UKey-based identity authentication method and system, terminal and UKey equipment

Abstract

The invention provides an identity authentication method and system based on a UKey, a terminal and UKey equipment, and belongs to the technical field of network security. The identity authentication method based on the UKey is applied to a terminal, and the terminal is provided with a UKey driver and work platform login software. The method comprises the following steps: calling a UKey drive to authenticate a UKey device under the condition that the UKey device is detected; and under the condition that the UKey equipment passes the authentication, performing identity authentication on a login user of the operation platform login software based on the UKey equipment to obtain an identity authentication result. According to the embodiment of the invention, the authentication of the terminal on the UKey equipment is realized through the UKey driver, and the identity authentication of the login user is carried out only when the authentication of the UKey equipment is passed, so that the security of the identity authentication is improved, and the user identity is prevented from being stolen.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a UKey-based identity authentication method, a UKey device, a UKey-based identity authentication system, a terminal, a UKey-based identity authentication apparatus, a machine-readable storage medium, and an electronic device. Background Technology

[0002] With the development of information technology, enterprises are paying more and more attention to the security of software systems, and have correspondingly raised the requirements for the security of user identity authentication.

[0003] Among the current authentication methods, the most common is the username plus password method. However, this is also the most primitive and insecure method, easily compromised by external leaks or through password guessing, wiretapping, and replay attacks, leading to the theft of legitimate user identities. The second method is biometric identification technology, which relies on unique human biometric features (including fingerprints, voice, iris scans, etc.). It offers excellent security and effectiveness, but its implementation is still immature, limiting its widespread application. The third method, and currently the most popular in e-government and e-commerce, is USB key (UKey) authentication. USB Key combines modern cryptography, smart card technology, and USB technology, representing a new generation of authentication products. It features a Personal Identification Number (PIN) and hardware two-factor authentication, along with secure storage and a processing chip for encryption algorithms.

[0004] The existing UKey-based authentication method stores user information in a UKey, and then the system compares the information entered by the user when logging into the system with the user information stored in the UKey to determine whether to allow the user to log in. This approach has low security. Summary of the Invention

[0005] The purpose of this invention is to provide a UKey-based identity authentication method, a UKey device, a UKey-based identity authentication system, a terminal, a UKey-based identity authentication apparatus, a machine-readable storage medium, and an electronic device. This UKey-based identity authentication method improves the security of identity authentication and prevents user identity from being stolen.

[0006] To achieve the above objectives, the first aspect of this application provides a UKey-based authentication method applied to a terminal, wherein the terminal has a UKey driver and operating platform login software installed; the method includes: If a UKey device is detected, the UKey driver is invoked to authenticate the UKey device; If the UKey device is successfully authenticated, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

[0007] In this embodiment of the application, the terminal is provided with a first state machine, and the UKey device is provided with a second state machine; The process of authenticating the login user in the operation platform login software based on the UKey device and obtaining the authentication result includes: When both the first state machine and the second state machine are in the authentication state, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

[0008] In this embodiment of the application, during the process of authenticating the UKey device by calling the UKey driver, the UKey driver and the UKey device communicate using a first encryption protection channel. The first encryption protection channel encrypts the communication command data using a first encryption method. The first encryption method is to use the UKey transmission key to distribute the UKey serial number to obtain a first symmetric key, and then encrypt and protect the communication command data based on the first symmetric key.

[0009] In this embodiment of the application, during the process of authenticating the login user in the operation platform login software based on the UKey device, the UKey driver communicates with the UKey device using a second encryption protection channel. The second encryption protection channel uses a second encryption method to encrypt the communication command data. The second encryption method is to obtain a second symmetric key by distributing the UKey serial number based on the base key, and to encrypt and protect the communication command data based on the second symmetric key.

[0010] In this embodiment of the application, the base key is obtained based on a device authentication random number, which is a random number generated during the authentication process of the UKey device.

[0011] In this embodiment of the application, the step of calling the UKey driver to authenticate the UKey device includes: The UKey driver sends a device authentication request instruction to the UKey device; The UKey device determines a first signature value based on the device authentication request instruction and the UKey serial number, and sends the first signature value to the UKey driver; The UKey driver verifies the first signature value, and if the first signature value passes the verification, sends a device authentication confirmation command to the UKey device. The UKey device generates an authentication confirmation result based on the device authentication confirmation command, and sends the authentication confirmation result to the UKey driver.

[0012] In this embodiment of the application, the device authentication request instruction includes a first random number, which is generated by the UKey driver; The step of determining the first signature value by the UKey device based on the device authentication request command and the UKey serial number includes: The first original data is obtained by concatenating the first random number, the second random number, and the UKey serial number by the UKey device, and the second random number is generated by the UKey device. The first original data is signed by the UKey device to obtain the first signature value.

[0013] In this embodiment of the application, the step of verifying the first signature value by the UKey driver and sending a device authentication confirmation command to the UKey device if the first signature value verification is successful includes: The UKey driver obtains the UKey serial number and the second random number sent by the UKey device; The second original data is obtained by concatenating the first random number, the second random number, and the UKey serial number, driven by the UKey driver. The UKey driver verifies the first signature value based on the second original data; If the first signature value passes verification, the UKey drives the hash operation on the second original data to obtain the first hash value; The UKey driver generates a device authentication confirmation instruction based on the first hash value and sends the device authentication confirmation instruction to the UKey device.

[0014] In this embodiment of the application, the step of generating an authentication confirmation result by the UKey device based on the device authentication confirmation command and sending the authentication confirmation result to the UKey driver includes: The UKey device performs a hash operation on the first original data to obtain a second hash value; The UKey device compares the first hash value and the second hash value in the device authentication confirmation command to obtain the authentication confirmation result, and sends the authentication confirmation result to the UKey driver.

[0015] In this embodiment of the application, the step of authenticating the login user of the operation platform login software based on the UKey device and obtaining the authentication result includes: Based on the UKey serial number, generate an identity authentication login request and send the identity authentication login request to the operation platform; The operating platform returns an identity authentication login response based on the identity authentication login request; The identity authentication login response is verified, and if the identity authentication login response is verified successfully, a login confirmation operation instruction is generated and sent to the operation platform. The operating platform returns a login confirmation response based on the login confirmation operation instruction; Based on the login confirmation response, the identity authentication result is obtained.

[0016] In this embodiment of the application, generating an identity authentication login request based on the UKey serial number includes: Obtain the UKey serial number and the third random number sent by the UKey device; The UKey serial number and the third random number are concatenated to obtain the third original data; The third original data is encrypted to obtain the first ciphertext; Based on the first encrypted message, an identity authentication login request is generated.

[0017] In this embodiment of the application, the step of the operating platform returning an identity authentication login response based on the identity authentication login request includes: The operating platform decrypts the first ciphertext to obtain decrypted data, and signs the decrypted data to obtain a second signature value; The operating platform concatenates the decrypted data and the fourth random number to obtain the fourth original data, and then encrypts the fourth original data to obtain the second ciphertext. The operating platform returns an identity authentication login response based on the second signature value and the second ciphertext.

[0018] In this embodiment of the application, the step of verifying the identity authentication login response, and generating a login confirmation operation instruction and sending the login confirmation operation instruction to the operating platform if the identity authentication login response passes verification, includes: The second signature value and the second ciphertext are obtained by parsing the identity authentication login response; The second ciphertext is sent to the UKey device for decryption to obtain plaintext data; The plaintext data is compared with the third original data to obtain the comparison result; If the comparison results are consistent, the second signature value is verified based on the third original data. If the verification is successful, the plaintext data is sent to the UKey device for signing to obtain the third signature value. Based on the third signature value, a login confirmation operation instruction is generated and sent to the operating platform.

