Identity authentication method and system, and computer device

Abstract

The present invention relates to the field of information security technology, and provides an identity authentication method, system, and computer device. The method performs password-free authentication through the fingerprint authentication method of a fingerprint password key, and the username and password are only stored in the fingerprint password key; during the identity authentication process, the client encrypts the first random number generated by the fingerprint password key using the public key of the server and sends it to the server, and the server encrypts the decrypted first random number and the second random number generated by the server to obtain ciphertext data and sends it to the server. The client and the server perform two-way identity authentication using the random numbers of both parties and combining with certificates. The client and the server use the first random number, the second random number, and the feature code to perform operations to obtain a transmission key, avoiding attackers stealing authentication credentials through network monitoring or other means and then resending the data to the authentication server for replay attacks, thus ensuring the security of data transmission during the authentication process.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and particularly to an identity authentication method and system. Background Art

[0002] With the development of information technology, more and more attention has been paid to system security issues. When a user logs in to or accesses a system, an identity authentication method is required. A commonly used access control method is to use passwords, and the legitimacy of a user is confirmed by matching the passwords. However, traditional password-based identity authentication methods have security risks. Biometric identification technology refers to a technology that uses a computer to authenticate a person's identity based on their own physiological or behavioral characteristics. It is based on the inherent and unique physiological and behavioral characteristics of the human body, and uses a computer for image processing or pattern recognition to identify and authenticate an individual's identity. Compared with traditional password-based identity authentication methods, biometric identification technology is more secure and reliable, and is not easy to forge or counterfeit.

[0003] Currently, in identity authentication methods based on digital certificates and biometrics, it is usually required that a server or a third-party authoritative certification center request the input of biometric information during the process of verifying a user's identity, and store the biometric information in the server. At the same time, when the user logs in to the server, the user needs to input the biometric information again for verification and login. For example, the patent document with the application number CN201210256168.X and the title "Method for Dual Authentication Based on Digital Certificates and Biometric Information". This kind of authentication method makes the user's biometric information transmitted over the network repeatedly, which has security risks. Moreover, the user's biometric information is stored in the server database, and its use cannot be effectively supervised, and there may be abuse of the user's biometric information.

[0004] In another authentication method, the user logs in to an authentication server using a username and password. After the user logs in successfully, the authentication server calls a digital certificate from the user's certificate storage device according to the user's request. After receiving the call request from the authentication server, the certificate storage device requires the user to perform fingerprint identification. The user scans their fingerprint through a fingerprint sensor, and compares the scanned fingerprint information with the fingerprint information stored in the storage area. If the comparison is successful, the digital certificate data stored in the storage area is sent to the authentication server for certificate authentication. For example, the patent document with the application number CN201010034386.X and the title "Certificate Authentication System Based on a Certificate Storage Device with Fingerprint Identification and Its Authentication Method". This kind of authentication method adds fingerprint authentication on the basis of the user password login method, which enhances the security of authentication to a certain extent. However, if the username and password are cracked or leaked, there is a security risk of replay attack by eavesdropping or intercepting the digital certificate data returned after successful fingerprint authentication and then resending it to the authentication server for authentication. Summary of the Invention

[0005] To solve the above technical deficiencies, the present invention provides an identity authentication method and system.

[0006] In a first aspect of the present invention, an identity authentication method is provided, which is applied to a client and a server. The method includes:

[0007] The client generates a first random number through a fingerprint password key, encrypts the first random number using the public key of the server preset in the client to obtain a first ciphertext data, and sends the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key.

[0008] The server decrypts the received first ciphertext data using the private key of the server to obtain the first random number, and calculates a first key using the first random number; the server generates a second random number, performs an encryption operation using the first key and the second random number to obtain a second ciphertext data, and sends the second ciphertext data to the client.

[0009] The client calculates a second key corresponding to the first key using the first random number, decrypts the received second ciphertext data using the second key to obtain the second random number, calculates a third key using the second random number, and performs an encryption operation using the third key and the second random number to obtain a third ciphertext data.

[0010] The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server.

[0011] The client calculates a transmission key using the first random number, the second random number, and the feature code of the client. The feature code of the client is obtained by the client performing an encryption operation using the certificate information of the fingerprint password key.

[0012] The client obtains the username and password for the user to log in to the system from the fingerprint password key, encrypts the username and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server.

[0013] The server calculates a fourth key corresponding to the third key using the second random number, decrypts the received third ciphertext data using the fourth key to obtain the second random number, compares the decrypted second random number with the second random number generated by the server. Under the condition that the comparison result is consistent, a transmission key is calculated using the first random number, the second random number, and the feature code of the server. The feature code of the server is obtained by the server performing an encryption operation using the received certificate information of the fingerprint password key.

[0014] The server uses the transmission key to decrypt the received final ciphertext data to obtain the username and password, searches for the username and password in the server's database, and determines that the identity authentication of the user logging in to the system is successful under the condition that the username and password are found.

[0015] In an embodiment of the present invention, the method further includes:

[0016] After the server uses the first key and the second random number to perform an encryption operation to obtain the second ciphertext data, it uses the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and at the same time sends the server certificate, the first signature value, and the second ciphertext data to the client;

[0017] The client uses the root certificate to verify the received server certificate and the first signature value.

[0018] In an embodiment of the present invention, the method further includes:

[0019] After the client authenticates the fingerprint entered by the user through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data to obtain the second signature value, and at the same time sends the user certificate, the second signature value, and the third ciphertext data to the server;

[0020] The server uses the root certificate to verify the received user certificate and the second signature value.

[0021] In an embodiment of the present invention, the feature codes of the client and the server are generated in the following manner:

[0022] Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key;

[0023] Perform a hash operation on the user geographical information to obtain the first hash value;

[0024] Concatenate the user identity information and the first hash value and then perform a hash operation to obtain the second hash value;

[0025] Concatenate the issuer identity information and the second hash value and then perform a hash operation to obtain the third hash value;

[0026] Concatenate the name of the system to which the user wants to log in and the third hash value and then perform a hash operation to obtain the fourth hash value, and use the fourth hash value as the feature code;

[0027] Alternatively, the feature codes of the client and the server are generated in the following manner:

[0028] Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key;

[0029] Obtain the name of the system that the user wants to log in to;

[0030] Concatenate the user's geographical information, user identity information, issuer identity information, and the name of the system that the user wants to log in to, and perform a hash operation on the concatenated data to obtain a feature code.

[0031] In an embodiment of the present invention, storing the username and password for the user to log in to the system in the fingerprint password key includes:

[0032] When initially inputting the username and password for the user to log in to the system, use the fingerprint information pre-stored in the fingerprint password key to verify the fingerprint currently entered by the user. After the fingerprint verification passes, obtain the serial number of the fingerprint password key;

[0033] Perform a first operation based on the serial number of the fingerprint password key to obtain a first data;

[0034] Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext;

[0035] Perform a second operation based on the serial number of the fingerprint password key to obtain a second data;

[0036] Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext;

[0037] Use the second ciphertext as the encryption key to encrypt the username and password to obtain user ciphertext data;

[0038] Store the user ciphertext data in the fingerprint password key.

[0039] In an embodiment of the present invention, performing a first operation based on the serial number of the fingerprint password key to obtain a first data includes: performing a hash operation on the serial number of the fingerprint password key, and taking the first n byte data as the initial data. Take the first m byte data of the initial data, invert it, and then concatenate it to obtain n byte first data, where m < n.

[0040] In an embodiment of the present invention, performing a second operation based on the serial number of the fingerprint password key to obtain a second data includes: performing a hash operation on the serial number of the fingerprint password key, and taking the first n byte data as the initial data. Take the last m byte data of the initial data, invert it, and then concatenate it to obtain n byte second data, where m < n.

