Ukey-based offline security authentication method, device, equipment and medium

Abstract

The embodiments of the present disclosure disclose a UKEY-based offline security authentication method, device, equipment and medium. The method comprises the following steps: a terminal generates a random number; an authentication platform encrypts the random number to obtain an encrypted random number; the authentication platform generates a digital certificate according to preset key user data; the digital certificate is stored in a preset UKEY; the random number and the encrypted random number are stored in the terminal; after detecting that the UKEY is inserted into the offline terminal, the encrypted random number is decrypted through the UKEY to obtain a decrypted random number; the decrypted random number is compared with the random number, if the comparison is successful, it is determined that the digital certificate is valid, the key user data of the digital certificate is read, and the terminal completes offline login. The method / system can achieve the technical effect of securely verifying the identity of the user when the UKEY is inserted into the offline terminal.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of security authentication, and particularly relates to an offline security authentication method and device based on UKEY, equipment and medium. BACKGROUND

[0002] With the continuous development of electronic information and the Internet, the application systems in various enterprises and institutions are gradually increasing. Generally, a user uses a terminal to access an application system, needs to insert a UKEY into the terminal to initiate a request authentication to a server of the application system, and the terminal must maintain a communication connection with the server to perform user identity verification.

[0003] If the terminal with the inserted UKEY is in an offline network state (for example, on a business trip or in an information gap), the user identity verification cannot be completed and the user cannot log in to the application system, which greatly limits the use scenarios of the UKEY. SUMMARY

[0004] Therefore, the present disclosure provides an offline security authentication method and device based on UKEY, which can solve the technical problem that the user identity verification cannot be performed when the terminal with the inserted UKEY is in an offline network state.

[0005] In a first aspect, the present disclosure provides an offline security authentication method based on UKEY, which adopts the following technical scheme:

[0006] generating a random number by a terminal;

[0007] encrypting the random number by an authentication platform to obtain an encrypted random number;

[0008] generating a digital certificate according to preset key user data by the authentication platform;

[0009] storing the digital certificate to a preset UKEY;

[0010] storing the random number and the encrypted random number to the terminal;

[0011] decrypting the encrypted random number by the UKEY to obtain a decrypted random number after detecting that the UKEY is inserted into the terminal in an offline state;

[0012] comparing the decrypted random number with the random number, and if the comparison is successful, determining that the digital certificate is valid, reading the key user data of the digital certificate, and enabling the terminal to complete offline login.

[0013] Optionally, the authentication platform generates a digital certificate according to preset key user data, including:

[0014] Obtaining attribute information of a user with login server authority as preset key user data;

[0015] The authentication platform signs the key user data by using a private key to generate the digital certificate.

[0016] Optionally, the terminal generates a random number, including:

[0017] The terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number.

[0018] Optionally, the encryption of the MAC address of the terminal and the first timestamp of the terminal includes that the terminal generates a random number, including:

[0019] Reading a string of the MAC address, performing HASH operation on the string of the MAC address to obtain a random factor of the MAC address;

[0020] Reading a string of the first timestamp, performing multiplication and congruence calculation on the string of the first timestamp to obtain a random factor of the first timestamp;

[0021] According to a preset encryption algorithm, the random factor of the MAC address and the random factor of the first timestamp are encrypted, and the terminal generates a random number.

[0022] Optionally, the decryption of the encrypted random number by the UKEY to obtain a decrypted random number includes:

[0023] The encrypted random number saved by the terminal is sent to the UKEY;

[0024] The UKEY also stores a decryption algorithm and a key, and the encrypted random number is decrypted by the decryption algorithm and the key in the UKEY to obtain the decrypted random number;

[0025] The decrypted random number is sent to the terminal.

[0026] Optionally, the decryption of the encrypted random number by the decryption algorithm and the key in the UKEY to obtain the decrypted random number includes:

[0027] According to the public key of the decryption algorithm and the key, each binary tuple of the random number matrix of the encrypted random number is decrypted to obtain the decrypted random number.

[0028] Optionally, after the terminal detects that the UKEY is inserted offline, the method further includes:

[0029] Inputting a PIN code of the UKEY;

[0030] verifying whether the PIN code is correct, and if correct, decrypting the encrypted random number by the UKEY to obtain a decrypted random number.

[0031] Optionally, the UKEY-based offline secure authentication method further comprises: after detecting that the UKEY is inserted into the terminal online, calling an interface of the server, reading key user data of the digital certificate, so that the terminal completes online login.

