Identity authentication method, security module, sim card and system

Abstract

The application belongs to the technical field of safety, and discloses an identity authentication method, a security module, a SIM card and a system. The method is applied to the security module, the security module is composed of a security chip with an SPI interface, the SPI interface contains an INT control pin, and the method comprises the following steps: performing a security operation according to a first random number in an encryption initial instruction and a second random number in decryption data fed back by the SIM card to obtain an identity authentication key; encrypting an identity data reading instruction according to the identity authentication key and sending the encrypted reading instruction to the SIM card, so that the SIM card verifies a message authentication code in the encrypted reading instruction and feeds back identity encryption data when the verification is passed; and performing identity authentication according to the identity encryption data and a biological characteristic value of a target user. The method not only shortens the business time consumption and the identity authentication time, but also guarantees the security of the identity authentication, realizes offline real person authentication of a digital identity, and improves the user experience.

Description

Technical Field

[0001] This invention relates to the field of security technology, and in particular to an identity authentication method, a security module, a SIM card, and a system. Background Technology

[0002] Currently, user authentication in digital identity verification scenarios requires a backend system, with data encryption and decryption handled by terminal software or the backend. The encryption and decryption keys are stored on the terminal or in the backend. Digital identity verification requires comparing user biometric information and parsing identity data, resulting in large data transmission volumes. Transmitting this data to the backend system necessitates extensive encryption and decryption, leading to lengthy processing times and a poor user experience. Furthermore, terminal software-based encryption and decryption schemes offer low security, allowing for information theft through software attacks and image interception. Software updates can erase encryption and decryption keys, and rewriting them introduces new security risks. Cloud-based or server-based encryption and decryption schemes require a network connection, making them unsuitable for offline scenarios. Moreover, the storage and transfer of sensitive data across multiple parties compromises information security. Summary of the Invention

[0003] The main objective of this invention is to provide an identity authentication method, a security module, a SIM card, and a system, aiming to solve the technical problems in the prior art where offline digital identity authentication is not possible and the security level during the authentication process is low.

[0004] To achieve the above objectives, the present invention provides an identity authentication method applied to a security module, the identity authentication method comprising:

[0005] A security calculation is performed based on the first random number in the initial encryption command and the second random number in the decryption data fed back by the SIM card to obtain the authentication key;

[0006] The identity data reading instruction is encrypted using the identity authentication key to determine the encrypted reading instruction;

[0007] The encrypted read command is sent to the SIM card so that the SIM card verifies the message authentication code in the encrypted read command and returns encrypted identity data when the verification is successful.

[0008] Identity authentication is performed based on the encrypted identity data and the target user's biometric values.

[0009] Optionally, before performing a security calculation based on the first random number in the initial encryption instruction and the second random number in the decryption data fed back by the SIM card to obtain the authentication key, the method further includes:

[0010] Upon receiving an identity initialization instruction, the preset key is distributed according to the first random number in the identity initialization instruction to obtain a process key;

[0011] The identity initialization command is encrypted using the process key to generate an encrypted initialization command;

[0012] The encryption initialization command is sent to the SIM card so that the SIM card verifies the message authentication code in the encryption initialization command, and returns the initial encrypted data when the verification is successful;

[0013] The initial encrypted data is verified using the message authentication code in the initial encrypted data. If the verification is successful, the initial encrypted data is decrypted to obtain the decrypted data.

[0014] Optionally, the step of authenticating identity based on the encrypted identity data and the target user's biometric value includes:

[0015] Decrypt the encrypted identity data to obtain the user identity data;

[0016] The biometric value of the target user sent by the authentication terminal through the SPI interface is obtained, wherein the biometric value is obtained by the authentication terminal by converting the collected biometric information of the target user;

[0017] The biometric values ​​are compared with the user identity data;

[0018] The identity authentication of the target user is completed based on the comparison results.

[0019] Optionally, after completing the identity authentication of the target user based on the comparison result, the method further includes:

[0020] When identity authentication is successful, the user's identity data is decrypted to obtain the plaintext identity information;

[0021] The plaintext identity information is sent to the authentication terminal so that the authentication terminal determines that the authentication is complete based on the plaintext identity information.

[0022] Furthermore, to achieve the above objectives, the present invention also provides an identity authentication method applied to a SIM card, the identity authentication method comprising:

[0023] Upon receiving the encryption initialization command sent by the security module, verification is performed based on the message authentication code in the encryption initialization command;

[0024] Upon successful verification, the second random number is encrypted using the process key in the initial encryption instruction to generate initial encrypted data.

