Multi-factor enhanced authentication method and device suitable for trusted fingerprint mouse

Abstract

The invention discloses a multi-factor enhanced authentication method and device suitable for a credible fingerprint mouse, and the method comprises the steps: carrying out the preliminary identity authentication through the credible fingerprint mouse when a target user logs in a setting system through a user name and a password; after the preliminary identity authentication is passed, the trusted fingerprint mouse obtains biological information of the target user, calls a digital certificate corresponding to the biological information, and signs to obtain a signature value; the credible fingerprint mouse judges the validity of the signature value, and performs enhanced identity authentication on the target user according to the validity; and after the identity authentication is enhanced, the trusted fingerprint mouse determines the application permission range of the target user according to the digital certificate, and opens the corresponding application permission for the target user. Through a two-factor authentication technology of user name password and fingerprint biological characteristics, a special security chip is adopted to protect sensitive information, information leakage is avoided, corresponding security management and integration standards are formed, and a security foundation is laid for future informatization construction.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a multi-factor enhanced authentication method and device suitable for a trusted fingerprint mouse. Background Art

[0002] The trusted fingerprint mouse is a mouse product that combines fingerprint recognition technology and security authentication functions. It uses the user's fingerprint as a way of identity authentication, providing a high-security level of identity authentication. It is suitable for application scenarios that require high security, such as e-government, network identity authentication, etc. This type of mouse not only improves the convenience of use, but also enhances data security and privacy protection.

[0003] At present, the authentication method of information systems is the key to determining whether the system is secure or not. Traditional identity authentication technology is based on password verification technology composed of numbers, characters, etc. With the implementation of the National Level Protection 2.0 system, traditional single-factor authentication has been unable to meet the needs of critical information systems due to security risks such as weak passwords and password cracking.

[0004] Therefore, how to invent a method for implementing multi-factor enhanced authentication based on computer external devices has become an urgent problem to be solved. Summary of the invention

[0005] To this end, the present invention provides a multi-factor enhanced authentication method and device suitable for a trusted fingerprint mouse, which solves the problem that traditional single-factor authentication cannot meet the security requirements of key information systems due to security risks such as weak passwords and password cracking.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, comprising:

[0007] When the target user logs in to the setting system with the user name and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user with the user name and password;

[0008] When the preliminary identity authentication is passed, the trusted fingerprint mouse obtains the biometric information of the target user; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value;

[0009] The trusted fingerprint mouse judges the validity of the signature value, and performs enhanced identity authentication on the target user based on the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission scope of the target user based on the digital certificate, and opens application permissions within the application permission scope for the target user.

[0010] As a preferred solution for a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, the digital certificate includes the biometric information and identity information of the target user; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage permission information.

[0011] As a preferred solution for a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, in the process of the trusted fingerprint mouse signing the digital certificate and obtaining the signature value, the trusted fingerprint mouse encrypts, decrypts and signs the digital certificate through the SM2 algorithm.

[0012] As a preferred solution of a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, in the process of the trusted fingerprint mouse judging the validity of the signature value, the trusted fingerprint mouse sends the signature value to a unified identity authentication system, and the validity of the signature value is judged by the unified identity authentication system.

[0013] As a preferred solution for a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, when the initial identity authentication fails, the acquired biometric information cannot retrieve the corresponding digital certificate or the signature value is invalid, it is considered that the identity authentication of the target user has failed.

[0014] The present invention also provides a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, based on the above multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, comprising:

[0015] A preliminary identity authentication module, used for the trusted fingerprint mouse to perform preliminary identity authentication on the target user through the user name and the password when the target user logs into the setting system through the user name and the password;

[0016] A digital certificate retrieving module, which is used for the trusted fingerprint mouse to obtain the biometric information of the target user after the preliminary identity authentication is passed; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value;

[0017] The enhanced identity authentication module is used for the trusted fingerprint mouse to judge the validity of the signature value, and to perform enhanced identity authentication on the target user based on the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission scope of the target user based on the digital certificate, and opens application permissions within the application permission scope for the target user.

[0018] As a preferred solution for a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, in the digital certificate retrieval module, the digital certificate includes the biometric information and identity information of the target user; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage permission information.

[0019] As a preferred solution for a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, in the digital certificate retrieval module, during the process of the trusted fingerprint mouse signing the digital certificate and obtaining the signature value, the trusted fingerprint mouse encrypts, decrypts and signs the digital certificate through the SM2 algorithm.