[0032] Optionally, the comparing the decrypted random number with the random number comprises:

[0033] reading a first MD5 value of the decrypted random number, and reading a second MD5 value of the random number;

[0034] comparing the first MD5 value with the second MD5 value;

[0035] if the two are consistent, determining that the digital certificate is valid.

[0036] Optionally, the UKEY-based offline secure authentication method further comprises:

[0037] if the comparison fails, determining that the digital certificate is invalid, and generating a prompt message for stopping executing offline login of the terminal.

[0038] In a second aspect, the embodiments of the present disclosure further provide a UKEY-based offline secure authentication device, comprising:

[0039] a random number generation module configured to generate a random number for a terminal;

[0040] an encryption module configured to encrypt the random number by an authentication platform to obtain an encrypted random number;

[0041] a certificate generation module configured to generate a digital certificate according to preset key user data by the authentication platform;

[0042] a storage module configured to store the digital certificate to a preset UKEY, and store the random number and the encrypted random number to the terminal;

[0043] a decryption module configured to decrypt the encrypted random number by the UKEY to obtain a decrypted random number after detecting that the UKEY is inserted into the terminal offline;

[0044] a comparison module configured to compare the decrypted random number with the random number, and if the comparison is successful, determine that the digital certificate is valid, and read key user data of the digital certificate, so that the terminal completes offline login.

[0045] In a third aspect, the embodiments of the present disclosure further provide an electronic device, which adopts the following technical scheme:

[0046] The electronic device comprises:

[0047] at least one processor; and

[0048] a memory connected with the at least one processor in communication; wherein

[0049] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the UKEY-based offline security authentication method.

[0050] In a fourth aspect, the embodiments of the present disclosure further provide a computer-readable storage medium storing computer instructions for causing a computer to perform the UKEY-based offline security authentication method.

[0051] The UKEY-based offline security authentication method provided by the embodiments of the present disclosure can automatically decrypt the encrypted random number of the terminal when the UKEY is inserted into the offline terminal, obtain the decrypted random number, read the key user data of the digital certificate when the decrypted random number and the random number are successfully compared, and complete the offline login of the application program of the server. The above method can achieve the technical effect of securely verifying the identity of the user in the offline network state.

[0052] The above description is only a summary of the technical scheme of the present disclosure. In order to more clearly understand the technical means of the present disclosure, the following preferred embodiments will be described in detail in combination with the drawings, and the above and other purposes, characteristics and advantages of the present disclosure will be more apparent and easy to understand. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical scheme of the embodiments of the present disclosure, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0054] Figure 1 The flowchart of the UKEY-based offline security authentication method provided by the embodiments of the present disclosure is shown in the figure;

[0055] Figure 2 The module schematic diagram of the UKEY-based offline security authentication device provided by the embodiments of the present disclosure is shown in the figure;

[0056] Figure 3 A principle block diagram of an electronic device is provided for the embodiments of the present disclosure. DETAILED DESCRIPTION

[0057] The embodiments of the present disclosure will be described in detail below with reference to the drawings.

[0058] It should be apparent that the following describes the embodiments of the present disclosure through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, not all. The present disclosure can also be implemented or applied by other different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0059] It should be noted that the following describes various aspects of the embodiments within the scope of the appended claims. It should be apparent that the aspects described herein can be embodied in a wide variety of forms and that any particular structure and / or function described herein is merely illustrative. Based on the disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, an apparatus and / or a method can be implemented using any number of the aspects set forth herein. In addition, this apparatus and / or method can be implemented using other structures and / or functionalities in addition to or other than one or more of the aspects set forth herein.

[0060] It should also be noted that the drawings provided in the following embodiments only schematically illustrate the basic concepts of the present disclosure, and only the components related to the present disclosure are shown in the drawings, not the number, shape and size of the components when actually implemented. The actual implementation of each component can be a random change in shape, number and ratio, and the layout of the components can also be more complex.

[0061] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, one skilled in the art will understand that the described aspects can be practiced without these specific details.

[0062] The present disclosure provides an offline security authentication method based on UKEY. Referring to Figure 1 as shown, Figure 1A flowchart diagram of an offline security authentication method based on a UKEY is provided for embodiments of the present disclosure. The method can be executed by an electronic device, which can be implemented by software and / or hardware. The offline security authentication method based on a UKEY includes:

[0063] Step S10: The terminal generates a random number.