[0025] The initial encrypted data is sent to the security module so that the security module decrypts the initial encrypted data to obtain decrypted data. An identity authentication key is generated based on the first random number in the initial encryption instruction and the second random number in the decrypted data. The identity data reading instruction is encrypted based on the identity authentication key, and the encrypted reading instruction is determined and fed back.

[0026] Verification is performed based on the message authentication code in the encrypted read instruction;

[0027] Upon successful verification, encrypted identity data is generated based on the identity authentication key and sent to the security module, enabling the security module to perform identity authentication based on the encrypted identity data and the target user's biometric value.

[0028] Optionally, the verification based on the message authentication code in the encryption initialization instruction includes:

[0029] Get the current key version;

[0030] The authentication code is calculated based on the first random number in the initial encryption instruction and the current key version, and the calculated authentication code is determined.

[0031] The calculated authentication code is compared with the message authentication code in the initial encryption instruction, and the verification is determined based on the comparison result.

[0032] Optionally, generating encrypted identity data based on the identity authentication key includes:

[0033] The reading mode is determined according to the encrypted reading instruction;

[0034] Data is organized according to the reading pattern to determine the identity data to be read;

[0035] The identity data is encrypted using the identity authentication key to generate encrypted identity data.

[0036] Furthermore, to achieve the above objectives, the present invention also proposes a security module, which includes:

[0037] The arithmetic module is used to perform secure calculations based on the first random number in the initial encryption command and the second random number in the decryption data fed back by the SIM card to obtain the authentication key.

[0038] The encryption module is used to encrypt the identity data reading instruction according to the identity authentication key, and to determine the encrypted reading instruction;

[0039] The sending module is used to send the encrypted reading instruction to the SIM card, so that the SIM card can verify the message authentication code in the encrypted reading instruction and return the encrypted identity data when the verification is successful;

[0040] The authentication module is used to authenticate the identity based on the encrypted identity data and the biometric value of the target user.

[0041] Furthermore, to achieve the above objectives, the present invention also proposes a SIM card, the SIM card comprising:

[0042] The sending module is used to send the initial encrypted data to the security module so that the security module can decrypt the initial encrypted data to obtain decrypted data, generate an identity authentication key according to the first random number in the initial encryption instruction and the second random number in the decrypted data, encrypt the identity data reading instruction according to the identity authentication key, determine the encrypted reading instruction and feed it back.

[0043] The verification module is also used to perform verification based on the message authentication code in the encrypted reading instruction;

[0044] The generation module is used to generate encrypted identity data based on the identity authentication key when the verification is successful, and send the encrypted identity data to the security module so that the security module can perform identity authentication based on the encrypted identity data and the biometric value of the target user.

[0045] In addition, to achieve the above objectives, the present invention also proposes an identity authentication system, which includes the security module and the SIM card as described above.

[0046] This invention applies to a security module comprised of a security chip with an SPI interface, including an INT control pin. The authentication method includes: performing a secure operation based on a first random number in the initial encryption command and a second random number in the decrypted data returned by the SIM card to obtain an authentication key; encrypting an identity data read command using the authentication key to determine an encrypted read command; sending the encrypted read command to the SIM card to enable the SIM card to verify the message authentication code in the encrypted read command, and returning encrypted identity data upon successful verification; and performing identity authentication based on the encrypted identity data and the biometric value of the target user. Through this method, by performing a secure operation based on the first random number in the initial encryption command and the second random number in the decrypted data returned by the SIM card, encrypting the identity data read command based on the authentication key, sending the encrypted read command to the SIM card, and having the SIM card perform secure verification and return encrypted data upon successful verification, the security module performs identity authentication based on the encrypted identity data and the biometric value of the target user. This not only shortens the processing time and authentication time but also ensures the security of identity authentication and achieves offline real-person authentication of digital identity, thus improving the user experience. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating the first embodiment of the identity authentication method of the present invention;

[0048] Figure 2 This is a schematic diagram of the system architecture of an embodiment of the identity authentication method of the present invention;

[0049] Figure 3 This is a flowchart illustrating the second embodiment of the identity authentication method of the present invention;

[0050] Figure 4 This is a flowchart illustrating the authentication process of an embodiment of the identity authentication method of the present invention.