[0041] In an embodiment of the present invention, the client obtains the username and password for the user to log in to the system from the fingerprint password key, including:

[0042] Obtain the serial number of the fingerprint password key;

[0043] Perform a first operation based on the serial number of the fingerprint password key to obtain a first data;

[0044] Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext;

[0045] Perform a second operation based on the serial number of the fingerprint password key to obtain the second data;

[0046] Use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext;

[0047] Obtain the user ciphertext data from the fingerprint password key;

[0048] Use the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

[0049] The second aspect of the present invention provides an identity authentication method applied to a client, and the method includes:

[0050] Generate a first random number through the fingerprint password key, encrypt the first random number using the public key of the server preset in the client to obtain the first ciphertext data, and send the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key;

[0051] Use the first random number to calculate the second key corresponding to the first key, use the second key to decrypt the second ciphertext data from the server to obtain the second random number, use the second random number to calculate the third key, and use the third key and the second random number to perform an encryption operation to obtain the third ciphertext data; the second ciphertext data is obtained by the server performing an encryption operation using the first key and the second random number, the second random number is generated by the server, and the first key is obtained by the server performing an operation on the first random number obtained by decrypting the first ciphertext data from the client using the private key of the server;

[0052] Perform fingerprint authentication on the fingerprint entered by the user through the fingerprint password key, and after the fingerprint authentication is passed, send the third ciphertext data and the certificate information of the fingerprint password key to the server;

[0053] Use the first random number, the second random number, and the feature code of the client to perform an operation to obtain the transmission key, and the feature code of the client is obtained by the client performing an encryption operation using the certificate information of the fingerprint password key;

[0054] Obtain the username and password for the user to log in to the system from the fingerprint password key, use the transmission key to encrypt the username and password to obtain the final ciphertext data, and send the final ciphertext data to the server for identity authentication.

[0055] The third aspect of the present invention provides an identity authentication method applied to a server, and the method includes:

[0056] Decrypt the first ciphertext data from the client using the private key of the server to obtain a first random number, and use the first random number to perform an operation to obtain a first key; the first ciphertext data is obtained by the client encrypting the first random number generated by the fingerprint password key using the public key of the server preset by the client, the fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key;

[0057] Generate a second random number, perform an encryption operation using the first key and the second random number to obtain second ciphertext data, and send the second ciphertext data to the client;

[0058] Use the second random number to perform an operation to obtain a fourth key corresponding to the third key of the client, use the fourth key to decrypt the third ciphertext data from the client to obtain the second random number, compare the decrypted second random number with the second random number generated by the server, and under the condition that the comparison result is consistent, use the first random number, the second random number, and the feature code of the server to perform an operation to obtain a transmission key, and the feature code of the server is obtained by the server performing an encryption operation using the certificate information of the received fingerprint password key; the third key is obtained by the client performing an operation on the second random number obtained by decrypting the second ciphertext data from the server using the second key, and the second key is obtained by the client performing an operation using the first random number; the third ciphertext data is obtained by the client performing an encryption operation using the third key and the second random number; the third ciphertext data is sent to the server by the client after passing the fingerprint authentication of the fingerprint entered by the user through the fingerprint password key;

[0059] Use the transmission key to decrypt the final ciphertext data from the client to obtain the username and password, search for the username and password in the database of the server, and under the condition that the username and password are found, determine that the identity authentication of the user logging in to the system is successful; the final ciphertext data is obtained by the client obtaining the username and password for the user to log in to the system from the fingerprint password key and encrypting the username and password using the transmission key of the client, and the transmission key of the client is obtained by the client performing an operation using the first random number, the second random number, and the feature code agreed with the server.

[0060] The fourth aspect of the present invention provides an identity authentication system, including: a fingerprint password key, a client, and a server;

[0061] The fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key;

[0062] The client generates a first random number through a fingerprint password key, encrypts the first random number using the public key of the server preset in the client to obtain first ciphertext data, and sends the first ciphertext data to the server;

[0063] The server decrypts the received first ciphertext data using the private key of the server to obtain the first random number, and obtains a first key through an operation using the first random number; the server generates a second random number, performs an encryption operation using the first key and the second random number to obtain second ciphertext data, and sends the second ciphertext data to the client;

[0064] The client obtains a second key corresponding to the first key through an operation using the first random number, decrypts the received second ciphertext data using the second key to obtain the second random number, obtains a third key through an operation using the second random number, and performs an encryption operation using the third key and the second random number to obtain third ciphertext data;

[0065] The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key, and after the fingerprint authentication passes, sends the third ciphertext data and the certificate information of the fingerprint password key to the server;

[0066] The client performs an operation using the first random number, the second random number, and the feature code of the client to obtain a transmission key, and the feature code of the client is obtained through an encryption operation using the certificate information of the fingerprint password key;

[0067] The client obtains the username and password for the user to log in to the system from the fingerprint password key, encrypts the username and password using the transmission key to obtain final ciphertext data, and sends the final ciphertext data to the server;

[0068] The server performs an operation using the second random number to obtain a fourth key corresponding to the third key, decrypts the received third ciphertext data using the fourth key to obtain the second random number, compares the decrypted second random number with the second random number generated by the server, and under the condition that the comparison result is consistent, performs an operation using the first random number, the second random number, and the feature code of the server to obtain a transmission key, and the feature code of the server is obtained through an encryption operation using the received certificate information of the fingerprint password key;

[0069] The server decrypts the received final ciphertext data using the transmission key to obtain the username and password, searches for the username and password in the database of the server, and under the condition that the username and password are found, determines that the identity authentication of the user logging in to the system is successful.

[0070] The present invention also provides a computer device, including: a memory and a processor, the memory stores a computer program, and the processor is used to execute the computer program to implement the above identity authentication method.

[0071] The present invention also provides a computer program product, including a computer program which, when executed by a processor, implements the above-mentioned identity authentication method.

[0072] The present invention also provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, implements the above-mentioned identity authentication method.

[0073] On the one hand, the present invention performs password-free authentication through the fingerprint authentication method of the fingerprint password key. The username and password are only stored in the fingerprint password key. When the user logs in to the system, there is no need to manually enter the username and password, avoiding the risk of sensitive data such as the username and password being monitored or leaked. On the other hand, during the identity authentication process, the client encrypts the first random number generated by the fingerprint password key using the public key of the server and then sends it to the server. The server encrypts the obtained first random number and the second random number generated by the server to obtain ciphertext data and sends it to the server. The client and the server perform two-way identity authentication using the random numbers of both parties and in combination with the certificate. After the authentication passes, the client and the server perform operations using the first random number, the second random number, and the feature code to obtain a transmission key, and use the transmission key to encrypt and decrypt data, avoiding attackers stealing authentication credentials through network monitoring or other means and then resending the data to the authentication server for replay attacks. On yet another hand, the client obtains the username and password for the user to log in to the system from the fingerprint password key. The client encrypts the username and password using the transmission key and then sends it to the server. The server decrypts it using the transmission key to implement the identity authentication for the user to log in to the system, further ensuring the security of data transmission during the authentication process.

[0074] Other features and advantages of the technical solution of the present invention will be described in detail in the following specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The drawings described herein are used to provide a further understanding of the present invention, and constitute a part of the present invention. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation to the present invention. In the drawings:

[0076] Figure 1 is a signal interaction process diagram of the identity authentication method provided by an embodiment of the present invention;

[0077] Figure 2 is a flowchart (upper part) of the identity authentication method provided by a specific example of the present invention;

[0078] Figure 3 is a flowchart (lower part) of the identity authentication method provided by a specific example of the present invention;

[0079] Figure 4 It is a flowchart for storing the username and password in a fingerprint password key provided by a specific example of the present invention;

[0080] Figure 5 It is a flowchart for obtaining the username and password from a fingerprint password key provided by a specific example of the present invention;

[0081] Figure 6 It is a block diagram of an identity authentication system provided by an embodiment of the present invention. Specific Embodiments

[0082] In order to make the technical solutions and advantages in the embodiments of the present invention clearer and more understandable, the following further details the exemplary embodiments of the present invention with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than an exhaustive list of all embodiments. It should be noted that, without conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other.