[0020] As a preferred solution for a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, in the enhanced identity authentication module, during the process in which the trusted fingerprint mouse judges the validity of the signature value, the trusted fingerprint mouse sends the signature value to a unified identity authentication system, and the validity of the signature value is judged by the unified identity authentication system.

[0021] As a preferred solution for a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, in the preliminary identity authentication module, the digital certificate retrieval module and the enhanced identity authentication module, when the preliminary identity authentication fails, the acquired biometric information cannot retrieve the corresponding digital certificate or the signature value is invalid, it is considered that the identity authentication of the target user has failed.

[0022] The present invention has the following advantages: the present invention uses a mouse as a fingerprint collection device, and fully combines the traditional USBKEY identity authentication function (or user name and password), pattern identification technology and the mouse, which not only has the identification function of identity uniqueness but also improves the convenience and ease of use. In the identity authentication process, it is necessary to identify the live fingerprint feature to avoid the security risks caused by the loss of the device or the leakage of the password when the user uses the ordinary USBKEY; in order to strengthen the protection of user information, the user's own biometrics are used to authenticate their own identity, prevent the access of unauthorized users and the use of unauthorized resources, and ensure information security. The multi-factor authentication service is used to integrate the device fingerprint, biometric fingerprint, and mobile security technology in the traditional mobile terminal with the domestic cryptographic algorithm, digital certificate and identity authentication technology to realize the mobile terminal compliance password security module, and through the integration with the user management and information system, realize the user identity authentication, data integrity protection, data confidentiality and user behavior non-repudiation; the present invention uses the double-factor authentication technology of user name and password + fingerprint biometrics, and adopts a dedicated security chip to protect sensitive information, avoid information leakage, and apply the SM2 algorithm to encrypt data to ensure the confidentiality of data during transmission and storage. In response to security management and related security requirements such as identity authentication, data integrity, and data confidentiality, a unified security architecture is used to build identity authentication and password security basic services, and to provide comprehensive security services such as unified user management, authorization and authentication, digital certificates, password services, and data trusted and secure access control for information networks and systems. Corresponding security management and integration standards are further formed to lay a security foundation for future information construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0024] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0025] Figure 1 A schematic flow chart of a multi-factor enhanced authentication method applicable to a trusted fingerprint mouse provided in Embodiment 1 of the present invention;

[0026] Figure 2 A schematic diagram of the structure of a trusted fingerprint mouse in a multi-factor enhanced authentication method applicable to a trusted fingerprint mouse provided in Embodiment 1 of the present invention;

[0027] Figure 3 This is a schematic diagram of the architecture of a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0028] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] Example 1

[0030] See also Figure 1 Embodiment 1 of the present invention provides an embodied intelligent execution and training method based on an edge-end collaborative large model, comprising the following steps:

[0031] S1. When the target user logs in to the setting system using the user name and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user using the user name and password;

[0032] S2. When the preliminary identity authentication is passed, the trusted fingerprint mouse obtains the biometric information of the target user; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value;

[0033] S3. The trusted fingerprint mouse determines the validity of the signature value, and performs enhanced identity authentication on the target user based on the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission scope of the target user based on the digital certificate, and opens application permissions within the application permission scope for the target user.

[0034] In this embodiment, Figure 2 As shown, the trusted fingerprint mouse includes: mouse chip, fingerprint sensor, national secret security chip and 2.4G transmitter.

[0035] Among them, the mouse chip is used to perform preliminary identity authentication on the target user;

[0036] The fingerprint sensor is used to obtain the target user's target fingerprint information after the target user passes the initial identity authentication, and upload the target fingerprint information to the national secret security chip;

[0037] The national secret security chip is used to enhance the identity authentication of the target user based on the target biometric fingerprint information;

[0038] The 2.4G transmitter is used to send the transmission data generated by the mouse chip and the secure transmission data generated by the national security chip to the PC after the target user passes the enhanced identity authentication; the transmission data and secure transmission data are used to drive the wireless secure mouse driver on the PC.

[0039] The 2.4G transmitter communicates with the 2.4G receiver installed on the PC through a 2.4G communication channel. The 2.4G transmitter transmits the transmission data and the secure transmission data to the 2.4G receiver through the 2.4G communication channel, and transmits the transmission data and the secure transmission data to the trusted fingerprint mouse driver on the PC through the 2.4G receiver.