[0051] Figure 5 This is a flowchart illustrating the third embodiment of the identity authentication method of the present invention;

[0052] Figure 6 This is a schematic diagram of the overall process of an embodiment of the identity authentication method of the present invention;

[0053] Figure 7 This is a structural block diagram of an embodiment of the security module of the present invention;

[0054] Figure 8 This is a structural block diagram of an embodiment of the SIM card of the present invention;

[0055] Figure 9 This is a structural block diagram of the first embodiment of the identity authentication system of the present invention.

[0056] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0057] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0058] This invention provides an identity authentication method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating a first embodiment of an identity authentication method according to the present invention.

[0059] An authentication method is applied to a security module, the security module being composed of a security chip with an SPI interface, the SPI interface including an INT control pin, the authentication method comprising the following steps:

[0060] Step S10: Perform a security calculation based on the first random number in the initial encryption command and the second random number in the decryption data fed back by the SIM card to obtain the authentication key.

[0061] It should be noted that the execution entity in this embodiment is the security module in the identity authentication system. The identity authentication system includes a security module, a SIM card, and a main control chip. The main control chip and the security module are the authentication terminals. A schematic diagram of applying the SIM card to a mobile phone is shown below. Figure 2 As shown, the authentication terminal accesses the SIM card via NFC to read identity data.

[0062] It is understood that this embodiment proposes a security module with an embedded data link layer protocol and SPI interface, and describes its ability to perform digital identity data encryption and decryption and local real-person authentication on the terminal side. This security module integrates an independent security chip to replace the existing software encryption and decryption scheme. While greatly improving the security of keys and sensitive information, the local encryption and decryption and biometric comparison capabilities of the security module mean that the digital identity terminal no longer needs to connect to the network when performing identity authentication. The corresponding privacy data does not need to be stored and transferred through multiple parties, making the overall solution more simplified.

[0063] In its implementation, this security module interacts with the digital identity terminal via SPI. Existing solutions using the ISO7816 interface for communication between the digital identity terminal and the security module typically have a maximum communication rate of only 2.5 Mbps. The SPI interface can significantly increase the command transmission rate to 20-50 Mbps. Traditional industrial equipment lacks the ISO7816 interface, and the SPI interface solves the compatibility issues of digital identity on traditional industrial equipment. Considering potential differences in the main control chips of digital identity terminals, to reduce power consumption, increase flexibility, and expandability, this embodiment adds an INT control pin to the original protocol. This pin is used by the security module to notify the terminal whether it can receive or send data. In this embodiment, the security module hardware uses an SE chip with an SPI interface as the core module, providing the hardware implementation of security encryption functions and the SPI physical interface. The SE chip's built-in GPIO interface is used for the INT signal. The SPI interface includes MOSI, MISO data pins, SCLK clock pin, SS chip select pin, and INT control pin. The INT control pin is used to receive notifications from the smart encryption card or security module and determine whether data can be received or sent based on the notification.

[0064] It should be noted that the SPI interface and its link layer protocol enable the terminal to quickly transmit digital identity authentication data and user biometric data to the security module via APDU commands. After integrating the security module, the digital identity authentication terminal can have offline digital identity real-person authentication capabilities.

[0065] It is understandable that the encrypted initial instruction refers to the security module encrypting the identity initial instruction. The encrypted initial instruction contains a first random number, a message authentication code, and a key version.

[0066] In the specific implementation, after the security module sends the initial encryption command to the SIM card, the SIM card performs security verification on the initial encryption command. After the verification is successful, it will return the initial encrypted data. The security module decrypts the initial encrypted data to obtain the decrypted data, which contains a second random number, a message authentication code, and ciphertext.

[0067] It should be noted that the security module performs a security operation on the first random number A in the initial encryption command and the second random number B in the decrypted data, and the result is the identity authentication key.

[0068] Understandably, in order to obtain decrypted data while ensuring authentication security, the method further includes, before performing secure calculations based on the first random number in the initial encryption command and the second random number in the decrypted data returned by the SIM card to obtain the identity authentication key, the following steps are also included: upon receiving the initial identity command, distributing the preset key according to the first random number in the initial identity command to obtain a process key; encrypting the initial identity command according to the process key to generate an initial encryption command; sending the initial encryption command to the SIM card so that the SIM card verifies the message authentication code in the initial encryption command, and upon successful verification, returning initial encrypted data; verifying the message authentication code in the initial encrypted data, and upon successful verification, decrypting the initial encrypted data to obtain decrypted data.

