Method, apparatus and device for protecting password key password conversion biometric protection

Abstract

The application discloses a method, device and equipment for protecting a password key password from being converted into biometric protection, the method comprising: receiving a first random number and a current device identifier sent by a password device; verifying current biometric information input by a user to obtain a biometric verification result, if the current device identifier indicates that a fingerprint accessory is successfully paired with the password device; encrypting a preset password based on the first random number to obtain first encrypted data, if the biometric verification result indicates that the biometric verification is passed; sending the first encrypted data to the password device. By encrypting and storing the preset password in the fingerprint accessory, and based on pairing verification and biometric verification, the safe access of the encrypted preset password can be realized, the information isolation and physical isolation of the preset password and the password device are realized, and finally a separated security architecture composed of the fingerprint accessory and the password device is constructed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information encryption, and in particular to a method, device and equipment for password key password protection conversion to biometric protection. BACKGROUND

[0002] In the field of traditional password authentication technology, the single-factor authentication system based on static password or fixed digital certificate has long dominated the market. Its core defects lie in the singleness of security mechanism and the inherent vulnerability of static credentials. Early password devices such as U-shield, smart card, etc. generally use fixed keys or pre-stored digital certificates as the only verification credentials. Attackers can induce users to disclose passwords through phishing attacks, or use distributed brute-force tools to exhaust weak password combinations, or even intercept static credentials in the communication link through man-in-the-middle attacks. More seriously, integrated biometric modules (such as fingerprint sensors rigidly connected with master control chips) have hardware-level security risks: the storage of biometric templates is not fully isolated and encrypted, and reverse engineering or firmware vulnerabilities can lead to user biometric data leakage; the physical binding design of the sensor and the master control chip causes the key components to fail, which in turn causes the system to crash, and the irreproducibility of biometric features makes the leakage risk permanent. In addition, existing peripheral communication protocols generally use one-way authentication mechanisms, lack of two-way dynamic verification and end-to-end encryption protection, and attackers can fake device identities or replay historical authentication data to bypass security protection. These technical defects lead to systematic risks in traditional password devices in high-security scenarios such as financial transactions and government systems, making it difficult to meet the requirements of non-repudiation and dynamic defense. SUMMARY

[0003] To solve the technical problem of low security of the existing password authentication method, the present application provides a method, device and equipment for password key password protection conversion to biometric protection, which encrypts and stores a preset password in a fingerprint accessory, and based on the dual verification of pairing verification and biometric verification, the secure access of the encrypted preset password is realized, the information isolation and physical isolation of the preset password and the password device are realized, and finally a separated security architecture composed of the fingerprint accessory and the password device is built for password protection and authentication, the fingerprint collection and verification are completed by the independent accessory, and the password device only stores the encryption key, so that the password device is prevented from being attacked and leaking, and the security and stability are effectively improved.

[0004] In a first aspect, the present application provides a method for password key password protection conversion to biometric protection, applied to a fingerprint accessory, comprising:

[0005] receiving a first random number and a current device identifier sent by a password device;

[0006] In a case where the current device identifier indicates that the fingerprint accessory is successfully paired with the password device, verifying current biometric information input by the user to obtain a biometric verification result;

[0007] If the biometric verification result indicates that biometric verification is passed, encrypting a preset password based on the first random number to obtain first encrypted data; the encrypted preset password is respectively stored in the fingerprint accessory and the password device;

[0008] Sending the first encrypted data to the password device; the first encrypted data is used for password verification by the password device.

[0009] In an optional embodiment, before receiving the first random number and the device identifier sent by the password device, the method further comprises:

[0010] Receiving and storing the initial device identifier sent by the password device;

[0011] Receiving and storing the initial biometric information input by the user;

[0012] Based on the initial device identifier, a binding relationship is established with the password device;

[0013] Based on the binding relationship, the preset password is encrypted to obtain first encrypted password information.

[0014] In an optional embodiment, the method further comprises:

[0015] Based on the device identifier, a key pair is generated;

[0016] Based on the key pair, a first public key is sent to the password device;

[0017] Receiving a second public key generated and sent by the password device based on the key pair;

[0018] Based on the first public key and the second public key, a first encryption key is generated; the first encryption key is used to encrypt the preset password to obtain the first encrypted password information.

[0019] In an optional embodiment, the method further comprises:

[0020] Obtaining the first encrypted password information; the first encrypted password information is stored in a storage module of the fingerprint accessory;

[0021] Based on the first encryption key, the first encrypted password information is decrypted to obtain second encrypted data;

[0022] encrypt the second encrypted data based on the first random number to obtain the first encrypted data.

[0023] In an optional embodiment, the sending the first encrypted data to the password device comprises:

[0024] obtaining current time information to generate timestamp information;

[0025] performing message authentication encryption on the timestamp information and the first encrypted data to obtain second encrypted data;

[0026] sending the first encrypted data, the second encrypted data and the timestamp information to the password device.

