Interface conversion device and system

Abstract

The embodiment of the invention discloses an interface conversion device and system.The interface conversion device comprises a first interface, at least one second interface, at least one contact type card read-write card slot, a contact type card read-write card slot and a single-chip microcomputer, the first interface is used for being connected with an upper computer and conducting data transmission with the upper computer; the at least one second interface is used for connecting a first type of password token and performing data transmission with the first type of password token; the at least one contact card read-write card slot is used for connecting a second type of password token and performing data transmission with the second type of password token; the NFC coil is arranged in the interface conversion device and is used for carrying out data transmission with the third type password token; and the single-chip microcomputer is arranged in the interface conversion device and is used for protocol conversion. The interface conversion device carries out protocol conversion through the single-chip microcomputer, and multiple types of old tokens can still be used for providing keys after user terminal equipment is upgraded.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to an interface conversion device and system. Background Art

[0002] With the advancement of technology, more and more application scenarios require login verification, for example, users log in to shopping websites, banking applications, employees log in to corporate platforms, etc. The traditional login methods are password login, password combined with U shield login, etc. However, since password login requires users to remember the password, there is a risk of forgetting the password. When using password combined with U shield login, not only do users need to remember the password, but they also need to install the U shield driver on the user's terminal device. The operation process is complicated, and the development of U shield is difficult. It is necessary to set up a security chip internally, and when security problems occur, it can only be improved but not upgraded, and the cost is relatively high.

[0003] In the prior art, in order to improve the convenience of login, a password-free login is designed. The following three methods are commonly used to provide keys: method 1, using the operating system and the computer's built-in trusted chip; method 2, using the operating system and the cloud key manager; method 3, using an external authenticator; due to the diversity of software and hardware working platforms used by users, the above three methods of providing keys have their own problems. Specifically, the above method 1 does not require an external device, but because the software and the computer's built-in trusted chip pass the key, it cannot be migrated to other computers for use; the above method 2, the key is stored in the cloud, which does not comply with the security management strategy used for internal deployment of the enterprise; the above method 3 has poor compatibility. For example, when the above external authenticator is a near-field wireless communication NFC card, it can be used on device A but not on device B, or the user terminal needs to use NFC FIDO 2.0 to provide the key, but the user can only provide NFC FIDO 1.0 or USB Type-A and other old tokens to provide the key.

[0004] In summary, how to continue to use multiple types of old tokens to provide keys after the user terminal equipment is upgraded is a problem that needs to be solved at present. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides an interface conversion device and system, which continue to use multiple types of old tokens to provide keys after the user terminal equipment is upgraded, thereby reducing the cost of users replacing new tokens.

[0006] In a first aspect, an embodiment of the present invention provides an interface conversion device, the device comprising:

[0007] The first interface is used to connect to a host computer and perform data transmission with the host computer;

[0008] at least one second interface, used to connect to a first type of cryptographic token and perform data transmission with the first type of cryptographic token;

[0009] At least one contact card reader / writer slot, used for connecting to a second type of cryptographic token and performing data transmission with the second type of cryptographic token;

[0010] A near-field wireless communication NFC coil is arranged inside the interface conversion device and is used for data transmission with a third type of password token;

[0011] The single-chip microcomputer is arranged inside the interface conversion device and is used for performing protocol conversion, converting the first protocol instruction in the data sent by the host computer through the first interface into a second protocol instruction available for the first type of password token, the second type of password token or the third type of password token, and sending it to the second interface, the contact card reader / writer slot or the near-field wireless communication NFC coil.

[0012] Optionally, the first interface is a USB Type-C interface or a USB Type-A interface; the second interface is a USB Type-A interface or a USB Type-C interface.

[0013] Optionally, the contact card reader / writer slot is an ISO 7816 contact card reader / writer socket.

[0014] Optionally, the near-field wireless communication NFC coil includes a standard NFC coil and a reader / writer chip, wherein the standard NFC coil is used to transmit data with the third type of cryptographic token, and the reader / writer chip is connected to the single-chip microcomputer, receives the second protocol instruction sent by the single-chip microcomputer, and sends the first response information of the third type of cryptographic token to the single-chip microcomputer.