[0069] It should be noted that the security module organizes the digital identity reading initialization command. The initialization command includes the key version used and a first random number A. The security module uses the first random number A to distribute the preset key to obtain a process key. The process key is then used to encrypt the initialization command data and calculate the MAC (Message Authentication Code) to obtain the encrypted initial command. The authentication terminal sends the encrypted initial command via NFC to activate the SIM card digital identity application. In this embodiment, the initialization command is the identity initialization command.

[0070] Understandably, after receiving the initial encryption command, the SIM card selects the corresponding key version, uses the first random number A to distribute the key, and then verifies the MAC of the initial encryption command. If the verification fails, the current process ends. If the verification succeeds, the SIM card first generates a second random number B, encrypts it using the current process key, then performs MAC calculation on the ciphertext, and sends the initial encrypted data back to the authentication terminal.

[0071] The security module verifies the MAC in the initial encrypted data. After successful verification, it decrypts the initial encrypted data to obtain the decrypted data.

[0072] Step S20: Encrypt the identity data reading instruction according to the identity authentication key to determine the encrypted reading instruction.

[0073] It should be noted that the security module encrypts the identity data read command based on the identity authentication key and calculates the MAC to generate an encrypted read command.

[0074] Step S30: Send the encrypted read command to the SIM card so that the SIM card verifies the message authentication code in the encrypted read command and returns the encrypted identity data when the verification is successful.

[0075] It should be noted that the security module sends the encrypted read command to the SIM card via NFC. The SIM card uses the authentication key to verify the MAC in the encrypted read command. When the verification is successful, the encrypted read command is decrypted, the data is organized according to the read mode in the encrypted read command, the target user's identity data is read, encrypted using the authentication key, and the MAC is calculated to generate encrypted identity data and send it back to the authentication terminal.

[0076] Step S40: Perform identity authentication based on the encrypted identity data and the target user's biometric value.

[0077] It should be noted that the security module compares the encrypted identity data fed back by the SIM card with the target user's biometric value, and determines whether the target user has passed the identity authentication based on the comparison result.

[0078] This embodiment applies to a security module, which consists of a security chip with an SPI interface, including an INT control pin. The authentication method includes: performing a secure operation based on a first random number in the initial encryption command and a second random number in the decrypted data returned by the SIM card to obtain an authentication key; encrypting an identity data read command based on the authentication key to determine an encrypted read command; sending the encrypted read command to the SIM card so that the SIM card verifies the message authentication code in the encrypted read command, and returns encrypted identity data upon successful verification; and performing identity authentication based on the encrypted identity data and the biometric value of the target user. Through this method, by performing a secure operation based on the first random number in the initial encryption command and the second random number in the decrypted data returned by the SIM card, encrypting the identity data read command based on the authentication key, sending the encrypted read command to the SIM card, and having the SIM card perform secure verification and return encrypted data upon successful verification, the security module performs identity authentication based on the encrypted identity data and the biometric value of the target user. This not only shortens the service time and identity authentication time but also ensures the security of identity authentication and achieves offline real-person authentication of digital identity, improving the user experience.

[0079] Reference Figure 3 , Figure 3 This is a flowchart illustrating a second embodiment of an identity authentication method according to the present invention.

[0080] Based on the first embodiment described above, step S40 in the identity authentication method of this embodiment includes:

[0081] Step S41: Decrypt the encrypted identity data to obtain the user identity data.

[0082] It should be noted that the authentication terminal reads the encrypted identity data from the SIM card and transmits it to the security module via the SPI interface. Compared to the ISO7816 interface (maximum 2.5Mbps), the SPI interface (20-50Mbps) can increase the command transmission rate by 8-20 times. The security module decrypts the received encrypted identity data to obtain the target user's identity data. This user identity data includes, but is not limited to, the user's biometric features and identity information.

[0083] Step S42: Obtain the biometric value of the target user sent by the authentication terminal through the SPI interface. The biometric value is obtained by the authentication terminal converting the collected biometric information of the target user.

[0084] It should be noted that the authentication terminal collects the target user's face or fingerprint and other biometric information on-site through its own camera or fingerprint sensor, converts it into biometric value through a standard algorithm, and then transmits the target user's biometric value to the security module through the SPI interface.

[0085] Step S43: Compare the biometric value with the user identity data.

[0086] It should be noted that the security module compares the biometric values ​​collected by the authentication terminal with the user's biometric information values ​​in the user identity data fed back by the SIM card, thereby obtaining the result of whether the biometric values ​​are consistent with the user's biometric information values.