[0019] In this embodiment of the application, the step of the operating platform returning a login confirmation response based on the login confirmation operation instruction includes: The operating platform verifies the third signature value in the login confirmation operation instruction based on the fourth original data, obtains a second verification result, and returns a login confirmation response based on the second verification result.

[0020] In this embodiment of the application, the terminal is further equipped with user management software; the method further includes: If a UKey device is detected, the user management software is used to bind the user identity to the UKey device.

[0021] A second aspect of this application provides a terminal equipped with a USB port for connecting a UKey device, and the terminal is used to implement the aforementioned UKey-based authentication method.

[0022] A third aspect of this application provides a UKey device for implementing the aforementioned UKey-based authentication method.

[0023] The fourth aspect of this application provides a UKey-based identity authentication system, including a UKey device and a terminal, wherein the UKey device is connected to the terminal, and the terminal is equipped with a UKey driver and an operating platform login software. The terminal is used to call the UKey driver to authenticate the UKey device when a UKey device is detected; and if the UKey device is successfully authenticated, the terminal uses the UKey device to authenticate the login user of the operating platform login software and obtains the authentication result.

[0024] A fifth aspect of this application provides a UKey-based identity authentication device for use in a terminal, wherein the terminal is equipped with a UKey driver and operating platform login software; the device includes: The device authentication module is used to call the UKey driver to authenticate the UKey device when a UKey device is detected. The identity authentication module is used to authenticate the login user of the operation platform login software based on the UKey device when the UKey device is successfully authenticated, and obtain the identity authentication result.

[0025] A sixth aspect of this application provides an electronic device, the electronic device comprising: At least one processor; A memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the above-described UKey-based authentication method by executing the instructions stored in the memory.

[0026] A seventh aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned UKey-based authentication method.

[0027] The above technical solution involves installing a UKey driver and the operating platform login software on the terminal. Upon detecting a UKey device, the UKey driver is invoked to authenticate the UKey device. If the UKey device authentication is successful, the login user of the operating platform login software is authenticated based on the UKey device, resulting in an authentication result. By using the UKey driver to authenticate the UKey device from the terminal, and only performing user authentication when the UKey device authentication is successful, the security of identity authentication is improved, preventing user identity theft.

[0028] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0029] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 The illustration shows a flowchart of a UKey-based identity authentication method according to an embodiment of this application; Figure 2 A flowchart illustrating a protection channel encryption method according to an embodiment of this application is shown schematically. Figure 3 This illustration schematically depicts a device authentication process according to an embodiment of this application. Figure 1 ; Figure 4 This illustration schematically depicts a device authentication process according to an embodiment of this application. Figure 2 ; Figure 5 This illustration schematically depicts a device authentication process according to an embodiment of this application. Figure 3 ; Figure 6 This illustration schematically depicts a device authentication process according to an embodiment of this application. Figure 4 ; Figure 7 A flowchart illustrating the encryption method of the protection channel two according to an embodiment of this application is shown schematically; Figure 8 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 1 ; Figure 9 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 2 ; Figure 10 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 3 ; Figure 11 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 4 ; Figure 12 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 5 ; Figure 13 This illustration schematically depicts the authentication and login process between the operating terminal and the operating platform according to an embodiment of this application. Figure 6 ; Figure 14 A schematic diagram illustrating the UKey initialization flowchart according to an embodiment of this application is shown. Figure 15 This illustration schematically shows a terminal initialization flowchart according to an embodiment of the present application; Figure 16 A schematic diagram illustrating the overall block diagram of the basic environment according to an embodiment of this application is shown. Figure 17 This schematic diagram illustrates a structural block diagram of a UKey-based identity authentication device according to an embodiment of this application; Figure 18 The diagram illustrates the internal structure of a computer device according to an embodiment of this application.

[0030] Explanation of reference numerals in the attached figures 410 - Device authentication module; 420 - Identity authentication module; A01 - Processor; A02 - Network interface; A03 - Internal memory; A04 - Display screen; A05 - Input device; A06 - Non-volatile storage medium; B01 - Operating system; B02 - Computer program. Detailed Implementation

[0031] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0032] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0033] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0034] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0035] Please refer to Figure 1 , Figure 1 This illustration schematically shows a flowchart of a UKey-based authentication method according to an embodiment of this application. This embodiment provides a UKey-based authentication method applied to a terminal, wherein the terminal has a UKey driver and operating platform login software installed; the method includes the following steps: Step 210: If a UKey device is detected, the UKey driver is invoked to authenticate the UKey device; In this embodiment, the terminal can be a general-purpose Windows or Linux PC, an embedded terminal, or an Android device. It needs a USB port to correctly recognize USB devices and enable network communication. The aforementioned job platform login software is used for identity authentication login to the job platform; only after successful identity authentication login can the corresponding job operations be performed. The UKey driver can refer to a dedicated UKey driver developed based on the open-source libusb driver to adapt to a specific terminal system. For example, it can modify the USB driver recognition process and add communication command encryption protection, ensuring that only terminals with the dedicated UKey driver installed can correctly communicate and interact with the UKey device. The aforementioned UKey device is a dedicated hardware device containing a dedicated security computing chip capable of performing various encryption and decryption operations, signature verification, public / private key pair generation, etc., and has a hardware random number generator. The UKey device can also store digital certificates and private keys; the private key can only participate in operations within the UKey and cannot be read out. The UKey device is pre-loaded with the user's initial PIN code and transmission key upon factory release. Ordinary users will be prompted to modify the initial PIN code and transmission key upon first login to the job platform.

[0036] During authentication, the UKey device is first inserted into the terminal. The UKey driver identifies and detects the UKey device, and can also open the UKey device to obtain its handle, facilitating the sending of commands. If the UKey device is detected, the UKey driver is invoked to authenticate it.

[0037] In some embodiments, the terminal is further equipped with user management software; the method further includes: If a UKey device is detected, the user management software is used to bind the user identity to the UKey device.

[0038] In this embodiment, the UKey device needs to be bound to a regular user's identity using user management software on the terminal. Simultaneously, it needs to apply for and install a certificate for the user's UKey from the CA system. Only then can the regular user complete identity authentication and login using the UKey device. After successful authentication, the user can perform corresponding job operations on the work terminal. This allows regular users to transmit large amounts of data with the UKey even without terminal system administrator privileges.

[0039] In some embodiments, the step of authenticating the UKey device by invoking the UKey driver includes the following steps: First, the UKey driver sends a device authentication request instruction to the UKey device; In this embodiment, the device authentication request instruction may include a random number generated by the UKey driver. Specifically, the random number may be automatically generated by the UKey driver calling the system software algorithm interface.

[0040] Then, the UKey device determines the first signature value based on the device authentication request instruction and the UKey serial number, and sends the first signature value to the UKey driver; In this embodiment, after receiving a device authentication request instruction, the UKey device can sign the stored UKey serial number. The signing can be done using the signing private key in the UKey.

[0041] In some embodiments, the device authentication request instruction includes a first random number, which is generated by the UKey driver; correspondingly, the step of determining the first signature value by the UKey device based on the device authentication request instruction and the UKey serial number includes: The first step involves the UKey device concatenating the first random number, the second random number, and the UKey serial number to obtain the first original data. The second random number is generated by the UKey device. In this embodiment, the second random number can be generated by the random number generator in the UKey device. The above concatenation can be performed by sequentially concatenating the first random number, the second random number, and the UKey serial number. For example, the second random number can be represented as R1, the first random number can be represented as R2, and the UKey serial number can be represented as SN. After receiving the device authentication request instruction, the UKey device concatenates R1|R2|SN to form the original data Data1, thus obtaining the first original data.