[0027] In an optional embodiment, the method further comprises:

[0028] In a first update scenario, decrypting the first encrypted password information based on the first encryption key to obtain second encrypted data;

[0029] generating and storing a second encryption key based on the first public key and the second public key;

[0030] encrypting the second encrypted data based on the second encryption key to obtain and store second encrypted password information.

[0031] In an optional embodiment, the method further comprises:

[0032] In a second update scenario, receiving the current device identifier and a second random number sent by the password device;

[0033] if the current device identifier indicates that the password device and the fingerprint accessory are successfully paired, verifying the current biometric information input by the user to obtain a biometric verification result;

[0034] if the biometric verification result indicates that biometric verification is passed, decrypting the first encrypted password information based on the first encryption key to obtain second encrypted data;

[0035] generating and storing a second encryption key based on the first public key and the second public key;

[0036] encrypting the second encrypted data based on the second encryption key to obtain and store second encrypted password information.

[0037] In a second aspect, the embodiments of the present application provide a method for converting password key password protection to biometric identification protection, applied to a password device, comprising:

[0038] In response to a password verification instruction input by a user, a first random number and a current device identifier are sent to the fingerprint accessory;

[0039] If the first encrypted data sent by the fingerprint accessory is received, the first encrypted data is decrypted based on a binding relationship between the password device and the fingerprint accessory to obtain second encrypted data; the first encrypted data is obtained by encrypting the preset password by the first random number; the preset password is stored in the fingerprint accessory and the password device after being encrypted respectively;

[0040] Based on the first encrypted data and the second encrypted data, a current random number is obtained.

[0041] In a case where the current random number and the first random number match, password verification is passed.

[0042] In a third aspect, an embodiment of the present application provides a device for converting password key password protection into biometric protection, applied to a fingerprint accessory, and comprising:

[0043] A first receiving module is configured to receive a first random number and a current device identifier sent by a password device.

[0044] A first verification module is configured to verify current biometric information input by a user to obtain a biometric verification result in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired.

[0045] A first encryption module is configured to encrypt a preset password based on the first random number to obtain first encrypted data in a case where the biometric verification result indicates that biometric verification is passed; the preset password is stored in the fingerprint accessory and the password device after being encrypted respectively.

[0046] A first sending module is configured to send the first encrypted data to the password device; the first encrypted data is used for password verification by the password device.

[0047] In a fourth aspect, an embodiment of the present application provides a device for converting password key password protection into biometric protection, applied to a password device, and comprising:

[0048] A second sending module is configured to send a first random number and a current device identifier to a fingerprint accessory in response to a password verification instruction input by a user.

[0049] A first decryption module is configured to decrypt first encrypted data sent by the fingerprint accessory based on a binding relationship between the password device and the fingerprint accessory to obtain second encrypted data in a case where the first encrypted data is received; the first encrypted data is obtained by encrypting the preset password by the first random number; the preset password is stored in the fingerprint accessory and the password device after being encrypted respectively.

[0050] a second decryption module, configured to obtain a current random number based on the first encrypted data and the second encrypted data;

[0051] a password verification module, configured to pass the password verification in a case where the current random number and the first random number match.

[0052] In a fifth aspect, an embodiment of the present application provides an electronic device, which comprises a processor and a memory. The memory stores at least one instruction, at least one program, a code set or an instruction set. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method for converting password key password protection into biometric protection.

[0053] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, which stores at least one instruction or at least one program. The at least one instruction or the at least one program is loaded and executed by a processor to implement the method for converting password key password protection into biometric protection.

[0054] In a seventh aspect, an embodiment of the present application provides a computer program product or a computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium. The processor executes the computer instructions, so that the computer device executes the method for converting password key password protection into biometric protection.

[0055] The method, the device and the equipment for converting password key password protection into biometric protection provided by the embodiments of the present application have the following technical effects:

[0056] receive a first random number and a current device identifier sent by the password device; in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired, verify current biometric information input by a user to obtain a biometric verification result; if the biometric verification result indicates that biometric verification is passed, encrypt a preset password based on the first random number to obtain first encrypted data; the preset password is stored in the fingerprint accessory and the password device after being encrypted; send the first encrypted data to the password device; the first encrypted data is used for password verification by the password device; by encrypting and storing the preset password in the fingerprint accessory based on double verification of pairing verification and biometric verification, secure access of the encrypted preset password is realized, information isolation and physical isolation of the preset password and the password device are realized, and finally a separate security architecture composed of the fingerprint accessory and the password device is constructed for password protection and authentication, fingerprint collection and verification are completed by independent accessories, and the password device only stores an encryption key, so that the password device is prevented from being attacked and compromised, and security and stability are effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, and the advantages thereof, a brief introduction will be given to the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0058] Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application;