[0040] The 2.4G transmitter communicates with the 2.4G receiver through the 2.4G channel to receive the application data of the PC host computer, and interacts with the national secret level 2 fingerprint module through the UART serial port. In addition, the 2.4G transmitter main control chip also realizes the data reporting function of the wireless mouse.

[0041] In this embodiment, the 2.4G receiver is innovatively defined as a USB composite device. In addition to realizing the data transmission and data reporting functions of the traditional wireless mouse, another USB custom device is virtualized to share the 2.4G channel to realize data interaction between the PC driver and the national secret secondary fingerprint module in the wireless fingerprint mouse. The 2.4G receiver communicates with the Windows Hello driver upwards and communicates with the 2.4G transmitter downwards through the 2.4G channel.

[0042] In this embodiment, the national secret level 2 fingerprint module is composed of a national secret level 2 security chip and a high-performance, low-power fingerprint sensor, and adopts the MOC (matc on chip) working mode, that is, the collection, processing, storage, comparison, and management of all fingerprint data are implemented in the national secret level 2 security chip, ensuring the full cycle security of personal biometric data. The national secret level 2 fingerprint module interacts with the 2.4G transmitter through the UART serial port to achieve two-way data exchange.

[0043] During the data exchange process, the data protocol is divided into request data and response data, where the request data is the security and fingerprint application request sent from the PC to the National Secret Level 2 fingerprint module, and the response data is the security and fingerprint service results returned by the fingerprint module to the upper PC. The specific definitions are as follows: Table 1 and Table 2:

[0044]

[0045] Table 1 Security and fingerprint application request data sent from the PC to the National Secret Level 2 fingerprint module

[0046]

[0047] Table 2 Security and fingerprint service result data returned by the fingerprint module to the host PC

[0048] In this embodiment, in the overall architecture of the trusted fingerprint mouse, the security chip is connected to the fingerprint sensor to complete the security functions of the secure fingerprint mouse. Specific functions include: driving the fingerprint sensor to collect fingerprint images, executing the fingerprint algorithm to complete the fingerprint entry, comparison, deletion and other functions, completing the storage of fingerprint templates, completing the secure storage of keys, certificates, and sensitive data, and completing the calculation functions of cryptographic algorithms such as encryption, decryption, signing, signature verification, and summary. The fingerprint sensor generally uses a capacitive fingerprint sensor, which is used to collect fingerprint images, and is also the only electronic component in the entire system that needs to be exposed on the surface of the device.

[0049] In this embodiment, in step S1, when the target user logs in to the setting system through the user name and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user through the user name and password;

[0050] Specifically, when the target user logs in to the setting system using the user name and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user through the mouse chip.

[0051] In this embodiment, in step S2, after the preliminary identity authentication is passed, the trusted fingerprint mouse obtains the biometric information of the target user; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value;

[0052] Specifically, after the initial identity authentication is passed, the trusted fingerprint mouse obtains the target user's biometric fingerprint information through the fingerprint sensor; based on the target user's biometric fingerprint information, the trusted fingerprint mouse compares the acquired target fingerprint information with the stored fingerprint information, and if there is fingerprint information that is consistent with the target fingerprint information, the digital certificate corresponding to the fingerprint information is retrieved. The digital certificate is decrypted and signed using the SM2 algorithm to obtain a signature value.

[0053] The digital certificate includes the target user's biometric information and identity information; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage permission information.

[0054] Among them, the SM2 algorithm is the SM2 elliptic curve public key cryptography algorithm, which is a public key cryptography algorithm independently designed by my country. It includes the SM2-1 elliptic curve digital signature algorithm, the SM2-2 elliptic curve key exchange protocol, and the SM2-3 elliptic curve public key encryption algorithm, which are used to implement digital signature key negotiation and data encryption functions respectively.

[0055] In this embodiment, in step S3, the trusted fingerprint mouse judges the validity of the signature value, and performs enhanced identity authentication on the target user based on the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission scope of the target user based on the digital certificate, and opens application permissions within the application permission scope for the target user.