[0083] The identity authentication method provided by the embodiment of the present invention involves a fingerprint password key (fingerprint USBKey), a client, and a server. The fingerprint password key (fingerprint USBKey) is a dedicated hardware device containing an arithmetic chip that can perform various encryption and decryption operations, signature verification, and generation of public / private key pairs, and has a hardware random number generator. The USBKEY can store a signature digital certificate and a private key, and the private key can only participate in operations inside the USBKEY and cannot be read out. The fingerprint USBKey has functions such as fingerprint collection and fingerprint comparison. The server has a server for authentication, and the server has functions such as asymmetric key generation and storage, certificate storage, random number generation, and signature verification. The user certificate and the server certificate are both issued by the root certificate, and the user certificate and the server certificate are certificates at the same level.

[0084] The initial conditions for performing identity authentication are: (1) The fingerprint USBKey generates a signature key pair, and uses this key pair to generate a certificate request file. The user certificate is issued by the certification authority using the root certificate and stored in the fingerprint USBKey; (2) The user completes the fingerprint collection and entry of the USBKey (the fingerprint information is stored inside the USBKey, and the fingerprint password key binds the user's fingerprint information); (3) The server generates a signature key pair, and uses this key pair to generate a certificate request file. The server certificate is issued by the certification authority using the same root certificate and stored in the server.

[0085] In the technical solution of the present invention, password-free authentication is performed through the fingerprint authentication method of the fingerprint password key. The username and password are only stored in the fingerprint password key. When the user logs in to the system, there is no need to manually enter the username and password, avoiding the risk of sensitive data such as the username and password being monitored or leaked. During the identity authentication process, the client encrypts the first random number generated by the fingerprint password key using the public key of the server and sends it to the server. The server encrypts the obtained first random number and the second random number generated by the server to obtain ciphertext data and sends it to the server. The client and the server perform two-way identity authentication using the random numbers of both parties and combining certificates. After the authentication passes, the client and the server use the first random number, the second random number, and the feature code to calculate the transmission key, and use the transmission key to encrypt and decrypt data, preventing attackers from stealing authentication credentials through network monitoring or other means and then resending the data to the authentication server for replay attacks. The client obtains the username and password for the user to log in to the system from the fingerprint password key. The client encrypts the username and password using the transmission key and sends it to the server. The server decrypts it using the transmission key to implement the identity authentication for the user to log in to the system, further ensuring the security of data transmission during the authentication process.

[0086] Solution 1

[0087] Figure 1 is the signal interaction process diagram of the identity authentication method provided by the embodiment of the present invention. As Figure 1 shown, the identity authentication method provided in this embodiment involves a fingerprint password key, a client, and a server. Before the client and the server perform identity authentication, it is necessary to store the username and password for the user to log in to the system in the fingerprint password key. Specifically, the user inputs the username and password for logging in to the system and enters the fingerprint. The fingerprint password key verifies the fingerprint currently entered by the user. After the verification passes, the username and password for the user to log in to the system are stored in the fingerprint password key.

[0088] The method for the client and the server to perform identity authentication includes the following steps:

[0089] The client generates a first random number R1 through the fingerprint password key, encrypts the first random number R1 using the public key of the server preset by the client to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server;

[0090] The server uses the private key of the server to decrypt the received first ciphertext data Cipher1 to obtain the first random number R1, and calculates the first key Key using the first random number R1; the server generates a second random number R2, and performs an encryption operation using the first key Key and the second random number R2 to obtain the second ciphertext data Cipher2, and sends the second ciphertext data Cipher2 to the client;

[0091] The client uses the first random number R1 for operation to obtain a second key Key' corresponding to the first key Key, uses the second key Key' to decrypt the received second ciphertext data Cipher2 to obtain a second random number R2, uses the second random number R2 for operation to obtain a third key Key", and uses the third key Key" and the second random number R2 for encryption operation to obtain third ciphertext data Cipher3;

[0092] The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data Cipher3 and the certificate information of the fingerprint password key are sent to the server;

[0093] The client uses the first random number R1, the second random number R2, and the feature code of the client for operation to obtain a transmission key Key1;

[0094] The client obtains the username and login password for the user to log in to the system from the fingerprint password key, uses the transmission key Key1 to encrypt the username and login password to obtain the final ciphertext data, and sends the final ciphertext data to the server;

[0095] The server uses the second random number R2 for operation to obtain a fourth key Key''' corresponding to the third key Key", uses the fourth key Key''' to decrypt the received third ciphertext data Cipher3 to obtain a second random number R2', compares the decrypted second random number R2' with the second random number R2 generated by the server, and under the condition that the comparison result is consistent, uses the first random number R1, the second random number R2, and the feature code of the server for operation to obtain a transmission key Key1;

[0096] The server uses the transmission key Key1 to decrypt the received final ciphertext data to obtain the username and login password, checks the username and login password in the server's database, and under the condition that the username and login password are found, determines that the identity authentication of the user to log in to the system is successful.

[0097] In a specific embodiment, the client uses the certificate information of the fingerprint password key to perform an encryption operation to obtain the feature code of the client; the server uses the received certificate information of the fingerprint password key to perform an encryption operation to obtain the feature code of the server. The feature code of the client matches the feature code of the server, enabling the encryption and decryption of the transmission key. The certificate of the fingerprint password key also serves as the user certificate of the client, and this certificate contains the following information: version number, indicating the version information of the certificate; serial number, providing a unique identifier for the certificate; signature algorithm, specifying the algorithm used to sign the certificate; issuer, including issuer geographical information (such as province, city) and issuer institution information; certificate validity period, that is, the start and end dates and times of certificate use; subject, including user geographical information (such as province, city), user identity information (such as department, sub-department, etc.); subject public key information, including public key algorithm and the public key itself; issuer unique identity information and subject unique identity information; certificate signature algorithm and digital signature, using a specific algorithm to sign the certificate content to ensure the integrity and authenticity of the certificate.

[0098] In a specific example, the feature code of the client and the feature code of the server can be generated in the following manner:

[0099] Extract the user geographical information S, user identity information L, and issuer identity information CN from the certificate information of the fingerprint password key;

[0100] Perform a hash SM3 operation on the user geographical information S to obtain the first hash value HASH1;

[0101] Concatenate the user identity information L with the first hash value HASH1 and then perform a hash SM,3 operation to obtain the second hash value HASH2;

[0102] Concatenate the issuer identity information CN with the second hash value HASH2 and then perform a hash SM3 operation to obtain the third hash value HASH3;

[0103] Concatenate the name M of the system that the user wants to log in to with the third hash value HASH3 and then perform a hash SM3 operation to obtain the fourth hash value HASH4, and use the fourth hash value as the feature code.

[0104] In another specific example, the feature code of the client or the server can be generated in the following manner:

[0105] Extract the user geographical information S, user identity information L, and issuer identity information CN from the certificate information of the fingerprint password key;

[0106] Obtain the name M of the system that the user wants to log in to;

[0107] Concatenate the user geographical information S, user identity information L, issuer identity information CN, and the name M of the system to which the user wants to log in, and perform the hash SM3 operation on the concatenated data to obtain a feature code.

[0108] In this embodiment, the feature codes of the client and the server are generated through the certificate information of the fingerprint password key. For users (clients or servers) in different regions or with different identities, matching feature codes can be obtained. The feature codes, as dispersion keys, participate in the encryption operation together with random numbers to generate the transmission keys of the client and the server, increasing the difficulty of cracking the transmission keys and improving the key security.

[0109] In another embodiment, the above method further includes: after the server uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, use the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1, and at the same time send the server certificate, the first signature value Signdata1, and the second ciphertext data Cipher2 to the client.

[0110] The client uses the root certificate to verify the received server certificate and the first signature value Signdata1. After the verification passes, the client uses the first random number R1 to calculate the second key Key' corresponding to the first key Key.

[0111] After the client authenticates the fingerprint entered by the user through the fingerprint password key, use the private key in the signature key to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2, and at the same time send the user certificate, the second signature value Signdata2, and the third ciphertext data Cipher3 to the server.