[0059] Figure 2 is a flowchart of a method for converting password key password protection to biometric protection provided by an embodiment of the present application Figure One ;

[0060] Figure 3 is a flowchart of a method for converting password key password protection to biometric protection provided by an embodiment of the present application Figure Two ;

[0061] Figure 4 is a flowchart of a method for binding a fingerprint accessory and a password device provided by an embodiment of the present application;

[0062] Figure 5 is a flowchart of a method for converting password key password protection to biometric protection provided by an embodiment of the present application Figure Three ;

[0063] Figure 6is a flowchart of a key update method provided by an embodiment of the present application Figure One ;

[0064] Figure 7 is a flowchart of a key update method provided by an embodiment of the present application Figure Two ;

[0065] Figure 8 is a structural diagram of a device for converting password key password protection to biometric protection provided by an embodiment of the present application Figure One ;

[0066] Figure 9 is a structural diagram of a device for converting password key password protection to biometric protection provided by an embodiment of the present application Figure Two ;

[0067] Figure 10 is a hardware structure block diagram of a server for a method of converting password key password protection to biometric protection provided by an embodiment of the present application. DETAILED DESCRIPTION

[0068] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0069] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or server including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product, or device.

[0070] Please refer to Figure 1 , Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application, including a password device 101 and a fingerprint accessory 102. The password device 101 and the fingerprint accessory 102 can be connected in communication through a wired or wireless manner.

[0071] In a possible embodiment, the password device 101 is used to verify password information, and contains an operation chip that can complete various encryption and decryption operations, generate a public key / private key pair, and the like, and has a secure storage chip that can store various public key / private key pairs and encrypted information, and has a hardware random number generator.

[0072] In a possible embodiment, the fingerprint accessory 102 is used to independently collect and verify biometric information of a user, taking fingerprint information as an example.

[0073] Specifically, the fingerprint accessory can be a U-shield, a fingerprint password key (fingerprint USBKey), or the like, and contains an operation chip that can complete various encryption and decryption operations, generate a public key / private key pair, and the like, and has a secure storage chip that can store various public key / private key pairs and encrypted information, and the private key can only participate in operations in the USBKEY and cannot be read out. The fingerprint accessory has functions of fingerprint collection and fingerprint comparison.

[0074] It should be particularly emphasized that, in the present application, only the verification of fingerprints by the fingerprint accessory is taken as an example, and in other possible embodiments, the independent accessory for verifying other biometric information, such as iris and palm print accessories, can also be used, and the accessory can also be integrated in wearable devices and implantable biological chips, but needs to be physically independent of the password device.

[0075] The following describes a specific embodiment of a method for converting password key password protection to biometric protection, Figure 2 is a flowchart of a method for converting password key password protection to biometric protection provided by an embodiment of the present application Figure One The present specification provides method operation steps such as embodiments or flowcharts, but more or fewer operation steps can be included based on conventional or non-inventive labor. The order of steps listed in the embodiments is only one of many execution orders, and does not represent the only execution order. In actual system or server product execution, the method order shown in the embodiments or the drawings can be executed in sequence or in parallel (for example, in a parallel processor or multi-thread processing environment). Specifically, as shown in Figure 2 applied to the fingerprint accessory, the method comprises the following steps:

[0076] S201: receiving a first random number and a current device identifier sent by a password device.

[0077] S202: verifying current biometric information input by a user to obtain a biometric verification result, in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired.

[0078] S203: If the biometric verification result indicates that the biometric verification is passed, encrypt a preset password based on the first random number to obtain first encrypted data; the encrypted preset password is stored in the fingerprint accessory and the password device respectively.

[0079] S204: Send the first encrypted data to the password device; the first encrypted data is used for password verification by the password device.

[0080] Figure 3 is a flowchart of a method for converting biometric identification protection to password key password protection provided by an embodiment of the present application Figure 2 As shown in Figure 3 applied to a password device, comprising:

[0081] S205: In response to a password verification instruction input by a user, send a first random number and a current device identifier to a fingerprint accessory.

[0082] S206: If the first encrypted data sent by the fingerprint accessory is received, decrypt the first encrypted data based on the binding relationship between the password device and the fingerprint accessory to obtain second encrypted data; the first encrypted data is obtained by encrypting the preset password with the first random number; the encrypted preset password is stored in the fingerprint accessory and the password device respectively.

[0083] S207: Obtain a current random number based on the first encrypted data and the second encrypted data.

[0084] S208: If the current random number matches the first random number, the password verification is passed.

[0085] Figure 4 is a flowchart of a binding method for a fingerprint accessory and a password device provided by an embodiment of the present application, which can include:

[0086] S301: Receive and store the initial device identifier sent by the password device.

