypts it with private key 1 to obtain the mobile APP information, namely, message ID 2 and public key 2;

[0052] S7, the driver uses the mobile APP public key 2 to encrypt the message and respond to the message. The message response is a communication mechanism. After processing the message, it is returned through WebSocket, which also means that the binding is completed.

[0053] S8, the mobile APP gets the response and decrypts it with private key 2, and the binding is completed;

[0054] S9, the driver obtains the FIDO authentication request, packages the request data into message data, encrypts it using public key 2, and sends it to message ID 2;

[0055] S10, the backend message service calls the API of the corresponding system platform of the mobile terminal and the message ID2 to perform system notification and encrypt the message data and send it to the mobile terminal APP;

[0056] S11, the mobile APP receives the system notification and decrypts it using private key 2. If the decryption is successful, it means that the device is paired. If the decryption fails, the request is abandoned.

[0057] S12, the functional module of the mobile APP starts to parse the data and verify it through the FIDO protocol standard;

[0058] S13, after the mobile APP is successfully verified, the user is prompted to authenticate based on the user module;

[0059] S14, the user authenticates through biometrics or other means, indicating that he agrees to the FIDO authentication, encrypts the result with public key 1, and calls the API to return data;

[0060] S15, the backend message service queries the Websocket connection corresponding to message ID1 and sends the data to the driver;

[0061] S16, the driver uses private key 1 to decrypt the data and returns the authentication result to the RP.

[0062] The message ID1 in the method can be obtained through the public key SHA1 hash algorithm or directly use a random number as the message ID1, and the message ID2 can be obtained through the system notification API.

[0063] The authentication method and authentication system of the present invention have the following advantages during implementation:

[0064] First, because the mobile device directly acts as the authenticator, no additional hardware support is required, which is economical and practical; second, the present invention is based on the Internet network for authentication, which can meet the needs of remote login, and because the system directly pushes the authentication information, the authentication efficiency is improved; third, the present invention adopts an encrypted communication method on both ends of the mobile terminal and the driver, which is more secure; fourth, after the mobile terminal and the driver are bound for authentication, the authentication establishment time is short, and there is no need to frequently change the password, which is more convenient and quick to operate, thereby improving management efficiency.

[0065] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. For relevant persons familiar with the technical field, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A FIDO2 authentication system based on the Internet network, characterized in that: include: A mobile APP for FIDO authentication, a PC driver for forwarding FIDO authentication requests, and a backend message service for communication between the mobile APP and the driver. The mobile APP, the backend message service, and the driver are connected in sequence; The driver generates public key 1 and private key 1 by calling keychain or trusted platform module, and applies for a message ID 1 from the backend message service and establishes a communication connection based on WebSocket. The mobile APP generates public key 2 and private key 2 through KeyChain or KeyStore, and applies to the operating system for and obtains a message ID 2. After obtaining public key 1 and message ID 1, the mobile APP uses public key 1 to encrypt public key 2, message ID 2 and system platform information, and submits them to the backend message service. The backend message service queries the Websocket connection corresponding to message ID 1 and sends the data to the driver. The driver obtains mobile data and decrypts it with private key 1 to obtain message ID 2 and public key 2; it encrypts the message with public key 2 to respond to the message; after obtaining the response, the mobile APP decrypts it with private key 2, and the binding is completed; The driver obtains the FIDO authentication request, packages the request data into message data, encrypts it through public key 2, and sends it to message ID 2; the backend message service calls the API of the corresponding system platform on the mobile terminal and message ID 2 for system notification and encrypts the message data and sends it to the mobile terminal APP; After receiving the system notification, the mobile APP decrypts the data using private key 2. The data is parsed through the function module and verified through the FIDO protocol standard. After successful verification, the user is prompted to authenticate based on the user module. When the user agrees to the FIDO authentication, the result is encrypted using public key 1 and the API is called to return the data. The backend message service queries the Websocket connection corresponding to message ID 1 and sends the data to the driver; the driver decrypts the data using private key 1 and returns the authentication result to the relying party.