[0056] Specifically, the trusted fingerprint mouse sends the signature value to the unified identity authentication system, and the unified identity authentication system determines the validity of the signature value. After confirming that the signature value is valid, the enhanced identity authentication of the target user is completed; after the user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission range of the target user according to the usage permission information in the digital certificate, and opens the application permissions within the application permission range for the target user.

[0057] In this embodiment, when the initial identity authentication fails, when the acquired biometric information cannot retrieve the corresponding digital certificate or when the signature value is invalid, it is considered that the identity authentication of the target user has failed.

[0058] In summary, when the target user logs in to the setting system through the username and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user through the username and password; when the preliminary identity authentication is passed, the trusted fingerprint mouse obtains the biometric information of the target user; according to the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain the signature value; the trusted fingerprint mouse judges the validity of the signature value, and performs enhanced identity authentication on the target user according to the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission range of the target user according to the digital certificate, and opens the application permission within the application permission range for the target user. The present invention uses the mouse as a fingerprint acquisition device, fully combines the traditional USBKEY identity authentication function (or username password) and fingerprint identification technology with the mouse, and has both the identification function of identity uniqueness and the convenience and ease of use. In the identity authentication process, it is necessary to identify the live fingerprint characteristics to avoid the security risks caused by the loss of the device or the leakage of the password when the user uses the ordinary USBKEY. In order to strengthen the protection of user information, use your own biometrics to authenticate your identity, prevent unauthorized users from accessing and using unauthorized resources, and ensure information security. Multi-factor authentication services are used to integrate the device fingerprint, biometric fingerprint, and mobile security technology in traditional mobile terminals with domestic cryptographic algorithms, digital certificates, and identity authentication technologies to achieve a mobile terminal compliance password security module. Through integration with user management and information systems, user identity authentication, data integrity protection, data confidentiality, and user behavior non-repudiation are achieved. The present invention uses a two-factor authentication technology of username password + fingerprint biometrics, and uses a dedicated security chip to protect sensitive information, avoid information leakage, and apply the SM2 algorithm to encrypt data to ensure the confidentiality of data during transmission and storage. In view of security management and related security requirements such as identity authentication, data integrity, and data confidentiality, a unified security architecture is used to construct identity authentication and password security basic services, and unified user management, authorization and authentication, digital certificates, password services, data trusted security access control and other comprehensive security services are provided for information networks and systems, and corresponding security management and integration standards are further formed to lay a security foundation for future information construction.

[0059] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0060] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0061] Example 2

[0062] See also Figure 3 Embodiment 2 of the present invention further provides a multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, comprising:

[0063] The preliminary identity authentication module 001 is used for the trusted fingerprint mouse to perform preliminary identity authentication on the target user through the user name and the password when the target user logs into the setting system through the user name and the password;

[0064] The digital certificate retrieving module 002 is used for, when the preliminary identity authentication is passed, the trusted fingerprint mouse to obtain the biometric information of the target user; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value;

[0065] The enhanced identity authentication module 003 is used for the trusted fingerprint mouse to judge the validity of the signature value, and to perform enhanced identity authentication on the target user based on the validity of the signature value; after the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission scope of the target user based on the digital certificate, and opens application permissions within the application permission scope for the target user.

[0066] In this embodiment, in the digital certificate retrieval module 002, the digital certificate includes the biometric information and identity information of the target user; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage permission information.

[0067] In this embodiment, in the digital certificate retrieving module 002, when the trusted fingerprint mouse signs the digital certificate and obtains the signature value, the trusted fingerprint mouse encrypts, decrypts and signs the digital certificate through the SM2 algorithm.

[0068] In this embodiment, in the enhanced identity authentication module 003, during the process of the trusted fingerprint mouse judging the validity of the signature value, the trusted fingerprint mouse sends the signature value to the unified identity authentication system, and the validity of the signature value is judged by the unified identity authentication system.

[0069] In this embodiment, in the preliminary identity authentication module 001, the digital certificate retrieval module 002 and the enhanced identity authentication module 003, when the preliminary identity authentication fails, the acquired biometric information cannot retrieve the corresponding digital certificate or the signature value is invalid, it is considered that the identity authentication of the target user has failed.

[0070] It should be noted that the information interaction, execution process and other contents between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0071] Example 3

[0072] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a multi-factor enhanced authentication method applicable to a trusted fingerprint mouse is stored. The program code includes instructions for executing embodiment 1 or any possible implementation thereof, a multi-factor enhanced authentication method applicable to a trusted fingerprint mouse.