[0087] In a possible embodiment, the fingerprint accessory receives and stores the initial device identifier sent by the password device, and the fingerprint accessory stores the initial device identifier in the secure chip of the fingerprint accessory. Different password devices have different initial device identifiers, and the pairing binding is realized by storing the unique and tamper-proof initial device identifier in the storage module of the fingerprint accessory and the password device respectively. Before subsequent information interaction, the pairing binding relationship is verified, and a two-way authentication mechanism of the fingerprint accessory and the password device is constructed, effectively improving the security.

[0088] S302: Receive and store the initial biometric information input by the user.

[0089] After the initial device identifier is stored by the fingerprint accessory, a prompt instruction can be sent to the user to prompt the user to input initial biometric information, i.e., the user inputs his / her own fingerprint information.

[0090] In the embodiments of the present application, the fingerprint accessory collects the fingerprint input by the user through the fingerprint collection device, extracts feature points from the fingerprint, generates an encrypted fingerprint template, and stores the encrypted fingerprint template in the secure chip of the fingerprint accessory.

[0091] S303: Establish a binding relationship with the password device based on the initial device identifier.

[0092] In a possible embodiment, establishing a binding relationship with the password device based on the initial device identifier includes:

[0093] S3031: Generating a key pair based on the initial device identifier.

[0094] S3032: Sending a first public key to the password device based on the key pair.

[0095] S3033: Receiving a second public key generated and sent by the password device based on the key pair.

[0096] S3034: Generating a first encryption key based on the first public key and the second public key.

[0097] In the embodiments of the present application, the first encryption key is used to encrypt the preset password to obtain the first encrypted password information.

[0098] In the embodiments of the present application, the first encryption key K1 is a first session key.

[0099] In a possible embodiment, the fingerprint accessory generates an SM2 key pair including a first private key and a first public key generated based on the first private key, sends the first public key of the key pair to the password device, and stores the first private key in a secure storage area. The fingerprint accessory obtains the first encryption key K1 based on the product of the first private key and the second public key sent by the password device.

[0100] Correspondingly, the password device generates an SM2 key pair including a second private key and a second public key, sends the second public key of the key pair to the fingerprint accessory, and stores the second private key in a secure storage area. The password device obtains the first encryption key K1 equal to the fingerprint accessory based on the product of the second private key and the first public key sent by the fingerprint accessory.

[0101] SM2 is an elliptic curve public key cryptography algorithm standard, the full name of which is SM2 Elliptic Curve Public Key Cryptography Algorithm. It is a self-designed cryptographic algorithm in China and belongs to the category of elliptic curve cryptography (ECC). It aims to provide efficient and secure asymmetric encryption and digital signature capabilities. Due to the characteristics of SM2, the fingerprint accessory and the password device can obtain an equal first encryption key K1.

[0102] In the embodiment of the present application, the first encrypted password information is obtained by encrypting the preset password based on the binding relationship.

[0103] In the embodiment of the present application, the first encrypted password information is obtained by encrypting the preset password based on the binding relationship.

[0104] In the embodiment of the present application, before the fingerprint accessory receives the first encrypted password information sent by the password device, the user first inputs the preset password P to the fingerprint accessory. The preset password is a fixed credential pre-configured in the existing identity authentication system. Optionally, the preset password can be a username and a user password. The preset password P can also be encrypted and sent by the password device, but directly inputting the fingerprint accessory has stronger security and avoids leakage in the information transmission process.

[0105] In one possible embodiment, after receiving the preset password P, the fingerprint accessory calculates the SM3 hash value PH of the preset password P of the user through the SM3 algorithm. The format is usually a 64-bit hexadecimal string.

[0106] SM3 is a cryptographic hash algorithm, the full name of which is SM3 Cryptographic Hash Algorithm. It is a self-designed cryptographic standard in China and belongs to the family of hash functions. It is used to generate a fixed-length message digest to ensure data integrity and authenticity.

[0107] In one possible embodiment, after obtaining the hash value PH, the fingerprint accessory uses the first encryption key K1 to perform SM4 encryption on the SM3 hash value PH of the preset password P to obtain the first encrypted password information PH(K1), and stores PH(K1) in the secure chip of the fingerprint accessory.

[0108] SM4 is a block symmetric encryption algorithm, the full name of which is SM4 Block Cipher Algorithm. It is a self-designed cryptographic standard in China and is used for data encryption and decryption. It is suitable for high-security scenarios such as wireless local area networks, mobile communications, and the Internet of Things.

[0109] Through the above steps, the two-way binding of the fingerprint accessory and the password device is completed, and after the binding, the fingerprint accessory can verify the legitimacy of the password device, and the password device can reversely verify the authenticity of the fingerprint accessory.

[0110] Figure 5 is a flowchart of a method for converting password key protection to biometric protection provided by an embodiment of the present application Figure Three , which can include:

[0111] S401: receiving a first random number and a current device identifier sent by a password device.

[0112] In password verification, the password device generates a first random number in response to a trigger operation of a user, and acquires a stored current device identifier, and sends the first random number and the current device identifier to the fingerprint accessory.

