Authorization authentication method and authorization authentication system

Abstract

The application provides an authorization authentication method and system, which comprises the following steps: interacting with a server to obtain authorization request information, interacting with a fingerprint U disk to obtain first-stage ciphertext information, and determining whether the registration challenge of a client is successful; if yes, interacting with the server to obtain authorization challenge information based on the identity authentication identifier of the client, interacting with the fingerprint U disk to obtain second-stage ciphertext information based on the identity authentication identifier, and determining whether the authorization challenge of the client is successful, wherein the identity authentication identifier is generated based on fingerprint data of a user and a device identifier of the fingerprint U disk; if yes, interacting with the server to obtain security channel establishment information based on the identity authentication identifier, interacting with the fingerprint U disk to obtain third-stage ciphertext information based on the identity authentication identifier, determining whether the authorization authentication of the client is successful, and determining whether a secure connection is established between the client and the server, thereby improving the security of identity authorization access control.

Description

Technical Field

[0001] This application relates to the field of network security communication technology, and more specifically, to an authorization and authentication method and system. Background Technology

[0002] In the field of network security communication, identity authorization and access control is a crucial link in ensuring the security of information systems. It can ensure that the identities of the entities participating in the communication are authentic and trustworthy, and that the data transmission process is secure and controllable.

[0003] Currently, identity authorization and access control rely on Public Key Infrastructure (PKI) and Transport Layer Security (TLS). The PKI system is large and complex, with cumbersome key distribution and lifecycle management, and excessive reliance on certificate services from trusted third-party authorities. Furthermore, the TLS protocol cannot guarantee the legitimacy of the client operator, meaning it cannot effectively identify whether the person currently using the client device is an authorized user, posing a significant security risk. Additionally, the TLS handshake process requires multiple rounds of interactive verification, resulting in a lengthy handshake and significant overhead on system memory and network traffic, making it unsuitable for scenarios with high concurrency and low latency requirements.

[0004] Therefore, existing technologies for identity-based access control have certain limitations. Summary of the Invention

[0005] The purpose of this application is to address the shortcomings of the prior art by providing an authorization and authentication method and system to solve the practical problem of the limitations of identity authorization and access control in the prior art.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide an authorization and authentication method applied to a client in an authorization and authentication system, wherein the client is communicatively connected to a fingerprint USB key; the method includes: The system exchanges authorization request information with the server and first-stage encrypted information with the fingerprint U-shield, and determines whether the client's registration challenge is successful. If so, authorization challenge information is exchanged between the client's identity authentication identifier and the server, and a second-stage encrypted information exchange is conducted between the identity authentication identifier and the fingerprint U-shield, and it is determined whether the client's authorization challenge is successful. The identity authentication identifier is generated based on the user's fingerprint data and the device identifier of the fingerprint U-shield. If so, a secure channel is established between the identity authentication identifier and the server for information exchange, and a third-stage encrypted information exchange is conducted between the identity authentication identifier and the fingerprint U-shield. It is also determined whether the client's authorization authentication is successful and whether a secure connection is established between the client and the server.

[0007] As an optional implementation, the process includes exchanging authorization request information with the server, exchanging first-stage encrypted information with the fingerprint U-shield, and determining whether the client's registration challenge was successful, including: Receive the first random number sent by the fingerprint U-shield, and send an authorization request message to the server according to the first random number; The system receives and parses the authorization response message sent by the server to obtain authorization response data, which includes a cipher suite identifier, a first ciphertext, and an authentication code. The authorization response data is sent to the fingerprint USB key; Receive the first return data sent by the fingerprint U-shield, the first return data including the first decrypted plaintext and the verification code; The success of the client's registration challenge is determined based on the authorization response data and the first returned data.

[0008] As an optional implementation, receiving the first return data sent by the fingerprint U-shield includes: Receive the temporary data encryption key sent by the fingerprint U-shield; Send the temporary data encryption key and the first ciphertext to the fingerprint U-shield; The system receives the first decrypted plaintext sent by the fingerprint U-shield, wherein the first decrypted plaintext includes at least the encryption public key of the server, the signature public key of the server, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield; Receive the verification code sent by the fingerprint U-shield.

[0009] As an optional implementation, the authorization challenge information exchange between the client's authentication identifier and the server, and the second-stage encrypted information exchange between the authentication identifier and the fingerprint USB key, and the determination of whether the client's authorization challenge is successful, include: The second return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Based on the second returned data, an authorization challenge request message is sent to the server. The authorization challenge response message sent by the server is received and parsed to obtain authorization challenge response data, which includes a fourth ciphertext, a fifth ciphertext, and a second signature data; Send the authorization challenge response data to the fingerprint U-shield; The third return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data. The success of the client's authorization challenge is determined based on the authorization challenge response data and the third return data.

[0010] As an optional implementation, receiving the second return data sent by the fingerprint U-shield based on the identity authentication identifier includes: Receive the third random number sent by the fingerprint U-shield; Perform an XOR operation on the second random number and the third random number to generate the first encryption key, and send the third random number and the server's encryption public key to the fingerprint U-shield; Receive the second ciphertext sent by the fingerprint U-shield; The identity authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number and first encryption key are sent to the fingerprint U-shield; Receive the third ciphertext sent by the fingerprint U-shield; Send the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; The system receives the first signature data sent by the fingerprint U-shield, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0011] As an optional implementation, receiving the third return data sent by the fingerprint U-shield based on the identity authentication identifier includes: Send the fourth ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive a fourth random number sent by the fingerprint U-shield, wherein the fourth random number is generated by a hardware cryptographic module deployed on the server. Perform an XOR operation on the third random number and the fourth random number to generate a second encryption key, and send the second encryption key, the fifth ciphertext, and the fourth random number to the fingerprint U-shield; The system receives a second decrypted plaintext sent by the fingerprint U-shield. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server by performing a hash operation on the identifier of the hardware cryptographic module and a fifth random number generated by the hardware cryptographic module. Send the identity authentication identifier and the user registration identifier to the fingerprint U-shield; Receive the first hash result sent by the fingerprint U-shield; Send the server's identifier, the user registration identifier, the first hash result, and the server's signature public key to the fingerprint U-shield; Receive the first signature verification data sent by the fingerprint U-shield.

[0012] As an optional implementation, the step of establishing a secure channel for information exchange between the identity authentication identifier and the server, and conducting third-stage encrypted information exchange between the identity authentication identifier and the fingerprint U-shield, and determining whether the client's authorization authentication is successful, and whether a secure connection has been established between the client and the server, includes: The fourth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fourth return data includes the sixth ciphertext and the third signature data. Based on the fourth returned data, a secure channel establishment request message is sent to the server. Receive and parse the secure channel establishment response message sent by the server to obtain secure channel establishment response data, which includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data; Send the security channel establishment response data to the fingerprint U-shield; The fifth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext. Based on the established response data of the secure channel and the fifth returned data, it is determined whether the client's authorization authentication was successful, and whether a secure connection was established between the client and the server.

[0013] As an optional implementation, receiving the fourth return data sent by the fingerprint U-shield based on the identity authentication identifier includes: Receive the sixth random number sent by the fingerprint U-shield; Send the user registration identifier, the sixth random number, and the server-side encryption public key to the fingerprint U-shield; Receive the sixth ciphertext sent by the fingerprint U-shield; Send the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; Receive the third signature data sent by the fingerprint U-shield.

