Binding authentication method and device and medium

Abstract

The invention provides a binding authentication method, equipment and a medium, which are applied to the technical field of equipment authentication. The binding authentication method comprises the following steps: receiving a first verification value sent by a fingerprint module; generating a second verification value according to the hardware information of the current mainboard and the corresponding dynamic salt value; if the first verification value is the same as the second verification value, sending a random array to the fingerprint module, so that the fingerprint module performs private key signature on the random array; obtaining signature information obtained after the fingerprint module performs private key signature on the random number group, and analyzing the signature information to obtain an analysis result; and if the analysis result accords with the dynamic verification standard, controlling the fingerprint module to enter a fingerprint working mode. Therefore, an authentication mechanism of hybrid binding of the hardware information and the dynamic salt value is adopted, and hardware binding of the fingerprint module and the host is ensured; and the uniqueness and the use safety of the fingerprint module are ensured through dual protection of static authentication of the verification value and dynamic authentication of the random array.

Description

Technical Field

[0001] This invention relates to the field of device authentication technology, and in particular to a binding authentication method, device and medium. Background Technology

[0002] With the deepening of informatization, information security has entered a new network era. Security issues have become a common challenge facing humanity in the information age, and ensuring data security and business continuity has become the primary objectives of information security. In the computer field, the BIOS (Basic Input Output System) is a set of programs embedded in a read-only memory (ROM) chip on the computer motherboard. It is the first software program loaded when the computer boots up, and also serves as the hub connecting the software program and hardware devices. It is mainly responsible for hardware initialization and settings, such as power-on self-test and loading the operating system. Therefore, the BIOS is crucial to the entire computer system; malicious damage to it can directly lead to the paralysis of the entire hardware system.

[0003] Currently, many domestically produced desktop computers support fingerprint authentication in their BIOS as a security measure for booting. However, due to the limited computing power of the BIOS, it cannot fully realize the entire process of fingerprint acquisition and calculation. Therefore, currently, fingerprint acquisition, processing, and matching are mostly completed by an external fingerprint recognition module. The calculation result is then returned to the BIOS, which provides the final interactive operation. However, in this design, the same model of product can bypass BIOS fingerprint verification by replacing the external fingerprint module, thus posing a risk of BIOS data leakage.

[0004] Therefore, finding a way to prevent bypassing BIOS fingerprint verification by replacing an external fingerprint module is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a binding authentication method, device, and medium that can solve the problem that in the prior art, fingerprint authentication is used as a security boot setting, but the same model of product can bypass BIOS fingerprint verification by replacing the external fingerprint module, thus posing a risk of BIOS data leakage.

[0006] To address the aforementioned technical problems, embodiments of the present invention provide a binding authentication method, comprising:

[0007] Receive the first verification value sent by the fingerprint module, wherein the first verification value is generated based on the hardware information of the motherboard where the binding stage is located and the corresponding dynamic salt value;

[0008] A second verification value is generated based on the hardware information of the current motherboard and the corresponding dynamic salt value;

[0009] If the first verification value and the second verification value are the same, a random array is sent to the fingerprint module so that the fingerprint module can sign the random array with its private key.

[0010] Obtain the signature information obtained by the fingerprint module after signing the random array with a private key, and parse the signature information to obtain the parsing result;

[0011] If the analysis result meets the dynamic verification standard, the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information.

[0012] In some embodiments, a second verification value is generated based on the hardware information of the current motherboard and the corresponding dynamic salt value, including:

[0013] Get the hardware information of the current motherboard;

[0014] A dynamic salt value is randomly generated based on a preset storage encryption key;

[0015] A secure hash algorithm is used to concatenate the hardware information of the current motherboard and the corresponding dynamic salt value to obtain the second verification value.

[0016] In some embodiments, it also includes:

[0017] If the first verification value and the second verification value are different, then obtain the hardware information of the motherboard where the binding stage corresponding to the first verification value sent by the fingerprint module is located.

[0018] Determine whether the various parameters in the hardware information of the motherboard during the binding phase are the same as those in the current motherboard.

[0019] If any of the parameters are different, a random array is sent to the fingerprint module after receiving the remote authorization signal;

[0020] If all parameters are the same, a security log indicating an abnormal binding connection will be generated.