[0087] Step S44: Complete the identity authentication of the target user based on the comparison results.

[0088] It should be noted that when the biometric value matches the user's biometric information value, the target user's identity authentication is successful; otherwise, it fails, thus completing the offline real-person authentication of the digital identity. The specific process is as follows: Figure 4 As shown.

[0089] Understandably, to ensure the integrity of the identity authentication process, after completing the identity authentication of the target user based on the comparison result, the process further includes: decrypting the user's identity data to obtain plaintext identity information when the identity authentication is successful; and sending the plaintext identity information to the authentication terminal so that the authentication terminal determines the end of the authentication based on the plaintext identity information.

[0090] In the specific implementation, when the target user's identity authentication is successful, the security module decrypts the user's identity information in the user identity data to obtain the plaintext identity information, and sends the target user's plaintext identity information to the authentication terminal through the SPI interface. The authentication terminal determines the end of the authentication process based on the plaintext identity information.

[0091] This embodiment obtains user identity data by decrypting the encrypted identity data; it acquires the biometric value of the target user sent by the authentication terminal via the SPI interface, the biometric value being obtained by the authentication terminal converting the collected biometric information of the target user; it compares the biometric value with the user identity data; and it completes the identity authentication of the target user based on the comparison result. Through the above methods, the security of the authentication process and the accuracy of the authentication result are ensured.

[0092] refer to Figure 5 , Figure 5 This is a flowchart illustrating a third embodiment of an identity authentication method according to the present invention.

[0093] The identity authentication method in this embodiment is applied to a SIM card and includes the following steps:

[0094] Step S01: Upon receiving the encryption initialization command sent by the security module, verify the message authentication code in the encryption initialization command.

[0095] It should be noted that the execution subject in this embodiment is the SIM card in the identity authentication system. The identity authentication system includes a security module, a SIM card, and a main control chip. The main control chip and the security module are authentication terminals.

[0096] It is understandable that the encrypted initialization command refers to the encrypted version of the identity initialization command obtained by the security module. The encrypted initialization command contains a first random number, a message authentication code, and a key version. When the SIM card receives the encrypted initialization command sent by the security module, it will perform security verification based on the message authentication code in the encrypted initialization command.

[0097] In a specific implementation, to ensure the accuracy of the verification process, the verification based on the message authentication code in the initial encryption instruction further includes: obtaining the current key version; calculating the authentication code based on the first random number in the initial encryption instruction and the current key version to determine the calculated authentication code; comparing the calculated authentication code with the message authentication code in the initial encryption instruction, and determining whether the verification is successful based on the comparison result.

[0098] It should be noted that the SIM card obtains the current key version in the initial encryption command, uses the first random number A in the initial encryption command to distribute the key corresponding to the current key version, calculates the MAC, and verifies whether the calculated authentication code and the message authentication code of the initial encryption command are consistent. If they are consistent, the verification is successful.

[0099] Step S02: Upon successful verification, the second random number is encrypted using the process key in the initial encryption instruction to generate initial encrypted data.

[0100] It should be noted that if verification fails, the current process ends. If verification succeeds, the SIM card first generates a second random number B, encrypts it using the process key, and then performs a MAC calculation on the ciphertext to generate the initial encrypted data.

[0101] Step S03: Send the initial encrypted data to the security module so that the security module decrypts the initial encrypted data to obtain decrypted data. Generate an identity authentication key based on the first random number in the initial encryption instruction and the second random number in the decrypted data. Encrypt the identity data reading instruction based on the identity authentication key, determine the encrypted reading instruction, and provide feedback.

[0102] It should be noted that the SIM card sends the initial encrypted data to the authentication terminal. The authentication terminal sends the initial encrypted data to the security module via the SPI interface. The security module verifies the MAC in the initial encrypted data. After successful verification, it decrypts the initial encrypted data to obtain decrypted data. It then performs a secure operation on the first random number A in the initial encryption command and the second random number B in the decrypted data to obtain the identity authentication key. Based on the identity authentication key, it encrypts the identity data read command and calculates the MAC to generate an encrypted read command, which is then sent to the SIM card.

[0103] Step S04: Verify according to the message authentication code in the encrypted reading instruction.

[0104] Step S05: Upon successful verification, generate encrypted identity data based on the identity authentication key and send the encrypted identity data to the security module so that the security module can perform identity authentication based on the encrypted identity data and the target user's biometric value.