[0014] As an optional implementation, receiving the fifth return data sent by the fingerprint U-shield based on the identity authentication identifier includes: Send the seventh ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive the seventh random number sent by the fingerprint U-shield, wherein the seventh random number is generated by the hardware cryptographic module deployed on the server; Send the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier to the fingerprint U-shield; Receive the second signature verification data sent by the fingerprint U-shield; The server identifier, the first hash result, the seventh random number, and the sixth random number are sent to the fingerprint U-shield; Receive the session key sent by the fingerprint U-shield; Send the session key and the eighth ciphertext to the fingerprint U-shield; Receive the third decrypted plaintext sent by the fingerprint U-shield.

[0015] Secondly, embodiments of this application provide an authorization and authentication method applied to a fingerprint U-shield in an authorization and authentication system, wherein the fingerprint U-shield is communicatively connected to a client; the method includes: A first-stage encrypted information exchange is performed with the client so that the client can determine whether the client's registration challenge is successful; The client performs a second-stage encrypted information exchange with the client based on the client's identity authentication identifier, so that the client can determine whether the client's authorization challenge is successful. The identity authentication identifier is generated in advance by the fingerprint U-shield based on the user's fingerprint data and the device identifier of the fingerprint U-shield. A third-stage encrypted information exchange is conducted between the identity authentication identifier and the client, enabling the client to determine whether the client's authorization authentication was successful.

[0016] As an optional implementation, the first-stage encrypted information exchange with the client includes: Generate a first random number and send the first random number to the client; Receive authorization response data sent by the client, the authorization response data including a cipher suite identifier, a first ciphertext, and an authentication code; First return data is generated based on the authorized response data, and the first return data is sent to the client. The first return data includes a first decrypted plaintext and a verification code.

[0017] As an optional implementation, generating first return data based on the authorization response data and sending the first return data to the client includes: A hash operation is performed on the cipher suite identifier, the client's device type, the client's application type, and the first random number to obtain a temporary data encryption key, and the temporary data encryption key is sent to the client; Receive the temporary data encryption key and the first ciphertext sent by the client; The first ciphertext is decrypted based on the temporary data encryption key to obtain the first decrypted plaintext, wherein the first decrypted plaintext includes at least the encryption public key of the server, the signature public key of the server, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext to the client; Receive the first decrypted plaintext and the temporary data encryption key sent by the client; Based on the first decrypted plaintext and the temporary data encryption key, the verification code is obtained and sent to the client.

[0018] As an optional implementation, the second-stage encrypted information exchange between the client and the client based on the client's authentication identifier includes: The second return data is generated based on the identity authentication identifier and sent to the client. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Receive authorization challenge response data sent by the client, the authorization challenge response data including fourth ciphertext, fifth ciphertext and second signature data; The third return data is generated based on the authorized challenge response data and the identity authentication identifier, and the third return data is sent to the client. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data.

[0019] As an optional implementation, generating second return data based on the identity authentication identifier and sending the second return data to the client includes: Generate a third random number and send the third random number to the client; Receive the third random number sent by the client and the server's encryption public key; The third random number is encrypted using the server's public key to obtain the second ciphertext, and the second ciphertext is sent to the client. The system receives the authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number, and first encryption key sent by the client. Based on the third random number and the first encryption key, the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are encrypted to obtain the third ciphertext, and the third ciphertext is sent to the client. Receive the authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are signed to obtain the first signature data, and the first signature data is sent to the client, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0020] As an optional implementation, the step of generating third return data based on the authorization challenge response data and the identity authentication identifier, and sending the third return data to the client, includes: Receive the fourth ciphertext sent by the client and the encryption private key of the fingerprint U-shield; The fourth ciphertext is decrypted based on the encryption private key of the fingerprint U-shield to obtain a fourth random number, and the fourth random number is sent to the client. The fourth random number is generated by the hardware cryptographic module deployed on the server. Receive the second encryption key, the fifth ciphertext, and the fourth random number sent by the client; Based on the fourth random number and the second encryption key, the fifth ciphertext is decrypted to obtain the second decrypted plaintext, and the second decrypted plaintext is sent to the client. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server in advance by performing a hash operation on the identifier of the hardware cryptographic module and the fifth random number generated by the hardware cryptographic module. Receive the authentication identifier and the user registration identifier sent by the client; Perform a hash operation on the identity authentication identifier and the user registration identifier to obtain the first hash result, and send the first hash result to the client; Receive the server's identifier, the user registration identifier, the first hash result, and the server's signature public key sent by the client; The first signature verification data is obtained based on the server's identifier, the user registration identifier, the first hash result, and the server's signature public key, and then sent to the client.

[0021] As an optional implementation, the third-stage encrypted information exchange between the authentication identifier and the client includes: The fourth return data is generated based on the identity authentication identifier and sent to the client. The fourth return data includes the sixth ciphertext and the third signature data. The system receives secure channel establishment response data sent by the client, which includes a seventh ciphertext, an eighth ciphertext, and a fourth signature data. The fifth return data is generated based on the established response data of the secure channel and the identity authentication identifier, and then sent to the client. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

[0022] As an optional implementation, generating fourth return data based on the identity authentication identifier and sending the fourth return data to the client includes: Generate a sixth random number and send the sixth random number to the client; Receive the sixth random number, user registration identifier, and server encryption public key sent by the client; The sixth random number and the user registration identifier are encrypted using the server's decryption public key to obtain the sixth ciphertext, and the sixth ciphertext is sent to the client. Receive the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the first hash result and the sixth random number are signed to obtain the third signature data, and the third signature data is sent to the client, wherein the signature identifier of the third signature data is the user registration identifier.

[0023] As an optional implementation, the step of generating fifth return data based on the secure channel establishment response data and the identity authentication identifier, and sending the fifth return data to the client, includes: Receive the seventh ciphertext sent by the client and the encryption private key of the fingerprint U-shield; Based on the encryption private key of the fingerprint U-shield, the seventh ciphertext is decrypted to obtain a seventh random number, and the seventh random number is sent to the client. The seventh random number is generated by the hardware cryptographic module deployed on the server. Receive the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier sent by the client; The second signature verification data is obtained based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier, and then sent to the client. Receive the server's identifier, first hash result, seventh random number, and sixth random number sent by the client; A hash operation is performed on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain the session key, and the session key is sent to the client. Receive the session key and the eighth ciphertext sent by the client; Based on the session key, the eighth ciphertext is decrypted to obtain the third decrypted plaintext, and the third decrypted plaintext is sent to the client.

[0024] Thirdly, embodiments of this application provide an authorization authentication device corresponding to the authorization authentication method executed by the client, the authorization authentication device comprising: The first determining module is used to exchange authorization request information with the server, exchange first-stage encrypted information with the fingerprint U-shield, and determine whether the client's registration challenge is successful. The second determining module is used to, if so, perform authorization challenge information exchange between the client and the server based on the client's identity authentication identifier, and perform second-stage encrypted information exchange between the identity authentication identifier and the fingerprint U-shield, and determine whether the client's authorization challenge is successful, wherein the identity authentication identifier is generated based on the user's fingerprint data and the device identifier of the fingerprint U-shield; The third determining module is used to, if yes, establish information exchange between the identity authentication identifier and the server based on a secure channel, and establish third-stage encrypted information exchange between the identity authentication identifier and the fingerprint U-shield, and determine whether the client's authorization authentication is successful, and whether a secure connection is established between the client and the server.

