One-time bidirectional collaborative enhancement authentication method based on digital certificate and biological characteristics

Abstract

The invention relates to a one-time bidirectional collaborative enhancement authentication method based on a digital certificate and biological characteristics, and belongs to the technical field of network security. In the user identity authentication process, the verification of the biological characteristic ciphertext is changed from the traditional authentication server side authentication to the client side authentication, the biological characteristic plaintext is prevented from appearing at the authentication server side, the privacy safety is protected, the biological characteristic ciphertext is stored in the authentication server, and after the authentication server judges based on the digital certificate, the authentication efficiency is improved. And finding a corresponding biological characteristic ciphertext, performing symmetric encryption on the biological characteristic by using a random number generated in a certificate verification process, and distributing the biological characteristic ciphertext to a corresponding authentication client. In the process, one-time pad in the biological characteristic transmission process is ensured, the safety of the biological characteristics is enhanced, and bidirectional authentication between the authentication client and the authentication server is completed at the same time.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a one-time two-way collaborative enhanced authentication method based on digital certificates and biometrics. Background Art

[0002] Digital certificate authentication technology and biometric authentication technology have been widely used. With the rapid development of the Internet and big data technology, network transactions, online services and other activities are becoming more and more frequent. Traditional server-side authentication methods inevitably require the biometric plaintext to be loaded into memory, which has a certain risk of privacy leakage. In addition, in traditional two-way authentication methods, the client usually sends the digital certificate and biometrics to the server at one time to complete the authentication. In this case, if a middleman forges the authentication server response, the forger obtains the digital certificate and biometric ciphertext of the authentication requester, further increasing the risk of leaking biometrics. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is how to provide a one-time two-way collaborative enhanced authentication method based on digital certificates and biometrics to solve the problem that authentication servers may be forged or biometrics may be stolen in existing identity authentication technologies.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention proposes a one-time two-way collaborative enhanced authentication method based on digital certificates and biometrics, which is implemented by an authentication system and includes:

[0007] Biometric collection: Collect user biometric information through biometric collection equipment;

[0008] Biometric information encryption: The collected biometrics are asymmetrically encrypted using the public key in the digital certificate, and the biometric ciphertext is sent to the authentication server;

[0009] Identity authentication: First, the digital certificate is sent to the authentication server for authentication. After the authentication is passed, the authentication server identifies the biometric ciphertext of the corresponding person based on the certificate, uses the random number in the certificate authentication process as the symmetric key to symmetrically encrypt the biometric, and uses the server signature private key to sign the biometric ciphertext. Finally, it is sent to the corresponding authentication client together with the biometric ciphertext, signature value, and signature certificate to request the execution of biometric authentication;

[0010] Authentication result feedback: After receiving the request, the authentication client first verifies the server signature and its certificate. After the identity is verified, it first uses the symmetric key to decrypt, and then uses the private key to decrypt the biometric features. At the same time, it collects user features for comparison. After the comparison is successful, the personnel information is returned to the authentication server, otherwise it returns a comparison failure message; the authentication server makes a final comparison between the obtained personnel information and the personnel information authenticated by the certificate, and returns the authentication result if successful, otherwise it returns an error message if failed.

[0011] (III) Beneficial effects

[0012] The present invention proposes a one-time two-way collaborative enhanced authentication method based on digital certificates and biometrics. The present invention designs and implements a one-time two-way collaborative enhanced authentication method based on digital certificates and biometrics, which has the following advantages:

[0013] (1) High security: Combining digital certificates with biometric technology, it effectively prevents user identity forgery and information leakage. At the same time, it protects biometrics based on the user's one-time password technology to ensure the security of user privacy data;

[0014] (2) Convenience: Users do not need to remember complex passwords and can complete identity authentication through simple biometric recognition;

[0015] (3) Good compatibility: Supports multiple biometric recognition methods to meet the needs of different users and application scenarios.

[0016] The present invention provides a secure two-way authentication scheme by combining digital certificates and biometric authentication technology, which not only improves data security but also enhances user privacy protection experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a system architecture diagram of the present invention;

[0018] Figure 2 It is the system composition diagram;

[0019] Figure 3 Flowchart for user registration;

[0020] Figure 4 To enhance the authentication flow chart. DETAILED DESCRIPTION

[0021] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0022] The present invention relates to the field of network security technology, and in particular to a two-way collaborative enhanced authentication method based on digital certificates and biometrics, in particular, a method of encrypting biometrics using a user public key certificate, which increases the authentication strength while ensuring the security of the biometrics.

[0023] The purpose of the present invention is to provide a two-way collaborative enhanced authentication method based on digital certificates and biometric technology to solve the problem of forged authentication servers or stolen biometrics in existing identity authentication technologies. In the process of user identity authentication, the verification of biometric ciphertext is changed from traditional authentication server authentication to client authentication, which prevents the biometric plaintext from appearing on the authentication server and protects the security of privacy. The biometric ciphertext is stored in the authentication server, which finds the corresponding biometric ciphertext based on the digital certificate, uses the random number generated in the certificate verification process to symmetrically encrypt the biometrics, and distributes the biometric ciphertext to the corresponding authentication client. In this process, the one-time one-key transmission process of the biometrics is guaranteed, the security of the biometrics is strengthened, and the two-way authentication between the authentication client and the authentication server is completed.