[0064] Specifically, the step S10 includes:

[0065] The terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number.

[0066] The string of the MAC address and the string of the first timestamp are randomly encrypted according to a preset encryption algorithm to obtain the random number of the terminal. The preset encryption algorithm includes, but is not limited to, the national encryption SM2 or the national encryption SM4 algorithm; the MAC address refers to a local area network address, and the English full name of MAC is Media Access Control Address. The MAC address is a bit address burned in a flash memory chip by a network device manufacturer during production to confirm the position of the network device, which can be understood as a physical address; the first timestamp refers to a time point at which the MAC address is obtained, for example, the MAC address is obtained at 13:00 PM on September 1, 2022, Beijing time. The Unix timestamp time stamp on September 1, 2022, 13:00 PM is converted as the first timestamp.

[0067] In one embodiment, the terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number, including:

[0068] reading the string of the MAC address, performing HASH operation (i.e., first addition and subtraction operation, and then remainder operation) on the string of the MAC address to obtain a random factor of the MAC address;

[0069] reading the string of the first timestamp, performing multiplication and congruence method calculation (i.e., first addition and subtraction operation and absolute value operation, and then remainder operation) on the string of the first timestamp to obtain a random factor of the first timestamp;

[0070] According to the preset encryption algorithm, the random factor of the MAC address and the random factor of the first timestamp are encrypted to generate a random number by the terminal.

[0071] The HASH operation is a hash algorithm that accepts an input of unlimited length and returns an output of fixed length; the multiplication and congruence method is a mathematical method for generating uniform pseudo-random numbers using the congruence operation in elementary number theory.

[0072] In this embodiment, the random number generated by the terminal can be a 64-bit, 128-bit, or 256-bit random number. The larger the number of bits of the generated random number, the more difficult it is to brute force, thereby effectively improving the security of the random number.

[0073] Step S20: The authentication platform encrypts the random number to obtain an encrypted random number.

[0074] In this embodiment, the authentication platform is a certificate authority (for example, the authentication platform is a CA certificate authority, which is a trusted organization that issues digital certificates for websites and other entities). The authentication platform encrypts the random number using a private key to obtain an encrypted random number.

[0075] In one embodiment, the authentication platform encrypts the random number to obtain an encrypted random number, including:

[0076] According to the digital sequence of the random number, a random number matrix is generated, and the authentication platform encrypts the random number matrix using a private key to obtain the encrypted random number.

[0077] Specifically, the digital sequence of the random number is read and arranged into an n x n random number matrix. Each element of the random number matrix is a two-tuple composed of two random data blocks of the same length, a plurality of different two-tuples are obtained, and each two-tuple is cyclically encrypted using the private key of the authentication platform to obtain an encrypted random number.

[0078] Step S30: The authentication platform generates a digital certificate according to the preset key user data and stores the digital certificate in the preset UKEY.

[0079] In this embodiment, the preset key user data can be sent by a server to the authentication platform, where the server refers to a device that the user wants to log in to on the terminal using the UKEY. The application program of the server is installed on the terminal, and through the use of the server by the user, the server can automatically obtain the attribute information of the user logging in to the server as the preset key user data. The authentication platform generates a digital certificate according to the key user data and stores the digital certificate in the UKEY issued by the authentication platform to the corresponding user. Storing the digital certificate in the preset UKEY can save the program of returning the digital certificate to the server for installation, and is also one of the important links to achieve offline login to the application program of the server.

[0080] The digital certificate is a public key system that uses a pair of matching keys for encryption and decryption. Each user sets a specific private key that only he or she knows to decrypt and sign, and sets a public key that is publicly known and shared by a group of users for encryption and signature verification.

[0081] The UKEY is a small hardware device with USB interface, which has CPU, memory, operating system (for example, COS chip operating system) built-in, and is used to store user's key, digital certificate, encryption algorithm, decryption algorithm, etc.

[0082] In one embodiment, the authentication platform generates a digital certificate according to preset key user data, including:

[0083] A11, obtaining user attribute information with login server authority as preset key user data;

[0084] In this embodiment, the user attribute information with login server authority is obtained from the user authority list of the server, and the user attribute information includes but is not limited to user account, user name, and user ID number. The user attribute information is calculated by a preset hash algorithm (for example, MD5 algorithm, HMAC-SHA1 algorithm, etc.) to obtain a hash value result, which is used as the preset key user data. By obtaining the key user data, the repeated login operation of the user using the password and account can be saved, and the fast verification of the user login can be realized.