[0042] The second step involves the UKey device signing the first original data to obtain a first signature value.

[0043] In this embodiment, the first original data can be signed using the signing private key in the UKey to obtain the authentication data signature value, i.e., the first signature value. The above signature can be implemented using existing signature algorithms, such as the Chinese national cryptographic algorithm (SM2) signature, which will not be elaborated here.

[0044] The first random number, the second random number, and the UKey serial number are concatenated, and then the concatenated data is signed. Because the first and second random numbers are incorporated into the UKey serial number—these two random numbers originate from the UKey driver and the UKey device, respectively—the randomness of the concatenated data is enhanced. This ensures that the initial source data changes each time the UKey device is authenticated, effectively preventing the problem of data parsing still being possible even when the UKey device authentication has expired.

[0045] Then, the UKey driver verifies the first signature value, and if the first signature value passes the verification, sends a device authentication confirmation command to the UKey device. In this embodiment, the signature verification can be performed by parsing the UKey signing certificate to obtain the UKey signing public key, and then using the UKey signing public key to verify the first signature value. It should be noted that the UKey signing certificate can be obtained in advance from the UKey device. Specifically, the UKey driver can send an instruction to the UKey device to obtain the UKey signing certificate, and then the UKey device returns the UKey signing certificate.

[0046] In some embodiments, to further ensure the validity of the UKey signing certificate, the UKey driver can verify the validity of the UKey signing certificate with the CA system. If invalid, the device authentication process is exited; if valid, the first signature value is verified using the UKey signing public key in the UKey signing certificate. The aforementioned CA system can refer to a CA platform certificate management system used to manage signing certificates, which is existing technology and will not be elaborated upon here.

[0047] In some embodiments, the step of verifying the first signature value by the UKey driver and sending a device authentication confirmation command to the UKey device if the first signature value verification is successful includes: The first step is for the UKey driver to obtain the UKey serial number and the second random number sent by the UKey device; In this embodiment, the second random number can be generated by the UKey driver first sending a random number retrieval command to the UKey device, and the UKey device returning the second random number to the UKey driver after receiving the random number retrieval command. Similarly, the UKey serial number can also be generated by the UKey driver first sending a UKey serial number retrieval command to the UKey device, and the UKey device returning the UKey serial number to the UKey driver after receiving the UKey serial number retrieval command.

[0048] The second step involves the UKey driver concatenating the first random number, the second random number, and the UKey serial number to obtain the second original data. In this embodiment, the above concatenation can be performed by sequentially concatenating the first random number, the second random number, and the UKey serial number. For example, the second random number can be represented as R1, the first random number can be represented as R2, and the UKey serial number can be represented as SN. After receiving the device authentication request instruction, the UKey device concatenates R1|R2|SN to form the original data Data2, thus obtaining the second original data. It should be noted that the above concatenation is performed in the same order as the concatenation order used to obtain the first original data.

[0049] The third step involves the UKey driver verifying the first signature value based on the second original data. In this embodiment, the UKey signing certificate can be parsed to obtain the UKey signing public key, and then the first signature value can be verified using the UKey signing public key and the second signature value. For example, SM2 verification can be used, where the second signature value is the original data and the UKey signing public key is the signing public key. The above verification process can be implemented using existing technologies, and will not be elaborated further here.

[0050] Fourth step: If the first signature value passes verification, the UKey drives the hash operation on the second original data to obtain the first hash value; In this embodiment, if signature verification fails, the authentication process exits; if signature verification succeeds, the UKey drives a hash operation on the second original data to obtain a first hash value. This hash operation can be implemented using existing technologies, such as SM3 hashing. For example, in the above example, an SM3 hash operation can be performed on Data2 to obtain hash value H1, which is the first hash value.

[0051] Fifth step: The UKey driver generates a device authentication confirmation instruction based on the first hash value and sends the device authentication confirmation instruction to the UKey device.

[0052] In this embodiment, the device authentication confirmation instruction includes a first hash value, and the first hash value can also be sent as the device authentication confirmation instruction.

[0053] By combining a first random number, a second random number, and the UKey serial number in the UKey driver, the first signature value can be accurately verified. If the verification is successful, a hash operation is performed on the second original data obtained by combining the first random number, the second random number, and the UKey serial number. The hash value is then sent to the UKey device via a device authentication confirmation command, enabling the UKey device to perform device authentication confirmation.

[0054] Finally, the UKey device generates an authentication confirmation result based on the device authentication confirmation command, and sends the authentication confirmation result to the UKey driver.

[0055] In some embodiments, the step of generating an authentication confirmation result by the UKey device based on the device authentication confirmation instruction and sending the authentication confirmation result to the UKey driver includes: The first step is to perform a hash operation on the first original data by the UKey device to obtain a second hash value; In this embodiment, the hash operation described above can be implemented using existing technologies, such as SM3 hash operation. For example, in the above example, an SM3 hash operation can be performed on Data1 to obtain hash value H2, which is the second hash value. It should be noted that the hash operation used in the calculation of the second hash value is the same as the hash operation used in the calculation of the first hash value.

[0056] The second step involves the UKey device comparing the first hash value and the second hash value in the device authentication confirmation command to obtain the authentication confirmation result, and then sending the authentication confirmation result to the UKey driver.

[0057] In this embodiment, the UKey device compares the second hash value with the first hash value to see if they match. The comparison result is the authentication confirmation result. If they match, the device authentication is successful; otherwise, the device authentication fails.

[0058] It should be noted that if device authentication is successful, the UKey device can modify its authentication permission status internally and store the first and second random numbers generated during the authentication process in its cache. Correspondingly, the UKey driver cache can store the device authentication permission status corresponding to that UKey device and the first and second random numbers generated during the authentication process.

[0059] By performing a hash operation on the first original data using the UKey device to obtain a second hash value, and then comparing the first hash value with the second hash value, the authentication confirmation result can be determined quickly and accurately.

[0060] The process involves the UKey driver sending a device authentication request command to the UKey device; the UKey device signing the UKey serial number based on the device authentication request command to obtain a first signature value, and sending the first signature value to the UKey driver; the UKey driver verifying the first signature value, and if the verification is successful, sending a device authentication confirmation command to the UKey device; and the UKey device generating an authentication confirmation result based on the device authentication confirmation command, and sending the authentication confirmation result to the UKey driver. This allows for accurate authentication of the UKey device by sending a device authentication request command to the UKey device; the UKey device signing the UKey serial number to obtain a first signature value, and sending the first signature value to the UKey driver; the UKey driver verifying the first signature value, and if the verification is successful, sending a device authentication confirmation command to the UKey device; and the UKey device generating an authentication confirmation result based on the device authentication confirmation command, and sending the authentication confirmation result to the UKey driver.

[0061] In some embodiments, during the process of authenticating the UKey device by calling the UKey driver, the UKey driver and the UKey device communicate using a first encryption protection channel. The first encryption protection channel encrypts the communication command data using a first encryption method. The first encryption method is to distribute the UKey serial number using the UKey transmission key to obtain a first symmetric key, and then encrypt and protect the communication command data based on the first symmetric key.