[0021] In some embodiments, the signature information obtained by the fingerprint module after signing the random array with a private key is acquired, and the signature information is parsed to obtain the parsing result, including:

[0022] Obtain the signature information obtained by the fingerprint module after signing the random array with a private key;

[0023] The fingerprint acquisition module performs private key signing on the random array using the corresponding private key signing method.

[0024] Determine the signature decryption method corresponding to the private key signing method;

[0025] The signature information is parsed based on the signature decryption method to obtain the parsing result.

[0026] In some embodiments, if the parsing result meets the dynamic verification standard, the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information, including:

[0027] Obtain the parsing time and parsing data corresponding to the parsing results;

[0028] If the parsing time is less than the preset valid time and the parsed data is equal to a random array, the parsing result meets the dynamic verification standard, and the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information.

[0029] In some embodiments, it also includes:

[0030] If the parsing time exceeds the preset valid time or the parsed data is not equal to the random array, the parsing result does not meet the dynamic verification standard, and the fingerprint module is controlled to enter the protection mode.

[0031] In some embodiments, after the first verification value and the second verification value are the same, the method further includes:

[0032] A first physical unclonable response is generated based on the first challenge signal and sent to the fingerprint module. The first challenge signal is generated on the motherboard during the bonding phase.

[0033] A corresponding second physical unclonable response is generated based on the second challenge signal sent by the fingerprint module and sent to the fingerprint module so that the fingerprint module can compare the first physical unclonable response and the second physical unclonable response. The first challenge signal and the second challenge signal are the same.

[0034] The comparison results after the fingerprint receiving module compares the first physical non-cloning response and the second physical non-cloning response;

[0035] If the bit matching degree of the comparison case representing the first physical non-clonable response and the second physical non-clonable response reaches the preset fault tolerance threshold, then a random array is sent to the fingerprint module.

[0036] If the bit matching degree of the comparison situation representing the first physical unclonable response and the second physical unclonable response does not reach the preset fault tolerance threshold, a security log representing the binding connection abnormality is generated.

[0037] In some embodiments, after obtaining fingerprint information, the method further includes:

[0038] Determine whether the acquired fingerprint information is the same as the preset security fingerprint information;

[0039] If the fingerprint information is the same as the preset security fingerprint information, the system will enter the operating mode.

[0040] If the fingerprint information is different from the preset security fingerprint information, the entered password information is retrieved;

[0041] If the password authentication is successful, the system will enter the operating mode.

[0042] If password authentication fails, a security log representing a communication attack is generated.

[0043] On the other hand, the present invention also provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to implement the above-described binding authentication method when executing a computer program.

[0046] On the other hand, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the binding authentication method described above.

[0047] On the other hand, the present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the binding authentication method described above.

[0048] Therefore, this invention employs a hybrid binding authentication mechanism, which ensures hardware binding between the fingerprint module and the host through a combination of hardware information and dynamic salt values; and ensures the uniqueness of the fingerprint module and the security of its use through dual protection of static authentication of verification values ​​and dynamic authentication of random arrays. Attached Figure Description

[0049] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart of a binding authentication method provided in an embodiment of the present invention;

[0051] Figure 2 A complete flowchart of a binding authentication method provided in an embodiment of the present invention;

[0052] Figure 3 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0054] The terms "comprising" and "having," and any variations thereof, in the specification and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may include steps or units not listed.

[0055] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0056] Next, we will describe in detail the binding authentication method, device and medium provided by the embodiments of the present invention.

[0057] Figure 1 A flowchart of a binding authentication method provided in an embodiment of the present invention is shown below. Figure 1 As shown, the binding authentication method includes the following steps:

[0058] S10: Receive the first verification value sent by the fingerprint module, wherein the first verification value is generated based on the hardware information of the motherboard where the binding stage is located and the corresponding dynamic salt value.

[0059] S11: Generate a second verification value based on the hardware information of the current motherboard and the corresponding dynamic salt value.

[0060] In this embodiment, the binding authentication method provided by the present invention is specifically applied to an electronic device including a motherboard, BIOS, fingerprint module and computer. The BIOS and fingerprint module are integrated on the motherboard, while the computer includes other components such as memory, power supply, and graphics card to provide the required environment.

[0061] In current electronic devices, binding authentication between the BIOS and the fingerprint module requires binding the BIOS and the fingerprint module. In other words, the BIOS is bound to the corresponding fingerprint module after the electronic device is designed or before it is used. Then, when using the electronic device later, only binding authentication is required.