[0112] The server uses the root certificate to verify the received user certificate and the second signature value Signdata2. After the verification passes, the server uses the second random number R2 to calculate the fourth key Key''' corresponding to the third key Key'', and uses the fourth key Key''' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2'.

[0113] In a specific example, such as Figure 2 and Figure 3 shown, the identity authentication process between the client and the server includes:

[0114] 1. The client generates a 16-byte first random number R1 through the fingerprint USBKey;

[0115] 2. The client encrypts the first random number R1 using the public key of the server pre - set in the client to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server (i.e., the server);

[0116] 3. The server decrypts the first ciphertext data Cipher1 using the private key of the server to obtain the first random number R1;

[0117] 4. The server performs SM3 hashing operation on the first random number R1 to obtain a 32 - byte result, and performs an exclusive - OR operation on the first 16 - byte data and the last 16 - byte data to obtain a 16 - byte first key Key;

[0118] 5. The server generates a second random number R2 and temporarily stores it;

[0119] 6. The server uses the SM4 algorithm with the first key Key as the key and adopts the symmetric encryption algorithm (ECB) to encrypt the second random number R2 to obtain the second ciphertext data Cipher2;

[0120] 7. The server signs the second ciphertext data Cipher2 using the private key in the signature key to obtain the first signature value Signdata1, and sends the server certificate, the second ciphertext data Cipher2, and the first signature value Signdata1 to the client;

[0121] 8. The client uses the root certificate to verify the validity of the server certificate and verify the correctness of the first signature value Signdata1;

[0122] 9. If the client verification fails, the authentication process ends; if the verification is successful, perform SM3 hashing operation on the first random number R1 to obtain a 32 - byte result, and perform an exclusive - OR operation on the first 16 - byte data and the last 16 - byte data to obtain a 16 - byte second key Key’;

[0123] 10. The client uses the SM4 algorithm with the second key Key’ as the key and adopts the symmetric encryption algorithm to decrypt the received second ciphertext data Cipher2 to obtain the second random number R2;

[0124] 11. The client performs SM3 hashing operation on the second random number R2 to obtain a 32 - byte result, and performs an exclusive - OR operation on the first 16 - byte data and the last 16 - byte data to obtain a 16 - byte third key Key”;

[0125] 12. The client uses the SM4 algorithm with the third key Key” as the key and adopts the symmetric encryption algorithm to encrypt the second random number R2 to obtain the third ciphertext data Cipher3;

[0126] 13. The client authenticates the fingerprint entered by the user through the fingerprint password key. If the fingerprint authentication fails, the process ends; if the fingerprint authentication is successful, the private key in the signature key is used to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2, and the user certificate, the third ciphertext data Cipher3, and the second signature value Signdata2 are sent to the server;

[0127] 14. The server uses the root certificate to verify the validity of the user certificate and verifies the second signature value Signdata2;

[0128] 15. If the server - side verification fails, the authentication ends; if the verification is successful, perform the SM3 hash operation on the temporarily stored second random number R2 to obtain a 32 - byte result, and perform an exclusive - OR operation on the first 16 - byte data and the last 16 - byte data to obtain a 16 - byte fourth key Key”';

[0129] 16. The server uses the SM4 algorithm with the fourth key Key”' as the key to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2';

[0130] 17. The server compares the decrypted second random number R2' with the second random number R2 temporarily stored on the server. If they are inconsistent, the authentication ends; if they are consistent, the client and the server respectively use the feature code, the first random number R1, and the second random number R2 for calculation to obtain 32 - byte data, and take the last 16 - byte data as the transmission key Key1;

[0131] 18. The client obtains the username and password of the user logging in to the system;

[0132] 19. The client uses the SM4 algorithm with the transmission key Key1 as the key and adopts the symmetric encryption algorithm to encrypt the username and password and then send them to the server;

[0133] 20. After receiving the ciphertext data, the server uses the transmission key Key1 to decrypt the ciphertext data to obtain the username and password;

[0134] 21. The server checks in the database whether the username and password exist and compares whether the password is correct. If the username exists and the password is correct, the authentication is successful.

[0135] In an embodiment, storing the username and password of the user logging in to the system in the fingerprint password key includes the following steps:

[0136] When initially entering the username and password of the user logging in to the system, use the fingerprint information pre - stored in the fingerprint password key to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, obtain the serial number of the fingerprint password key;

[0137] Perform a first operation on the serial number of the fingerprint password key to obtain first data;

[0138] Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext;

[0139] Perform a second operation on the serial number of the fingerprint password key to obtain second data;

[0140] Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext;

[0141] Use the second ciphertext as an encryption key to encrypt the username and password to obtain user ciphertext data;

[0142] Store the user ciphertext data in the fingerprint password key.

[0143] In the above steps, performing a first operation on the serial number of the fingerprint password key to obtain first data specifically includes: performing an SM3 hash operation on the serial number of the fingerprint password key and taking the first n bytes of data as the initial data, and reversing the first m (m < n) bytes of the initial data and then concatenating them to obtain n bytes of first data. Performing a second operation on the serial number of the fingerprint password key to obtain second data specifically includes: performing an SM3 hash operation on the serial number of the fingerprint password key and taking the first n bytes of data as the initial data, and reversing the last m (m < n) bytes of the initial data and then concatenating them to obtain n bytes of second data.

[0144] In this embodiment, key dispersion is performed through the master key and serial number of the fingerprint password key. The master key is used to encrypt and generate the first ciphertext, the first ciphertext is used to encrypt and generate the second ciphertext, and the second ciphertext is used to encrypt the username and password. Compared with the method of directly using the master key to encrypt the username and password, the security of storing the username and password is improved.

[0145] In a specific example, as Figure 4 shown, the process of storing the username and password in the fingerprint password key is as follows:

[0146] (1) The user inputs the username and password for system login;

[0147] (2) Verify the fingerprint currently entered by the user. If the fingerprint verification fails, the process ends;

[0148] (3) If the fingerprint verification is successful, obtain the serial number of the fingerprint USBKey. If the acquisition fails, the process ends;

[0149] (4) If the acquisition of the fingerprint USBKey serial number is successful, perform an SM3 hash operation on the serial number and take the first 16 bytes of data as data;

[0150] (5) Take the first 8 bytes of data from data, invert them to get a new 8-byte data, and splice them to get a 16-byte data data1;

[0151] (6) Use the SM4 algorithm, the USBKey master key, and the ECB (symmetric encryption algorithm) mode to encrypt data1 to obtain the ciphertext Cipher';

[0152] (7) Take the last 8 bytes of data from data, invert them to get a new 8-byte data, and splice them to get a 16-byte data data2;

[0153] (8) Use the SM4 algorithm, the ciphertext Cipher' as the key, and the ECB mode to encrypt data2 to obtain the ciphertext Cipher";

[0154] (9) Use the SM4 algorithm, the ECB mode, and the key Cipher" to encrypt the user and password to obtain the user ciphertext data Cipher"';

[0155] (10) Store the user ciphertext data Cipher"' in the file of the fingerprint USBKey.