[0024] 1. Methods

[0025] Biometric collection: Collect user biometric information, such as fingerprints, finger vein features, etc., through biometric collection devices.

[0026] Biometric information encryption: The collected biometrics are asymmetrically encrypted using the public key in the digital certificate, and the biometric ciphertext is sent to the authentication server.

[0027] Identity authentication: First, the digital certificate is sent to the authentication server for authentication. After the authentication is passed, the authentication server identifies the biometric ciphertext of the corresponding person based on the certificate, uses the random number in the certificate authentication process as the symmetric key to symmetrically encrypt the biometric, and uses the server signature private key to sign the biometric ciphertext. Finally, it is sent to the corresponding authentication client together with the biometric ciphertext, signature value, and signature certificate, requesting to perform biometric authentication.

[0028] Authentication result feedback: After receiving the request, the authentication client first verifies the server signature and its certificate. After the identity is verified, it first uses the symmetric key to decrypt, and then uses the private key to decrypt the biometrics. At the same time, it collects user features for comparison. After the comparison is successful, it returns the personnel information to the authentication server, otherwise it returns the comparison failure information. The authentication server makes a final comparison between the obtained personnel information and the personnel information authenticated by the certificate, and returns the authentication result if successful, and returns an error message if failed.

[0029] (II) System

[0030] This is achieved by the authentication system, which includes a biometric collection device, an authentication client, and an authentication server. The biometric collection device is responsible for collecting user biometric information, has an embedded encryption module, and provides cryptographic computing services; the authentication client provides a human-computer interaction interface and authentication proxy functions, connects users, authentication servers, and biometric collection devices, and provides identity proxy functions for users. The authentication server provides certificate authentication and biometric recognition algorithms to provide identity authentication services for users.

[0031] Embodiment 1:

[0032] 1. System architecture

[0033] This system is divided into four layers according to business functions, including service layer, proxy layer, data layer and hardware support layer. The system architecture is as follows: Figure 1 shown.

[0034] The service layer, i.e. the authentication server, provides functions such as user management, biometric management, and digital certificate authentication;

[0035] The proxy layer, i.e. the authentication client, calls the biometric collection device downward and connects to the authentication server upward to provide proxy functions such as user biometric collection, user digital certificate authentication, and password calculation;

[0036] The data layer includes authentication protocol data, biometric data, digital certificates and other data required for identity authentication;

[0037] The hardware support layer includes biometric collection equipment and cryptographic operation modules, which support the completion of biometric collection, data protection and cryptographic certificate authentication.

[0038] (II) Module composition

[0039] The present invention can be implemented by combining software and hardware. The system mainly comprises an authentication server, an authentication client and a biometric feature collection device. The functional components are as follows: Figure 2 shown.

[0040] The authentication server is deployed in the central computer room. It has an embedded password module to support the verification of user identity certificates and has the ability to store user biometrics, providing data support for two-way identity authentication.

[0041] The authentication client is deployed on the user's PC to drive the identity authentication terminal and provide the user with the proxy function of digital certificate and biometric identity authentication.

[0042] The biometric collection device is plugged into the user's PC via a USB cable. It includes a cryptographic calculation module and a biometric collection module, providing the cryptographic calculation and biometric collection and comparison functions required in the identity authentication process.

[0043] (III) Main Workflow

[0044] (1) User Registration

[0045] User identity registration mainly includes user identity information registration and user biometric collection and trusteeship.

[0046] S11. The user first fills in the basic user information through the authentication server client;

[0047] S12. The user drives the biometric feature collection device by calling the authentication client deployed on the user side to complete the biometric feature data collection;

[0048] S13, the biometric feature collection device collects the user's biometric features, calls the internal encryption module to perform public key encryption on the biometric features, and uses the signature private key to sign the registration data packet;

[0049] S14. The user sends basic user information, biometric information and signature value to the authentication server to complete identity registration.

[0050] (2) Identity Authentication

[0051] S21. When the user logs in, he first performs digital certificate authentication, carries the user certificate to initiate an identity authentication request to the authentication service, and obtains the authentication server encryption certificate and random number. The authentication server generates a random number and encrypts the random number using the user encryption certificate, and returns it to the client.

[0052] S22, the authentication client calls the collection device to decrypt the random number, generates an authentication data packet, and sends it to the authentication server;

[0053] S23, the authentication server first verifies the authentication data packet. After successful verification, it queries the user's biometric features stored locally based on the user information, uses the random number used in the authentication certificate as the symmetric encryption key to symmetrically encrypt the user's biometric features, and returns the authentication result and biometric ciphertext to the authentication client;

[0054] S24. The authentication client uses the symmetric key to decrypt, uses the private key to decrypt and verify the biometric feature, and completes the two-way authentication after successful verification.