[0062] The initial binding process between the BIOS and the fingerprint module is as follows: Upon first boot, binding initialization is performed. After receiving the boot command, the BIOS collects the hardware information of the motherboard during the binding phase. This hardware information includes the Universally Unique Identifier (UUID), the Trusted Platform Module (TPM) public key, and the Media Access Control Address (MAC) of the onboard network card. Then, the BIOS calls the TPM module via a command to generate a 32-byte random number, which serves as its dynamic salt value and is stored in the TPM's storage area. Finally, a hybrid binding method is used, concatenating the hardware information and the dynamic salt value, calculating the first verification value using the SHA-256 algorithm, and returning this first verification value to the fingerprint module. The fingerprint module can interpret this first verification value as a binding credential. It should be noted that during the binding phase, in addition to sending the first verification value to the fingerprint module, the BIOS also sends the dynamic salt value to the fingerprint module for encrypted storage.

[0063] When the electronic device is started and used subsequently, a new binding credential, or second verification value, needs to be generated based on the hardware information of the current motherboard and the corresponding dynamic salt value. The calculation method for the second verification value is the same as that for the first verification value. If the electronic device remains intact, meaning that no components have been replaced in the current electronic device compared to the electronic device during the binding phase, it can be determined that the hardware information of the motherboard during the binding phase is the same as that of the current motherboard, and its corresponding dynamic salt value is also the same. Therefore, its first and second verification values ​​are the same. If modules or components in the electronic device have been replaced, it can be determined that the hardware information of the motherboard during the binding phase is different from that of the current motherboard, but the corresponding dynamic salt value is the same. Therefore, its first and second verification values ​​are different. Based on the above principle, the first and second verification values ​​can be used to determine whether a module replacement has occurred in the electronic device.

[0064] S12: If the first verification value and the second verification value are the same, a random array is sent to the fingerprint module so that the fingerprint module can sign the random array with its private key.

[0065] In this embodiment, if the first verification value and the second verification value are the same, it means that no replacement has been made to the components in the current electronic device and the electronic device in the binding stage. In other words, the BIOS and the fingerprint module are bound together, and the static binding authentication in the hardware stage ends here.

[0066] After confirming that the current fingerprint module is bound to the BIOS, the BIOS sends another random array to the fingerprint module for dynamic authentication. Upon receiving the random array, the fingerprint module signs it with its private key, essentially encrypting it.

[0067] S13: Obtain the signature information obtained by the fingerprint module after signing the random array with the private key, and parse the signature information to obtain the parsing result.

[0068] S14: If the parsing result meets the dynamic verification standard, control the fingerprint module to enter the fingerprint working mode to obtain fingerprint information.

[0069] In this embodiment, after the BIOS receives the signature information (which can be understood as encrypted random data) obtained by the fingerprint module signing the random array with a private key, it needs to parse it. If the result meets the dynamic verification standard, it means that both dynamic authentication and static authentication are successful and the current fingerprint module is secure. Therefore, the BIOS controls the fingerprint module to enter the fingerprint working mode to obtain fingerprint information.

[0070] It should be noted that the parsing of the signature information to obtain the parsing result is relative to the encryption method of the fingerprint module's private key signing of the random array. It can be understood that if the random array is signed with a private key using encryption method A, then the signature information needs to be parsed using decryption method A.

[0071] It should also be noted that whether the parsing result meets the dynamic verification standard can be determined by whether the parsing result includes data that is the same as the random array. That is, if the parsing result includes data that is the same as the random array, the parsing result meets the dynamic verification standard; if the parsing result does not include data that is the same as the random array, the parsing result does not meet the dynamic verification standard.

[0072] As can be seen from the above technical solution, the present invention provides a binding authentication method, comprising: receiving a first verification value sent by a fingerprint module, wherein the first verification value is generated based on the hardware information of the motherboard where the binding stage is located and the corresponding dynamic salt value; generating a second verification value based on the hardware information of the current motherboard and the corresponding dynamic salt value; if the first verification value and the second verification value are the same, sending a random array to the fingerprint module so that the fingerprint module can sign the random array with its private key; obtaining the signature information obtained after the fingerprint module signs the random array with its private key, and parsing the signature information to obtain a parsing result; if the parsing result meets the dynamic verification standard, controlling the fingerprint module to enter the fingerprint working mode to obtain fingerprint information. Thus, the present invention adopts a hybrid binding authentication mechanism, ensuring hardware binding between the fingerprint module and the host through the combination of hardware information and dynamic salt value; and ensuring the uniqueness and security of the fingerprint module through the dual protection of static authentication of the verification value and dynamic authentication of the random array.