[0113] S402: determining whether the fingerprint accessory and the password device are successfully paired, if yes, performing S404; if not, performing S403.

[0114] S403: returning first failure information to the password device.

[0115] S404: receiving current biometric information input by a user.

[0116] Optionally, the fingerprint accessory obtains a binding verification result based on the received current device identifier and the stored initial device identifier, specifically, if the received current device identifier is the same as the stored initial device identifier, it is considered that the fingerprint accessory and the password device are successfully paired; if the received current device identifier is not the same as the stored initial device identifier, it is considered that the fingerprint accessory and the password device are failed to pair.

[0117] In an embodiment of the present application, the first failure information is used to indicate that the fingerprint accessory and the password device are failed to pair.

[0118] In a possible embodiment, after successful pairing, a pairing success prompt and a fingerprint input instruction can also be sent, which are used to prompt the user to input the fingerprint.

[0119] S405: determining whether biometric verification is successful based on the current biometric information, if yes, performing S404; if not, performing S406.

[0120] S406: returning second failure information to the password device.

[0121] S407: encrypting a preset password based on the first random number to obtain first encrypted data.

[0122] In a possible embodiment, the preset password is stored in the fingerprint accessory and the password device after encryption respectively. Specifically, an encrypted password information PH(K1) is decrypted by using an encryption key K1 to obtain a hash value PH of the preset password, and the hash value PH of the preset password is encrypted by using a first random number R to obtain first encrypted data PH(R).

[0123] In the embodiment of the application, the fingerprint accessory performs fingerprint verification on the initial biometric information saved in the fingerprint accessory and the current biometric information input by the user, to obtain a biometric verification result. Specifically, if the input current biometric information is the same as the stored initial biometric information, the biometric verification is considered to be successful; if the input current biometric information is not the same as the stored initial biometric information, the biometric verification is considered to be failed.

[0124] In the embodiment of the application, the second failure information is used to indicate the fingerprint verification failure.

[0125] In an optional embodiment, if the password device receives the first failure information or the second failure information for a preset number of times, the password device can know that the password binding fails or the fingerprint verification fails for multiple times, and the key needs to be updated or the fingerprint needs to be updated.

[0126] S408: sending the first encrypted data to the password device. The first encrypted data is used for password verification by the password device.

[0127] In an optional embodiment, sending the first encrypted data to the password device comprises:

[0128] S4081: obtaining current time information to generate timestamp information.

[0129] S4082: performing message authentication encryption on the timestamp information and the first encrypted data to obtain second encrypted data.

[0130] S4083: sending the first encrypted data, the second encrypted data and the timestamp information to the password device.

[0131] S409: verifying data integrity and timestamp. If the verification is passed, S411 is executed; if the verification is not passed, S410 is executed.

[0132] S410: issuing third failure information.

[0133] In an optional embodiment, the third failure information is used to indicate that the data is incomplete or the authentication is timed out.

[0134] S411: calculating an SM3 hash value of the preset password in the password device.

[0135] In the case of data integrity and timestamp verification, the SM3 hash value PHi of the preset password Pi in the password device is calculated.

[0136] S412: The first encrypted data is decrypted based on the binding relationship between the password device and the fingerprint accessory, to obtain second encrypted data.

[0137] S413: The current random number is obtained based on the first encrypted data and the second encrypted data.

[0138] In the embodiment of the application, the SM3 hash value PHi of the preset password Pi in the password device is used as a decryption key to decrypt the first encrypted data PH(R) to obtain the current random number R1.

[0139] S414: It is judged whether the current random number is the same as the first random number, if yes, S415 is executed; if not, S416 is executed.

[0140] S415: The password authentication is passed.

[0141] S416: The password authentication is not passed.

[0142] Figure 6 is a flowchart of a key updating method provided by the embodiment of the application Figure One The method can include:

[0143] S501: In the first updating scenario, the first encrypted password information is decrypted based on the first encryption key to obtain second encrypted data.

[0144] In a possible embodiment, the first updating scenario can be that the password is successfully authenticated for a preset number of times.

[0145] S502: The first encrypted password information is decrypted based on the first encryption key to obtain the second encrypted data.

[0146] S503: A second encryption key is generated and stored based on the first public key and the second public key.

[0147] S504: The second encrypted data is encrypted based on the second encryption key to obtain and store second encrypted password information.

[0148] After successful authentication for N times, the fingerprint accessory decrypts the first encrypted password information PHi(K1) using the current first encryption key K1 to obtain the user password SM3 hash value PHi.

[0149] The fingerprint accessory and the password device generate a new second encryption key K2 through an SM2 key exchange protocol and save the second encryption key K2 to the fingerprint accessory. The fingerprint accessory encrypts PHi using the new second encryption key K2 to obtain new PHi(K2) and stores the PHi(K2).