[0085] A12, the authentication platform uses a private key to sign the key user data to generate the digital certificate.

[0086] The server sends the key user data to the authentication platform, the authentication platform generates a private key and a public key for the key user data, binds the key user data with the public key, and uses the private key to sign the bound key user data and the public key to generate the digital certificate of the terminal. By generating the digital certificate, the security and compatibility of the UKEY can be improved.

[0087] Step S40: storing the random number and the encrypted random number to the terminal.

[0088] In this embodiment, by storing the encrypted random number and the random number in the same folder, the data storage can be prevented from being chaotic, and the associated data can be quickly found during the later maintenance, so that the work efficiency can be effectively improved.

[0089] In this embodiment, the remaining capacity of each partition of the hard disk of the terminal is monitored by a preset memory monitoring program (for example, the preset memory monitoring program is memtest). If the remaining capacity of the main partition (for example, the C disk) is greater than a preset value (for example, the preset value is 50G), the application program of the server reads the folder position of the installation path of the terminal (for example, under the computer / C disk), a folder is newly created in the folder position, and the random number and the encrypted random number are stored. In other embodiments, if the remaining capacity of the main partition (for example, the C disk) is less than or equal to the preset value, the partition with the largest remaining capacity is selected according to the memory monitoring program to store the random number and the encrypted random number, so as to ensure the smooth running of the terminal system.

[0090] In one embodiment, before the random number and the encrypted random number are stored in the terminal, the method further comprises:

[0091] establishing an authentication interface between the authentication platform and the terminal.

[0092] The random number and the encrypted random number are sent to the terminal for storage through the pre-established authentication interface, so as to ensure the security of the data transmission between the authentication platform and the terminal, and effectively avoid data leakage or intrusion of users with unknown intentions.

[0093] Through the above steps S10-S40, the digital certificate, the decryption algorithm, and the key related to the key user data are stored in the UKEY through the authentication platform in the offline network state, and the encrypted random number of the authentication platform and the random number generated by the terminal are stored in the terminal locally, so that even if there is no network between the UKEY and the terminal, the validity of the digital certificate can be verified subsequently.

[0094] Step S50: After detecting that the UKEY is inserted into the offline terminal, the encrypted random number is decrypted by the UKEY to obtain a decrypted random number.

[0095] In this embodiment, when the terminal is in an offline network state (for example, the user is working or on a business trip, or the network signal is poor), the user needs to process business and inserts the UKEY into the offline terminal. The hardware detection program of the terminal automatically detects that the new hardware needs to be started, the encrypted random number is sent to the UKEY for decryption, and a decrypted random number is obtained.

[0096] In one embodiment, the encrypted random number is decrypted by the UKEY to obtain a decrypted random number, including:

[0097] The encrypted random number saved by the terminal is sent to the UKEY.

[0098] The UKEY also stores a decryption algorithm and a key, and the encrypted random number is decrypted by the decryption algorithm and the key in the UKEY to obtain the decrypted random number.

[0099] The decrypted random number is sent to the terminal.

[0100] In one embodiment, the decryption of the encrypted random number by the decryption algorithm and the key in the UKEY to obtain the decrypted random number comprises:

[0101] Each pair of the random number matrix of the encrypted random number is decrypted by the decryption algorithm and the public key of the key to obtain the decrypted random number.

[0102] Specifically, each pair of the random number matrix of the encrypted random number is cyclically decrypted by the decryption algorithm and the public key of the key in the UKEY, and the decrypted result is sorted into a 1x n 2 digital sequence and used as the decrypted random number of the terminal. The decryption of the encrypted random number by the key in the UKEY not only ensures the uniqueness and reliability of the key, but also ensures that the encrypted random number of the terminal is not tampered with or forged.

[0103] In one embodiment, after the terminal detects that the UKEY is inserted offline, the method further comprises:

[0104] Inputting a PIN code of the UKEY;

[0105] Verifying whether the PIN code is correct, and if so, decrypting the encrypted random number by the UKEY to obtain the decrypted random number.

[0106] When the offline terminal detects that the UKEY is inserted, the chip operating system built-in the UKEY is automatically started, and a login interface of the UKEY is displayed on the terminal. When the PIN code input by the user on the login interface is correct, the encrypted random number pre-stored in the terminal is read and sent to the UKEY for decryption to obtain the decrypted random number.