[0073] The specific implementation of step S11 above, which generates the second verification value based on the hardware information of the current motherboard and the corresponding dynamic salt value, is as follows: obtain the hardware information of the current motherboard; randomly generate the corresponding dynamic salt value based on the preset storage encryption key; and use a secure hash algorithm to concatenate the hardware information of the current motherboard and the corresponding dynamic salt value to obtain the second verification value.

[0074] In a specific embodiment, the BIOS collects the hardware information of the current motherboard, including the Universally Unique Identifier (UUID), the Trusted Platform Module (TPM) public key, and the Media Access Control Address (MAC) of the onboard network card. Then, it calls the TPM module via command, uses the TPM's random number generator to generate a 32-byte random number as its dynamic salt value, and stores it in the TPM's storage area. In other words, it randomly generates the corresponding dynamic salt value based on the preset storage encryption key. Finally, it uses a hybrid binding method to concatenate the current hardware information and the dynamic salt value, and uses the SHA-256 algorithm to calculate the second verification value.

[0075] The secure hash algorithm converts input data of arbitrary length into a fixed-length output value (hash value, which is the verification value in this invention), and has the characteristics of unidirectional and fixed-length output.

[0076] It should be noted that the embodiments provided by the present invention are only one possible implementation method, but are not limited to this only implementation method. Users can set their own implementation methods according to their needs.

[0077] This invention provides a method for generating a second verification value, which employs a secure hash algorithm. Its one-way and fixed-length output characteristics provide stronger authentication security.

[0078] The above embodiments describe static hardware authentication. Dynamic authentication only proceeds after successful static authentication. However, there is a scenario where static authentication fails, and the subsequent operations are as follows:

[0079] If the first verification value and the second verification value are different, then obtain the hardware information of the motherboard where the binding stage corresponding to the first verification value sent by the fingerprint module is located.

[0080] Determine whether the various parameters in the hardware information of the motherboard during the binding phase are the same as those in the current motherboard.

[0081] If any of the parameters are different, a random array is sent to the fingerprint module after receiving the remote authorization signal;

[0082] If all parameters are the same, a security log indicating an abnormal binding connection will be generated.

[0083] In this embodiment, if the first verification value and the second verification value are different, there are two possible reasons for this discrepancy, each corresponding to a different subsequent operation. The first reason is that the fingerprint module has been replaced, resulting in a problem with the first verification value received by the BIOS. The second reason is that during the use of the electronic device, some components are damaged and replaced, causing the hardware information of the motherboard where the binding process took place to differ from the hardware information of the current motherboard.

[0084] Since there are two different reasons, it is necessary to determine which one is causing the difference between the first and second verification values. This invention uses a method of judging whether the various parameters in the hardware information of the motherboard during the binding phase are the same as those in the current motherboard's hardware information. If any parameter is different, it indicates that the difference between the first and second verification values ​​is caused by the second reason, indirectly indicating that the fingerprint module is secure, i.e., it has been bound to the BIOS. Then, after receiving the remote authorization signal, a random array is sent to the fingerprint module.

[0085] If all parameters are the same, it indicates that the first verification value and the second verification value are different due to the first reason, and indirectly indicates that there is a problem with the first verification value. At this time, a security log indicating an abnormal binding connection is generated.

[0086] In addition, the system obtains the number of times the binding connection is abnormal in the security log in real time. If the number exceeds the security threshold, the dynamic salt value is regenerated. This means that the first verification value and the second verification value will be recalculated. The dynamic salt value update adopts a lazy loading mechanism and is only triggered in the abnormal log to avoid frequent calculations.

[0087] It should be noted that, considering performance issues, hardware static authentication only needs to be performed each time the device is powered on, avoiding the need to calculate the verification value every time.

[0088] This invention provides follow-up operations after static authentication failure, which fully considers the reasons for static authentication failure and further determines the reliability of authentication; at the same time, this invention limits static authentication to be performed only once every time the computer is powered on, which optimizes the performance of the motherboard and reduces resource waste.