[0025] As an optional implementation, the first determining module is specifically used for: Receive the first random number sent by the fingerprint U-shield, and send an authorization request message to the server according to the first random number; The system receives and parses the authorization response message sent by the server to obtain authorization response data, which includes a cipher suite identifier, a first ciphertext, and an authentication code. The authorization response data is sent to the fingerprint USB key; Receive the first return data sent by the fingerprint U-shield, the first return data including the first decrypted plaintext and the verification code; The success of the client's registration challenge is determined based on the authorization response data and the first returned data.

[0026] As an optional implementation, the first determining module is specifically used for: Receive the temporary data encryption key sent by the fingerprint U-shield; Send the temporary data encryption key and the first ciphertext to the fingerprint U-shield; The system receives the first decrypted plaintext sent by the fingerprint U-shield, wherein the first decrypted plaintext includes at least the encryption public key of the server, the signature public key of the server, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield; Receive the verification code sent by the fingerprint U-shield.

[0027] As an optional implementation, the second determining module is specifically used for: The second return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Based on the second returned data, an authorization challenge request message is sent to the server. The authorization challenge response message sent by the server is received and parsed to obtain authorization challenge response data, which includes a fourth ciphertext, a fifth ciphertext, and a second signature data; Send the authorization challenge response data to the fingerprint U-shield; The third return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data. The success of the client's authorization challenge is determined based on the authorization challenge response data and the third return data.

[0028] As an optional implementation, the second determining module is specifically used for: Receive the third random number sent by the fingerprint U-shield; Perform an XOR operation on the second random number and the third random number to generate the first encryption key, and send the third random number and the server's encryption public key to the fingerprint U-shield; Receive the second ciphertext sent by the fingerprint U-shield; The identity authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number and first encryption key are sent to the fingerprint U-shield; Receive the third ciphertext sent by the fingerprint U-shield; Send the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; The system receives the first signature data sent by the fingerprint U-shield, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0029] As an optional implementation, the second determining module is specifically used for: Send the fourth ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive a fourth random number sent by the fingerprint U-shield, wherein the fourth random number is generated by a hardware cryptographic module deployed on the server. Perform an XOR operation on the third random number and the fourth random number to generate a second encryption key, and send the second encryption key, the fifth ciphertext, and the fourth random number to the fingerprint U-shield; The system receives a second decrypted plaintext sent by the fingerprint U-shield. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server by performing a hash operation on the identifier of the hardware cryptographic module and a fifth random number generated by the hardware cryptographic module. Send the identity authentication identifier and the user registration identifier to the fingerprint U-shield; Receive the first hash result sent by the fingerprint U-shield; Send the server's identifier, the user registration identifier, the first hash result, and the server's signature public key to the fingerprint U-shield; Receive the first signature verification data sent by the fingerprint U-shield.

[0030] As an optional implementation, the third determining module is specifically used for: The fourth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fourth return data includes the sixth ciphertext and the third signature data. Based on the fourth returned data, a secure channel establishment request message is sent to the server. Receive and parse the secure channel establishment response message sent by the server to obtain secure channel establishment response data, which includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data; Send the security channel establishment response data to the fingerprint U-shield; The fifth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext. Based on the established response data of the secure channel and the fifth returned data, it is determined whether the client's authorization authentication was successful, and whether a secure connection was established between the client and the server.

[0031] As an optional implementation, the third determining module is specifically used for: Receive the sixth random number sent by the fingerprint U-shield; Send the user registration identifier, the sixth random number, and the server-side encryption public key to the fingerprint U-shield; Receive the sixth ciphertext sent by the fingerprint U-shield; Send the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; Receive the third signature data sent by the fingerprint U-shield.

[0032] As an optional implementation, the third determining module is specifically used for: Send the seventh ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive the seventh random number sent by the fingerprint U-shield, wherein the seventh random number is generated by the hardware cryptographic module deployed on the server; Send the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier to the fingerprint U-shield; Receive the second signature verification data sent by the fingerprint U-shield; The server identifier, the first hash result, the seventh random number, and the sixth random number are sent to the fingerprint U-shield; Receive the session key sent by the fingerprint U-shield; Send the session key and the eighth ciphertext to the fingerprint U-shield; Receive the third decrypted plaintext sent by the fingerprint U-shield.

[0033] Fourthly, embodiments of this application provide an authorization authentication device corresponding to the authorization authentication method performed by a fingerprint U-shield, the authorization authentication device comprising: The first interaction module is used to perform a first-stage encrypted information exchange with the client, so that the client can determine whether the client's registration challenge is successful. The second interaction module is used to perform a second-stage encrypted information exchange between the client and the client based on the client's identity authentication identifier, so that the client can determine whether the client's authorization challenge is successful. The identity authentication identifier is generated in advance by the fingerprint U-shield based on the user's fingerprint data and the device identifier of the fingerprint U-shield. The third interaction module is used to perform third-stage encrypted information exchange with the client based on the identity authentication identifier, so that the client can determine whether the client's authorization authentication is successful.

[0034] As an optional implementation, the first interaction module is specifically used for: Generate a first random number and send the first random number to the client; Receive authorization response data sent by the client, the authorization response data including a cipher suite identifier, a first ciphertext, and an authentication code; First return data is generated based on the authorized response data, and the first return data is sent to the client. The first return data includes a first decrypted plaintext and a verification code.

[0035] As an optional implementation, the first interaction module is specifically used for: A hash operation is performed on the cipher suite identifier, the client's device type, the client's application type, and the first random number to obtain a temporary data encryption key, and the temporary data encryption key is sent to the client; Receive the temporary data encryption key and the first ciphertext sent by the client; The first ciphertext is decrypted based on the temporary data encryption key to obtain the first decrypted plaintext, wherein the first decrypted plaintext includes at least the encryption public key of the server, the signature public key of the server, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext to the client; Receive the first decrypted plaintext and the temporary data encryption key sent by the client; Based on the first decrypted plaintext and the temporary data encryption key, the verification code is obtained and sent to the client.

[0036] As an optional implementation, the second interaction module is specifically used for: The second return data is generated based on the identity authentication identifier and sent to the client. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Receive authorization challenge response data sent by the client, the authorization challenge response data including fourth ciphertext, fifth ciphertext and second signature data; The third return data is generated based on the authorized challenge response data and the identity authentication identifier, and the third return data is sent to the client. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data.

[0037] As an optional implementation, the second interaction module is specifically used for: Generate a third random number and send the third random number to the client; Receive the third random number sent by the client and the server's encryption public key; The third random number is encrypted using the server's public key to obtain the second ciphertext, and the second ciphertext is sent to the client. The system receives the authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number, and first encryption key sent by the client. Based on the third random number and the first encryption key, the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are encrypted to obtain the third ciphertext, and the third ciphertext is sent to the client. Receive the authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the identity authentication identifier, the user registration identifier, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are signed to obtain the first signature data, and the first signature data is sent to the client, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0038] As an optional implementation, the second interaction module is specifically used for: Receive the fourth ciphertext sent by the client and the encryption private key of the fingerprint U-shield; The fourth ciphertext is decrypted based on the encryption private key of the fingerprint U-shield to obtain a fourth random number, and the fourth random number is sent to the client. The fourth random number is generated by the hardware cryptographic module deployed on the server. Receive the second encryption key, the fifth ciphertext, and the fourth random number sent by the client; Based on the fourth random number and the second encryption key, the fifth ciphertext is decrypted to obtain the second decrypted plaintext, and the second decrypted plaintext is sent to the client. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server in advance by performing a hash operation on the identifier of the hardware cryptographic module and the fifth random number generated by the hardware cryptographic module. Receive the authentication identifier and the user registration identifier sent by the client; Perform a hash operation on the identity authentication identifier and the user registration identifier to obtain the first hash result, and send the first hash result to the client; Receive the server's identifier, the user registration identifier, the first hash result, and the server's signature public key sent by the client; The first signature verification data is obtained based on the server's identifier, the user registration identifier, the first hash result, and the server's signature public key, and then sent to the client.