[0107] Each UKEY has a hardware PIN code, which can be understood as a password required for using the UKEY. Only the person who knows the PIN code has the right to use the UKEY. By simultaneously owning the UKEY and the PIN code, the two-factor authentication ensures the identity authentication of the user, and the PIN code is set to have a maximum retry limit (for example, 3 times), and the continuous input of errors will be locked. This effectively prevents the UKEY from being repeatedly retried by an illegal user after being lost.

[0108] In one embodiment, after detecting the UKEY is inserted into the terminal, the interface of the server is called to read the key user data of the digital certificate to enable the terminal to complete the online login.

[0109] If the terminal in the network state detects the UKEY insertion, after the user inputs the correct PIN code, the key user data of the digital certificate is directly read to enable the terminal to communicate with the server to realize the user login to the server for business operation. The UKEY of the present disclosure can meet the online network and / or offline network use scenarios of the user, and effectively overcomes the limitation of the single use scenario of the UKEY in the prior art.

[0110] Step S60: Comparing the decrypted random number with the random number, if the comparison is successful, it is determined that the digital certificate is valid, the key user data of the digital certificate is read to enable the terminal to complete the offline login.

[0111] In an embodiment, the decrypted random number of the UKEY is sent to the terminal, and the random number stored in the terminal is compared with the decrypted random number. When the two password hash functions are completely consistent, it is indicated that the digital certificate of the UKEY is valid, the key user data of the digital certificate is read to complete the offline login to the server, and the user performs business operation in the offline state of the server.

[0112] In one embodiment, the comparison of the decrypted random number with the random number comprises:

[0113] The first MD5 value of the decrypted random number is read, and the second MD5 value of the random number is read;

[0114] The first MD5 value is compared with the second MD5 value;

[0115] If they are consistent, it is determined that the digital certificate is valid.

[0116] The MD5 value is a widely used password hash function, which can generate a 128-bit (16-byte) hash value to ensure the integrity of information transmission. The MD5 value is equivalent to the ID of the random number, and its value is unique. If the random number has been modified (such as embedded viruses, Trojan horses, etc.), its MD5 value will change. Therefore, if the first MD5 value of the decrypted random number is inconsistent with the second MD5 value of the random number, it may be that the random number has been modified or leaked, which proves that the digital certificate is invalid.

[0117] In one embodiment, the offline security authentication method based on the UKEY further comprises:

[0118] If the comparison fails, it is determined that the digital certificate is invalid, and a prompt message is generated to stop performing offline login of the terminal.

[0119] The comparison failure represents that the first MD5 value of the decrypted random number is inconsistent with the second MD5 value of the random number, indicating that the digital certificate of the UKEY is invalid or fake; a prompt message is generated on the interface of the terminal to stop performing offline login (for example, Hello, the UKEY you use is an invalid UKEY, please check and retry).

[0120] In one embodiment, the reading of the key user data of the digital certificate to enable the terminal to complete offline login includes:

[0121] The key user data of the digital certificate is read, and the key user data is input to an application program of the server corresponding to the terminal for offline login.

[0122] After determining that the digital certificate is valid, the application program of the server installed in the terminal is initially started, and the user account, user name, and user ID number contained in the key user data of the digital certificate in the UKEY are read for verification. After the key user data verification is successful, offline login to the server is automatically completed, and the user can perform business operation on the application program of the server in the state that the terminal is offline.

[0123] The present disclosure, through the above steps S50-S60, when the UKEY is inserted into the offline terminal, the encrypted random number is decrypted to obtain the decrypted random number, the decrypted random number is compared with the random number, when the comparison is successful, the key user data of the digital certificate is read to complete offline login to the application program of the server. The compatibility and security of UKEY login are improved, and the communication frequency between the terminal and the server is also reduced, effectively preventing the risk of data leakage in transmission.

[0124] The present disclosure, through steps S10-S60, the authentication platform encrypts the random number generated by the terminal to obtain the encrypted random number, increases the difficulty of brute force cracking of the random number, and effectively improves the security of the random number; and the authentication platform generates a digital certificate according to the preset key user data, stores the digital certificate to the preset UKEY, and stores the random number and the encrypted random number to the terminal, ensuring the security of the connection between the UKEY and the terminal.

[0125] When the UKEY is inserted into the offline terminal, the UKEY automatically decrypts the encrypted random number of the terminal to obtain the decrypted random number, and when the decrypted random number is successfully compared with the random number, the key user data of the digital certificate is read to complete offline login to the application program of the server. The technical effect of safely verifying the identity of the user in the offline network state is realized.