[0156] In one embodiment, the client obtains the username and password for the user to log in to the system from the fingerprint password key, including the following steps:

[0157] Obtain the serial number of the fingerprint password key;

[0158] Perform a first operation based on the serial number of the fingerprint password key to obtain a first data;

[0159] Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext;

[0160] Perform a second operation based on the serial number of the fingerprint password key to obtain a second data;

[0161] Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext;

[0162] Obtain the user ciphertext data from the fingerprint password key;

[0163] Use the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

[0164] In a specific example, as Figure 5 shown, the process for the client to obtain the username and password for the user to log in to the system from the fingerprint password key is:

[0165] (1) Obtain the fingerprint USBKey serial number. If the acquisition fails, end the process;

[0166] (2) If the acquisition is successful, perform the SM3 hashing operation on the USBKey serial number, and take the first 16-byte data as data;

[0167] (3) Take the first 8 bytes of data from data, invert them to get a new 8-byte data, and splice them to get 16-byte data data1;

[0168] (4) Use the SM4 algorithm, the USBKey master key, and the ECB (symmetric encryption algorithm) mode to encrypt the data1 to obtain the ciphertext Cipher';

[0169] (5) Take the last 8 bytes of data from data, invert them to get a new 8-byte data, and splice them to get 16-byte data data2;

[0170] (6) Use the SM4 algorithm, with the ciphertext Cipher' as the key, and the ECB mode to encrypt the data2 to obtain the ciphertext Cipher";

[0171] (7) Obtain the user ciphertext data Cipher''' from the fingerprint USBKey. If the acquisition fails, end the process;

[0172] (8) If the acquisition is successful, use the SM4 algorithm, with the key being Cipher", and adopt the ECB mode to decrypt the user ciphertext data Cipher''' to obtain the username and password.

[0173] Solution Two

[0174] The embodiment of the present invention also provides an identity authentication method applied to a client. This method corresponds to the identity authentication method applied to a fingerprint password key, a client, and a server provided in the above embodiment. The identity authentication method applied to a client includes the following steps:

[0175] Generate a first random number R1 through the fingerprint password key, encrypt the first random number R1 using the public key of the server preset in the client to obtain the first ciphertext data Cipher1, and send the first ciphertext data Cipher1 to the server;

[0176] Use the first random number R1 to perform an operation to obtain a second key Key' corresponding to the first key Key. Use the second key Key' to decrypt the second ciphertext data Cipher2 from the server to obtain a second random number R2. Use the second random number R2 to perform an operation to obtain a third key Key". Use the third key Key" and the second random number R2 to perform an encryption operation to obtain third ciphertext data Cipher3; the second ciphertext data Cipher2 is obtained by the server performing an encryption operation using the first key Key and the second random number R2. The second random number R2 is generated by the server. The first key Key is obtained by the server performing an operation on the first random number R1 obtained by decrypting the first ciphertext data Cipher1 from the client using the server's private key.

[0177] Perform fingerprint authentication on the fingerprint entered by the user through a fingerprint password key. After the fingerprint authentication is passed, send the third ciphertext data Cipher3 and the certificate information of the fingerprint password key to the server.

[0178] Use the first random number R1, the second random number R2, and the client's feature code to perform an operation to obtain a transmission key Key1.

[0179] Obtain the username and password for the user to log in to the system from the fingerprint password key. Use the transmission key Key1 to encrypt the username and password to obtain the final ciphertext data, and send the final ciphertext data to the server for identity authentication.

[0180] In a specific embodiment, the client uses the certificate information of the fingerprint password key to perform an encryption operation to obtain the client's feature code. The client's feature code matches the server's feature code, which can achieve the encryption and decryption of the transmission key. The specific generation method of the client feature code can be understood with reference to the description in the above Scheme 1 and will not be elaborated here.

[0181] In a specific embodiment, the above method steps further include: the client uses the root certificate to verify the server certificate and the first signature value Signdata1 from the server. The first signature value Signdata1 is obtained by the server using the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, and then using the private key in the signature key to sign the second ciphertext data Cipher2; the server certificate and the first signature value Signdata1 are sent to the client simultaneously with the second ciphertext data Cipher2.

[0182] In a specific embodiment, the above method steps further include: after the client authenticates the fingerprint entered by the user through the fingerprint password key, use the private key in the signature key to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2, and at the same time send the user certificate, the second signature value Signdata2, and the third ciphertext data Cipher3 to the server for verification.

[0183] In a specific embodiment, in the method steps of the identity authentication applied to the client, first, the username and password for the user to log in to the system need to be stored in the fingerprint password key, and then the client obtains the username and password from the fingerprint password key. For the specific processes of storing the username and password in the fingerprint password key and obtaining the username and password from the fingerprint password key, reference can be made to the foregoing specific examples for understanding.

[0184] Solution Three

[0185] The embodiment of the present invention also provides an identity authentication method applied to the server, and this method corresponds to the identity authentication method applied to the fingerprint password key, the client, and the server provided in the above embodiment. The identity authentication method applied to the server includes:

[0186] Use the private key of the server to decrypt the first ciphertext data Cipher1 from the client to obtain the first random number R1, and use the first random number R1 to calculate the first key Key; the first ciphertext data Cipher1 is encrypted by the client using the public key of the server preset in the client for the first random number R1 generated by the fingerprint password key;

[0187] Generate a second random number R2, use the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, and send the second ciphertext data Cipher2 to the client;

[0188] The fourth key Key''' corresponding to the third key Key'' of the client is obtained by operating with the second random number R2. The third ciphertext data Cipher3 from the client is decrypted with the fourth key Key''' to obtain the second random number R2. The decrypted second random number R2 is compared with the second random number R2 generated by the server. Under the condition that the comparison result is consistent, the transmission key Key1 is obtained by operating with the first random number R1, the second random number R2, and the feature code of the server side; the third key Key'' is obtained by the client operating with the second random number R2 obtained by decrypting the second ciphertext data Cipher2 from the server side with the second key Key'. The second key Key' is obtained by the client operating with the first random number R1; the third ciphertext data Cipher3 is obtained by the client performing an encryption operation with the third key Key'' and the second random number R2; the third ciphertext data Cipher3 is sent to the server side by the client after the fingerprint authentication of the fingerprint entered by the user through the fingerprint password key;

[0189] The username and password are obtained by decrypting the final ciphertext data from the client with the transmission key Key1. The username and password are searched in the database of the server side. Under the condition that the username and password are found, it is determined that the identity authentication of the user logging in to the system is successful; the final ciphertext data is obtained by the client obtaining the username and password for the user to log in to the system from the fingerprint password key and encrypting the username and password with the transmission key Key1 of the client. The transmission key Key1 of the client is obtained by the client operating with the first random number R1, the second random number R2, and the feature code of the client.

[0190] In a specific embodiment, the server side performs an encryption operation with the received certificate information of the fingerprint password key to obtain the feature code of the server side. The feature code of the server side matches the feature code of the client, and the encryption and decryption of the transmission key can be realized. The specific generation method of the server side feature code can be understood with reference to the description in the above Scheme 1 and will not be elaborated here.

[0191] In a specific embodiment, the above method steps further include: after the server side uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, the private key in the signature key is used to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1. At the same time, the server certificate, the first signature value Signdata1, and the second ciphertext data Cipher2 are sent to the client for verification.

[0192] In a specific embodiment, the above method steps further include: the server uses the root certificate to verify the user certificate and the second signature value Signdata2 from the client. The second signature value Signdata2 is obtained by the client using the private key in the signature key to sign the third ciphertext data Cipher3 after the fingerprint authentication of the fingerprint entered by the user through the fingerprint password key; the user certificate and the second signature value Signdata2 are sent to the server simultaneously with the third ciphertext data Cipher3.

[0193] In a specific embodiment, in the method steps of the identity authentication applied to the server, first, the username and password for the user to log in to the system need to be stored in the fingerprint password key, and then the client obtains the username and password from the fingerprint password key. The specific processes of storing the username and password in the fingerprint password key and obtaining the username and password from the fingerprint password key can be understood with reference to the foregoing specific examples.

[0194] Solution Four

[0195] The embodiment of the present invention further provides an identity authentication system. As Figure 6 shown, the identity authentication system provided by the embodiment of the present invention includes: a fingerprint password key, a client, and a server. The fingerprint password key is bound to the fingerprint information of the user, and the username and password for the user to log in to the system are stored in the fingerprint password key. The client generates a first random number R1 through the fingerprint password key, encrypts the first random number R1 using the public key of the server preset in the client to obtain the first ciphertext data Cipher1, and sends the first ciphertext data Cipher1 to the server.