[0105] It should be noted that the SIM card uses an identity authentication key to verify the MAC in the encrypted read command. When the verification is successful, it generates encrypted identity data based on the identity authentication key and sends it back to the authentication terminal. The authentication terminal sends the encrypted identity data to the security module. The security module compares the encrypted identity data fed back by the SIM card with the target user's biometric value and determines whether the target user has passed the identity authentication based on the comparison result.

[0106] Understandably, in order to generate accurate identity encryption data, the step of generating identity encryption data based on the identity authentication key further includes: determining a reading mode based on the encryption reading instruction; organizing data according to the reading mode to determine the identity data to be read; and encrypting the read identity data based on the identity authentication key to generate identity encryption data.

[0107] In its implementation, the SIM card decrypts the encrypted read command, organizes the data according to the read pattern specified in the command, reads the target user's identity data, encrypts the target user's identity data using an authentication key, and calculates the MAC address to generate encrypted identity data. In this embodiment, the target user's identity data is the read identity data.

[0108] It should be noted that the specific authentication process is shown in Figure 6. The authentication terminal accesses the SIM card application via NFC to read the identity data, which is then decrypted by the security module. The security module then performs local comparison of biometric information features such as facial images or fingerprints to achieve offline real-person authentication of digital identity.

[0109] This embodiment is applied to a SIM card. Upon receiving an initial encryption command from a security module, it verifies the information using the message authentication code in the initial encryption command. If the verification is successful, it encrypts a second random number using the process key in the initial encryption command to generate initial encrypted data. This initial encrypted data is then sent to the security module, which decrypts it to obtain decrypted data. An authentication key is generated using the first random number in the initial encryption command and the second random number in the decrypted data. The authentication key is used to encrypt an identity data read command, which is then confirmed and fed back. The message authentication code in the encrypted read command is then verified. If the verification is successful, encrypted identity data is generated using the authentication key and sent to the security module, allowing the security module to perform identity authentication based on the encrypted identity data and the target user's biometric value. This not only shortens the processing time and identity authentication time but also ensures the security of identity authentication and enables offline real-person authentication of digital identity, improving the user experience.

[0110] In addition, refer to Figure 7 This invention also proposes a security module, which includes:

[0111] The arithmetic module 10 is used to perform secure calculations based on the first random number in the initial encryption instruction and the second random number in the decryption data fed back by the SIM card to obtain the identity authentication key.

[0112] The encryption module 20 is used to encrypt the identity data reading instruction according to the identity authentication key, and to determine the encrypted reading instruction.

[0113] The sending module 30 is used to send the encrypted reading instruction to the SIM card, so that the SIM card can verify the message authentication code in the encrypted reading instruction and return the encrypted identity data when the verification is successful.

[0114] The authentication module 40 is used to perform identity authentication based on the encrypted identity data and the biometric value of the target user.

[0115] This embodiment obtains an authentication key by performing a secure operation based on a first random number in the initial encryption command and a second random number in the decrypted data returned by the SIM card. The authentication key is then used to encrypt an identity data read command, resulting in an encrypted read command. This encrypted read command is sent to the SIM card, which verifies the message authentication code within the command. Upon successful verification, the SIM card returns encrypted identity data. Identity authentication is then performed based on the encrypted identity data and the target user's biometric value. This method, involving secure operations based on the first random number in the initial encryption command and the second random number in the decrypted data returned by the SIM card, encryption of the identity data read command using the authentication key, sending the encrypted read command to the SIM card, security verification by the SIM card, and authentication based on the encrypted identity data and the target user's biometric value, not only shortens the processing time and authentication time but also ensures the security of identity authentication. Furthermore, it enables offline real-person authentication of digital identity, improving the user experience.

[0116] In one embodiment, the calculation module 10 is further configured to, upon receiving an identity initialization instruction, distribute a preset key according to a first random number in the identity initialization instruction to obtain a process key;

[0117] The identity initialization command is encrypted using the process key to generate an encrypted initialization command;

[0118] The encryption initialization command is sent to the SIM card so that the SIM card verifies the message authentication code in the encryption initialization command, and returns the initial encrypted data when the verification is successful;

[0119] The initial encrypted data is verified using the message authentication code in the initial encrypted data. If the verification is successful, the initial encrypted data is decrypted to obtain the decrypted data.