[0062] In this embodiment, the aforementioned communication instruction data refers to the instructions and data transmitted between the UKey driver and the UKey device, such as: device authentication confirmation instructions, first hash values, etc. The aforementioned UKey transmission key can be a transmission key modified by the UKey user. The aforementioned distribution refers to combining the UKey transmission key with the UKey serial number to generate a unique, scenario-specific subkey to enhance key security. This distribution is existing technology and will not be elaborated further here. The aforementioned encryption protection of the communication instruction data can be achieved using existing encryption algorithms; for example, please refer to... Figure 2 , Figure 2 The flowchart illustrating the encryption method of the protection channel according to an embodiment of this application is shown. The unique identifier of the UKey device (UKey serial number SN) is distributed using the UKey user-modified transmission key to obtain a symmetric key KEY1, and the communication command data is encrypted and protected using the SM4 algorithm in ECB mode.

[0063] By using the first encrypted protection channel to communicate during the authentication process of the UKey device by calling the UKey driver, the communication command data can be protected, thereby improving the security and reliability of UKey device authentication.

[0064] The following example illustrates the UKey device authentication process. Please refer to [link / reference]. Figures 3-6 The UKey device authentication process includes the following steps: 1. Insert the UKey device into the terminal system. The dedicated UKey driver will automatically recognize the UKey device and open the device, and then initiate the device authentication operation.

[0065] 2. The UKey dedicated driver sends a random number retrieval command to the UKey, protects the command data according to the encryption method of protection channel one, and obtains and saves the 16-byte random number R1 returned by the UKey.

[0066] 3. The UKey dedicated driver calls the system software algorithm interface to obtain a 16-byte random number R2.

[0067] 4. The UKey dedicated driver sends a command to the UKey to obtain the UKey serial number, protects the command data according to the encryption method of protection channel one, and obtains and saves the 16-byte serial number SN returned by the UKey.

[0068] 5. The UKey dedicated driver sends a device authentication command to the UKey (this command data must contain a random number R2). The command data is protected according to the encryption method of protection channel one. After receiving the device authentication command, the UKey concatenates R1|R2|SN to form the original data Data1, and uses the signing private key in the UKey to perform SM2 signing on Data1, generating a 64-byte authentication data signature value S1 and returning it to the terminal system software.

[0069] 6. The original data Data2 is composed of R1|R2|SN stored in the UKey dedicated driver splicing cache.

[0070] 7. The UKey dedicated driver sends a command to UKey to obtain the UKey signature certificate, protects the command data according to the encryption method of protection channel one, and obtains the signature certificate returned by UKey.

[0071] 8. The UKey dedicated driver verifies the validity of the UKey signing certificate with the CA system. If invalid, the authentication process is terminated.

[0072] 9. The UKey dedicated driver parses the UKey signature certificate to obtain the UKey signature public key, and performs SM2 verification on the original data Data2 and signature value S1 using a software algorithm. If the verification fails, the authentication process is exited.

[0073] 10. The UKey dedicated driver calls the software algorithm to perform SM3 hash operation on Data2 to obtain the hash value H1.

[0074] 11. The UKey dedicated driver sends a device authentication confirmation command to the UKey (this command data must contain a hash value H1). The command data is protected according to the encryption method of protection channel one. After receiving the device authentication confirmation command, the UKey performs SM3 operation on the original data Data1 to obtain H2.

[0075] 12. The UKey compares the results of H2 and H1 to see if they match. The comparison result is the authentication confirmation result, and the result is returned to the UKey's dedicated driver. If the comparison result is successful, it means that the device authentication is successful. The UKey needs to modify the device authentication permission status internally and store R1 and R2 from the authentication process in the UKey cache.

[0076] 13. If the UKey dedicated driver receives a successful authentication confirmation result, it means that the device authentication is successful. The device authentication permission status corresponding to the UKey and R1 and R2 in the UKey authentication process need to be stored in the driver cache.

[0077] Step 220: If the UKey device is successfully authenticated, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

[0078] In this embodiment, the user enters the job terminal system with ordinary user privileges, inserts the user UKey device, and opens the job platform login software to perform identity authentication and login. The job platform login software in the terminal loads the UKey driver and automatically performs device authentication. Only after the UKey device is successfully authenticated can the user identity authentication and login process continue.

[0079] In some embodiments, the step of authenticating the login user of the operating platform login software based on the UKey device to obtain the authentication result includes: First, based on the UKey serial number, an identity authentication login request is generated and sent to the operating platform; In this embodiment, the aforementioned authentication login request can be obtained based on the UKey serial number in the UKey device. This can be achieved by directly adding the UKey serial number to the authentication login request before sending, or by encrypting the UKey serial number before adding it to the authentication login request.

[0080] In some embodiments, generating an identity authentication login request based on the UKey serial number includes: The first step is to obtain the UKey serial number and the third random number sent by the UKey device; In this embodiment, the UKey serial number can be obtained by the operating platform login software first calling the UKey driver to send a command to the UKey device to obtain the UKey serial number, which is then returned by the UKey device. The operating platform login software then calls the dedicated UKey driver to send a command to the UKey device to obtain a random number, which is then returned by the UKey device as a third random number.

[0081] The second step is to concatenate the UKey serial number and the third random number to obtain the third original data; In this embodiment, the login software for the work platform can be assembled sequentially.

[0082] The third step is to encrypt the third original data to obtain the first ciphertext; In this embodiment, the encryption described above can be performed on the third source data based on the public key in the server-side encryption certificate. This server-side encryption certificate can be obtained by the operating platform and sent to the terminal via the network. It should be noted that, to improve the reliability of the server-side encryption certificate, the operating platform login software can verify the validity of the server-side signature certificate with the CA system. If invalid, the authentication process is exited; otherwise, the third source data is encrypted based on the public key in the server-side encryption certificate.

[0083] The fourth step is to generate an identity authentication login request based on the first ciphertext.

[0084] In this embodiment, the identity authentication login request may contain a first ciphertext.

[0085] By concatenating the UKey serial number and a third random number, the concatenated third original data is encrypted, and an identity authentication login request is generated based on the encrypted first ciphertext. The UKey serial number can be sent to the operating platform more securely through the identity authentication login request.

[0086] Then, the operating platform returns an identity authentication login response based on the identity authentication login request; In this embodiment, the operating platform calculates and returns an authentication login response based on the authentication login request.

[0087] In some embodiments, the step of the operating platform returning an authentication login response based on the authentication login request includes: The first step is for the operating platform to decrypt the first ciphertext to obtain decrypted data, and then to sign the decrypted data to obtain a second signature value. In this embodiment, the decryption can be performed using the server's decryption private key, followed by signing using one's own signing private key. The signing can be implemented using existing signature algorithms, such as the SM2 national cryptographic algorithm, which will not be elaborated upon here.

[0088] The second step involves the operating platform concatenating the decrypted data and the fourth random number to obtain the fourth original data, and then encrypting the fourth original data to obtain the second ciphertext. In this embodiment, the fourth random number is a random number generated by the job platform, and the concatenation can be done sequentially. The encryption can be performed using the public key in the UKey encryption certificate. The job platform login software can call the UKey driver to send an instruction to the UKey device to obtain the UKey encryption certificate. The UKey device returns the UKey encryption certificate, and then the job platform login software sends the UKey encryption certificate to the job platform via the network. In some embodiments, the job platform login software can verify the validity of the UKey encryption certificate with the CA system. If valid, it sends the UKey encryption certificate to the job platform via the network.

[0089] The third step involves the operating platform returning an identity authentication login response based on the second signature value and the second ciphertext.

[0090] In this embodiment, the second signature value and the second ciphertext can be added to the identity authentication login response and returned.