[0039] As an optional implementation, the third interaction module is specifically used for: The fourth return data is generated based on the identity authentication identifier and sent to the client. The fourth return data includes the sixth ciphertext and the third signature data. The system receives secure channel establishment response data sent by the client, which includes a seventh ciphertext, an eighth ciphertext, and a fourth signature data. The fifth return data is generated based on the established response data of the secure channel and the identity authentication identifier, and then sent to the client. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

[0040] As an optional implementation, the third interaction module is specifically used for: Generate a sixth random number and send the sixth random number to the client; Receive the sixth random number, user registration identifier, and server encryption public key sent by the client; The sixth random number and the user registration identifier are encrypted using the server's decryption public key to obtain the sixth ciphertext, and the sixth ciphertext is sent to the client. Receive the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the first hash result and the sixth random number are signed to obtain the third signature data, and the third signature data is sent to the client, wherein the signature identifier of the third signature data is the user registration identifier.

[0041] As an optional implementation, the third interaction module is specifically used for: Receive the seventh ciphertext and the encryption private key of the fingerprint U-shield sent by the client; Based on the encryption private key of the fingerprint U-shield, the seventh ciphertext is decrypted to obtain a seventh random number, and the seventh random number is sent to the client. The seventh random number is generated by the hardware cryptographic module deployed on the server. Receive the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier sent by the client; The second signature verification data is obtained based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier, and then sent to the client. Receive the server's identifier, first hash result, seventh random number, and sixth random number sent by the client; A hash operation is performed on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain the session key, and the session key is sent to the client. Receive the session key and the eighth ciphertext sent by the client; Based on the session key, the eighth ciphertext is decrypted to obtain the third decrypted plaintext, and the third decrypted plaintext is sent to the client.

[0042] Fifthly, embodiments of this application provide an electronic device, which is the client or the fingerprint U-shield. The electronic device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The processor executes the machine-readable instructions to perform the method steps as described in the first aspect or the fingerprint U-shield described in the second aspect.

[0043] Sixthly, embodiments of this application provide an authorization and authentication system, which includes: a client, a fingerprint U-shield, and a server, wherein the fingerprint U-shield is communicatively connected to the client; The client is used to perform the steps of the method described in the first aspect above; The fingerprint U-shield is used to perform the steps of the method described in the second aspect above.

[0044] The beneficial effects of this application are: This application provides an authorization authentication method and system. The client interacts with the server to exchange authorization request information, and with the fingerprint U-shield to exchange encrypted information in the first stage, determining whether the client's registration challenge was successful. After the client's registration challenge is successful, the client interacts with the server to exchange authorization challenge information based on its authentication identifier, and with the fingerprint U-shield to exchange encrypted information in the second stage, determining whether the client's authorization challenge was successful. After the client's authorization challenge is successful, the client interacts with the server to exchange secure channel establishment information based on its authentication identifier, and with the fingerprint U-shield to exchange encrypted information in the third stage, determining whether the client's authorization authentication was successful and whether a secure connection was established between the client and the server. Because the authentication identifier is pre-generated by the fingerprint U-shield based on the user's fingerprint data and the fingerprint U-shield's device identifier, the user and the fingerprint U-shield are strongly bound together. During the identity authorization access control process, when the client interacts with the server and the fingerprint U-shield based on its authentication identifier, it can accurately identify whether the user corresponding to the client initiating the authorization authentication is a legitimate user, ensuring that the current client user is a legitimate person and guaranteeing the security of identity authorization access control. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic diagram of the architecture of the authorization and authentication system provided in the embodiments of this application; Figure 2 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 1 ; Figure 3 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 2 ; Figure 4 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 3 ; Figure 5 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 4 ; Figure 6 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 5 ; Figure 7 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 6 ; Figure 8 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 7 ; Figure 9 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 8 ; Figure 10 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 9 ; Figure 11 A module structure diagram of an authorization and authentication device provided in an embodiment of this application; Figure 12 A module structure diagram of another authorization and authentication device provided in the embodiments of this application; Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0048] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0049] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0050] Currently, identity authorization and access control rely on PKI and TLS. The PKI system is large and complex, with cumbersome key distribution and lifecycle management, and excessive reliance on certificate services from trusted third-party authorities. Furthermore, the TLS protocol cannot effectively identify whether the user currently using the client device is an authorized user, posing a significant security risk. Additionally, the TLS handshake process requires multiple rounds of interactive verification, resulting in lengthy handshake times and significant overhead on system memory and network traffic, making it unsuitable for high-concurrency, low-latency scenarios. In other words, existing identity authorization and access control technologies have certain limitations.

[0051] Based on the above-mentioned problems, this application provides an authorization and authentication method that generates an identity authentication identifier for the client based on the user's fingerprint data and the device identifier of the fingerprint U-shield. During the registration challenge, authorization challenge, and authorization authentication process on the client, the identity authentication identifier of the client can be used to verify whether the person currently using the client device is an authorized user, thereby improving the security of identity authorization access control.

[0052] Figure 1This is a schematic diagram of the architecture of the authorization and authentication system provided in the embodiments of this application, such as... Figure 1 As shown, the authorization and authentication system includes a client, a fingerprint USB key, and a server. Figure 1 For example, the client communicates with the fingerprint U-shield and the server respectively. For instance, the fingerprint U-shield can be plugged into the Universal Serial Bus (USB) interface of the client.

[0053] The client and server exchange information during the authentication and authorization control process, including authorization request information exchange, authorization challenge information exchange, and secure channel establishment information exchange. The client also engages in multi-stage encrypted information exchange with the fingerprint U-shield, including first-stage, second-stage, and third-stage encrypted information exchange. Specifically, the client exchanges authorization challenge and secure channel establishment information with the server based on its own authentication identifier, and conducts second-stage and third-stage encrypted information exchange with the fingerprint U-shield based on its own authentication identifier. Furthermore, the client's authentication identifier is generated by the fingerprint U-shield based on the user's fingerprint data and the fingerprint U-shield's device identifier, which can identify whether the user currently using the client is an authorized user.

[0054] Specifically, the server receives authorization request messages sent by the client and sends authorization response messages to the client based on the authorization request messages; it also receives authorization challenge request messages sent by the client and sends authorization challenge response messages to the client based on the authorization challenge request messages; and it receives secure channel establishment request messages sent by the client and sends secure channel establishment response messages to the client based on the secure channel establishment request messages.

[0055] By having the client interact with the server and fingerprint U-shield multiple times during the identity authorization process based on the client's identity authentication identifier, the legitimacy of the user currently using the client can be accurately identified, thereby improving the security of identity authorization access control.

[0056] Figure 2 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 1 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method is explained. Figure 2 As shown, the method includes: S101. The client and server exchange authorization request information.