[0120] In one embodiment, the authentication module 40 is further configured to decrypt the encrypted identity data to obtain user identity data;

[0121] The biometric value of the target user sent by the authentication terminal through the SPI interface is obtained, wherein the biometric value is obtained by the authentication terminal by converting the collected biometric information of the target user;

[0122] The biometric values ​​are compared with the user identity data;

[0123] The identity authentication of the target user is completed based on the comparison results.

[0124] In one embodiment, the authentication module 40 is further configured to decrypt the user's identity data to obtain plaintext identity information when the identity authentication is successful;

[0125] The plaintext identity information is sent to the authentication terminal so that the authentication terminal determines that the authentication is complete based on the plaintext identity information.

[0126] Since this security module adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be repeated here.

[0127] In addition, refer to Figure 8 The present invention also proposes a SIM card, the SIM card comprising:

[0128] The verification module 11 is used to verify the encryption initialization command sent by the security module according to the message authentication code in the encryption initialization command.

[0129] The encryption module 12 is used to encrypt the second random number according to the process key in the initial encryption instruction when the verification is successful, so as to generate initial encrypted data.

[0130] The sending module 13 is used to send the initial encrypted data to the security module so that the security module can decrypt the initial encrypted data to obtain decrypted data, generate an identity authentication key according to the first random number in the initial encryption instruction and the second random number in the decrypted data, encrypt the identity data reading instruction according to the identity authentication key, determine the encrypted reading instruction and provide feedback.

[0131] The verification module 11 is also used to perform verification based on the message authentication code in the encrypted reading instruction.

[0132] The generation module 14 is used to generate encrypted identity data based on the identity authentication key when the verification is successful, and send the encrypted identity data to the security module so that the security module can perform identity authentication based on the encrypted identity data and the biometric value of the target user.

[0133] This embodiment verifies the initial encryption command received from the security module using the message authentication code in the command. Upon successful verification, it encrypts a second random number using the process key in the command to generate initial encrypted data. This initial encrypted data is then sent to the security module for decryption. An authentication key is generated using the first random number in the command and the second random number in the decrypted data. This authentication key is used to encrypt an identity data read command, which is then confirmed and fed back. The message authentication code in the read command is then verified. Upon successful verification, encrypted identity data is generated using the authentication key and sent to the security module, allowing the module to perform identity authentication based on the encrypted data and the target user's biometric value. This not only shortens the processing time and authentication time but also ensures the security of identity authentication and enables offline real-person authentication of digital identities, improving the user experience.

[0134] In one embodiment, the verification module 11 is further configured to obtain the current key version;

[0135] The authentication code is calculated based on the first random number in the initial encryption instruction and the current key version, and the calculated authentication code is determined.

[0136] The calculated authentication code is compared with the message authentication code in the initial encryption instruction, and the verification is determined based on the comparison result.

[0137] In one embodiment, the generation module 14 is further configured to determine a reading mode based on the encrypted reading instruction;

[0138] Data is organized according to the reading pattern to determine the identity data to be read;

[0139] The identity data is encrypted using the identity authentication key to generate encrypted identity data.

[0140] Since this SIM card adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be described in detail here.

[0141] In addition, refer to Figure 9 This invention also proposes an identity authentication system, which includes a security module 21 and a SIM card 22.

[0142] Since this identity authentication system adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought about by the technical solutions of the above embodiments, which will not be repeated here.

[0143] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0144] In addition, for technical details not described in detail in this embodiment, please refer to the identity authentication method provided in any embodiment of the present invention, which will not be repeated here.

[0145] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0146] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0147] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0148] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. An identity authentication method, characterized by, The application is applied to a security module composed of a security chip with an SPI interface, the SPI interface contains an INT control pin, and the identity authentication method comprises the following steps: According to the first random number in the encrypted initial instruction and the second random number in the decryption data fed back by the SIM card, a secure operation is performed to obtain an identity authentication key; According to the identity authentication key, identity data reading instructions are encrypted to determine encrypted reading instructions; The encrypted reading instructions are sent to the SIM card to enable the SIM card to verify the message authentication code in the encrypted reading instructions, and identity encrypted data is fed back when the verification is passed; According to the identity encrypted data and the biological feature value of the target user, identity authentication is performed.