[0150] By the above steps, potential attacks such as key cracking, replay attacks, etc. caused by long-term use of the same session key can be effectively prevented.

[0151] Figure 7 is a flowchart of a key updating method provided by an embodiment of the present application Figure Two The method can include:

[0152] S601: In a second updating scenario, receiving the current device identifier and a second random number sent by the password device.

[0153] In a possible embodiment, the second updating scenario can be a user password modification scenario or an abnormal problem scenario.

[0154] S602: Determine whether the password device and the fingerprint accessory are successfully paired. If yes, S604 is executed; if not, S603 is executed.

[0155] In the case where the current device identifier indicates that the password device and the fingerprint accessory are successfully paired, the current biometric information input by the user is verified to obtain the biometric verification result.

[0156] S603: Send fourth failure information to the password device.

[0157] S604: Receive the current biometric information input by the user.

[0158] S605: Determine whether the biometric verification is passed. If yes, S607 is executed; if not, S606 is executed.

[0159] S606: Send fifth failure information to the password device.

[0160] S607: Decrypt the first encrypted password information based on the first encryption key to obtain second encrypted data.

[0161] S608: Generate and store a second encryption key based on the first public key and the second public key.

[0162] S609: Encrypt the second encrypted data based on the second encryption key to obtain and store second encrypted password information.

[0163] When the user modifies the password or detects an abnormality, the password device operation can be triggered, the password device reads the current device identifier and generates a second random number R2, and sends it to the fingerprint accessory.

[0164] The fingerprint accessory compares the initial device identifier of the password device to which the fingerprint accessory is bound, and after the comparison is consistent, the fingerprint verification is started, and the user is prompted to input the fingerprint. The fingerprint accessory compares the user input fingerprint with the fingerprint information stored in the fingerprint accessory to perform fingerprint verification.

[0165] After the fingerprint verification is passed, the fingerprint accessory decrypts PH1(K1) using the current first encryption key K1 to obtain the user preset password SM3 hash value PH1.

[0166] The fingerprint accessory and the password device generate a new second encryption key K2 through an SM2 key exchange protocol and save the new second encryption key K2 to the fingerprint accessory. The fingerprint accessory encrypts PH1 using the new second encryption key K2 to obtain a new PH1(K2) and stores the new PH1(K2).

[0167] Through the above steps, the dynamic key update and the biometric feature binding after the binding verification and the biometric verification are performed when the user actively modifies the password and the system detects abnormal behavior (such as multiple authentication failures, device intrusion attempts), to ensure the security of the password modification or abnormal recovery process.

[0168] The application also provides a device for converting password key password protection to biometric protection, Figure 8 The device for converting password key password protection to biometric protection provided by the application is shown in the structure diagram Figure One As shown in Figure 8 The device 700 is applied to a fingerprint accessory and includes the following components.

[0169] The first receiving module 701 is configured to receive a first random number and a current device identifier sent by a password device.

[0170] The first verification module 702 is configured to verify current biometric feature information input by a user to obtain a biometric feature verification result in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired.

[0171] The first encryption module 703 is configured to encrypt a preset password based on the first random number to obtain first encrypted data in a case where the biometric feature verification result indicates that the biometric feature verification is passed; and the preset password is stored in the fingerprint accessory and the password device respectively after being encrypted.

[0172] The first sending module 704 is configured to send the first encrypted data to the password device; and the first encrypted data is used for password verification by the password device.

[0173] In an optional embodiment, the device further includes the following components.

[0174] The second receiving module is configured to receive and store an initial device identifier sent by the password device.

[0175] The third receiving module is configured to receive and store the initial biometric information input by the user.

[0176] The binding module is configured to establish a binding relationship with the password device based on the initial device identifier.

[0177] The third receiving module is configured to encrypt the preset password based on the binding relationship to obtain first encrypted password information.

[0178] In an optional implementation, the binding module is further configured to generate a key pair based on the device identifier, send a first public key to the password device based on the key pair, receive a second public key generated and sent by the password device based on the key pair, generate a first encryption key based on the first public key and the second public key, and use the first encryption key to encrypt the preset password to obtain the first encrypted password information.

[0179] In an optional implementation, the first encryption module is further configured to obtain the first encrypted password information, store the first encrypted password information in a storage module of the fingerprint accessory, decrypt the first encrypted password information based on the first encryption key to obtain second encrypted data, and encrypt the second encrypted data based on the first random number to obtain the first encrypted data.

[0180] In an optional implementation, the first sending module is further configured to obtain current time information to generate time stamp information, perform message authentication encryption on the time stamp information and the first encrypted data to obtain second encrypted data, and send the first encrypted data, the second encrypted data, and the time stamp information to the password device.

[0181] In an optional implementation, the method further includes:

[0182] The third decryption module is configured to, in a first updating scenario, decrypt the first encrypted password information based on the first encryption key to obtain second encrypted data.