[0015] Optionally, the single chip microcomputer is further used to receive a first response message sent by the first type of cryptographic token, the second type of cryptographic token or the third type of cryptographic token, convert the first response message into a second response message, and send it to the first interface.

[0016] Optionally, the first type of cryptographic token is a cryptographic token with a USB Type-A interface or a USB Type-C interface, the second type of cryptographic token is a contact card, and the third type of cryptographic token is a card with an NFC coil or a USB token with NFC function.

[0017] Optionally, the at least one second interface and the at least one contact card reader / writer slot are simultaneously connected to a cryptographic token of a corresponding type.

[0018] Optionally, the protocol between the host computer and the first interface is a USB HID protocol.

[0019] In a second aspect, an embodiment of the present invention provides an interface conversion system, the system comprising:

[0020] Host computer;

[0021] An interface conversion device as described in any one of the first aspects, wherein the interface conversion device is connected to the host computer via a first interface.

[0022] Optionally, the system further comprises:

[0023] At least one first type of cryptographic token, at least one second type of cryptographic token and / or at least one third type of cryptographic token, wherein the first type of cryptographic token is connected to the interface conversion device via a second interface for wired data transmission; the second type of cryptographic token is connected to the interface conversion device via a contact card reader / writer slot for wired data transmission; the third type of cryptographic token is connected to the interface conversion device via a near-field wireless communication NFC coil for wireless data transmission.

[0024] The interface conversion device in the embodiment of the present invention includes a first interface, at least one second interface, at least one contact card reader / writer slot, a contact card reader / writer slot and a single-chip microcomputer, wherein the first interface is used to connect to a host computer and perform data transmission with the host computer; at least one second interface is used to connect to a first type of password token and perform data transmission with the first type of password token; at least one contact card reader / writer slot is used to connect to a second type of password token and perform data transmission with the second type of password token; an NFC coil is arranged inside the interface conversion device and is used to perform data transmission with a third type of password token; and a single-chip microcomputer is arranged inside the interface conversion device and is used to perform protocol conversion. The interface conversion device performs protocol conversion through the single-chip microcomputer, and can continue to use multiple types of old tokens to provide keys after the user terminal device is upgraded, thereby reducing the cost of users replacing new tokens. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0026] Figure 1 is a structural schematic diagram of an interface conversion device in an embodiment of the present invention;

[0027] Figure 2 It is a schematic diagram of the connection between an interface conversion device and a password token in an embodiment of the present invention;

[0028] Figure 3It is a schematic diagram of the connection between another interface conversion device and a password token in an embodiment of the present invention;

[0029] Figure 4 It is a schematic diagram of the connection between another interface conversion device and a password token in an embodiment of the present invention;

[0030] Figure 5 It is a schematic diagram of the interaction between an interface conversion device and a password token in an embodiment of the present invention;

[0031] Figure 6 It is a schematic diagram of the connection between another interface conversion device and a password token in an embodiment of the present invention;

[0032] Figure 7 is a structural schematic diagram of an interface conversion system in an embodiment of the present invention;

[0033] Figure 8 is a flow chart of a method for interface conversion in an embodiment of the present invention;

[0034] Fig. 9 is a flow chart of another method for interface conversion in an embodiment of the present invention;

[0035] Fig.10 is a flow chart of another method for interface conversion in an embodiment of the present invention;

[0036] Fig.11 This is another method flow chart of interface conversion in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The present application is described below based on embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, some specific details are described in detail. It is possible for those skilled in the art to fully understand the present application without the description of these details. In order to avoid confusing the essence of the present application, known methods, processes, flows, components and circuits are not described in detail.

[0038] In addition, persons of ordinary skill in the art will appreciate that the drawings provided herein are for illustration purposes and are not necessarily drawn to scale.

[0039] Unless the context clearly requires otherwise, the words "include", "comprising" and similar words throughout the application should be interpreted as including rather than exclusive or exhaustive; that is, the meaning is "including but not limited to".