2. According to the FIDO2 authentication system implemented based on the Internet network as claimed in claim 1, it is characterized in that: The back-end message service communicates with the driver program on the PC side via the Internet.

3. The FIDO2 authentication system based on the Internet network according to claim 1, characterized in that: The backend message service communicates with the mobile APP via the Internet.

4. The FIDO2 authentication system based on the Internet network according to claim 1, characterized in that: The mobile APP includes a function module, a user module, and a notification module, the three modules are connected to each other, and the notification module is connected to the backend message service; The functional modules include FIDO2 protocol implementation, encryption algorithm implementation, credential management storage function implementation, communication with security module components, user module control implementation, and notification module input recognition implementation.

5. The FIDO2 authentication system based on the Internet network according to claim 1, characterized in that: Use the mobile APP for FIDO authentication as a FIDO authenticator; The driver program simulates a FIDO authenticator by implementing the USB-HID driver of the operating system, and then forwards the user's FIDO authentication request on the PC side to the notification module of the mobile APP through the backend message service.

6. The FIDO2 authentication system based on the Internet network according to claim 5, characterized in that: The backend message service is used to forward the data between the FIDO authenticator and the driver, and push it to the FIDO authenticator, that is, the system notification of the mobile APP.

7. A FIDO2 authentication method based on the Internet network, which is applied to a FIDO2 authentication system based on the Internet network, characterized in that: include: S1, the driver is initialized, public key 1 and private key 1 are generated by calling keychain or trusted platform module respectively, and a message ID 1 is requested from the backend message service and a communication connection is established based on WebSocket; S2, mobile APP is initialized, public key 2 and private key 2 are generated through KeyChain or KeyStore, and a message ID 2 is requested from the operating system. S3, the driver displays the public key 1 information and the message ID 1 in the form of a QR code; S4, the mobile APP scans the QR code and obtains the public key 1 and message ID 1; S5, the mobile APP uses public key 1 to encrypt public key 2, message ID 2 and system platform information, and submits it to the backend message service, indicating that it will be bound to message ID 1. The backend message service queries the WebSocket connection and sends mobile data to the driver; S6, the driver obtains the mobile data and decrypts it with private key 1 to obtain the mobile APP information, namely, message ID 2 and public key 2; S7, the driver uses public key 2 to encrypt the message and responds to the message. The message response is a communication mechanism. After processing the message, it is returned through WebSocket, which also means that the binding is completed. S8, the mobile APP gets the response and decrypts it with private key 2, and the binding is completed; S9, the driver obtains the FIDO authentication request, packages the request data into message data, encrypts it using public key 2, and sends it to message ID 2; S10, the backend message service calls the API of the corresponding system platform of the mobile terminal and the message ID2 to perform system notification and encrypt the message data and send it to the mobile terminal APP; S11, the mobile APP receives the system notification and decrypts it using private key 2. If the decryption is successful, it means that the device has been paired. If the decryption fails, the request is abandoned. S12, the functional module of the mobile APP starts to parse the data and verify it through the FIDO protocol standard; S13, after the mobile APP is successfully verified, the user is prompted to authenticate based on the user module; S14, the user authenticates through biometrics, indicating that he agrees to the FIDO authentication, encrypts the result with public key 1, and calls the API to return data; S15, the backend message service queries the Websocket connection corresponding to message ID1 and sends the data to the driver; S16, the driver uses private key 1 to decrypt the data and returns the authentication result to the relying party.

8. The FIDO2 authentication method based on the Internet network according to claim 7, characterized in that: The message ID1 is obtained by using the public key SHA1 hash algorithm; or, a random number is directly used as the message ID1.

9. The FIDO2 authentication method based on the Internet network according to claim 7, characterized in that: The message ID2 is obtained through the system notification API.

Images