[0091] The first ciphertext is decrypted by the operating platform to obtain decrypted data, and the decrypted data is signed to obtain a second signature value. The operating platform concatenates the decrypted data with a fourth random number to obtain fourth original data, and encrypts the fourth original data to obtain a second ciphertext. Based on the second signature value and the second ciphertext, the operating platform can accurately return an identity authentication login response.

[0092] Then, the identity authentication login response is verified, and if the identity authentication login response is verified successfully, a login confirmation operation instruction is generated and sent to the operation platform. In this embodiment, the identity authentication login response is first verified. Only if the verification is successful is a login confirmation operation instruction generated and sent to the operation platform; if the signature verification fails, the identity authentication login process is exited.

[0093] In some embodiments, verifying the authentication login response, and generating a login confirmation instruction and sending the login confirmation instruction to the operating platform if the authentication login response passes verification, includes: The first step is to parse the second signature value and the second ciphertext from the identity authentication login response; In this embodiment, the second signature value and the second ciphertext can be extracted by parsing the identity authentication login response.

[0094] The second step is to send the second ciphertext to the UKey device for decryption to obtain plaintext data; In this embodiment, the operation platform login software can call the UKey driver to send a decryption command to the UKey device, and the UKey device can decrypt the second ciphertext to obtain plaintext data, which is then sent to the operation platform login software.

[0095] The third step is to compare the plaintext data with the third original data to obtain the comparison result; In this embodiment, the above comparison can be used to determine whether the plaintext data contains third original data. If it does, the two data are consistent; otherwise, the two data are inconsistent.

[0096] Fourth step: if the comparison results are consistent, the second signature value is verified based on the third original data, and if the verification is successful, the plaintext data is sent to the UKey device for signing to obtain the third signature value; In this embodiment, the job platform login software verifies the second signature value using the signing public key from the server-side signing certificate and the third original data. If the verification fails, the software exits the identity authentication login process. If the verification passes, the job platform login software calls the UKey driver to send a signing instruction to the UKey device, using the signing private key in the UKey device to sign the plaintext data, thus obtaining the third signature value.

[0097] Fifth, based on the third signature value, generate a login confirmation operation instruction and send the login confirmation operation instruction to the operating platform.

[0098] In this embodiment, the third signature value can be added to the login confirmation operation command and sent to the operation platform.

[0099] Then, the operating platform returns a login confirmation response based on the login confirmation operation instruction; In some embodiments, the step of the operating platform returning a login confirmation response based on the login confirmation operation instruction includes: The operating platform verifies the third signature value in the login confirmation operation instruction based on the fourth original data and returns a login confirmation response.

[0100] In this embodiment, the job platform verifies the third signature value using the signing public key from the UKey signing certificate and the fourth original data. If the verification fails, the authentication login process exits; if the verification succeeds, a login confirmation response is returned, indicating successful login. The job platform then sends a successful authentication login confirmation response to the terminal system, after which the job platform allows the terminal system to access the system. The job platform login software can call the UKey driver to send an instruction to the UKey device to obtain the UKey signing certificate. The UKey device returns the obtained UKey signing certificate, and the job platform login software then sends the UKey signing certificate to the job platform via the network. In some embodiments, the job platform login software can verify the validity of the UKey signing certificate with the CA system. If the certificate is found to be valid, the software sends the UKey signing certificate to the job platform via the network.

[0101] Finally, based on the login confirmation response, the identity authentication result is obtained.

[0102] In this embodiment, receiving a login confirmation response from the job platform indicating successful login means that the user has successfully authenticated their identity and is allowed to access the job platform to perform tasks.

[0103] In some embodiments, during the process of authenticating the login user in the operation platform login software based on the UKey device, the UKey driver communicates with the UKey device using a second encryption protection channel. The second encryption protection channel uses a second encryption method to encrypt the communication command data. The second encryption method is to obtain a second symmetric key by distributing the UKey serial number based on a base key, and then encrypt and protect the communication command data based on the second symmetric key.

[0104] The base key is obtained based on a device authentication random number, which is a random number generated during the authentication process of the UKey device.

[0105] In this embodiment, after the UKey device and UKey driver have device authentication permissions, all communication command data between the driver and the UKey device is transmitted using a second encrypted protection channel. Please refer to [link / reference]. Figure 7 , Figure 7The flowchart of the encryption method for the second protection channel according to an embodiment of this application is illustrated. The encryption method can be as follows: SM3 hashing is performed using the random numbers (first random number and second random number) generated by both parties during the authentication process between the terminal and the UKey device. The data obtained by XORing the first 16 bytes and the last 16 bytes is used as the base key. Then, the unique identifier of the UKey device (UKey serial number SN) is distributed to obtain the symmetric key KEY2. The communication command data is encrypted and protected using the SM4 algorithm ECB mode.

[0106] By using the second encrypted protection channel to communicate during the authentication process of the login user in the operation platform login software based on the UKey device, the communication command data can be protected, thereby improving the security and reliability of the authentication.

[0107] By setting up a first encryption protection channel and a second encryption protection channel, a dual-channel encryption protection method is implemented to encrypt and protect communication data, thereby enhancing the security level of the UKey secure access terminal. Only after UKey device authentication or user authentication can the corresponding private key be used for computation and communication data interaction, further improving the security of identity authentication.

[0108] The following example illustrates the identity authentication process. Please refer to [link / reference]. Figures 8-13 The identity authentication process includes the following steps: 1. Log in to the job terminal system with normal user privileges, insert the user UKey device, and open the job platform login software to perform identity authentication and login operations.

[0109] 2. The terminal system operating platform login software will load the UKey dedicated driver and automatically perform device authentication. Only after the UKey device is successfully authenticated can the user identity authentication login process continue.

[0110] 3. The terminal system operating platform login software calls the UKey dedicated driver to send an instruction to the UKey to obtain the UKey signature certificate and UKey encryption certificate. The instruction data is protected according to the encryption method of protection channel two. The signature certificate and encryption certificate returned by the UKey are obtained, and the validity of the UKey signature certificate and encryption certificate are verified with the CA system. If invalid, the identity authentication login process is exited.

[0111] 4. The terminal system operation platform login software sends the UKey signature certificate and UKey encryption certificate to the operation platform via the network.

[0112] 5. The operating platform verifies the validity of the UKey signing certificate and encryption certificate with the CA system. If invalid, it exits the identity authentication login process.

[0113] 6. The operating platform sends the server signature certificate and encryption certificate to the terminal system via the network.

[0114] 7. The terminal system operating platform login software verifies the validity of the server-side signature certificate and encryption certificate with the CA system. If invalid, it exits the identity authentication login process.

[0115] 8. The terminal system operating platform login software calls the UKey dedicated driver to send a command to the UKey to obtain the UKey serial number. The command data is protected according to the encryption method of protection channel two, and the 16-byte serial number SN returned by the UKey is obtained.

[0116] 9. The terminal system operating platform login software calls the UKey dedicated driver to send a command to the UKey to obtain a random number. The command data is protected according to the encryption method of protection channel two, and the 16-byte random number R4 returned by the UKey is obtained.

[0117] 10. The terminal system operating platform login software uses a software algorithm to encrypt R4|SN with the public key in the server's encryption certificate using SM2, resulting in Cipher2.

[0118] 11. The terminal system operation platform login software sends an identity authentication login request to the operation platform, and at the same time sends the encrypted Cipher2 to the operation platform.

[0119] 12. The operating platform decrypts Cipher2 using the server's decryption private key by calling the cryptographic machine to obtain R4|SN, and then uses its own signing private key to perform SM2 signing on R4|SN to obtain a 64-byte signature value S2.