[0040] In the description of this application, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of this application, unless otherwise specified, the meaning of "plurality" is two or more.

[0041] In the prior art, in order to improve the convenience of login, a password-free login is designed, for example, Fast IDentity Online (FIDO), WebAuthn or Passkey, wherein the FIDO is a technical specification for online user identity verification, allowing users to log in to online accounts using strong authentication methods such as biometrics or FIDO security keys, and FIDO versions include FIDO 1.0, FIDO2.0 and FIDO 2.1; the WebAuthn is an identity authentication method based on public key cryptography technology, which aims to replace the traditional username and password login method, provide a safer and more convenient identity authentication experience, and use the hardware security module or software-implemented security authenticator on the device to complete the identity authentication process by generating and storing the user's public and private key pairs, and using the private key to sign the challenge. The WebAuthn is evolved and generated after integrating the functions of U2F (Universal Second Factor) and UAF (Universal Authentication Framework) on the basis of FIDO2.0; the Passkey is another product name of FIDO WebAuthn.

[0042] The following three methods are commonly used to provide keys: Method 1: Using the operating system (OS) and the computer's built-in trusted chip, such as Windows Hello and Chrome; Method 2: Using the operating system and the cloud key manager, such as 1Password and iCloud Keychain; Method 3: Using an external authenticator, such as a USB device, a Bluetooth device, or a Near Field Communication (NFC) device; Due to the diversity of software and hardware working platforms used by users, the above three methods of providing keys have their own problems. Specifically, the above method 1 is inexpensive because it does not require an external device, but because the software and the computer's built-in trusted chip pass the key, it cannot be migrated to other computers for use, which is limited by the platform type; the above method 2 keys are stored in the cloud, and the price is connected, but it does not meet the security management strategy used for internal deployment in the enterprise; The above method 3 has poor compatibility. For example, when the above external authenticator is a near-field wireless communication NFC card, it can be used on device A but not on device B, or NFC FIDO1.0 can be used on the browser Android Chrome, but NFC FIDO 2.0 cannot be used on the browser Android Chrome, or the user terminal needs to use NFC FIDO 2.0 provides keys, while users can only provide old tokens such as NFC FIDO1.0 or USB Type-A to provide keys. Therefore, how to continue to use multiple types of old tokens to provide keys after the user terminal device is upgraded is a problem that needs to be solved at present.

[0043] In order to solve the above problems, an interface conversion device is proposed in the embodiment of the present invention. Figure 1 As shown, the device comprises:

[0044] A first interface 101, at least one second interface 102, at least one contact card reader / writer slot 103, a near-field wireless communication NFC coil 104 and a single-chip microcomputer 105, wherein the first interface is used to connect to a host computer and perform data transmission with the host computer; at least one of the second interfaces is used to connect to a first type of password token and perform data transmission with the first type of password token; at least one of the contact card reader / writer slots is used to connect to a second type of password token and perform data transmission with the second type of password token; the near-field wireless communication NFC coil is arranged inside the interface conversion device and is used to perform data transmission with a third type of password token; the single-chip microcomputer is arranged inside the interface conversion device and is used to perform protocol conversion, converting the first protocol instruction in the data sent by the host computer through the first interface into a second protocol instruction available to the first type of password token, the second type of password token or the third type of password token, and sending it to the second interface, the contact card reader / writer slot or the near-field wireless communication NFC coil.

[0045] In the Figure 1 Only one second interface and one contact card reader / writer slot are shown, and other multiple second interfaces or multiple contact card reader / writer slots are not shown.

[0046] In one possible implementation, if the first interface is a USB Type-C interface, the second interface is a USB Type-A interface, that is, the interface conversion device is connected to the host computer through a USB Type-C interface, and the first type password is the password token of the USB Type-A interface; if the first interface is a USB Type-A interface, the second interface is a USB Type-C interface, that is, the interface conversion device is connected to the host computer through a USB Type-A interface, and the first type password is the password token of the USB Type-C interface.