[0057] Optionally, the fingerprint U-shield is inserted into the client. After the client activates the fingerprint U-shield through fingerprint verification, it initiates an authorization request to the accessed server and exchanges authorization request information with the server to obtain authorization request interaction information.

[0058] S102. The client and the fingerprint U-shield exchange encrypted information in the first stage.

[0059] Optionally, the client interacts with the fingerprint U-shield based on the authorization request information to exchange first-stage encrypted information and obtain the registration challenge information.

[0060] S103. The client determines whether the client's registration challenge was successful.

[0061] Optionally, the client verifies the registration challenge interaction information based on the authorization request interaction information, and determines whether the client's registration challenge is successful based on the verification result. Specifically, if the verification passes, the client's registration challenge is considered successful.

[0062] S104. If so, the client interacts with the server on authorization challenge information based on the client's identity authentication identifier. The identity authentication identifier is generated in advance by the fingerprint U-shield based on the user's fingerprint data and the device identifier of the fingerprint U-shield.

[0063] Optionally, after the client successfully completes the registration challenge, the client initiates an authorization challenge request to the server based on the client's identity authentication identifier CPSN, and exchanges authorization challenge information with the server to obtain the signature information of the authorization challenge exchange.

[0064] Specifically, the fingerprint U-shield pre-generates a client authentication identifier (CPSN) based on the user's fingerprint data and the U-shield's device identifier. The fingerprint U-shield uses the SM3 cryptographic hash algorithm to calculate the hash value of the user's fingerprint data, obtaining SM3 (the user's fingerprint data). Then, it uses the SM3 algorithm to perform a hash operation between the hash value of the user's fingerprint data and the U-shield's device identifier. The resulting hash value is used as the client's authentication identifier (CPSN).

[0065] In other words, the authentication identifier CPSN = SM3(SM3(user's fingerprint data) || fingerprint U-shield device identifier). Since fingerprint data is a unique and uncopyable biometric identifier, the client's authentication identifier CPSN, generated by hashing the user's fingerprint data and the fingerprint U-shield's device identifier, strongly binds the user to the fingerprint U-shield. During subsequent identity authorization and access control processes, the client's authentication identifier CPSN can accurately identify whether the user corresponding to the client initiating authorization authentication is a legitimate user, ensuring that the current client user is an authorized person.

[0066] S105. The client performs a second-stage encrypted information exchange with the fingerprint U-shield based on the client's identity authentication identifier.

[0067] Optionally, the client, based on its identity authentication identifier CPSN and the signature information of the authorization challenge interaction, conducts a second-stage encrypted information exchange with the fingerprint U-shield to obtain the signature verification information of the authorization challenge interaction.

[0068] S106. The client determines whether the client's authorization challenge was successful.

[0069] Optionally, the client performs authorization challenge verification based on the signature information and verification information of the authorization challenge interaction to determine whether the client's authorization challenge is successful. If the authorization challenge verification passes, the client's authorization challenge is considered successful.

[0070] S107. If so, the client establishes a secure channel for information exchange with the server based on the client's identity authentication identifier.

[0071] Optionally, after the client's authorization challenge is successful, the client initiates a secure channel establishment request to the server based on the client's identity authentication identifier CPSN, and exchanges secure channel establishment information with the server to obtain the signature information of the secure channel establishment interaction.

[0072] S108. The client performs third-stage encrypted information exchange with the fingerprint U-shield based on the client's identity authentication identifier.

[0073] Optionally, the client uses its identity authentication identifier CPSN and the signature information for establishing the secure channel to perform third-stage encrypted information exchange with the fingerprint U-shield, thereby obtaining the verification information for establishing the secure channel.

[0074] S109. The client determines whether the client's authorization authentication was successful and whether a secure connection has been established between the client and the server.

[0075] Optionally, the client compares the signature information and verification information of the secure channel establishment interaction to determine whether the client's authorization authentication is successful.

[0076] If the authorization authentication comparison passes, it is determined that the client's authorization authentication is successful, and the session key with the server is successfully negotiated, thus establishing a secure connection between the client and the server.

[0077] In this embodiment, the client interacts with the server to exchange authorization request information, and with the fingerprint U-shield to exchange encrypted information in the first stage, determining whether the client's registration challenge was successful. After the client's registration challenge is successful, the client interacts with the server to exchange authorization challenge information based on the client's identity authentication identifier, and with the fingerprint U-shield to exchange encrypted information in the second stage, determining whether the client's authorization challenge was successful. After the client's authorization challenge is successful, the client interacts with the server to exchange secure channel establishment information based on the client's identity authentication identifier, and with the fingerprint U-shield to exchange encrypted information in the third stage, determining whether the client's authorization authentication was successful, and whether a secure connection has been established between the client and the server. Since the identity authentication identifier is pre-generated by the fingerprint U-shield based on the user's fingerprint data and the fingerprint U-shield's device identifier, the user and the fingerprint U-shield are strongly bound together. During the identity authorization access control process, when the client interacts with the server and the fingerprint U-shield based on the client's identity authentication identifier, it can accurately identify whether the user corresponding to the client initiating the authorization authentication is a legitimate user, ensuring that the current client user is a legitimate person and guaranteeing the security of identity authorization access control.

[0078] Figure 3 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 2 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 3 As shown, the above steps include: authorization request information exchange between the client and server; first-stage encrypted information exchange between the client and fingerprint U-shield; and the client determining whether the registration challenge was successful. S201, Generate the first random number using the fingerprint U-shield.

[0079] Optionally, the fingerprint U-shield is equipped with a random number generator to generate a high-quality first random number RC.

[0080] The fingerprint U-shield obtains a high-quality first random number RC from the random number generator. The high-quality first random number RC is used to implement resistance to quantum attacks.

[0081] S202, the fingerprint U-shield sends the first random number to the client.

[0082] Optionally, the fingerprint U-shield sends a first random number RC to the client.

[0083] S203. The client generates an authorization request message based on the first random number.

[0084] Optionally, the client generates an authorization request message based on a first random number RC, the client's device type, the type of application in the client that initiated the authorization request, the current time, and the client's cipher suite list.

[0085] The data format of the authorization request message can be (client device type||application type||current time||cipher suite list||first random number RC), where the cipher suite list is a combination of encryption or signature algorithms supported by the client.

[0086] S204. The client sends an authorization request message to the server.

[0087] Optionally, the client sends an authorization request message to the server. The server parses the authorization request message, selects a cipher suite identifier (CSAID) that matches the client, and obtains a second random number (RS) from the hardware cryptographic module deployed on the server. The server obtains a temporary data encryption key (MKEY) obtained by the hardware cryptographic module through SM3 cryptographic hash operation based on the client's device type, application type, cipher suite identifier (CSAID), and the first random number (RC) obtained from the authorization request message.

[0088] The server also obtains the first ciphertext Enc_msg_rsp obtained by the hardware cryptographic module through SM4 symmetric encryption based on the server standard time Ts, the validity period, the server encryption public key, the server signature public key, the second random number RS, and the temporary data encryption key MKEY.

[0089] That is, SM4_CBC_ENC(server standard time Ts||validity period||server encryption public key||server signing public key||second random number RS) yields the first ciphertext Enc_msg_rsp. Here, SM4 is a symmetric encryption / decryption algorithm, CBC represents Cipher Block Chaining (CBC) mode, and ENC represents Encryption. In SM4 symmetric encryption, the Initialization Vector (IV) is the last 16 bytes of the temporary data encryption key MKEY, and the encryption key is the first 16 bytes of the temporary data encryption key MKEY.