[0196] The server uses the private key of the server to decrypt the received first ciphertext data Cipher1 to obtain the first random number R1, and calculates the first key Key using the first random number R1; the server generates a second random number R2, and performs an encryption operation using the first key Key and the second random number R2 to obtain the second ciphertext data Cipher2, and sends the second ciphertext data Cipher2 to the client.

[0197] The client calculates the second key Key' corresponding to the first key Key using the first random number R1, decrypts the received second ciphertext data Cipher2 using the second key Key' to obtain the second random number R2, calculates the third key Key'' using the second random number R2, and performs an encryption operation using the third key Key'' and the second random number R2 to obtain the third ciphertext data Cipher3. The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key, and after the fingerprint authentication is passed, sends the third ciphertext data Cipher3 and the certificate information of the fingerprint password key to the server.

[0198] The client uses the first random number R1, the second random number R2, and the feature code of the client to perform an operation to obtain the transmission key Key1. The client obtains the username and password for the user to log in to the system from the fingerprint password key, uses the transmission key Key1 to encrypt the username and password to obtain the final ciphertext data, and sends the final ciphertext data to the server.

[0199] The server uses the second random number R2 to perform an operation to obtain the fourth key Key”' corresponding to the third key Key”, uses the fourth key Key”' to decrypt the received third ciphertext data Cipher3 to obtain the second random number R2, compares the decrypted second random number R2 with the second random number R2 generated by the server. Under the condition that the comparison result is consistent, the server uses the first random number R1, the second random number R2, and the feature code of the server to perform an operation to obtain the transmission key Key1. The server uses the transmission key Key1 to decrypt the received final ciphertext data to obtain the username and password, searches for the username and password in the server's database, and determines that the identity authentication of the user logging in to the system is successful under the condition that the username and password are found.

[0200] In a specific example, the client uses the certificate information of the fingerprint password key to perform an encryption operation to obtain the feature code of the client; the server uses the received certificate information of the fingerprint password key to perform an encryption operation to obtain the feature code of the server. The feature code of the client matches the feature code of the server, which can realize the encryption and decryption of the transmission key. The certificate of the fingerprint password key also serves as the user certificate of the client, and this certificate contains user geographical information, user identity information, issuer identity information, etc. The feature code of the client and the feature code of the server can be generated in the following way: extract the user geographical information S, user identity information L, and issuer identity information CN from the certificate information of the fingerprint password key; perform the SM3 hashing operation on the user geographical information S to obtain the first hash value HASH1; splice the user identity information L with the first hash value HASH1 and then perform the SM3 hashing operation to obtain the second hash value HASH2; splice the issuer identity information CN with the second hash value HASH2 and then perform the SM3 hashing operation to obtain the third hash value HASH3; splice the name of the system that the user wants to log in to with the third hash value HASH3 and then perform the SM3 hashing operation to obtain the fourth hash value HASH4, and use the fourth hash value as the feature code.

[0201] In another specific example, the feature code of the client or the server can be generated in the following way:

[0202] Extract the user geographical information S, user identity information L, and issuer identity information CN from the certificate information of the fingerprint password key;

[0203] Obtain the name M of the system that the user wants to log in to;

[0204] Concatenate the user geographical information S, user identity information L, issuer identity information CN, and the name M of the system that the user wants to log in to, and perform the SM3 hashing operation on the concatenated data to obtain a feature code.

[0205] In another embodiment, after the server uses the first key Key and the second random number R2 to perform an encryption operation to obtain the second ciphertext data Cipher2, it uses the private key in the signature key to sign the second ciphertext data Cipher2 to obtain the first signature value Signdata1. At the same time, it sends the server certificate, the first signature value Signdata1, and the second ciphertext data Cipher2 to the client. The client uses the root certificate to verify the received server certificate and the first signature value Signdata1. After the client passes the fingerprint authentication of the fingerprint entered by the user through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data Cipher3 to obtain the second signature value Signdata2. At the same time, it sends the user certificate, the second signature value Signdata2, and the third ciphertext data Cipher3 to the server. The server uses the root certificate to verify the received user certificate and the second signature value Signdata2.

[0206] In a specific embodiment, the above identity authentication system further includes: a data operation and writing device. The data operation and writing device is used for: when initially inputting the username and password for the user to log in to the system, using the fingerprint information pre-stored in the fingerprint password key to verify the fingerprint currently entered by the user. After the fingerprint verification passes, obtain the serial number of the fingerprint password key; perform a first operation based on the serial number of the fingerprint password key to obtain the first data; use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; perform a second operation based on the serial number of the fingerprint password key to obtain the second data; use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext; use the second ciphertext as the encryption key to encrypt the username and password to obtain the user ciphertext data; store the user ciphertext data in the fingerprint password key.

[0207] Among them, performing a first operation based on the serial number of the fingerprint password key to obtain the first data specifically includes: performing a hashing operation on the serial number of the fingerprint password key and taking the first n byte data as the initial data, and taking the first m byte data of the initial data in reverse and then concatenating them to obtain the first data of n bytes.

[0208] Among them, the second data is obtained by performing a second operation based on the serial number of the fingerprint password key, which specifically includes: performing a hash operation on the serial number of the fingerprint password key and taking the first n bytes of data as the initial data, and then taking the reverse of the last m bytes of the initial data and splicing them to obtain n bytes of the second data.

[0209] In a specific embodiment, the client obtains the username and password for the user to log in to the system from the fingerprint password key, including the following process: obtaining the serial number of the fingerprint password key; performing a first operation based on the serial number of the fingerprint password key to obtain the first data; performing an encryption operation on the first data using the master key of the fingerprint password key to obtain the first ciphertext; performing a second operation based on the serial number of the fingerprint password key to obtain the second data; performing an encryption operation on the second data using the first ciphertext to obtain the second ciphertext; obtaining the user ciphertext data from the fingerprint password key; using the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

[0210] In the identity authentication system provided in this embodiment, the specific process of storing the username and password in the fingerprint password key and obtaining the username and password from the fingerprint password key can be understood with reference to the specific examples in the foregoing identity authentication method.

[0211] The embodiment of the present invention also provides a computer device, including: a memory and a processor, the memory stores a computer program, and the processor is used to execute the computer program to implement the above identity authentication method.

[0212] The embodiment of the present invention also provides a computer program product, including a computer program, and the computer program implements the above identity authentication method when executed by a processor.

[0213] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and the computer program implements the above identity authentication method when executed by a processor.

[0214] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented in various computer languages, for example, object-oriented programming languages such as Java and interpreted scripting languages such as JavaScript.

[0215] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general purpose computers, special purpose computers, embedded processors, or other programmable data processing devices to produce a machine, such that the instructions executed by the processors of the computer or other programmable data processing devices create means for implementing the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.

[0216] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including instruction means for implementing the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.

[0217] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in the flow Figure 1 one or more flows and / or blocks Figure 1 one or more blocks.

[0218] Although the preferred embodiments of the present invention have been described, additional changes and modifications can be made by those skilled in the art once they learn the basic inventive concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art can make various changes and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

1. An identity authentication method, applied to a client, characterized in that The method includes: Generating a first random number through a fingerprint password key, encrypting the first random number using the public key of the server preset in the client to obtain first ciphertext data, and sending the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key; Calculating a second key corresponding to the first key using the first random number, decrypting the second ciphertext data from the server using the second key to obtain a second random number, calculating a third key using the second random number, and performing an encryption operation using the third key and the second random number to obtain third ciphertext data; the second ciphertext data is obtained by the server performing an encryption operation using the first key and the second random number, the second random number is generated by the server, and the first key is obtained by the server performing an operation on the first random number obtained by decrypting the first ciphertext data from the client using the private key of the server; Performing fingerprint authentication on the fingerprint entered by the user through the fingerprint password key, and after the fingerprint authentication passes, sending the third ciphertext data and the certificate information of the fingerprint password key to the server; Calculating a transmission key using the first random number, the second random number, and the feature code of the client, where the feature code of the client is obtained by the client performing an encryption operation using the certificate information of the fingerprint password key; Obtaining the username and password for the user to log in to the system from the fingerprint password key, encrypting the username and password using the transmission key to obtain final ciphertext data, and sending the final ciphertext data to the server for identity authentication.