[0183] The first key generation module is configured to generate and store a second encryption key based on the first public key and the second public key.

[0184] The second encryption module is configured to encrypt the second encrypted data based on the second encryption key to obtain and store the first encrypted password information.

[0185] In an optional implementation, the method further includes:

[0186] The fourth receiving module is configured to, in a second updating scenario, receive the current device identifier and a second random number sent by the password device.

[0187] The verification module is configured to verify the current biometric information input by the user to obtain a biometric verification result in a case where the current device identifier indicates that the password device and the fingerprint accessory are successfully paired.

[0188] The fourth decryption module is configured to decrypt the first encrypted password information based on the first encryption key to obtain second encrypted data in a case where the biometric verification result indicates that biometric verification is passed.

[0189] The second key generation module is configured to generate and store a second encryption key based on the first public key and the second public key.

[0190] The third encryption module is configured to encrypt the second encrypted data based on the second encryption key to obtain and store the second encrypted password information.

[0191] The present application also provides a device for converting password key password protection into biometric protection, Figure 9 is a structural diagram of a device for converting password key password protection into biometric protection provided by the present application. Figure Two As shown in Figure 9 applied to a password device, the device 800 comprises:

[0192] The second sending module 801 is configured to send a first random number and a current device identifier to a fingerprint accessory in response to a password verification instruction input by a user.

[0193] The first decryption module 802 is configured to decrypt the first encrypted data based on a binding relationship between the password device and the fingerprint accessory to obtain second encrypted data in a case where the first encrypted data sent by the fingerprint accessory is received; the first encrypted data is obtained by encrypting the preset password by the first random number; and the preset password is stored in the fingerprint accessory and the password device after being encrypted, respectively.

[0194] The second decryption module 803 is configured to obtain a current random number based on the first encrypted data and the second encrypted data.

[0195] The password verification module 804 is configured to pass password verification in a case where the current random number and the first random number match.

[0196] The device and method embodiments in the present application are based on the same application concept.

[0197] The method embodiments provided by the present application can be executed in a computer terminal, a server or a similar computing device. Taking the case where the method is run on a server as an example, Figure 10 is a hardware structure block diagram of a server for a method for converting password key password protection into biometric protection provided by the present application. As shown inFigure 10 As shown, the server 900 can vary significantly due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 910 (CPUs 910 may include, but are not limited to, microprocessors such as MCUs or programmable logic devices such as FPGAs), a memory 930 for storing data, and one or more storage media 920 (e.g., one or more mass storage devices) for storing application programs 923 or data 922. The memory 930 and storage media 920 may be temporary or persistent storage. The program stored in the storage media 920 may include one or more modules, each module may include a series of instruction operations on the server. Furthermore, the CPU 910 may be configured to communicate with the storage media 920 and execute the series of instruction operations in the storage media 920 on the server 900. Server 900 may also include one or more power supplies 960, one or more wired and wireless network interfaces 950, one or more input / output interfaces 940, and / or one or more operating systems 921, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0198] The input / output interface 940 can be used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of server 900. In one example, the input / output interface 940 includes a network interface controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the input / output interface 940 may be a radio frequency (RF) module used for wireless communication with the Internet.

[0199] Those skilled in the art will understand that Figure 10 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, server 900 may also include... Figure 10 The more or fewer components shown, or having the same Figure 10 The different configurations shown.

[0200] This application provides an electronic device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The processor loads and executes the at least one instruction, at least one program, code set, or instruction set to implement the above-described data processing method.

[0201] The embodiment of the present application also provides a computer readable storage medium, which can be arranged in a server to store at least one instruction, at least one program, a code set or an instruction set related to a method for realizing the method embodiment of the password key password protection conversion biometric protection, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to realize the method of the password key password protection conversion biometric protection.

[0202] Optionally, in the embodiment, the storage medium can be located in at least one of a plurality of network servers of a computer network. Optionally, in the embodiment, the storage medium can include but is not limited to a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk and various storage program code media.

[0203] According to the above embodiments of the method, device, electronic equipment or storage medium for the password key password protection conversion biometric protection provided by the present application, the first random number and the current device identifier sent by the password device are received; in the case that the current device identifier indicates that the fingerprint accessory and the password device are successfully paired, the current biometric information input by the user is verified to obtain a biometric verification result; if the biometric verification result indicates that the biometric verification is passed, the preset password is encrypted based on the first random number to obtain first encrypted data; the encrypted preset password is stored in the fingerprint accessory and the password device respectively; the first encrypted data is sent to the password device; the first encrypted data is used for password verification of the password device; by encrypting and storing the preset password in the fingerprint accessory, based on the double verification of the pairing verification and the biometric verification, the secure access of the encrypted preset password can be realized, the information isolation and the physical isolation of the preset password and the password device are realized, and finally a separate security architecture composed of the fingerprint accessory and the password device is constructed, password protection and authentication are performed, fingerprint collection and verification are completed by independent accessories, and the password device only stores the encryption key, so that the password device is prevented from being attacked and leaked, and the security and stability are effectively improved.