[0090] The server also obtains the authentication code hmac_msg_s by performing hash and key authentication processing on the hardware cryptographic module based on the server standard time Ts, validity period, server encryption public key, server signing public key, second random number RS, and temporary data encryption key MKEY. Specifically, it obtains the authentication code hmac_msg_s from HMAC_SM3(server standard time Ts||validity period||server encryption public key||server signing public key||second random number RS). The authentication key is the temporary data encryption key MKEY. HMAC_SM3 is a hash message authentication code (HMAC) based on the SM3 hash algorithm. HMAC combines the hash algorithm SM3 with a key to verify the integrity and authenticity of messages, preventing message tampering.

[0091] The server generates an authorization response message based on the cipher suite identifier (CSAID), the first ciphertext (Enc_msg_rsp), and the authentication code (hmac_msg_s). The data format of the authorization response message can be (CSAID||Authentication code (hmac_msg_s)||First ciphertext (Enc_msg_rsp)).

[0092] S205. The client receives the authorization response message sent by the server.

[0093] Optionally, the server sends an authorization response message to the client, and the client receives the authorization response message sent by the server. The authorization response message is generated by the server based on the Cipher Suite ID (CSAID), the first ciphertext (Enc_msg_rsp), and the authentication code (hmac_msg_s).

[0094] S206. The client parses the authorization response message sent by the server to obtain the authorization response data, which includes the cipher suite identifier, the first ciphertext, and the authentication code.

[0095] Optionally, the client parses the authorization response message sent by the server to obtain authorization response data. This authorization response data includes the Cipher Suite ID (CSAID), the first ciphertext Enc_msg_rsp, and the authentication code hmac_msg_s.

[0096] S207. The client sends the authorization response data to the fingerprint U-shield.

[0097] Optionally, the client sends the Cipher Suite ID (CSAID) from the authorization response data, as well as the client's device type, application type, and first random number (RC) from the authorization request data, to the fingerprint U-shield. The client also sends the first ciphertext (Enc_msg_rsp) from the authorization response data to the fingerprint U-shield.

[0098] S208, the fingerprint U-shield generates the first return data based on the authorization response data. The first return data includes the first decrypted plaintext and the verification code.

[0099] Optionally, the fingerprint U-shield decrypts the first decrypted plaintext based on the cipher suite identifier CSAID in the authorization response data sent by the client, the client's device type, application type and first random number RC in the authorization request data, and the first ciphertext Enc_msg_rsp in the authorization response data.

[0100] The fingerprint U-shield also performs hash and key verification processing on the first decrypted plaintext to obtain the verification code hmac_msg_c. The first decrypted plaintext and the verification code hmac_msg_c constitute the first returned data.

[0101] S209, the fingerprint U-shield sends the first returned data to the client.

[0102] Optionally, the fingerprint U-shield sends the first decrypted plaintext and verification code hmac_msg_c from the first returned data to the client.

[0103] S210. The client determines whether the client's registration challenge was successful based on the authorization response data and the first returned data.

[0104] Optionally, the client determines whether the client's registration challenge was successful based on the authentication code hmac_msg_s in the authorization response data and the verification code hmac_msg_c in the first returned data.

[0105] Specifically, the client verifies whether the verification code hmac_msg_c and the authentication code hmac_msg_s are the same. If they are different, the registration challenge fails; if they are the same, the registration challenge succeeds and the first decrypted plaintext is stored.

[0106] In this embodiment, the fingerprint U-shield generates a first random number and sends it to the client. The client generates an authorization request message based on the first random number and sends it to the server. The client receives and parses the authorization response message sent by the server, obtains the authorization response data, and sends it to the fingerprint U-shield. The fingerprint U-shield generates first return data based on the authorization response data and sends it to the client. The client determines whether the client's registration challenge is successful based on the authentication code in the authorization response data and the verification code in the first return data. If successful, the client stores the first decrypted plaintext in the first return data. Through the interaction of authorization request information between the client and the server, and the first-stage encrypted information interaction between the client and the fingerprint U-shield, the security of the registration challenge is improved.

[0107] Figure 4 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 3 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 4 As shown, in the above steps, the fingerprint U-shield generates first return data based on the authorization response data and sends the first return data to the client, including: S301, the fingerprint U-shield performs a hash operation on the password suite identifier, the client's device type, the client's application type, and the first random number to obtain a temporary data encryption key.

[0108] Optionally, the fingerprint U-shield receives the cipher suite identifier (CSAID) in the authorization response data sent by the client, as well as the client's device type, application type, and first random number (RC) in the authorization request data. It then uses the SM3 cryptographic hash algorithm to perform a hash operation on the cipher suite identifier (CSAID), the client's device type, the client's application type, and the first random number (RC) to obtain a temporary data encryption key (MKEY).

[0109] In other words, the temporary data encryption key MKEY=SM3(client device type||application type||crypto suite identifier CSAID||first random number RC).

[0110] S302, the fingerprint U-shield sends the temporary data encryption key to the client.

[0111] Optionally, the fingerprint U-shield sends a temporary data encryption key, MKEY, to the client.

[0112] S303, The client sends the temporary data encryption key and the first ciphertext to the fingerprint U-shield.

[0113] Optionally, the client sends the temporary data encryption key MKEY and the first ciphertext Enc_msg_rsp in the authorization response data to the fingerprint U-shield, which instructs the fingerprint U-shield to decrypt the first ciphertext Enc_msg_rsp using the temporary data encryption key MKEY as the decryption key.

[0114] It is worth noting that the fingerprint U-shield does not store data after encryption, decryption, signing, or verification. Before each encryption, decryption, signing, or verification process, it needs to obtain the key and data required for the calculation from the client.

[0115] S304. The fingerprint U-shield decrypts the first ciphertext based on the temporary data encryption key to obtain the first decrypted plaintext. The first decrypted plaintext includes at least the server's encryption public key, the server's signature public key, and a second random number from the hardware cryptographic module deployed on the server.

[0116] Optionally, the fingerprint U-shield performs SM4 symmetric decryption on the first ciphertext Enc_msg_rsp based on the temporary data encryption key MKEY to obtain the first decrypted plaintext. The first decrypted plaintext includes the server standard time Ts, the validity period, the server's public encryption key, the server's private encryption key, and a second random number RS. The second random number RS ​​is a high-quality random number generated by the hardware cryptographic module deployed on the server.

[0117] In other words, SM4_CBC_DEC(Enc_msg_rsp) = (Server standard time Ts||Validity period||Server encryption public key||Server signing public key||Second random number RS), where DEC stands for Decrypt. In SM4 symmetric decryption, IV is the last 16 bytes of the temporary data encryption key MKEY, and the decryption key is the first 16 bytes of the temporary data encryption key MKEY.

[0118] S305 and fingerprint U-shield send the first decrypted plaintext to the client.

[0119] Optionally, the fingerprint U-shield sends the first decrypted plaintext, namely the server standard time Ts, the validity period, the server encryption public key, the server encryption private key, and the second random number RS, to the client.

[0120] S306. The client sends the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield.