[0126] Referring toFigure 2 As shown, the UKEY-based offline security authentication device provided by the embodiments of the present disclosure provides a module schematic diagram.

[0127] The modules of the preferred embodiments of the UKEY-based offline security authentication method described in the present disclosure can be installed in an electronic device. According to the functions to be implemented, the modules of the UKEY-based offline security authentication device can include a random number generation module 110, an encryption module 120, a certificate generation module 130, a storage module 140, a decryption module 150, and a comparison module 160. The modules described in the present disclosure can also be referred to as units, which refer to a series of computer program segments that can be executed by an electronic device processor and can complete a fixed function, and are stored in the memory of the electronic device.

[0128] In the embodiments, the functions of each module / unit are as follows:

[0129] The random number generation module 110 is configured to generate a random number by a terminal.

[0130] The encryption module 120 is configured to encrypt the random number by the authentication platform to obtain an encrypted random number.

[0131] The certificate generation module 130 is configured to generate a digital certificate according to preset key user data by the authentication platform.

[0132] The storage module 140 is configured to store the digital certificate to a preset UKEY, and store the random number and the encrypted random number to the terminal.

[0133] The decryption module 150 is configured to decrypt the encrypted random number by the UKEY to obtain a decrypted random number after detecting that the UKEY is inserted into the terminal offline.

[0134] The comparison module 160 is configured to compare the decrypted random number with the random number. If the comparison is successful, it is determined that the digital certificate is valid, and the key user data of the digital certificate is read to enable the terminal to complete offline login.

[0135] In one embodiment, the authentication platform generates a digital certificate according to preset key user data, including:

[0136] Obtaining user attribute information having login server authority as preset key user data;

[0137] The authentication platform signs the key user data by using a private key to generate the digital certificate.

[0138] In one embodiment, the terminal generates a random number, including:

[0139] The terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number.

[0140] In one embodiment, the encryption of the MAC address of the terminal and the first timestamp of the terminal, and the generation of the random number by the terminal, include:

[0141] reading a string of the MAC address, performing HASH operation on the string of the MAC address to obtain a random factor of the MAC address;

[0142] reading a string of the first timestamp, performing multiplication and congruence operation on the string of the first timestamp to obtain a random factor of the first timestamp;

[0143] performing encryption operation on the random factor of the MAC address and the random factor of the first timestamp according to a preset encryption algorithm, and the terminal generates a random number.

[0144] In one embodiment, the decryption of the encrypted random number by the UKEY to obtain a decrypted random number includes:

[0145] sending the encrypted random number saved by the terminal to the UKEY;

[0146] The UKEY further stores a decryption algorithm and a key, and the encrypted random number is decrypted by the decryption algorithm and the key in the UKEY to obtain the decrypted random number.

[0147] The decrypted random number is sent to the terminal.

[0148] In one embodiment, the decryption of the encrypted random number by the decryption algorithm and the key in the UKEY to obtain the decrypted random number includes:

[0149] According to the public key of the decryption algorithm and the key, each binary tuple of the random number matrix of the encrypted random number is decrypted to obtain the decrypted random number.

[0150] In one embodiment, the UKEY-based offline security authentication device further includes a PIN verification module configured to input a PIN code of the UKEY after detecting that the UKEY is inserted into the terminal offline, and verify whether the PIN code is correct. If the PIN code is correct, the encrypted random number is decrypted by the UKEY to obtain a decrypted random number.

[0151] In one embodiment, the UKEY-based offline security authentication device further comprises an interface calling module, configured to call an interface of the server to read the key user data of the digital certificate after detecting that the UKEY is inserted into the terminal, so as to enable the terminal to complete online login.

[0152] In one embodiment, the comparing the decrypted random number with the random number comprises:

[0153] reading a first MD5 value of the decrypted random number, and reading a second MD5 value of the random number;

[0154] comparing the first MD5 value with the second MD5 value;

[0155] if the two values are consistent, determining that the digital certificate is valid.

[0156] In one embodiment, the UKEY-based offline security authentication device further comprises a prompting module, configured to, when the comparison fails, determine that the digital certificate is invalid, and generate a prompt message to stop performing offline login of the terminal.

[0157] An electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is configured to store non-transitory computer readable instructions. Specifically, the memory can include one or more computer program products that can include various forms of computer readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM), cache memory, and / or the like. The non-volatile memory may, for example, include read only memory (ROM), hard disk, flash memory, and / or the like.