2. The identity authentication method according to claim 1, wherein The method further includes: Verifying the server certificate and the first signature value from the server using the root certificate; The first signature value is obtained by the server signing the second ciphertext data using the private key in the signature key after performing an encryption operation using the first key and the second random number to obtain the second ciphertext data; The server certificate and the first signature value are sent to the client simultaneously with the second ciphertext data.

3. The identity authentication method according to claim 2, characterized in that The method further includes: After the fingerprint authentication of the fingerprint entered by the user through the fingerprint password key passes, signing the third ciphertext data using the private key in the signature key to obtain a second signature value, and simultaneously sending the user certificate, the second signature value, and the third ciphertext data to the server for verification, where the user certificate is the certificate of the fingerprint password key.

4. The identity authentication method according to claim 1, wherein The feature code of the client is generated in the following manner: Extracting the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key; Performing a hash operation on the user geographical information to obtain a first hash value; Concatenating the user identity information and the first hash value and then performing a hash operation to obtain a second hash value; Concatenating the issuer identity information and the second hash value and then performing a hash operation to obtain a third hash value; Concatenating the name of the system to which the user wants to log in and the third hash value and then performing a hash operation to obtain a fourth hash value, and using the fourth hash value as the feature code.

5. The identity authentication method according to claim 1, characterized in that, The method further includes: When initially inputting the username and password for a user to log in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification passes, the serial number of the fingerprint password key is obtained; Perform a first operation based on the serial number of the fingerprint password key to obtain first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain second data; Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the username and password to obtain user ciphertext data; Store the user ciphertext data in the fingerprint password key.

6. The identity authentication method according to claim 5, wherein The obtaining of the username and password for the user to log in to the system from the fingerprint password key includes: Obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext; [[ID=ll]]Perform a second operation based on the serial number of the fingerprint password key to obtain second data; Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext; Obtain the user ciphertext data from the fingerprint password key; Use the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

7. An identity authentication method, applied to a server, characterized in that The method includes: Use the private key of the server to decrypt the first ciphertext data from the client to obtain a first random number, and use the first random number to perform an operation to obtain a first key; the first ciphertext data is encrypted by the client using the public key of the server preset by the client for the first random number generated by the fingerprint password key. The fingerprint password key is bound to the fingerprint information of the user, and the username and password for the user to log in to the system are stored in the fingerprint password key; Generate a second random number, use the first key and the second random number to perform an encryption operation to obtain second ciphertext data, and send the second ciphertext data to the client; Use the second random number to perform an operation to obtain a fourth key corresponding to the third key of the client, use the fourth key to decrypt the third ciphertext data from the client to obtain the second random number, compare the decrypted second random number with the second random number generated by the server. Under the condition that the comparison result is consistent, use the first random number, the second random number, and the feature code of the server to perform an operation to obtain a transmission key; the feature code of the server is obtained by the server performing an encryption operation using the received certificate information of the fingerprint password key; the third key is obtained by the client performing an operation on the second random number decrypted from the second ciphertext data from the server using the second key, and the second key is obtained by the client performing an operation using the first random number; the third ciphertext data is encrypted by the client using the third key and the second random number; the third ciphertext data is sent to the server by the client after passing the fingerprint authentication for the fingerprint entered by the user through the fingerprint password key; The final ciphertext data from the client is decrypted using the transmission key to obtain the username and password. The username and password are searched for in the server's database. If the username and password are found, it is determined that the identity authentication of the user logging in to the system is successful; the final ciphertext data is obtained by the client from the fingerprint password key for the username and password of the user logging in to the system and encrypting the username and password using the transmission key of the client.

8. The identity authentication method according to claim 7, wherein The method further includes: After encrypting using the first key and the second random number to obtain the second ciphertext data, the private key in the signature key is used to sign the second ciphertext data to obtain the first signature value. At the same time, the server certificate, the first signature value, and the second ciphertext data are sent to the client for verification; The root certificate is used to verify the user certificate and the second signature value from the client. The user certificate is the certificate of the fingerprint password key; The second signature value is obtained by the client using the private key in the signature key to sign the third ciphertext data after the fingerprint authentication of the user input is passed through the fingerprint password key; The user certificate and the second signature value are sent to the server simultaneously with the third ciphertext data.

9. The identity authentication method according to claim 7, wherein The feature code of the server is generated in the following manner: Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key; Perform a hash operation on the user geographical information to obtain the first hash value; Concatenate the user identity information and the first hash value and then perform a hash operation to obtain the second hash value; Concatenate the issuer identity information and the second hash value and then perform a hash operation to obtain the third hash value; Concatenate the name of the system that the user is going to log in to and the third hash value and then perform a hash operation to obtain the fourth hash value, and use the fourth hash value as the feature code.

10. The identity authentication method according to claim 7, characterized in that, The method further includes: When initially entering the username and password of the user logging in to the system, the fingerprint information pre-stored in the fingerprint password key is used to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, the serial number of the fingerprint password key is obtained; Perform a first operation based on the serial number of the fingerprint password key to obtain the first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain the second data; Use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext; Use the second ciphertext as the encryption key to encrypt the username and password to obtain the user ciphertext data; Store the user ciphertext data in the fingerprint password key.

11. The identity authentication method according to claim 10, characterized in that, The client obtains the username and password of the user logging in to the system from the fingerprint password key, including: Obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain the first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain the second data; Use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext; Obtain the user ciphertext data from the fingerprint password key; Use the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

12. An identity authentication method, applied to a client and a server, characterized in that, The method includes: The client generates a first random number through a fingerprint password key, encrypts the first random number using the public key of the server preset in the client to obtain a first ciphertext data, and sends the first ciphertext data to the server; the fingerprint password key is bound to the user's fingerprint information, and the user name and password for logging in to the system are stored in the fingerprint password key; The server decrypts the received first ciphertext data using the private key of the server to obtain the first random number, and calculates a first key using the first random number; the server generates a second random number, performs an encryption operation using the first key and the second random number to obtain a second ciphertext data, and sends the second ciphertext data to the client; The client calculates a second key corresponding to the first key using the first random number, decrypts the received second ciphertext data using the second key to obtain the second random number, calculates a third key using the second random number, and performs an encryption operation using the third key and the second random number to obtain a third ciphertext data; The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key, and after the fingerprint authentication is passed, sends the third ciphertext data and the certificate information of the fingerprint password key to the server; The client calculates a transmission key using the first random number, the second random number, and the feature code of the client, and the feature code of the client is obtained by the client performing an encryption operation using the certificate information of the fingerprint password key; The client obtains the user name and password for logging in to the system from the fingerprint password key, encrypts the user name and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server; The server calculates a fourth key corresponding to the third key using the second random number, decrypts the received third ciphertext data using the fourth key to obtain the second random number, compares the decrypted second random number with the second random number generated by the server, and under the condition that the comparison result is consistent, calculates a transmission key using the first random number, the second random number, and the feature code of the server, and the feature code of the server is obtained by the server performing an encryption operation using the received certificate information of the fingerprint password key; The server decrypts the received final ciphertext data using the transmission key to obtain the user name and password, searches for the user name and password in the database of the server, and under the condition that the user name and password are found, determines that the identity authentication of the user logging in to the system is successful.

13. The identity authentication method according to claim 12, wherein The method further includes: After the server performs an encryption operation using the first key and the second random number to obtain the second ciphertext data, the server signs the second ciphertext data using the private key in the signature key to obtain a first signature value, and at the same time sends the server certificate, the first signature value, and the second ciphertext data to the client; The client verifies the received server certificate and the first signature value using the root certificate.

14. The identity authentication method according to claim 13, wherein The method further includes: After the client authenticates the fingerprint entered by the user through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data to obtain a second signature value. At the same time, it sends the user certificate, the second signature value, and the third ciphertext data to the server. The user certificate is the certificate of the fingerprint password key; The server uses the root certificate to verify the received user certificate and the second signature value.