[0121] Optionally, the client sends the first decrypted plaintext, namely the server standard time Ts, the validity period, the server encryption public key, the server encryption private key, the second random number RS, and the temporary data encryption key MKEY, to the fingerprint U-shield. This is used to instruct the fingerprint U-shield to verify the first decrypted plaintext, namely the server standard time Ts, the validity period, the server encryption public key, the server encryption private key, and the second random number RS, using the temporary data encryption key MKEY as the verification key.

[0122] S307 and fingerprint U-shield verify the code based on the first decrypted plaintext and the temporary data encryption key.

[0123] Optionally, the fingerprint U-shield uses the temporary data encryption key MKEY as the verification key. After hashing and key verification of the first decrypted plaintext (i.e., the server standard time Ts, validity period, server encryption public key, server encryption private key, and second random number RS), the verification code hmac_msg_c is obtained. Specifically, HMAC_SM3(Server Standard Time Ts||Validity Period||Server Encryption Public Key||Server Signature Public Key||Second Random Number RS) yields the verification code hmac_msg_c.

[0124] In other words, the verification code hmac_msg_c = HMAC_SM3(server standard time Ts||validity period||server encryption public key||server signing public key||second random number RS).

[0125] S308 and fingerprint U-shield send the verification code to the client.

[0126] Optionally, the fingerprint U-shield sends the verification code hmac_msg_c to the client, so that the client can determine whether the registration challenge is successful by verifying whether the verification code hmac_msg_c is the same as the authentication code hmac_msg_s.

[0127] In this embodiment, the fingerprint U-shield performs a hash operation on the password suite identifier, the client's device type, the client's application type, and a first random number to obtain a temporary data encryption key, which is then sent to the client. The client sends the temporary data encryption key and the first ciphertext to the fingerprint U-shield and receives the first decrypted plaintext obtained by the fingerprint U-shield decrypting the first ciphertext based on the temporary data encryption key. The client sends the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield and receives the verification code obtained by the fingerprint U-shield based on the first decrypted plaintext and the temporary data encryption key. Under the client's instruction, the fingerprint U-shield generates first return data based on the authorization response data and sends it to the client, so that the client can determine whether the registration challenge was successful by verifying whether the verification code is the same as the authentication code.

[0128] Figure 5 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 4 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 5 As shown, in the above steps, the client interacts with the server to exchange authorization challenge information based on the client's authentication identifier, and interacts with the fingerprint U-shield to exchange second-stage encrypted information, and determines whether the client's authorization challenge is successful, including: S401, the fingerprint U-shield generates second return data based on the identity authentication identifier. The second return data includes second ciphertext, third ciphertext, and first signature data. The third ciphertext includes the encrypted identity authentication identifier.

[0129] Optionally, the fingerprint U-shield obtains the second ciphertext CSM2_RC2 through encryption operations based on the SM2 elliptic curve public key cryptography algorithm.

[0130] The fingerprint U-shield uses the authentication identifier CPSN sent by the client to perform SM4 encryption to obtain a third ciphertext CENC_MSG, which includes the encrypted authentication identifier CPSN. The fingerprint U-shield then performs a digital signature operation based on the SM2 elliptic curve public key cryptography algorithm to obtain the first signature data Csignature_msg.

[0131] Among them, the second ciphertext CSM2_RC2, the third ciphertext CENC_MSG, and the first signature data Csignature_msg are the second returned data.

[0132] S402, the fingerprint U-shield sends the second returned data to the client.

[0133] Optionally, the fingerprint U-shield sends the second ciphertext CSM2_RC2, the third ciphertext CENC_MSG, and the first signature data Csignature_msg from the second returned data to the client.

[0134] S403. The client generates an authorization challenge request message based on the second returned data.

[0135] Optionally, the client generates an authorization challenge request message based on the second ciphertext CSM2_RC2, the third ciphertext CENC_MSG, and the first signature data Csignature_msg in the second returned data.

[0136] The data format of the authorization challenge request message can be (second ciphertext CSM2_RC2||first signature data Csignature_msg||third ciphertext CENC_MSG).

[0137] S404. The client sends an authorization challenge request message to the server.

[0138] Optionally, the client sends the authorization challenge request to the server, and the server parses the authorization challenge request message to obtain the second ciphertext CSM2_RC2, the third ciphertext CENC_MSG, and the first signature data Csignature_msg.

[0139] The server-side hardware cryptography module obtains a third random number RC2 by performing a decryption operation on the second ciphertext CSM2_RC2 using the server-side encryption private key as the decryption key. This third random number RC2 is calculated as SM2_DEC(CSM2_RC2). The third random number RC2 is generated by the random number generator in the fingerprint U-shield.

[0140] The server performs an XOR operation on the second random number RS ​​and the third random number RC2 to obtain the first encryption key Rkey. The server obtains the decrypted plaintext obtained by the hardware cryptographic module using the third random number RC2 as the IV and the first encryption key Rkey as the decryption key to perform an SM4 decryption operation on the third ciphertext CENC_MSG. This plaintext includes the client's authentication identifier CPSN, user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield.

[0141] That is, (Authentication Detection Number CPSN || User Registration Code || Public Key of Fingerprint U-Shield || Public Key of Fingerprint U-Shield Signature) = SM4_CBC_DEC(CENC_MSG).

[0142] The server obtains the signature verification data Csignature_msg_c by performing a digital signature verification operation based on the SM2 elliptic curve public key cryptography algorithm on the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield using the identity authentication identifier CPSN as the signature verification identifier. That is, the signature verification data Csignature_msg_c = SM2_Verify(user registration identifier USERID || encryption public key of fingerprint U-shield || signature public key of fingerprint U-shield).

[0143] The server compares the value of the first signature data Csignature_msg with the verification data Csignature_msg_c to determine if the verification data Csignature_msg_c is correct. After confirming that the verification data Csignature_msg_c is correct, the server checks whether the user registration code has already been registered. If so, it obtains the corresponding user registration identifier USERID.

[0144] The server obtains and stores the first hash result UCID obtained by the hardware cryptographic module performing a cryptographic hash operation, namely SM3 operation, on the user registration identifier USERID and the client's authentication identifier CPSN. That is, the first hash result UCID = SM3(user registration identifier USERID || authentication identifier CPSN).

[0145] The server obtains the fourth random number RS2 generated by the hardware cryptographic module, and performs an XOR operation between RS2 and the third random number RC2 to obtain the second encryption key RSCkey. The server then obtains the fourth ciphertext SSM2_RS2 obtained by the hardware cryptographic module using the public key of the fingerprint U-shield as the encryption key and performing an encryption operation on the fourth random number RS2 based on the SM2 elliptic curve public key cryptography algorithm. That is, SSM2_RS2 = SM2_ENC(fourth random number RS2).

[0146] The server obtains the fifth ciphertext SENC_MSG by performing SM4 encryption on the server's identifier SSID and the user registration identifier USERID using the fourth random number RS2 as the IV and the second encryption key RSCkey as the encryption key. That is, the fifth ciphertext SENC_MSG = SM4_CBC_ENC(server identifier SSID || user registration identifier USERID).

[0147] The server identifier SSID is generated by the hardware cryptographic module deployed on the server by performing an SM3 hash operation on the hardware cryptographic module identifier HSN and the fifth random number SR generated by the hardware cryptographic module. That is, the server identifier SSID = SM3(SR||HSN).

[0148] The server also obtains the second signature data Ssignature_msg_s from the hardware cryptographic module's signature private key based on the server, and performs a digital signature operation based on the SM2 elliptic curve public key cryptography algorithm on the server's identifier SSID, the user registration identifier USERID, and the first hash result UCID.