[0047] For example, assuming that the first interface is a USB Type-C interface and the second interface is a USB Type-A interface, the schematic diagram of the interface conversion device connected to the password token of the USB Type-A interface is as shown in Figure 2 Other interfaces are not shown.

[0048] In a possible implementation, the contact card reader / writer slot is an ISO 7816 contact card reader / writer socket, and the second type of password token is inserted into the ISO 7816 contact card reader / writer socket, wherein the second type of password token is a contact card, and the contact card reader / writer slot may also be other types of contact card reader / writer sockets.

[0049] For example, assuming that the first interface is a USB Type-C interface, the schematic diagram of the interface conversion device connected to the password token of the contact card is as shown in Figure 3 shown.

[0050] In a possible implementation, if there are multiple contact card reader / writer slots in the interface conversion device, the multiple contact card reader / writer slots may be arranged up and down on the same surface, or may be arranged on different surfaces of the interface conversion device.

[0051] In a possible implementation, a near field wireless communication NFC coil performs wireless data transmission with a third type of cryptographic token of a card provided with an NFC coil or a USB token with an NFC function.

[0052] For example, assuming that the first interface is a USB Type-C interface, the structural diagram of the interface conversion device interacting with the password token of the card provided with an NFC coil is as follows: Figure 4 As shown, there is no physical contact between the password token of the card provided with the NFC coil and the interface conversion device.

[0053] Assuming that the first interface is a USB Type-C interface, the structural diagram of the interaction between the interface conversion device and the USB token with NFC function is as follows: Figure 5 As shown, there is no physical contact between the USB token provided with NFC function and the interface conversion device.

[0054] In a possible implementation, the NFC coil provided in the interface conversion device includes a standard NFC coil and a reader / writer chip, wherein the standard NFC coil is used to transmit data with the third type of cryptographic token, the reader / writer chip is connected to the single-chip microcomputer, receives the second protocol instruction sent by the single-chip microcomputer, and sends the first response information of the third type of cryptographic token to the single-chip microcomputer.

[0055] In an embodiment of the present invention, if the card provided with the NFC coil provides an NFC FIDO1.0 or NFC FIDO2.0 application, the single-chip microcomputer can directly perform protocol conversion on the message sent by the card provided with the NFC coil; if the card provided with the NFC coil does not provide an NFC FIDO1.0 or NFC FIDO 2.0 application, it is necessary to copy the key storage space inside the card, and the protocol conversion can be achieved as long as the card can perform cryptographic signature.

[0056] In a possible implementation, the single chip microcomputer is also used to receive a first response message sent by the first type of cryptographic token, the second type of cryptographic token or the third type of cryptographic token, convert the first response message into a second response message, and send it to the first interface.

[0057] In a possible implementation, the at least one second interface and the at least one contact card reader / writer slot are simultaneously connected to a cryptographic token of a corresponding type.

[0058] For example, assume that the second interface of the interface conversion device is connected to the password token of the USB Type-A interface, and the contact card reader / writer slot is also connected to a contact card. Figure 6 As shown, this is only an exemplary description. Specifically, the second interface and the NFC coil can be used simultaneously, or the contact card reader / writer slot and the NFC coil can be used simultaneously, or the second interface, the NFC coil and the contact card reader / writer slot can be used simultaneously, which is determined according to actual conditions.

[0059] In a possible implementation, the protocol between the host computer and the first interface is a Universal Serial Bus Human Interface Device (USB HID) protocol, and the USB HID protocol is a USB protocol used for human interface device communication; the USB HID protocol can also be considered as a communication method in the Client to Authenticator Protocol (CTAP), wherein the CTAP protocol is a protocol for identity authentication and is part of the FIDO 2.0 standard.

[0060] In an embodiment of the present invention, the interface conversion device is mainly used in scenarios where FIDO password-free login has been deployed, but some long-tail users still need hardware token peripherals, or where cheap FIDO token peripherals are needed for strong user authentication and user growth.

