Mobile terminal security authentication method and system

Abstract

The invention provides a mobile terminal security authentication method and system. The mobile terminal security authentication method comprises the steps that a mobile security client is installed on a mobile terminal, and the mobile security client is bound with EMI D information of the mobile terminal and communicates with a cloud server; a private key of the mobile security client is divided into two secret key factors by adopting a secret key division technology, the two secret key factors are respectively and securely stored in the mobile terminal and the cloud server, the mobile terminal and the cloud server cooperatively compute, a complete plaintext secret key cannot appear forever, the security of the private key of the mobile security client is effectively protected, and the security of the mobile security client is ensured. The digital certificate realizes the functions of strong identity authentication and secure encryption.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a mobile terminal security authentication method and system. Background Art

[0002] With the development of mobile communication technology and the acceleration of the pace of national informatization construction, people's working methods are also constantly changing in the direction of convenience and efficiency. Especially in the era of mobile Internet, mobile office has liberated people from their daily work desks, making it a reality to work anytime and anywhere, making reasonable use of fragmented time and greatly improving office efficiency. Mobile office has been promoted and used not only in Internet companies and new industries, but also in traditional industries, government, public security, fire protection, taxation, finance, education and other industries.

[0003] However, due to the lack of corresponding security mechanisms to ensure the security of mobile terminals and the inability to determine the legitimacy of users during use, there are problems such as access by illegal users and illegal peripherals; at the same time, due to the use of mobile networks for communication, business information is transmitted through the air, and sensitive information is at risk of being leaked or tampered with during transmission. Therefore, the mobile mode poses new challenges to maintaining the integrity, timeliness and accuracy of information transmitted by wireless networks. In order to facilitate mobile office and support practical work, it is necessary to ensure the security of information communication networks while achieving business access through effective security mechanisms. Mobile terminals use mobile security clients to authenticate and encrypt mobile terminal personnel, but usually need to cooperate with hardware password modules such as TF cards / film cards to protect mobile terminal private keys. Hardware password modules such as TF cards / film cards need to be installed in mobile terminals, which require the installation of external devices, are inconvenient, difficult to promote, and costly. Summary of the invention

[0004] In order to overcome the defects in the above-mentioned prior art, an object of the present invention is to provide a mobile terminal security authentication method and system.

[0005] In order to achieve the above-mentioned object of the present invention, the present invention provides a mobile terminal security authentication method, comprising the following steps:

[0006] Install a mobile security client on the mobile terminal, which is bound to the international mobile equipment identity (EM ID) information of the mobile terminal and communicates with the cloud server;

[0007] Generate a client signature key factor on the mobile security client, and request the cloud server to generate a cloud server signature key factor; the mobile security client uses the client signature key factor to generate a client digital signature and sends it to the cloud server; the cloud server uses the cloud server signature key factor to generate a cloud server digital signature; merge the client digital signature and the cloud server digital signature into a complete digital signature;

[0008] The mobile security client applies to the digital certificate authentication system for a signature key certificate and an encryption key certificate; based on the signature key certificate, the encryption key certificate and the digital signature, the mobile security client and the cloud server perform mutual identity authentication.

[0009] This mobile terminal security authentication method adopts key splitting technology to securely store the two split key factors on the mobile terminal and cloud server respectively. The mobile terminal and cloud server work together to calculate, and the complete plaintext key will never appear, which effectively protects the private key security of the mobile security client. The digital certificate realizes the functions of strong identity authentication and secure encryption.

[0010] In an optional scheme of the mobile terminal security authentication method, the mobile security client applies for a signature certificate and an encryption certificate from the digital certificate authentication system. The application is forwarded through the cloud server, and the signature certificate is bound to the mobile terminal's international mobile equipment identity code EM ID. The signature key certificate and encryption key certificate are applied for and saved in the back-end system of the mobile security client.