[0073] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0074] Example 4

[0075] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0076] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse in embodiment 1 or any possible implementation thereof.

[0077] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0078] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0079] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0080] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made on the basis of the present invention. Therefore, these modifications or improvements made on the basis of not departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A multi-factor enhanced authentication method suitable for a trusted fingerprint mouse, characterized in that: include: When the target user logs in to the setting system with the user name and password, the trusted fingerprint mouse performs preliminary identity authentication on the target user with the user name and password; When the preliminary identity authentication is passed, the trusted fingerprint mouse obtains the biometric information of the target user; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value; The trusted fingerprint mouse determines the validity of the signature value, and performs enhanced identity authentication on the target user according to the validity of the signature value; After the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission range of the target user according to the digital certificate, and opens application permissions within the application permission range for the target user.

2. A multi-factor enhanced authentication method suitable for a trusted fingerprint mouse according to claim 1, characterized in that: The digital certificate includes the biometric information and identity information of the target user; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage authority information.

3. A multi-factor enhanced authentication method suitable for a trusted fingerprint mouse according to claim 2, characterized in that: In the process of the trusted fingerprint mouse signing the digital certificate and obtaining the signature value, the trusted fingerprint mouse encrypts, decrypts and signs the digital certificate through the SM2 algorithm.

4. A multi-factor enhanced authentication method suitable for a trusted fingerprint mouse according to claim 3, characterized in that: In the process of the trusted fingerprint mouse judging the validity of the signature value, the trusted fingerprint mouse sends the signature value to a unified identity authentication system, and the validity of the signature value is judged by the unified identity authentication system.

5. A multi-factor enhanced authentication method suitable for a trusted fingerprint mouse according to claim 4, characterized in that: When the preliminary identity authentication fails, when the acquired biometric information cannot retrieve the corresponding digital certificate or when the signature value is invalid, it is considered that the identity authentication of the target user has failed.

6. A multi-factor enhanced authentication device suitable for a trusted fingerprint mouse, using a multi-factor enhanced authentication method suitable for a trusted fingerprint mouse as claimed in any one of claims 1 to 5, characterized in that: include: A preliminary identity authentication module, used for the trusted fingerprint mouse to perform preliminary identity authentication on the target user through the user name and the password when the target user logs into the setting system through the user name and the password; A digital certificate retrieving module, which is used for the trusted fingerprint mouse to obtain the biometric information of the target user after the preliminary identity authentication is passed; based on the biometric information, the trusted fingerprint mouse retrieves the digital certificate corresponding to the biometric information, and signs the digital certificate to obtain a signature value; An enhanced identity authentication module, used for the trusted fingerprint mouse to judge the validity of the signature value, and to perform enhanced identity authentication on the target user according to the validity of the signature value; After the target user passes the enhanced identity authentication, the trusted fingerprint mouse determines the application permission range of the target user according to the digital certificate, and opens application permissions within the application permission range for the target user.

7. A multi-factor enhanced authentication device suitable for a trusted fingerprint mouse according to claim 6, characterized in that: In the digital certificate retrieval module, the digital certificate includes the biometric information and identity information of the target user; the biometric information is biometric fingerprint information; the identity information includes: name, email, organization name, department name and usage authority information.

8. A multi-factor enhanced authentication device suitable for a trusted fingerprint mouse according to claim 7, characterized in that: In the digital certificate retrieval module, during the process of the trusted fingerprint mouse signing the digital certificate and obtaining the signature value, the trusted fingerprint mouse encrypts, decrypts and signs the digital certificate through the SM2 algorithm.

9. A multi-factor enhanced authentication device suitable for a trusted fingerprint mouse according to claim 8, characterized in that: In the enhanced identity authentication module, during the process of the trusted fingerprint mouse judging the validity of the signature value, the trusted fingerprint mouse sends the signature value to the unified identity authentication system, and the validity of the signature value is judged by the unified identity authentication system.

10. A multi-factor enhanced authentication device suitable for a trusted fingerprint mouse according to claim 9, characterized in that: In the preliminary identity authentication module, the digital certificate retrieval module and the enhanced identity authentication module, when the preliminary identity authentication fails, the acquired biometric information cannot retrieve the corresponding digital certificate or the signature value is invalid, it is considered that the identity authentication of the target user has failed.

Images