[0204] It should be noted that the above-mentioned order of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And the above describes the specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be executed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0205] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0206] A person of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by program instructing relevant hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0207] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of password key password protection converting biometric protection, characterized by, The application is applied to a fingerprint accessory and a password device, the fingerprint accessory is a device independent of the password device, and comprises: The preset password is encrypted into first encrypted password information and stored in the fingerprint accessory and the password device respectively; The password device sends a first random number and a current device identifier to the fingerprint accessory in response to a password verification instruction input by a user; The fingerprint accessory receives the first random number and the current device identifier sent by the password device; The fingerprint accessory verifies current biological feature information input by the user to obtain a biological feature verification result in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired; If the biological feature verification result indicates that the biological feature verification is passed, the fingerprint accessory encrypts the preset password based on the first random number to obtain first encrypted data; The fingerprint accessory sends the first encrypted data to the password device; the first encrypted data is used for password verification by the password device; The password device obtains a current random number based on the first encrypted data and the first encrypted password information; In a case where the current random number matches the first random number, password verification is passed.

2. The method for converting password protection to biometric protection according to claim 1, characterized in that, Before receiving the first random number and the device identifier sent by the password device, the method further comprises: receiving and storing an initial device identifier sent by the password device; receiving and storing initial biological feature information input by the user; establishing a binding relationship with the password device based on the initial device identifier; encrypting the preset password based on the binding relationship to obtain first encrypted password information.

3. The method for converting password protection to biometric protection according to claim 2, characterized in that, The method of establishing a binding relationship with the password device based on the initial device identifier comprises: generating a key pair based on the initial device identifier; sending a first public key to the password device based on the key pair; receiving a second public key generated and sent by the password device based on the key pair; generating a first encryption key based on the first public key and the second public key; the first encryption key is used to encrypt the preset password to obtain the first encrypted password information.

4. The method for converting password protection to biometric protection according to claim 3, characterized in that, The method of encrypting the preset password based on the first random number to obtain first encrypted data comprises: obtaining the first encrypted password information; the first encrypted password information is stored in a storage module of the fingerprint accessory; decrypting the first encrypted password information based on the first encryption key to obtain a preset password; encrypting the preset password based on the first random number to obtain the first encrypted data.

5. The method of claim 3, wherein the password key password conversion biometric protection is converted into a password key password protection. The method further comprises: ​ in a first update scenario, decrypting the first encrypted password information based on the first encryption key to obtain a preset password; generating and storing a second encryption key based on the first public key and the second public key; encrypting the preset password based on the second encryption key to obtain and store second encrypted password information.

6. The method of claim 3, wherein the password key password conversion biometric protection is converted into a password key password protection. The method further comprises: ​ in a second update scenario, receiving the current device identifier and a second random number sent by the password device; verifying the current biological feature information input by the user to obtain the biological feature verification result in a case where the current device identifier indicates that the password device and the fingerprint accessory are successfully paired; If the biometric verification result indicates that the biometric verification is passed, the first encrypted password information is decrypted based on the first encryption key to obtain a preset password; A second encryption key is generated and stored based on the first public key and the second public key; The preset password is encrypted based on the second encryption key to obtain and store second encrypted password information.

7. An apparatus for password key password protection conversion biometric protection, characterized by, The application is applied to a fingerprint accessory and a password device, and the fingerprint accessory is a device independent of the password device, comprising: The preset password is encrypted as first encrypted password information and stored in the fingerprint accessory and the password device respectively; The second sending module is configured to send, to the fingerprint accessory, a first random number and a current device identifier in response to a password verification instruction input by a user; The first receiving module is configured to receive the first random number and the current device identifier sent by the password device; The first verification module is configured to verify current biometric information input by the user to obtain a biometric verification result in a case where the current device identifier indicates that the fingerprint accessory and the password device are successfully paired; The first encryption module is configured to encrypt, if the biometric verification result indicates that the biometric verification is passed, the preset password based on the first random number to obtain first encrypted data; The first sending module is configured to send, to the password device, the first encrypted data, and the first encrypted data is used for password verification by the password device; The second decryption module is configured to obtain a current random number based on the first encrypted data and the first encrypted password information by the password device; The password verification module is configured to pass the password verification in a case where the current random number matches the first random number.

8. An electronic device, comprising: The electronic device comprises a processor and a memory, and the memory stores at least one instruction, at least one program, a code set or an instruction set The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method for converting the password key password protection into the biometric identification protection. The computer readable storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for converting the password key password protection into the biometric identification protection.

9. A computer-readable storage medium, characterized in that, ​

Images