[0011] In an optional solution of the mobile terminal security authentication method, when forwarding the signature key certificate and encryption key certificate of the mobile security client, the cloud server also stores a copy and binds it to the international mobile equipment identity EM ID to obtain the cloud server signature key certificate;

[0012] When the Mobile Security Client and the Cloud Server perform mutual authentication,

[0013] The cloud server verifies the digital signature using the signature key certificate of the mobile security client, verifies the certificate chain of the root certificate issued by the superior CA certification center to the mobile security client, and verifies the international mobile equipment identity code EM ID information of the mobile terminal;

[0014] The mobile security client verifies the cloud server identity, verifies the certificate chain of the root certificate issued by the CA certification center to the cloud server, and verifies the cloud server signing key certificate.

[0015] In an optional solution of the mobile terminal security authentication method, when the mobile security client verifies the identity of the cloud server, the cloud server first goes to the CA certification center to issue a root certificate, and then imports the root certificate of the cloud server into the mobile security client, and uses the root certificate of the mobile security client to verify the root certificate of the cloud server.

[0016] The present application also provides a method for transmitting business data of a mobile terminal, which performs mobile security client identity authentication based on the above-mentioned mobile terminal security authentication method;

[0017] After verification, the encryption key certificate and encryption certificate are used to establish a two-way national secret SSL security channel with the VPN gateway system.

[0018] The mobile terminal business data transmission method has the function of providing reliable identity authentication and channel encryption for mobile terminal devices without the need for additional hardware equipment, and can effectively ensure the identity authentication, data confidentiality and data integrity of the mobile terminal, and ensure the transmission security of business data.

[0019] Optionally, the business system client transmits business data through the two-way national secret SSL secure channel. The data transmitted in the channel are all ciphertext. The ciphertext data is decrypted at the back end of the VPN gateway system to obtain plaintext, and the plaintext data is then passed to the business system backend system.

[0020] The present application also provides a mobile terminal security authentication system, including:

[0021] Mobile terminals,

[0022] The mobile security client is installed on the mobile terminal and is bound to the EMID information of the mobile terminal;

[0023] The cloud server communicates with the mobile security client;

[0024] Digital certificate authentication system, used to generate signature key certificates and encryption key certificates for mobile security clients;

[0025] The mobile terminal, mobile security client, cloud server and digital certificate authentication system perform the mobile security client identity authentication step according to the above-mentioned mobile terminal security authentication method to authenticate the security of the mobile terminal.

[0026] The mobile terminal security authentication system can provide reliable identity authentication for mobile terminal devices without the need for additional hardware equipment, and can effectively protect the private key security of the mobile security client.

[0027] The present application also provides a mobile terminal service data transmission system, including the above-mentioned mobile terminal security authentication system, VPN gateway system and service system;

[0028] After the mobile terminal security authentication is performed and passed based on the mobile terminal security authentication system, the mobile security client uses the encryption key and encryption certificate to establish a two-way national secret SSL security channel with the VPN gateway system; the business system transmits business data with the mobile terminal through the two-way national secret SSL security channel.

[0029] The mobile terminal business data transmission system can provide reliable identity authentication and channel encryption functions for mobile terminal devices without the need for additional hardware equipment, and can effectively ensure the identity authentication, data confidentiality and data integrity of the mobile terminal, and ensure the security of business data transmission.

[0030] The beneficial effects of the present invention are:

[0031] The present invention adopts key splitting technology to realize the protection of the private key of the mobile security client, and realizes the strong identity authentication and data encryption protection function of the mobile terminal based on the digital certificate. It has the characteristics of strong security, convenient use, simple promotion, low cost, etc., and has good use effect.

[0032] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0034] Figure 1 It is the principle logic diagram of the second embodiment;

[0035] Figure 2 This is a network deployment diagram of Example 4. DETAILED DESCRIPTION

[0036] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0037] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0038] Embodiment 1

[0039] This embodiment provides a mobile terminal security authentication method, including the following steps:

[0040] Install the mobile security client on the mobile terminal (such as a mobile phone or tablet), which is bound to the EMID information of the mobile terminal and communicates with the cloud server. The EMID is the unique ID of the mobile terminal. Only mobile terminals with the mobile security client installed can enter the network boundary, thereby accessing the network of the business system and transmitting data.