[0089] In dynamic authentication, the specific implementation of step S13 above—obtaining the signature information obtained by the fingerprint module after signing the random array with a private key, and parsing the signature information to obtain the parsing result—is as follows: obtaining the signature information obtained by the fingerprint module after signing the random array with a private key; obtaining the private key signing method corresponding to the fingerprint module signing the random array with a private key; determining the signature decryption method corresponding to the private key signing method; and parsing the signature information based on the signature decryption method to obtain the parsing result.

[0090] In this embodiment, the parsing of signature information to obtain the parsing result is relative to the encryption method used by the fingerprint module to sign the random array with its private key. It can be understood that if encryption method A is used to sign the random array with its private key, then decryption method A is required to parse the signature information. That is, first, the private key signing method (encryption method) corresponding to the fingerprint module's private key signing of the random array is obtained; then, the signature decryption method corresponding to the private key signing method is determined; and finally, the signature information is parsed based on the signature decryption method.

[0091] Step S14 above: If the parsing result meets the dynamic verification standard, the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information. The specific implementation method is as follows: obtain the parsing time and parsing data corresponding to the parsing result; if the parsing time is less than the preset valid time and the parsing data is equal to a random array, the parsing result meets the dynamic verification standard, and the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information. However, if the parsing time is greater than the preset valid time or the parsing data is not equal to a random array, the parsing result does not meet the dynamic verification standard, and the fingerprint module is controlled to enter the protection mode.

[0092] In this embodiment, whether the parsing result meets the dynamic verification standard can be determined based on whether the data corresponding to the parsing result includes data identical to the random array. That is, if the parsing result includes data identical to the random array, the parsing result meets the dynamic verification standard; if the parsing result does not include data identical to the random array, the parsing result does not meet the dynamic verification standard. Meanwhile, to ensure the validity period of the array, the parsing time corresponding to the parsing result needs to be less than a preset valid time. In other words, if the parsing time corresponding to the parsing result is less than the preset valid time, and the parsed data corresponding to the parsing result is equal to the random array, then it meets the dynamic verification standard; otherwise, it does not meet the dynamic verification standard.

[0093] After both static and dynamic authentication are successful, the fingerprint module enters fingerprint operating mode to acquire fingerprint information. After acquiring the fingerprint signal, the process includes: determining whether the acquired fingerprint information is the same as preset security fingerprint information; if the fingerprint information is the same as the preset security fingerprint information, entering system operation mode; if the fingerprint information is different from the preset security fingerprint information, acquiring the input password information; if the password authentication is successful, entering system operation mode; if the password authentication fails, generating a security log indicating communication attack information.

[0094] In this embodiment, the system on the motherboard will only enter operating mode if fingerprint authentication is successful. This means the operator with the current fingerprint can write and modify the system and programs. If fingerprint authentication fails, it indicates that the current operator is not qualified to make modifications. However, since the preset security fingerprint information is also pre-recorded, if a new operator is needed to temporarily modify or write code to the system, they can use password login to obtain temporary modification privileges. If both fingerprint and password authentication fail, a security log indicating a communication attack is generated, alerting the operator to the presence of a communication attack.

[0095] In summary, the complete flowchart of the binding authentication method provided by this invention is as follows: Figure 2 As shown, it includes the following steps:

[0096] S20: BIOS startup.

[0097] S21: Read the motherboard's hardware information and generate the corresponding dynamic salt value.

[0098] S22: Calculate the verification value.

[0099] S23: Determine whether the first verification value and the second verification value are consistent.

[0100] S24: If the first verification value and the second verification value are the same, then generate and send a random array.

[0101] S25: If the first verification value and the second verification value are inconsistent, the system is locked and proceeds to step S32.

[0102] S26: The fingerprint module performs private key signing on the random array.

[0103] S27: Determine whether the signature verification is successful.

[0104] S28: If the signature verification is successful, the fingerprint function will be enabled; if the signature verification fails, proceed to step S32.

[0105] S29: Determine whether fingerprint authentication was successful.

[0106] S30: If fingerprint authentication is successful, you will enter the system.

[0107] S31: If fingerprint authentication fails, determine whether password authentication is successful. If yes, proceed to step S30; otherwise, proceed to step S32.

[0108] S32: End.

[0109] It should be noted that steps S20-S32 are summaries of the above embodiments, and therefore will not be described in detail here.