[0061] In an embodiment of the present invention, an interface conversion system is proposed. Figure 7 As shown, it includes: a host computer 701 and an interface conversion device 702, and the interface conversion device is connected to the host computer through a first interface.

[0062] In a possible implementation, the system also includes: at least one first type of cryptographic token, at least one second type of cryptographic token and / or at least one third type of cryptographic token, wherein the first type of cryptographic token is connected to the interface conversion device through a second interface for wired data transmission; the second type of cryptographic token is connected to the interface conversion device through a contact card reader / writer slot for wired data transmission; and the third type of cryptographic token is connected to the interface conversion device through a near-field wireless communication NFC coil for wireless data transmission.

[0063] In the embodiment of the present invention, the interaction process between the operating system of the host computer and the interface conversion device and the password token is as follows: Figure 8 As shown, it is a flowchart of an interface conversion method, which specifically includes the following steps:

[0064] Step S801: The operating system broadcasts a FIDO authentication request via the USB HID protocol.

[0065] The authentication request is broadcast and sent to multiple interface conversion devices.

[0066] Step S802: After receiving the authentication request, the interface conversion device sends a FIDO authentication request response to the operating system.

[0067] Step S803: The operating system sends a FIDO authentication challenge to the interface conversion device.

[0068] The message structure of the FIDO authentication challenge is an application protocol data unit (APDU), and the protocol adopted by the FIDO authentication challenge is the FIDO CTAP protocol.

[0069] In a possible implementation, the FIDO authentication challenge may be a random number challenge, and the operating system also sends other information to the interface conversion device at the same time.

[0070] Step S804: The interface conversion device performs protocol conversion on the FIDO authentication challenge to determine a converted FIDO authentication challenge.

[0071] In a possible implementation, if the cryptographic token is an ISO 7816 contact card, the FIDO authentication challenge of the FIDOCTAP protocol is converted into an instruction of the ISO 7816 card. The ISO 7816 card usually has a cryptographic chip and the key cannot be exported.

[0072] In one possible implementation, if the cryptographic token is a card equipped with an NFC coil or a USB token with NFC function, the FIDO authentication challenge of the FIDO CTAP protocol is converted into an instruction of the contactless IC card protocol (ISO 14443), and communication is performed with the card equipped with an NFC coil or the USB token with NFC function through the NFC coil in the interface conversion device.

[0073] In a possible implementation, if the cryptographic token is an old commercial FIDO USB Type-A token, the FIDO authentication challenge is converted into an instruction corresponding to a token that supports the latest version of FIDO.

[0074] Step S805: The interface conversion device sends the converted FIDO authentication challenge to the cryptographic token.

[0075] Step S806: The cryptographic token calculates a first response message for the converted FIDO authentication challenge.

[0076] Step S807: The cryptographic token sends the first response message to the interface conversion device.

[0077] Step S808: The interface conversion device performs protocol conversion on the first response message to generate a second response message.

[0078] The second response message is a standard FIDO protocol report.

[0079] Step S809: The interface conversion device sends the second response message to the operating system.

[0080] In a possible implementation, before step S801, the method further includes other steps, specifically: Fig. 9 As shown, specifically including:

[0081] Step S810: The cryptographic token sends a device message to the interface conversion device.

[0082] The device message includes device type, version information and interface information.

[0083] Step S811: The interface conversion device saves the device message.

[0084] In a possible implementation, if the interface conversion device is connected to multiple cryptographic tokens, the cryptographic token that responds first is used as the target cryptographic token.

[0085] In a possible implementation, the interface conversion system may also include the participation of a cloud server and a browser, as shown in the specific flow chart. Fig.10 As shown, before step S801, the method further includes other steps, specifically including:

[0086] Step S812: The cloud server sends a FIDO authentication challenge to the browser.

[0087] Step S813: After receiving the FIDO authentication challenge, the browser calls the FIDO API of the operating system and sends the FIDO authentication challenge to the operating system.

[0088] In a possible implementation, the interface conversion system may also include the participation of a cloud server and a browser, as shown in the specific flow chart. Fig.11 As shown, after step S809, the method further includes other steps, specifically including:

[0089] Step S814: The operating system receives the second response message and sends the second response message to the browser.