[0041] The private key of the mobile security client is protected by a key splitting mechanism and is split into two key factors. Specifically: when the mobile security client is initialized, the client signature key factor is generated; at the same time, a request is sent to the cloud server, and the cloud server generates the cloud server signature key factor.

[0042] When the mobile security client is initialized, it also applies to the digital certificate authentication system for a signature certificate and an encryption certificate. The application is forwarded through the cloud server, and the international mobile equipment identity code EMID of the mobile terminal is used to bind the signature certificate. The signature key certificate and encryption key certificate are applied for and saved in the mobile security client backend system.

[0043] The mobile security client uses the client signature key factor to generate a client digital signature and sends it to the cloud server; the cloud server uses the cloud server signature key factor to generate a cloud server digital signature; and the client digital signature and the cloud server digital signature are combined into a complete digital signature.

[0044] Based on the signature key certificate, encryption key certificate and digital signature, the mobile security client and the cloud server perform mutual authentication. Specifically, the cloud server will also store a copy of the signature key certificate of the mobile security client, and bind it to the international mobile equipment identity code EMID to obtain the cloud server signature key certificate; the cloud server uses the signature key certificate of the mobile security client to verify the digital signature, and verify the certificate chain of the root certificate issued by the superior CA certification center to the mobile security client, and verify the international mobile equipment identity code EMID information of the mobile terminal. The certificate chain here is used to verify whether the user certificate at this level is issued by the superior legal institution. The mobile security client verifies the identity of the cloud server. Specifically, the cloud server first issues a root certificate to the CA certification center, and then imports the root certificate of the cloud server into the mobile security client, and uses the root certificate of the mobile security client to verify the root certificate of the cloud server, verify the certificate chain of the root certificate issued by the CA certification center to the cloud server, and verify the signature key certificate of the cloud server. If the verification is passed, the client identity authentication is completed, and the security authentication of the mobile terminal is passed.

[0045] Embodiment 2

[0046] like Figure 1 As shown, this embodiment is based on the first embodiment and provides a method for transmitting business data of a mobile terminal. Specifically, according to the first embodiment, the identity authentication of the mobile security client is performed. After passing the security authentication of the mobile terminal, the mobile security client uses the encryption key certificate and the encryption certificate to establish a two-way national secret SSL security channel with the VPN gateway system to protect the confidentiality and integrity of the data in the channel. The business system transmits business data with the mobile terminal through the two-way national secret SSL security channel. Specifically, the business system client transmits business data through the two-way national secret SSL security channel. The data transmitted in the channel are all ciphertext. The ciphertext data is decrypted at the back end of the VPN gateway system to obtain plaintext, and the plaintext data is then passed to the business system backend system.

[0047] Embodiment 3

[0048] This embodiment provides a mobile terminal security authentication system, including: a mobile terminal, a mobile security client installed on the mobile terminal and bound to the EM ID information of the mobile terminal, a cloud server communicating with the mobile security client, and a digital certificate authentication system for generating a signature key certificate and an encryption key certificate for the mobile security client. The mobile terminal, the mobile security client, the cloud server, and the digital certificate authentication system perform the mobile security client identity authentication step according to the mobile terminal security authentication method provided in the first embodiment, and authenticate the security of the mobile terminal.

[0049] Embodiment 4

[0050] This embodiment provides a mobile terminal service data transmission system, including the mobile terminal security authentication system provided in the third embodiment, as well as the VPN gateway system and the service system.

[0051] After the mobile terminal security authentication system provided in Example 3 performs the mobile terminal security authentication and passes it, the mobile security client uses the encryption key and encryption certificate to establish a two-way national secret SSL security channel with the VPN gateway system. The business system transmits business data with the mobile terminal through the two-way national secret SSL security channel. Specifically, the business system client transmits business data through the two-way national secret SSL security channel. The data transmitted in the channel are all ciphertext. The ciphertext data is decrypted at the back end of the VPN gateway system to obtain plaintext, and the plaintext data is then passed to the business system backend system.