[0120] 13. The work platform generates a 16-byte random number R5, and uses the encryption public key in the UKey's encryption certificate to encrypt R4|SN|R5 using SM2 to obtain the ciphertext Cipher3.

[0121] 14. The operating platform returns an identity authentication login response to the terminal system, and simultaneously sends the ciphertext Cipher3 and signature value S2 to the terminal system.

[0122] 15. The terminal system operating platform login software calls the UKey dedicated driver to send the SM2 decryption command to the UKey. The command data is protected according to encryption method two. The ciphertext Cipher3 is decrypted to obtain the plaintext Data5. The first 32 bytes of Data5 are compared with R4|SN stored in the terminal system cache. If they do not match, the identity authentication login process is exited.

[0123] 16. The terminal system operating platform login software uses the signature public key in the server's signature certificate to perform SM2 verification on the original data R4|SN and the signature value S2. If the verification fails, the identity authentication login process will be exited.

[0124] 17. The terminal system operating platform login software calls the UKey dedicated driver to send an SM2 signature instruction to the UKey, protects the instruction data according to the encryption method of protection channel two, and performs SM2 signature on the original text R4|SN|R5 using the UKey's signature private key to obtain a 64-byte signature value S3.

[0125] 18. The terminal system operation platform login software sends an identity authentication login confirmation operation to the operation platform, and at the same time sends the signature value S3 to the operation platform.

[0126] 19. The operating platform uses the public key of the signature certificate in the UKey to perform SM2 verification on the original data R4|SN|R5 and the signature value S3. If the verification fails, the platform exits the identity authentication login process.

[0127] 20. The work platform returns a response confirming successful identity authentication and login to the terminal system, after which the work platform allows the terminal system to access the system.

[0128] 21. After the terminal system receives a response from the job platform confirming successful identity authentication login, it indicates that the identity authentication login is successful and the user can be allowed to access the job platform to perform tasks.

[0129] In the above implementation process, a UKey driver and a job platform login software are installed on the terminal. Upon detecting a UKey device, the UKey driver is invoked to authenticate the UKey device. If the UKey device authentication is successful, the login user of the job platform login software is authenticated based on the UKey device, resulting in an authentication result. By using the UKey driver to authenticate the UKey device from the terminal, and only performing user authentication when the UKey device authentication is successful, the security of identity authentication is improved, preventing user identity theft.

[0130] The aforementioned UKey driver can be based on the libusb driver. Leveraging the features of the open-source libusb driver, this UKey driver allows ordinary users on the terminal to interact with the UKey device without administrator privileges. By combining UKey certificate management with user PIN codes, the secure access method for the terminal system is made more secure and user-friendly.

[0131] In some embodiments, the terminal is provided with a first state machine, and the UKey device is provided with a second state machine; The step of authenticating the login user in the job platform login software based on the UKey device and obtaining the authentication result includes: authenticating the login user in the job platform login software based on the UKey device while both the first state machine and the second state machine are in the authentication state, and obtaining the authentication result.

[0132] In this embodiment, when both the first and second state machines are in state 1, only device authentication-related instruction data can be sent to the UKey device. When both the first and second state machines are in state 2, ordinary users can use the job platform login software and the job platform server to send job data. The first state machine is initially in state 1, and after successful device authentication, the state of the first state machine switches to state 2. When the first state machine is in state 1, the UKey driver sends the device authentication instruction data to the UKey device. After receiving the data from the UKey driver, the UKey device parses the data according to the state of the second state machine. If the parsing fails, it will inform the UKey driver that the two state machines are inconsistent, and the UKey driver will also switch to state 1 to re-initiate the device authentication process.

[0133] By adding corresponding state machines to both the UKey driver and the UKey device, illegal command attacks can be intercepted at the driver layer, improving attack resistance. When a power loss occurs due to plugging or unplugging the UKey device, without state machines, a chaotic situation arises where the driver believes the device has been authenticated while the UKey device remains in its initial state. By setting separate state machines, the UKey device can provide real-time feedback of its true state to the UKey driver. The UKey driver can then determine the appropriate operation based on the actual state of the UKey device, preventing confusion and improving program execution reliability.

[0134] This embodiment provides a terminal equipped with a USB port for connecting a UKey device, and the terminal is used to implement the aforementioned UKey-based identity authentication method.

[0135] In this embodiment, please refer to Figure 15 , Figure 15This diagram schematically illustrates a terminal initialization flowchart according to an embodiment of this application. Terminals can be categorized into management terminals and job terminals based on their intended use. Management terminals require user management software to maintain and manage the binding and unbinding of ordinary user identities and UKeys. Job terminals require job platform login software; user authentication and login are required before corresponding job operations can be performed. Terminal authentication of the UKey device is achieved through the UKey driver within the terminal. User authentication is only performed when the UKey device is successfully authenticated, thus improving authentication security and preventing user identity theft.

[0136] This embodiment provides a UKey device for implementing the above-described UKey-based identity authentication method.

[0137] In this embodiment, please refer to Figure 14 , Figure 14 A schematic diagram illustrating the UKey initialization flowchart according to an embodiment of this application is provided. The aforementioned UKey device is a dedicated hardware device containing a dedicated security computing chip, capable of performing various encryption and decryption operations, signature verification, generation of public / private key pairs, etc., and equipped with a hardware random number generator. The UKey device can also store digital certificates and private keys; the private key can only participate in operations within the UKey and cannot be read out. The UKey device is pre-loaded with the user's initial PIN code and transmission key upon factory release. Ordinary users are prompted to change the initial PIN code and transmission key upon first login to the operating platform. The UKey driver in the terminal enables terminal authentication of the UKey device. User authentication is only performed after successful UKey device authentication, improving authentication security and preventing user identity theft.

[0138] This embodiment provides a UKey-based identity authentication system, including a UKey device and a terminal. The UKey device is connected to the terminal, and the terminal is equipped with a UKey driver and a working platform login software. The terminal is used to call the UKey driver to authenticate the UKey device when a UKey device is detected; and if the UKey device is successfully authenticated, the terminal uses the UKey device to authenticate the login user of the operating platform login software and obtains the authentication result.

[0139] In this embodiment, there can be one or more terminals; for example, please refer to 16. Figure 16The diagram schematically illustrates the overall block diagram of the basic environment according to an embodiment of this application. The terminal includes a management terminal and a job terminal. The management terminal only needs to install the UKey-specific driver and user management software. The job terminal requires not only the installation of the UKey-specific driver and job platform login software, but also the administrator of the terminal system to add different users and their permissions before the job terminal can be distributed to ordinary users for operation. The job platform and its server used for authentication cover functions such as asymmetric key generation and storage, certificate storage (server certificate), random number generation, and signature verification. The certificate management system can be a certificate issuance CA system supporting SM2 authentication, SM1 / SM4 encryption / decryption operations, and SM3 hash operations. User certificates and server certificates are both issued by root certificates and are certificates at the same level.

[0140] By installing a UKey driver and the operating platform login software on the terminal, and upon detecting a UKey device, the UKey driver is invoked to authenticate the UKey device. If the UKey device authentication is successful, the login user of the operating platform login software is authenticated based on the UKey device, and the authentication result is obtained. By implementing terminal authentication of the UKey device through the UKey driver, and only performing login user authentication when the UKey device authentication is successful, the security of identity authentication is improved, preventing user identity theft.