2. The identity authentication method of claim 1, wherein, Before the secure operation is performed according to the first random number in the encrypted initial instruction and the second random number in the decryption data fed back by the SIM card to obtain the identity authentication key, the following steps are further included: When the identity initial instruction is received, a process key is obtained by dispersing a preset key according to the first random number in the identity initial instruction; According to the process key, the identity initial instruction is encrypted to generate encrypted initial instructions; The encrypted initial instructions are sent to the SIM card to enable the SIM card to verify the message authentication code in the encrypted initial instructions, and initial encrypted data is fed back when the verification is passed; According to the message authentication code in the initial encrypted data, the initial encrypted data is decrypted to obtain decryption data when the verification is passed.

3. The identity authentication method of claim 1, wherein, The identity authentication is performed according to the identity encrypted data and the biological feature value of the target user, and the following steps are included: The identity encrypted data is decrypted to obtain user identity data; The biological feature value of the target user sent by the authentication terminal through the SPI interface is obtained, and the biological feature value is obtained by converting the biological information collected by the authentication terminal; The biological feature value and the user identity data are compared; According to the comparison result, the identity authentication of the target user is completed.

4. The identity authentication method as claimed in claim 3, characterized in that, After the identity authentication of the target user is completed according to the comparison result, the following steps are further included: When the identity authentication is passed, the user identity data is decrypted to obtain identity plaintext information; The identity plaintext information is sent to the authentication terminal to enable the authentication terminal to determine the end of authentication according to the identity plaintext information.

5. An identity authentication method characterized by, The application is applied to a SIM card, and the identity authentication method comprises the following steps: When the encrypted initial instruction sent by the security module is received, the message authentication code in the encrypted initial instruction is verified; When the verification is passed, the second random number is encrypted according to the process key in the encrypted initial instruction to generate initial encrypted data; The initial encrypted data is sent to the security module to enable the security module to decrypt the initial encrypted data to obtain decryption data, generate an identity authentication key according to the first random number in the encrypted initial instruction and the second random number in the decryption data, encrypt identity data reading instructions according to the identity authentication key, determine encrypted reading instructions, and feed back the encrypted reading instructions; The message authentication code in the encrypted reading instructions is verified; When the verification is passed, identity encryption data is generated according to the identity authentication key, and the identity encryption data is sent to the security module, so that the security module performs identity authentication according to the identity encryption data and a biometric value of a target user.

6. The identity authentication method of claim 5, wherein, The verification according to the message authentication code in the encryption initial instruction comprises: obtaining a current key version; performing authentication code calculation according to the first random number in the initial encryption instruction and the current key version to determine a calculated authentication code; comparing the calculated authentication code with the message authentication code in the encryption initial instruction to determine whether the verification is passed according to a comparison result.

7. The identity authentication method of claim 5, wherein, The identity encryption data is generated according to the identity authentication key, and the identity encryption data is sent to the security module, so that the security module performs identity authentication according to the identity encryption data and a biometric value of a target user. The security module comprises: an operation module, configured to perform security operation according to the first random number in the encryption initial instruction and a second random number in decryption data fed back by the SIM card to obtain an identity authentication key; an encryption module, configured to encrypt an identity data reading instruction according to the identity authentication key to determine an encryption reading instruction; 8. A security module, characterized in that a sending module, configured to send the encryption reading instruction to the SIM card, so that the SIM card performs verification on a message authentication code in the encryption reading instruction, and feeds back identity encryption data when the verification is passed; an authentication module, configured to perform identity authentication according to the identity encryption data and a biometric value of a target user. The SIM card comprises: a verification module, configured to perform verification according to a message authentication code in the encryption initial instruction when the encryption initial instruction sent by the security module is received; an encryption module, configured to generate initial encryption data by encrypting a second random number according to a process key in the encryption initial instruction when the verification is passed; 9. A SIM card, characterized by a sending module, configured to send the initial encryption data to the security module, so that the security module decrypts the initial encryption data to obtain decryption data, generates an identity authentication key according to the first random number in the encryption initial instruction and the second random number in the decryption data, encrypts an identity data reading instruction according to the identity authentication key to determine an encryption reading instruction and feeds back the encryption reading instruction; the verification module is further configured to perform verification according to a message authentication code in the encryption reading instruction; a generation module, configured to generate identity encryption data according to the identity authentication key when the verification is passed, and send the identity encryption data to the security module, so that the security module performs identity authentication according to the identity encryption data and a biometric value of a target user. The identity authentication system comprises the security module in claim 8 and the SIM card in claim 9. The identity authentication system comprises the security module in claim 8 and the SIM card in claim 9. ​ 10. An identity authentication system characterized by comprising: ​

Images