[0052] like Figure 2 As shown, the digital certificate authentication system, collaborative signature system, and VPN gateway system are deployed at the network boundary, namely the Internet cloud platform area, to authenticate and decrypt the mobile security client.

[0053] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0054] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A mobile terminal security authentication method, characterized in that: The following steps are involved: Install a mobile security client on the mobile terminal, which is bound to the international mobile equipment identity (EMID) information of the mobile terminal and communicates with the cloud server; Generate a client signature key factor on the mobile security client, and request the cloud server to generate a cloud server signature key factor; The mobile security client generates a client digital signature using the client signature key factor and sends it to the cloud server; The cloud server generates a cloud server digital signature using the cloud server signature key factor; combines the client digital signature and the cloud server digital signature into a complete digital signature; The mobile security client applies to the digital certificate authentication system to obtain the signature key certificate and encryption key certificate; Based on the signing key certificate, encryption key certificate and digital signature, the mobile security client and the cloud server perform mutual identity authentication.

2. The mobile terminal security authentication method according to claim 1, characterized in that: The mobile security client applies for a signature certificate and an encryption certificate from the digital certificate authentication system. The application is forwarded through the cloud server, and the mobile terminal's International Mobile Equipment Identity (EMID) is used to bind the signature certificate. The signature key certificate and encryption key certificate are obtained and saved in the back-end system of the mobile security client.

3. The mobile terminal security authentication method according to claim 1, characterized in that: When forwarding the signature key certificate and encryption key certificate of the mobile security client, the cloud server also stores a copy and binds it with the International Mobile Equipment Identity EMID to obtain the cloud server signature key certificate; When the Mobile Security Client and the Cloud Server perform mutual authentication, The cloud server verifies the digital signature using the signature key certificate of the mobile security client, verifies the certificate chain of the root certificate issued by the superior CA certification center to the mobile security client, and verifies the international mobile equipment identity EMID information of the mobile terminal; The mobile security client verifies the cloud server identity, verifies the certificate chain of the root certificate issued by the CA certification center to the cloud server, and verifies the cloud server signing key certificate.

4. The mobile terminal security authentication method according to claim 1, characterized in that: When the Mobile Security client verifies the identity of the cloud server, the cloud server first obtains a root certificate from the CA certification center, then imports the root certificate of the cloud server into the Mobile Security client, and uses the root certificate of the Mobile Security client to verify the root certificate of the cloud server.

5. A method for transmitting mobile terminal service data, characterized in that: Performing mobile security client identity authentication based on the mobile terminal security authentication method according to any one of claims 1 to 4; After verification, use the encryption key certificate and encryption certificate to establish a two-way national secret SSL security channel with the VPN gateway system; The business system transmits business data with the mobile terminal through the two-way national secret SSL secure channel.

6. The mobile terminal service data transmission method according to claim 5, characterized in that: The business system client transmits business data through the two-way national secret SSL secure channel. The data transmitted in the channel are all ciphertext. The ciphertext data is decrypted at the back end of the VPN gateway system to obtain plaintext, and the plaintext data is then passed to the business system backend system.

7. A mobile terminal security authentication system, characterized in that: include: Mobile terminals, The mobile security client is installed on the mobile terminal and is bound to the EMID information of the mobile terminal; The cloud server communicates with the mobile security client; Digital certificate authentication system, used to generate signature key certificates and encryption key certificates for mobile security clients; The mobile terminal, mobile security client, cloud server and digital certificate authentication system perform the mobile security client identity authentication step according to the mobile terminal security authentication method according to any one of claims 1-4 to authenticate the security of the mobile terminal.

8. A mobile terminal service data transmission system, characterized in that: It includes the mobile terminal security authentication system, VPN gateway system and business system as described in claim 7; After the mobile terminal security authentication is performed and passed based on the mobile terminal security authentication system, the mobile security client uses the encryption key and encryption certificate to establish a two-way national secret SSL security channel with the VPN gateway system; The business system transmits business data with the mobile terminal through the two-way national secret SSL secure channel.

Images