[0141] Please refer to Figure 17 , Figure 17 This schematically illustrates a structural block diagram of a UKey-based identity authentication device according to an embodiment of this application. This embodiment provides a UKey-based identity authentication device applied to a terminal, the terminal having a UKey driver and operating platform login software installed; the device includes a device authentication module 410 and an identity authentication module 420, wherein: The device authentication module 410 is used to call the UKey driver to authenticate the UKey device when a UKey device is detected. The identity authentication module 420 is used to authenticate the login user of the operation platform login software based on the UKey device when the UKey device is successfully authenticated, and obtain the identity authentication result.

[0142] The UKey-based identity authentication device includes a processor and a memory. The device authentication module 410 and identity authentication module 420 are stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0143] The processor contains a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured, and UKey-based authentication can be implemented by adjusting kernel parameters.

[0144] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0145] This invention provides a machine-readable storage medium storing a program that, when executed by a processor, implements the UKey-based authentication method.

[0146] This invention provides a processor for running a program, wherein the program executes the UKey-based authentication method during runtime.

[0147] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 18 As shown in the figure, the computer device includes a processor A01, a network interface A02, a display screen A04, an input device A05, and a memory (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A06. The non-volatile storage medium A06 stores an operating system B01 and a computer program B02. The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A06. The network interface A02 is used for communication with external terminals via a network connection. When the computer program is executed by the processor A01, it implements a UKey-based authentication method. The display screen A04 can be an LCD screen or an e-ink display screen. The input device A05 can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0148] Those skilled in the art will understand that Figure 18 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0149] In one embodiment, the UKey-based authentication device provided in this application can be implemented as a computer program, which can be implemented in the form of, for example... Figure 18 The computer device shown runs on this device. The computer device's memory can store the various program modules that make up the UKey-based authentication device, for example, Figure 17 The device authentication module 410 and the identity authentication module 420 are shown. The computer program, composed of these modules, causes the processor to execute the steps of the UKey-based identity authentication methods described in the various embodiments of this application.

[0150] Figure 18 The computer device shown can be used as follows Figure 17 The device authentication module 410 in the UKey-based identity authentication device shown executes step 210, and the identity authentication module 420 executes step 220.

[0151] This application provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. The device is applied to a terminal, which has a UKey driver and operating platform login software installed. When the processor executes the program, it performs the following steps: If a UKey device is detected, the UKey driver is invoked to authenticate the UKey device; If the UKey device is successfully authenticated, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

[0152] In one embodiment, the terminal is provided with a first state machine, and the UKey device is provided with a second state machine; The process of authenticating the login user in the operation platform login software based on the UKey device and obtaining the authentication result includes: When both the first state machine and the second state machine are in the authentication state, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

[0153] In one embodiment, during the process of authenticating the UKey device by calling the UKey driver, the UKey driver and the UKey device communicate using a first encryption protection channel. The first encryption protection channel encrypts the communication command data using a first encryption method. The first encryption method is to use the UKey transmission key to distribute the UKey serial number to obtain a first symmetric key, and then encrypt and protect the communication command data based on the first symmetric key.

[0154] In one embodiment, during the authentication of the login user in the operation platform login software based on the UKey device, the UKey driver communicates with the UKey device using a second encryption protection channel. The second encryption protection channel uses a second encryption method to encrypt the communication command data. The second encryption method is to obtain a second symmetric key by distributing the UKey serial number based on a base key, and then encrypt and protect the communication command data based on the second symmetric key.

[0155] In one embodiment, the base key is obtained based on a device authentication random number, which is a random number generated during the authentication process of the UKey device.

[0156] In one embodiment, the step of invoking the UKey driver to authenticate the UKey device includes: The UKey driver sends a device authentication request instruction to the UKey device; The UKey device determines a first signature value based on the device authentication request instruction and the UKey serial number, and sends the first signature value to the UKey driver; The UKey driver verifies the first signature value, and if the first signature value passes the verification, sends a device authentication confirmation command to the UKey device. The UKey device generates an authentication confirmation result based on the device authentication confirmation command, and sends the authentication confirmation result to the UKey driver.

[0157] In one embodiment, the device authentication request instruction includes a first random number, which is generated by the UKey driver; The step of determining the first signature value by the UKey device based on the device authentication request command and the UKey serial number includes: The first original data is obtained by concatenating the first random number, the second random number, and the UKey serial number by the UKey device, and the second random number is generated by the UKey device. The first original data is signed by the UKey device to obtain the first signature value.

[0158] In one embodiment, the step of verifying the first signature value by the UKey driver and sending a device authentication confirmation command to the UKey device if the first signature value verification is successful includes: The UKey driver obtains the UKey serial number and the second random number sent by the UKey device; The second original data is obtained by concatenating the first random number, the second random number, and the UKey serial number, driven by the UKey driver. The UKey driver verifies the first signature value based on the second original data; If the first signature value passes verification, the UKey drives the hash operation on the second original data to obtain the first hash value; The UKey driver generates a device authentication confirmation instruction based on the first hash value and sends the device authentication confirmation instruction to the UKey device.

[0159] In one embodiment, the step of generating an authentication confirmation result by the UKey device based on the device authentication confirmation command and sending the authentication confirmation result to the UKey driver includes: The UKey device performs a hash operation on the first original data to obtain a second hash value; The UKey device compares the first hash value and the second hash value in the device authentication confirmation command to obtain the authentication confirmation result, and sends the authentication confirmation result to the UKey driver.

[0160] In one embodiment, the step of authenticating the login user of the operating platform login software based on the UKey device and obtaining the authentication result includes: Based on the UKey serial number, generate an identity authentication login request and send the identity authentication login request to the operation platform; The operating platform returns an identity authentication login response based on the identity authentication login request; The identity authentication login response is verified, and if the identity authentication login response is verified successfully, a login confirmation operation instruction is generated and sent to the operation platform. The operating platform returns a login confirmation response based on the login confirmation operation instruction; Based on the login confirmation response, the identity authentication result is obtained.

[0161] In one embodiment, generating an identity authentication login request based on the UKey serial number includes: Obtain the UKey serial number and the third random number sent by the UKey device; The UKey serial number and the third random number are concatenated to obtain the third original data; The third original data is encrypted to obtain the first ciphertext; Based on the first encrypted message, an identity authentication login request is generated.

[0162] In one embodiment, the step of the operating platform returning an identity authentication login response based on the identity authentication login request includes: The operating platform decrypts the first ciphertext to obtain decrypted data, and signs the decrypted data to obtain a second signature value; The operating platform concatenates the decrypted data and the fourth random number to obtain the fourth original data, and then encrypts the fourth original data to obtain the second ciphertext. The operating platform returns an identity authentication login response based on the second signature value and the second ciphertext.

[0163] In one embodiment, verifying the identity authentication login response, and generating a login confirmation operation instruction and sending the login confirmation operation instruction to the operating platform if the identity authentication login response is verified successfully, includes: The second signature value and the second ciphertext are obtained by parsing the identity authentication login response; The second ciphertext is sent to the UKey device for decryption to obtain plaintext data; The plaintext data is compared with the third original data to obtain the comparison result; If the comparison results are consistent, the second signature value is verified based on the third original data. If the verification is successful, the plaintext data is sent to the UKey device for signing to obtain the third signature value. Based on the third signature value, a login confirmation operation instruction is generated and sent to the operating platform.

[0164] In one embodiment, the step of the operating platform returning a login confirmation response based on the login confirmation operation instruction includes: The operating platform verifies the third signature value in the login confirmation operation instruction based on the fourth original data, obtains a second verification result, and returns a login confirmation response based on the second verification result.

[0165] In one embodiment, the terminal is further equipped with user management software; the method further includes: If a UKey device is detected, the user management software is used to bind the user identity to the UKey device.