[0158] The processor can be a central processing unit (CPU) or other form of processing unit having data processing and / or instruction execution capabilities, and can control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to execute the computer readable instructions stored in the memory, so that the electronic device performs all or part of the steps of the UKEY-based offline security authentication method according to the embodiments of the present disclosure.

[0159] Those skilled in the art will understand that, in order to solve the technical problem of how to obtain a good user experience effect, the present embodiment can also include well-known structures such as a communication bus, an interface, and the like, which should also be included in the protection scope of the present disclosure.

[0160] As Figure 3 A principle block diagram of an electronic device according to an embodiment of the present disclosure is provided. It shows a structural schematic diagram suitable for implementing the electronic device in the embodiments of the present disclosure.Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0161] like Figure 3 As shown, an electronic device may include a processing unit (such as a central processing unit, graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0162] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 3 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0163] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the U-key-based offline security authentication method of embodiments of this disclosure are performed.

[0164] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0165] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the UKEY-based offline security authentication method described in the foregoing embodiments of the present disclosure are performed.

[0166] The computer-readable storage medium described above includes, but is not limited to, an optical storage medium (for example, a CD-ROM and a DVD), a magneto-optical storage medium (for example, an MO), a magnetic storage medium (for example, a magnetic tape or a magnetic hard disk), a medium having a built-in rewritable nonvolatile memory (for example, a memory card), and a medium having a built-in ROM (for example, a ROM cartridge).

[0167] For detailed description of the present embodiment, reference can be made to the corresponding description in the foregoing embodiments, which will not be repeated here.

[0168] The above describes the basic principles of the present disclosure in combination with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present disclosure are only examples and are not limiting, and these advantages, benefits, effects and the like cannot be considered as necessary for each embodiment of the present disclosure. In addition, the specific details of the above disclosure are only for the purpose of example and for the purpose of understanding, and are not limiting, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.

[0169] In the present disclosure, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. The block diagrams of devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply the connection, arrangement, configuration shown in the block diagram. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0170] In addition, as used herein, "or" used in a list of items, prefaced by "at least one of", indicates a disjunctive list such that, for example, a list of "at least one of A, B, or C" means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Also, the phrase "example of" does not mean an example of the preferred or even a preferred mode of doing something.

[0171] It should also be noted that in the systems and methods of the present disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalents of the present disclosure.

[0172] Various changes, modifications, and alterations to the techniques described herein can be made without departing from the teachings of the attached claims. Moreover, the scope of the claims should not be limited to the particular aspects described herein, but should be given the broadest interpretation available to them under the law. It is to be understood that the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. The terms "comprises," "comprising," "includes," "including," and the like can be used herein. As such, these terms are intended to be inclusive when they appear in the description. The description herein is directed to various aspects, embodiments and features of the disclosure. It is to be understood that each aspect, embodiment or feature described herein can be combined with any other aspect, embodiment or feature described herein. All combinations of aspects and elements within the scope of the embodiments and aspects are meant to be encompassed by the present disclosure. The descriptions in this detailed description are intended to be only examples and are not intended to limit or restrict the scope, applicability, or configuration of the disclosure in any way. Various changes can be made to the implementation of the aspects and techniques described herein, and equivalents (for example, substituting equivalent means for those described, adapting inoperative means for those described, or adapting or replacing described structures and / or functions to be compatible with changes in other implementations, and the like) can be made without departing from the scope of the disclosure. The scope of the disclosure is therefore intended to be only as set forth in the attached claims. If it is determined that any aspects of the foregoing material infringe on the patent rights of others, then the Applicant(s) hereby cede to such other patentees any license they can desire and request a mutual, nonexclusive license to practice such invention under the confined of the foregoing material.

[0173] The above description of the disclosed aspects is given for illustrative purposes only and is not intended to limit the scope of the disclosure. Various modifications, adaptations, and changes of the described aspects can be made and will be readily apparent to those skilled in the art, with the general principles defined herein being applicable to other aspects and fall within the scope of the disclosure. Therefore, the scope of the disclosure is indicated by the following claims rather than by the foregoing description. All changes that come within the meaning of the claims are intended to be embraced by the claims.