[0090] Step S815: The browser receives the second response message and sends the second response message to the cloud server.

[0091] In the embodiment of the present invention, the interface conversion device converts NFC cards, USB Type-A interfaces, and old versions of FIDO into USB authenticators with USB Type-C interfaces, solving various problems such as NFC cards are cheap but not universal on multiple platforms, built-in authenticators are cheap but not universal, and commercial USB tokens are expensive. In addition, since the interface conversion device in the embodiment of the present invention does not need to implement cryptographic algorithms and cryptographic hardware, cheaper FIDO cards can be selected to reduce development costs and material costs. Since the interface conversion device does not involve sensitive cryptographic operations, it can be updated online. Even if the interface conversion device encounters a man-in-the-middle attack or malicious firmware tampering, since the cryptographic information transferred by the interface conversion device has been signed and protected by the cryptographic chip in the lower-level device (i.e., the cryptographic token), the transmitted information will not be tampered with.

[0092] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0093] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. Users' refusal to process personal information other than the necessary information required for basic functions will not affect the user's use of basic functions.

Claims

1. An interface conversion device, characterized in that: The device comprises: The first interface is used to connect to a host computer and perform data transmission with the host computer; at least one second interface, used to connect to a first type of cryptographic token and perform data transmission with the first type of cryptographic token; At least one contact card reader / writer slot, used for connecting to a second type of cryptographic token and performing data transmission with the second type of cryptographic token; A near-field wireless communication NFC coil is arranged inside the interface conversion device and is used for data transmission with a third type of password token; The single-chip microcomputer is arranged inside the interface conversion device and is used for performing protocol conversion, converting the first protocol instruction in the data sent by the host computer through the first interface into a second protocol instruction available for the first type of password token, the second type of password token or the third type of password token, and sending it to the second interface, the contact card reader / writer slot or the near-field wireless communication NFC coil.

2. The device according to claim 1, characterized in that The first interface is a USB Type-C interface or a USB Type-A interface; the second interface is a USB Type-A interface or a USB Type-C interface.

3. The device according to claim 1, characterized in that The contact card reader / writer slot is an ISO 7816 contact card reader / writer socket.

4. The device according to claim 1, characterized in that The near-field wireless communication NFC coil includes a standard NFC coil and a reader / writer chip, wherein the standard NFC coil is used to transmit data with the third type of password token, and the reader / writer chip is connected to the single-chip microcomputer, receives the second protocol instruction sent by the single-chip microcomputer, and sends the first response information of the third type of password token to the single-chip microcomputer.

5. The device according to claim 1, characterized in that The single chip microcomputer is also used to receive a first response message sent by the first type of password token, the second type of password token or the third type of password token, convert the first response message into a second response message, and send it to the first interface.

6. The device according to claim 1, characterized in that The first type of cryptographic token is a cryptographic token with a USB Type-A interface or a USB Type-C interface, the second type of cryptographic token is a contact card, and the third type of cryptographic token is a card with an NFC coil or a USB token with NFC function.

7. The device according to claim 1, characterized in that The at least one second interface and the at least one contact card reading and writing slot are simultaneously connected to a password token of a corresponding type.

8. The device according to claim 1, characterized in that The protocol between the host computer and the first interface is the USB HID protocol.

9. An interface conversion system, characterized in that: The system comprises: Host computer; The interface conversion device according to any one of claims 1 to 8, wherein the interface conversion device is connected to the host computer via a first interface.

10. The system according to claim 9, characterized in that The system further comprises: At least one first type of cryptographic token, at least one second type of cryptographic token and / or at least one third type of cryptographic token, wherein the first type of cryptographic token is connected to the interface conversion device via a second interface for wired data transmission; the second type of cryptographic token is connected to the interface conversion device via a contact card reader / writer slot for wired data transmission; the third type of cryptographic token is connected to the interface conversion device via a near-field wireless communication NFC coil for wireless data transmission.

Images