[0110] Based on the above embodiments and corresponding steps, it can be seen that the present invention uses a combination of static and dynamic authentication to bind and authenticate the fingerprint module and the BIOS. The overall process involves static authentication steps and dynamic authentication steps. In addition, a combined static and dynamic authentication step can be added between static and dynamic authentication, specifically employing Physically Unclonable Function (PUF) verification. That is, after the first verification value and the second verification value are the same, the following step is also included:

[0111] A first physical unclonable response is generated based on the first challenge signal and sent to the fingerprint module. The first challenge signal is generated on the motherboard during the bonding phase.

[0112] A corresponding second physical unclonable response is generated based on the second challenge signal sent by the fingerprint module and sent to the fingerprint module so that the fingerprint module can compare the first physical unclonable response and the second physical unclonable response. The first challenge signal and the second challenge signal are the same.

[0113] The comparison results after the fingerprint receiving module compares the first physical non-cloning response and the second physical non-cloning response;

[0114] If the bit matching degree of the comparison case representing the first physical non-clonable response and the second physical non-clonable response reaches the preset fault tolerance threshold, then a random array is sent to the fingerprint module.

[0115] If the bit matching degree of the comparison situation representing the first physical unclonable response and the second physical unclonable response does not reach the preset fault tolerance threshold, a security log representing the binding connection abnormality is generated.

[0116] In other words, during the secure binding phase, a first challenge signal is input to the BIOS. The fingerprint module collects and stores the first Physically Unclonable Response (PUF response R_A) generated by the BIOS based on the first challenge signal. During the verification phase, the BIOS generates a corresponding second Physically Unclonable Response (PUF response R_B) based on the second challenge signal sent by the fingerprint module. The fingerprint module collects and stores the second Physically Unclonable Response (PUF response R_B) generated by the BIOS chip based on the second challenge signal. At this time, the fingerprint module stores the first Physically Unclonable Response (PUF response R_A) and the second Physically Unclonable Response (PUF response R_B). These two responses are then compared. Since this invention uses Physically Unclonable Function (PUF), even if the first challenge signal and the second challenge signal are the same, two completely identical Physically Unclonable Responses will not be obtained. Based on this, this invention needs to calculate the bit matching degree between the first Physically Unclonable Response (PUF response R_A) and the second Physically Unclonable Response (PUF response R_B). When the bit matching degree reaches a preset fault tolerance threshold, the binding authentication is successful, and a random array is sent to the fingerprint module to enable dynamic authentication.

[0117] Alternatively, when targeting servers (electronic devices) with higher security, a dynamic trust chain can be used for continuous authentication to defend against runtime kernel-level attacks.

[0118] Based on this, the binding authentication method provided by this invention is equivalent to performing triple authentication: the first authentication is static authentication; the second authentication is a combination of static and dynamic authentication; and the third authentication is dynamic authentication, which can further ensure the uniqueness of the fingerprint module and the security of its use.

[0119] Figure 3 A structural diagram of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown, the electronic device includes: a memory 60 for storing computer programs;

[0120] The processor 61 is used to implement the steps of the binding authentication method as described in the above embodiments when executing a computer program.

[0121] The electronic devices provided in this embodiment may include, but are not limited to, smartphones, tablets, laptops, or desktop computers.

[0122] The processor 61 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 61 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 61 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 61 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 61 may also include an Artificial Intelligence (AI) processor, which handles computational operations related to machine learning.

[0123] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 60 is used to store at least the following computer program 601, which, after being loaded and executed by the processor 61, is capable of implementing the relevant steps of the binding authentication method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. The operating system 602 may include Windows, Unix, Linux, etc.

[0124] In some embodiments, the electronic device may further include a display screen 62, an input / output interface 63, a communication interface 64, a power supply 65, and a communication bus 66.

[0125] Those skilled in the art will understand that Figure 3 The structures shown do not constitute a limitation on electronic devices and may include more or fewer components than those shown.

[0126] It is understood that if the binding authentication method in the above embodiments is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0127] Based on this, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the binding authentication method described above.

[0128] Based on this, embodiments of the present invention also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the binding authentication method described above.

[0129] The foregoing has provided a detailed description of a binding authentication method, device, and medium provided by embodiments of the present invention. The various embodiments are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0130] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0131] The binding authentication method, device, and medium provided by this invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this invention.