15. The identity authentication method according to claim 12, wherein The feature codes of the client and the server are generated in the following manner: Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key; Perform a hash operation on the user geographical information to obtain a first hash value; Concatenate the user identity information and the first hash value and then perform a hash operation to obtain a second hash value; Concatenate the issuer identity information and the second hash value and then perform a hash operation to obtain a third hash value; Concatenate the name of the system to which the user wants to log in and the third hash value and then perform a hash operation to obtain a fourth hash value, and use the fourth hash value as the feature code.

16. The identity authentication method according to claim 12, wherein The feature codes of the client and the server are generated in the following manner: Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key; Obtain the name of the system to which the user wants to log in; Concatenate the user geographical information, user identity information, issuer identity information, and the name of the system to which the user wants to log in, and perform a hash operation on the concatenated data to obtain the feature code.

17. The identity authentication method according to claim 12, wherein Store the username and password for the user to log in to the system in the fingerprint password key, including: When initially entering the username and password for the user to log in to the system, use the pre-stored fingerprint information in the fingerprint password key to verify the fingerprint currently entered by the user. After the fingerprint verification passes, obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain a first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain a first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain a second data; Use the first ciphertext to perform an encryption operation on the second data to obtain a second ciphertext; Use the second ciphertext as the encryption key to encrypt the username and password to obtain user ciphertext data; Store the user ciphertext data in the fingerprint password key.

18. The identity authentication method according to claim 17, wherein The performing a first operation based on the serial number of the fingerprint password key to obtain a first data includes: Perform a hash operation on the serial number of the fingerprint password key and take the first n bytes of data as the initial data. Take the first m bytes of the initial data, invert them, and then concatenate them to obtain n bytes of first data, where m < n; The performing a second operation based on the serial number of the fingerprint password key to obtain a second data includes: Perform a hash operation on the serial number of the fingerprint password key and take the first n bytes of data as the initial data. Take the last m bytes of the initial data, invert them, and then concatenate them to obtain n bytes of second data, where m < n.

19. The identity authentication method according to claim 17, wherein The client obtains the username and password for the user to log in to the system from the fingerprint password key, including: Obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain a first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain the second data; Use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext; Obtain the user ciphertext data from the fingerprint password key; Use the second ciphertext as the decryption key to decrypt the user ciphertext data to obtain the username and password.

20. An identity authentication system, characterized in that, Include: Fingerprint password key, client, and server; The fingerprint password key is bound to the user's fingerprint information, and the username and password for the user to log in to the system are stored in the fingerprint password key; The client generates a first random number through the fingerprint password key, encrypts the first random number using the public key of the server preset in the client to obtain the first ciphertext data, and sends the first ciphertext data to the server; The server uses the private key of the server to decrypt the received first ciphertext data to obtain the first random number, and uses the first random number to calculate the first key; The server generates a second random number, performs an encryption operation using the first key and the second random number to obtain the second ciphertext data, and sends the second ciphertext data to the client; The client uses the first random number to calculate the second key corresponding to the first key, uses the second key to decrypt the received second ciphertext data to obtain the second random number, uses the second random number to calculate the third key, and performs an encryption operation using the third key and the second random number to obtain the third ciphertext data; The client performs fingerprint authentication on the fingerprint entered by the user through the fingerprint password key. After the fingerprint authentication is passed, the third ciphertext data and the certificate information of the fingerprint password key are sent to the server; The client uses the first random number, the second random number, and the client's feature code to perform an operation to obtain the transmission key. The client's feature code is obtained by the client performing an encryption operation using the certificate information of the fingerprint password key; The client obtains the username and password for the user to log in to the system from the fingerprint password key, encrypts the username and password using the transmission key to obtain the final ciphertext data, and sends the final ciphertext data to the server; The server uses the second random number to calculate the fourth key corresponding to the third key, uses the fourth key to decrypt the received third ciphertext data to obtain the second random number, compares the decrypted second random number with the second random number generated by the server. Under the condition that the comparison result is consistent, use the first random number, the second random number, and the server's feature code to perform an operation to obtain the transmission key. The server's feature code is obtained by the server performing an encryption operation using the received certificate information of the fingerprint password key; The server uses the transmission key to decrypt the received final ciphertext data to obtain the username and password, searches for the username and password in the server's database, and under the condition that the username and password are found, determines that the identity authentication of the user logging in to the system is successful.

21. The identity authentication system according to claim 20, wherein After the server uses the first key and the second random number to perform an encryption operation to obtain the second ciphertext data, it uses the private key in the signature key to sign the second ciphertext data to obtain the first signature value, and at the same time sends the server certificate, the first signature value, and the second ciphertext data to the client; The client uses the root certificate to verify the received server certificate and the first signature value.

22. The identity authentication system according to claim 21, wherein After the client authenticates the fingerprint entered by the user through the fingerprint password key, it uses the private key in the signature key to sign the third ciphertext data to obtain the second signature value, and at the same time sends the user certificate, the second signature value, and the third ciphertext data to the server, where the user certificate is the certificate of the fingerprint password key; The server uses the root certificate to verify the received user certificate and the second signature value.

23. The identity authentication system according to claim 20, wherein The feature code of the client and the feature code of the server are generated in the following manner: Extract the user geographical information, user identity information, and issuer identity information from the certificate information of the fingerprint password key; Perform a hash operation on the user geographical information to obtain the first hash value; Concatenate the user identity information and the first hash value and then perform a hash operation to obtain the second hash value; Concatenate the issuer identity information and the second hash value and then perform a hash operation to obtain the third hash value; Concatenate the name of the system that the user wants to log in to and the third hash value and then perform a hash operation to obtain the fourth hash value, and use the fourth hash value as the feature code.

24. The identity authentication system according to claim 20, wherein It further includes: A data operation and writing device; The data operation and writing device is used for: When initially inputting the username and password of the user to log in to the system, use the fingerprint information pre-stored in the fingerprint password key to verify the fingerprint currently entered by the user. After the fingerprint verification is passed, obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain the first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain the second data; Use the first ciphertext to perform an encryption operation on the second data to obtain the second ciphertext; Use the second ciphertext as the encryption key to encrypt the username and password to obtain the user ciphertext data; Store the user ciphertext data in the fingerprint password key.

25. The identity authentication system according to claim 24, wherein Performing a first operation based on the serial number of the fingerprint password key to obtain the first data includes: Perform a hash operation on the serial number of the fingerprint password key and take the first n bytes of data as the initial data. Take the first m bytes of the initial data, invert them, and then concatenate them to obtain n bytes of the first data.

26. The identity authentication system according to claim 24, wherein Performing a second operation based on the serial number of the fingerprint password key to obtain the second data includes: Perform a hash operation on the serial number of the fingerprint password key and take the first n bytes of data as the initial data. Take the last m bytes of the initial data, invert them, and then concatenate them to obtain n bytes of the second data.

27. The identity authentication system according to claim 24, wherein The client obtains the username and password of the user to log in to the system from the fingerprint password key, including: Obtain the serial number of the fingerprint password key; Perform a first operation based on the serial number of the fingerprint password key to obtain the first data; Use the master key of the fingerprint password key to perform an encryption operation on the first data to obtain the first ciphertext; Perform a second operation based on the serial number of the fingerprint password key to obtain second data; Perform an encryption operation on the second data using the first ciphertext to obtain a second ciphertext; Obtain user ciphertext data from the fingerprint password key; Use the second ciphertext as a decryption key to decrypt the user ciphertext data to obtain the username and password.

28. A computer device, characterized in that, Comprising: A memory storing a computer program; A processor for executing the computer program to implement the authentication method according to any one of claims 1-19.

29. A computer program product, comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the authentication method according to any one of claims 1-19.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program, when executed by the processor, implements the authentication method according to any one of claims 1-19.

Images