[0174] The above description has been given for illustrative purposes only and is not intended to limit the embodiments of the disclosure. Although a number of example aspects and embodiments have been discussed above, those of skill in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A UKEY-based offline security authentication method, characterized by, The method comprises the following steps: The terminal generates a random number; The authentication platform encrypts the random number to obtain an encrypted random number, specifically including: reading the digital sequence of the random number and arranging it into an n*n random number matrix, taking each element of the random number matrix as a two-tuple composed of two random data blocks of the same length, obtaining a plurality of different two-tuples, and performing a cyclic encryption operation on each two-tuple by using the private key of the authentication platform to obtain the encrypted random number; The authentication platform generates a digital certificate according to preset key user data; The digital certificate is stored in a preset UKEY; The random number and the encrypted random number are stored in the terminal; After detecting that the UKEY is inserted into the offline terminal, the encrypted random number is decrypted by the UKEY to obtain a decrypted random number; The decrypted random number is compared with the random number, and if the comparison is successful, it is determined that the digital certificate is valid, the key user data of the digital certificate is read, and the terminal completes offline login; The authentication platform generates a digital certificate according to preset key user data, including: obtaining user attribute information with login server permission from a user permission list of a server; calculating a hash value of the user attribute information by a preset hash algorithm, taking the obtained hash value result as the preset key user data; sending the key user data to the authentication platform, the authentication platform generating a private key and a public key for the key user data, binding the key user data with the public key, and signing the bound key user data and public key by using the private key to generate a digital certificate of the terminal.

2. The UKEY-based offline security authentication method of claim 1, wherein, The terminal generates a random number, including: The terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number. 3.The UKEY-based offline security authentication method according to claim 2, characterized in that, The terminal encrypts the MAC address of the terminal and the first timestamp of the terminal to generate a random number, including: Reading the string of the MAC address, performing HASH operation on the string of the MAC address to obtain the random factor of the MAC address; Reading the string of the first timestamp, performing multiplication and congruence method calculation on the string of the first timestamp to obtain the random factor of the first timestamp; According to a preset encryption algorithm, the random factor of the MAC address and the random factor of the first timestamp are encrypted, and the terminal generates a random number.

4. The UKEY-based offline security authentication method of claim 1, wherein, Further comprising: After detecting that the UKEY is inserted into the online terminal, the interface of the server is called, the key user data of the digital certificate is read, and the terminal completes online login.

5. The UKEY-based offline security authentication method of claim 1, wherein, The comparison of the decrypted random number and the random number comprises: Reading the first MD5 value of the decrypted random number and the second MD5 value of the random number; Comparing the first MD5 value with the second MD5 value; If they are consistent, it is determined that the digital certificate is valid. 6.The UKEY-based offline security authentication method according to claim 1, wherein, Further comprising: If the comparison fails, it is determined that the digital certificate is invalid, and a prompt message for stopping executing the offline login of the terminal is generated.

7. An off-line security authentication apparatus based on UKEY, characterized by, The method comprises the following steps: A random number generation module is configured to generate a random number for a terminal; The encryption module is configured to encrypt the random number by the authentication platform to obtain an encrypted random number, and specifically includes: reading a digital sequence of the random number and arranging the digital sequence into an n*n random number matrix, taking each element of the random number matrix as a two-tuple composed of two random data blocks with the same length, obtaining a plurality of different two-tuples, performing a cyclic encryption operation on each two-tuple by using a private key of the authentication platform, and obtaining the encrypted random number; The certificate generation module is configured to generate a digital certificate according to preset key user data by the authentication platform; The storage module is configured to store the digital certificate into a preset UKEY, and store the random number and the encrypted random number into the terminal; The decryption module is configured to decrypt the encrypted random number by the UKEY to obtain a decrypted random number after detecting that the UKEY is inserted into the offline terminal; The comparison module is configured to compare the decrypted random number with the random number, and if the comparison is successful, it is determined that the digital certificate is valid, the key user data of the digital certificate is read, and the terminal is enabled to complete offline login. The authentication platform generates a digital certificate according to preset key user data, including: obtaining user attribute information with a login server permission from a user permission list of a server; performing hash value calculation on the user attribute information by using a preset hash algorithm, taking the obtained hash value result as the preset key user data; sending the key user data to the authentication platform, generating a private key and a public key by the authentication platform for the key user data, binding the key user data with the public key, signing the bound key user data and the public key by using the private key, and generating a digital certificate of the terminal.

8. An electronic device, comprising: The electronic device includes: at least one processor; and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the UKEY-based offline security authentication method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the WKEY-based offline security authentication method of any one of claims 1-6.

Images