Claims

1. A binding authentication method, characterized in that, include: Receive the first verification value sent by the fingerprint module, wherein the first verification value is generated based on the hardware information of the motherboard where the binding stage is located and the corresponding dynamic salt value; A second verification value is generated based on the hardware information of the current motherboard and the corresponding dynamic salt value; If the first verification value and the second verification value are the same, a random array is sent to the fingerprint module so that the fingerprint module can sign the random array with its private key. Obtain the signature information obtained by the fingerprint module after signing the random array with the private key, and parse the signature information to obtain the parsing result; If the parsing result meets the dynamic verification standard, the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information.

2. The binding authentication method according to claim 1, characterized in that, The step of generating a second verification value based on the current motherboard hardware information and the corresponding dynamic salt value includes: Obtain the hardware information of the current motherboard; The dynamic salt value is randomly generated based on the preset storage encryption key; The second verification value is obtained by concatenating the hardware information of the current motherboard and the corresponding dynamic salt value using a secure hash algorithm.

3. The binding authentication method according to claim 2, characterized in that, Also includes: If the first verification value and the second verification value are different, then obtain the hardware information of the motherboard where the binding stage is located corresponding to the first verification value sent by the fingerprint module; Determine whether the various parameters in the hardware information of the motherboard where the binding stage is located are the same as those in the hardware information of the current motherboard. If any of the parameters are different, the random array is sent to the fingerprint module after receiving the remote authorization signal; If all parameters are the same, a security log indicating an abnormal binding connection will be generated.

4. The binding authentication method according to claim 1, characterized in that, The process of obtaining the signature information obtained by the fingerprint module after signing the random array with the private key, and parsing the signature information to obtain the parsing result, includes: Obtain the signature information obtained by the fingerprint module after signing the random array with the private key; The fingerprint module performs the private key signature on the random array using the private key signature method corresponding to the fingerprint module's private key signature. Determine the signature decryption method corresponding to the private key signature method; The signature information is parsed based on the aforementioned signature decryption method to obtain the parsing result.

5. The binding authentication method according to claim 1, characterized in that, If the parsing result meets the dynamic verification standard, then the fingerprint module is controlled to enter the fingerprint working mode to obtain fingerprint information, including: Obtain the parsing time and parsing data corresponding to the parsing results; If the parsing time is less than the preset valid time and the parsed data is equal to the random array, then the parsing result meets the dynamic verification standard, and the fingerprint module is controlled to enter the fingerprint working mode to obtain the fingerprint information.

6. The binding authentication method according to claim 5, characterized in that, Also includes: If the parsing time is greater than the preset valid time or the parsed data is not equal to the random array, the parsing result does not meet the dynamic verification standard, and the fingerprint module is controlled to enter the protection mode.

7. The binding authentication method according to claim 1, characterized in that, After the first verification value and the second verification value are the same, the following steps are also included: A first physical unclonable response is generated based on the first challenge signal and sent to the fingerprint module, wherein the first challenge signal is generated on the motherboard where the binding phase is located; Based on the second challenge signal sent by the fingerprint module, a corresponding second physical unclonable response is generated and sent to the fingerprint module so that the fingerprint module can compare the first physical unclonable response and the second physical unclonable response, wherein the first challenge signal and the second challenge signal are the same; Receive the comparison results of the fingerprint module after comparing the first physically unclonable response and the second physically unclonable response; If the comparison indicates that the bit matching degree between the first physical non-clonable response and the second physical non-clonable response reaches a preset fault tolerance threshold, then the random array is sent to the fingerprint module. If the comparison indicates that the bit matching degree of the first physical unclonable response and the second physical unclonable response does not reach the preset fault tolerance threshold, a security log indicating an abnormal binding connection is generated.

8. The binding authentication method according to any one of claims 1-7, characterized in that, After obtaining the fingerprint information, the process also includes: Determine whether the acquired fingerprint information is the same as the preset security fingerprint information; If the fingerprint information is the same as the preset security fingerprint information, then the system enters the operating mode; If the fingerprint information is different from the preset security fingerprint information, then the input password information is obtained; If the password information is successfully authenticated, the system will enter the operating mode. If the password authentication fails, a security log representing communication attack information is generated.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the binding authentication method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the binding authentication method as described in any one of claims 1 to 8.

Images