[0055] Beneficial effects:

[0056] The present invention designs and implements a two-way collaborative enhanced authentication method based on digital certificates and biometrics, which has the following advantages:

[0057] (1) High security: Combining digital certificates with biometric technology, it effectively prevents user identity forgery and information leakage. At the same time, it protects biometrics based on the user's one-time password technology to ensure the security of user privacy data;

[0058] (2) Convenience: Users do not need to remember complex passwords and can complete identity authentication through simple biometric recognition;

[0059] (3) Good compatibility: Supports multiple biometric recognition methods to meet the needs of different users and application scenarios.

[0060] The present invention provides a secure two-way authentication scheme by combining digital certificates and biometric authentication technology, which not only improves data security but also enhances user privacy protection experience.

[0061] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics, characterized in that: This method is implemented by the authentication system. include: Biometric collection: Collect user biometric information through biometric collection equipment; Biometric information encryption: The collected biometrics are asymmetrically encrypted using the public key in the digital certificate, and the biometric ciphertext is sent to the authentication server; Identity authentication: First, the digital certificate is sent to the authentication server for authentication. After the authentication is passed, the authentication server identifies the biometric ciphertext of the corresponding person based on the certificate, uses the random number in the certificate authentication process as the symmetric key to symmetrically encrypt the biometric, and uses the server signature private key to sign the biometric ciphertext. Finally, it is sent to the corresponding authentication client together with the biometric ciphertext, signature value, and signature certificate to request the execution of biometric authentication; Authentication result feedback: After receiving the request, the authentication client first verifies the server signature and its certificate. After the identity is verified, it first uses the symmetric key to decrypt, and then uses the private key to decrypt the biometric features. At the same time, it collects user features for comparison. If the comparison is successful, it returns the personnel information to the authentication server, otherwise it returns the comparison failure information; The authentication server makes a final comparison between the obtained personnel information and the personnel information authenticated by the certificate, and returns the authentication result if successful, or an error message if failed.

2. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 1, characterized in that: The system is divided into four layers according to business functions, including: service layer, proxy layer, data layer and hardware support layer; The service layer, i.e. the authentication server, provides user management, biometric management, and digital certificate authentication functions; The proxy layer, i.e. the authentication client, calls the biometric collection device downward and connects to the authentication server upward to provide user biometric collection, user digital certificate authentication, and password calculation proxy functions; The data layer includes authentication protocol data, biometric data, and data required for digital certificate identity authentication; The hardware support layer includes biometric collection equipment and cryptographic operation modules, which support the completion of biometric collection, data protection and cryptographic certificate authentication.

3. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 1, characterized in that: The user's biometric information is a fingerprint feature.

4. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 1, characterized in that: The user's biometric information is vein characteristics.

5. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 1, characterized in that: The biometric collection device is responsible for collecting user biometric information, has an embedded encryption module, and provides cryptographic operation services; the authentication client provides a human-computer interaction interface and authentication agent functions, connects users, authentication servers and biometric collection devices, and provides identity agent functions for users; the authentication server provides certificate authentication and biometric recognition algorithms, and provides identity authentication services for users.

6. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 5, characterized in that: The authentication server is deployed in the central computer room. It has an embedded password module to support the verification of user identity certificates and has the ability to store user biometrics, providing data support for two-way identity authentication.

7. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 5, characterized in that: The authentication client is deployed on the user's PC to drive the identity authentication terminal and provide the user with the proxy function of digital certificate and biometric identity authentication.

8. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 5, characterized in that: The biometric collection device is plugged into the user's PC via a USB cable. It includes a cryptographic calculation module and a biometric collection module, providing the cryptographic calculation and biometric collection and comparison functions required in the identity authentication process.

9. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics according to any one of claims 1 to 78, characterized in that: The method includes a user identity registration process, specifically including: S11. The user first fills in the basic user information through the authentication server client; S12. The user drives the biometric feature collection device by calling the authentication client deployed on the user side to complete the biometric feature data collection; S13, the biometric feature collection device collects the user's biometric features, calls the internal encryption module to perform public key encryption on the biometric features, and uses the signature private key to sign the registration data packet; S14. The user sends basic user information, biometric information and signature value to the authentication server to complete identity registration.

10. The one-time two-way collaborative enhanced authentication method based on digital certificate and biometrics as claimed in claim 9, characterized in that: The method includes an identity authentication process, specifically including: S21. When the user logs in, first perform digital certificate authentication, carry the user certificate to initiate an identity authentication request to the authentication service, obtain the authentication server encryption certificate and random number; the authentication server generates a random number and encrypts the random number using the user encryption certificate, and returns it to the client; S22, the authentication client calls the collection device to decrypt the random number, generates an authentication data packet, and sends it to the authentication server; S23, the authentication server first verifies the authentication data packet. After successful verification, it queries the user's biometric features stored locally according to the user information, uses the random number used in the authentication certificate as the symmetric encryption key to symmetrically encrypt the user's biometric features, and returns the authentication result and the biometric ciphertext to the authentication client; S24. The authentication client uses the symmetric key to decrypt, uses the private key to decrypt and verify the biometric feature, and completes the two-way authentication after successful verification.

Images