[0166] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0168] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0169] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0170] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0171] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0172] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0173] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0174] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A UKey-based identity authentication method, characterized in that, The method is applied to a terminal, which has a UKey driver and an operating platform login software installed; the method includes: If a UKey device is detected, the UKey driver is invoked to authenticate the UKey device; If the UKey device is successfully authenticated, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

2. The UKey-based identity authentication method according to claim 1, characterized in that, The terminal is equipped with a first state machine, and the UKey device is equipped with a second state machine; The process of authenticating the login user in the operation platform login software based on the UKey device and obtaining the authentication result includes: When both the first state machine and the second state machine are in the authentication state, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

3. The UKey-based identity authentication method according to claim 1, characterized in that, During the process of authenticating the UKey device by calling the UKey driver, the UKey driver and the UKey device communicate using a first encryption protection channel. The first encryption protection channel encrypts the communication command data using a first encryption method. The first encryption method is to use the UKey transmission key to distribute the UKey serial number to obtain a first symmetric key, and then encrypt and protect the communication command data based on the first symmetric key.

4. The UKey-based identity authentication method according to claim 1, characterized in that, During the process of authenticating the login user in the operation platform login software based on the UKey device, the UKey driver communicates with the UKey device using a second encryption protection channel. The second encryption protection channel uses a second encryption method to encrypt the communication command data. The second encryption method is to obtain a second symmetric key by distributing the UKey serial number based on the base key, and then encrypt and protect the communication command data based on the second symmetric key.

5. The UKey-based identity authentication method according to claim 4, characterized in that, The base key is obtained based on a device authentication random number, which is a random number generated during the authentication process of the UKey device.

6. The UKey-based identity authentication method according to claim 1, characterized in that, The step of calling the UKey driver to authenticate the UKey device includes: The UKey driver sends a device authentication request instruction to the UKey device; The UKey device determines a first signature value based on the device authentication request instruction and the UKey serial number, and sends the first signature value to the UKey driver; The UKey driver verifies the first signature value, and if the first signature value passes the verification, sends a device authentication confirmation command to the UKey device. The UKey device generates an authentication confirmation result based on the device authentication confirmation command, and sends the authentication confirmation result to the UKey driver.

7. The UKey-based identity authentication method according to claim 6, characterized in that, The device authentication request instruction includes a first random number, which is generated by the UKey driver. The step of determining the first signature value by the UKey device based on the device authentication request command and the UKey serial number includes: The first original data is obtained by concatenating the first random number, the second random number, and the UKey serial number by the UKey device, and the second random number is generated by the UKey device. The first original data is signed by the UKey device to obtain the first signature value.

8. The UKey-based identity authentication method according to claim 7, characterized in that, The step of verifying the first signature value by the UKey driver and sending a device authentication confirmation command to the UKey device if the first signature value verification is successful includes: The UKey driver obtains the UKey serial number and the second random number sent by the UKey device; The second original data is obtained by concatenating the first random number, the second random number, and the UKey serial number, driven by the UKey driver. The UKey driver verifies the first signature value based on the second original data; If the first signature value passes verification, the UKey drives the hash operation on the second original data to obtain the first hash value; The UKey driver generates a device authentication confirmation instruction based on the first hash value and sends the device authentication confirmation instruction to the UKey device.

9. The UKey-based identity authentication method according to claim 8, characterized in that, The step of generating an authentication confirmation result based on the device authentication confirmation command by the UKey device and sending the authentication confirmation result to the UKey driver includes: The UKey device performs a hash operation on the first original data to obtain a second hash value; The UKey device compares the first hash value and the second hash value in the device authentication confirmation command to obtain the authentication confirmation result, and sends the authentication confirmation result to the UKey driver.

10. The UKey-based identity authentication method according to claim 1, characterized in that, The process of authenticating the login user of the operating platform login software based on the UKey device and obtaining the authentication result includes: Based on the UKey serial number, generate an identity authentication login request and send the identity authentication login request to the operation platform; The operating platform returns an identity authentication login response based on the identity authentication login request; The identity authentication login response is verified, and if the identity authentication login response is verified successfully, a login confirmation operation instruction is generated and sent to the operation platform. The operating platform returns a login confirmation response based on the login confirmation operation instruction; Based on the login confirmation response, the identity authentication result is obtained.

11. The UKey-based identity authentication method according to claim 10, characterized in that, The step of generating an identity authentication login request based on the UKey serial number includes: Obtain the UKey serial number and the third random number sent by the UKey device; The UKey serial number and the third random number are concatenated to obtain the third original data; The third original data is encrypted to obtain the first ciphertext; Based on the first encrypted message, an identity authentication login request is generated.

12. The UKey-based identity authentication method according to claim 11, characterized in that, The step of the operating platform returning an identity authentication login response based on the identity authentication login request includes: The operating platform decrypts the first ciphertext to obtain decrypted data, and signs the decrypted data to obtain a second signature value; The operating platform concatenates the decrypted data and the fourth random number to obtain the fourth original data, and then encrypts the fourth original data to obtain the second ciphertext. The operating platform returns an identity authentication login response based on the second signature value and the second ciphertext.

13. The UKey-based identity authentication method according to claim 12, characterized in that, The step of verifying the identity authentication login response, and generating a login confirmation operation instruction and sending the login confirmation operation instruction to the operation platform if the identity authentication login response is verified successfully, includes: The second signature value and the second ciphertext are obtained by parsing the identity authentication login response; The second ciphertext is sent to the UKey device for decryption to obtain plaintext data; The plaintext data is compared with the third original data to obtain the comparison result; If the comparison results are consistent, the second signature value is verified based on the third original data. If the verification is successful, the plaintext data is sent to the UKey device for signing to obtain the third signature value. Based on the third signature value, a login confirmation operation instruction is generated and sent to the operating platform.

14. The UKey-based identity authentication method according to claim 13, characterized in that, The step of the operating platform returning a login confirmation response based on the login confirmation operation instruction includes: The operating platform verifies the third signature value in the login confirmation operation instruction based on the fourth original data, obtains a second verification result, and returns a login confirmation response based on the second verification result.

15. The UKey-based identity authentication method according to claim 1, characterized in that, The terminal is also equipped with user management software; the method further includes: If a UKey device is detected, the user management software is used to bind the user identity to the UKey device.

16. A terminal, characterized in that, The terminal is provided with a USB port for connecting a UKey device, and the terminal is used to implement the UKey-based identity authentication method according to any one of claims 1-15.

17. A UKey device, characterized in that, Used to implement the UKey-based identity authentication method as described in any one of claims 1-15.

18. A UKey-based identity authentication system, characterized in that, It includes a UKey device and a terminal, wherein the UKey device is connected to the terminal, and the terminal is equipped with a UKey driver and an operating platform login software; The terminal is used to call the UKey driver to authenticate the UKey device when a UKey device is detected; If the UKey device is successfully authenticated, the login user of the operation platform login software is authenticated based on the UKey device to obtain the authentication result.

19. A UKey-based identity authentication device, characterized in that, Applied to a terminal, the terminal having a UKey driver and operating platform login software installed; the device includes: The device authentication module is used to call the UKey driver to authenticate the UKey device when a UKey device is detected. The identity authentication module is used to authenticate the login user of the operation platform login software based on the UKey device when the UKey device is successfully authenticated, and obtain the identity authentication result.

20. An electronic device, characterized in that, The electronic device includes: At least one processor; A memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the UKey-based authentication method according to any one of claims 1 to 15 by executing the instructions stored in the memory.

21. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the UKey-based authentication method according to any one of claims 1 to 15.

Images