[0149] That is, the second signature data Ssignature_msg_s=SM2_SIGN(server identifier SSID||user registration identifier USERID||first hash result UCID), where the signature identifier is the server identifier SSID.

[0150] The server generates an authorization challenge response message based on the fourth ciphertext SSM2_RS2, the second signature data Ssignature_msg_s, and the fifth ciphertext SENC_MSG. The data format of the authorization challenge response message can be (fourth ciphertext SSM2_RS2||second signature data Ssignature_msg_s||fifth ciphertext SENC_MSG).

[0151] S405. The client receives the authorization challenge response message sent by the server.

[0152] Optionally, the server sends an authorization challenge response message to the client, and the client receives the authorization challenge response message sent by the server. The authorization challenge response message is generated by the server based on the four-ciphertext SSM2_RS2, the second signature data Ssignature_msg_s, and the fifth ciphertext SENC_MSG.

[0153] S406. The client parses the authorization challenge response message sent by the server to obtain the authorization challenge response data, which includes the fourth ciphertext, the fifth ciphertext, and the second signature data.

[0154] Optionally, the client parses the authorization challenge response message sent by the server to obtain the authorization challenge response data. This data includes the fourth ciphertext SSM2_RS2, the second signature data Ssignature_msg_s, and the fifth ciphertext SENC_MSG.

[0155] S407. The client sends the authorization challenge response data to the fingerprint U-shield.

[0156] Optionally, the client sends the fourth ciphertext SSM2_RS2 and the fifth ciphertext SENC_MSG from the authorization challenge response data to the fingerprint U-shield, which instructs the fingerprint U-shield to decrypt the fourth ciphertext SSM2_RS2 and the fifth ciphertext SENC_MSG, and to verify the signature based on the decryption result.

[0157] S408 and fingerprint U-shield generate third return data based on authorization response data and identity authentication identifier. The third return data includes second decrypted plaintext, first hash result and first signature verification data.

[0158] Optionally, the fingerprint U-shield decrypts the fourth ciphertext SSM2_RS2 and the fifth ciphertext SENC_MSG in the authorization challenge response data sent by the client to obtain the second decrypted plaintext, and performs hash operation and signature verification operation based on the second decrypted plaintext to obtain the first hash result UCID and the first signature verification data Ssignature_msg_c.

[0159] Among them, the second decrypted plaintext, the first hash result UCID, and the first signature verification data Ssignature_msg_c are the third returned data.

[0160] S409 and the fingerprint U-shield send the third returned data to the client.

[0161] Optionally, the fingerprint U-shield sends the second decrypted plaintext, the first hash result UCID, and the first signature verification data Ssignature_msg_c from the third returned data to the client.

[0162] S410. The client determines whether the client's authorization challenge was successful based on the authorization challenge response data and the third-party return data.

[0163] Optionally, the client determines whether the client's authorization challenge was successful based on the second signature data Ssignature_msg_s in the authorization challenge response data and the first verification data Ssignature_msg_c in the third returned data.

[0164] Specifically, the client verifies whether the first signature data Ssignature_msg_c and the second signature data Ssignature_msg_s are the same. If they are different, the authorization challenge is determined to have failed; if they are the same, the authorization challenge is successful, and the second decrypted plaintext is stored.

[0165] In this embodiment, the fingerprint U-shield generates second return data based on the identity authentication identifier and sends it to the client. The client generates an authorization challenge request message based on the second return data and sends it to the server. The client receives and parses the authorization challenge response message sent by the server to obtain authorization challenge response data, which is then sent to the fingerprint U-shield. The client receives third return data sent by the fingerprint U-shield based on the authorization response data and the identity authentication identifier, and determines whether the client's authorization challenge was successful based on the authorization challenge response data and the third return data. By enabling the client to exchange authorization challenge information with the server based on its identity authentication identifier, and by enabling a second-stage encrypted information exchange with the fingerprint U-shield based on the identity authentication identifier, the security of the authorization challenge is enhanced.

[0166] Figure 6 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 5 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 6 As shown, in the above steps, the fingerprint U-shield generates second return data based on the identity authentication identifier and sends the second return data to the client, including: S501, the fingerprint U-shield generates a third random number.

[0167] Optionally, the fingerprint U-shield obtains a high-quality second random number RC2 from a random number generator.

[0168] S502 and fingerprint U-shield send a third random number to the client.

[0169] Optionally, the fingerprint U-shield sends a second random number RC2 to the client.

[0170] S503. The client performs an XOR operation on the second random number and the third random number to generate the first encryption key.

[0171] Optionally, the client performs an XOR operation on the second random number RS ​​and the third random number RC2 to generate the first encryption key Rkey.

[0172] S504. The client sends the third random number and the server's encrypted public key to the fingerprint U-shield.

[0173] Optionally, the client sends a third random number RC2 and the server's encryption public key to the fingerprint U-shield, instructing the fingerprint U-shield to encrypt the third random number RC2 based on the server's encryption public key.

[0174] The S505 fingerprint U-shield encrypts a third random number using the server's public key to obtain the second ciphertext.

[0175] Optionally, the fingerprint U-shield uses the server's public key as the encryption key to perform encryption operations on the third random number RC2 based on the SM2 elliptic curve public key cryptography algorithm to obtain the second ciphertext CSM2_RC2. That is, the second ciphertext CSM2_RC2 = SM2_ENC(RC2).

[0176] S506 and fingerprint U-shield send the second encrypted message to the client.

[0177] Optionally, the fingerprint U-shield sends the second encrypted text CSM2_RC2 to the client.

[0178] S507. The client sends the identity authentication identifier, user registration code, encryption public key of fingerprint U-shield, signature public key of fingerprint U-shield, third random number and first encryption key to fingerprint U-shield.

[0179] Optionally, the client sends the identity authentication identifier CPSN, user registration code, encryption public key of fingerprint U-shield, signature public key of fingerprint U-shield, third random number RC2 and first encryption key Rkey to fingerprint U-shield to instruct fingerprint U-shield to perform SM4 encryption operation.

[0180] S508 and the fingerprint U-shield encrypt the identity authentication identifier, user registration identifier, fingerprint U-shield's encryption public key, and fingerprint U-shield's signature public key based on the third random number and the first encryption key to obtain the third ciphertext.

[0181] Optionally, the fingerprint U-shield uses the third random number RC2 as the IV and the first encryption key Rkey as the encryption key to perform SM4 encryption operation on the identity authentication identifier CPSN, user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield to obtain the third ciphertext CENC_MSG.

[0182] That is, CENC_MSG=SM4_CBC_ENC(Authentication Token CPSN||User Registration Code||Fingerprint U-Shield Encryption Public Key||Fingerprint U-Shield Signing Public Key).

[0183] S509 and fingerprint U-shield send the third encrypted message to the client.

[0184] Optionally, the fingerprint U-shield sends the third ciphertext CENC_MSG to the client.

[0185] S510: The client sends the identity authentication identifier, user registration code, encryption public key of fingerprint U-shield, signature public key of fingerprint U-shield, and signature private key of fingerprint U-shield to fingerprint U-shield.

[0186] Optionally, the client sends the identity authentication identifier CPSN, user registration code, encryption public key of fingerprint U-shield, signature public key of fingerprint U-shield, and signature private key of fingerprint U-shield to fingerprint U-shield to instruct fingerprint U-shield to perform digital signature operation based on SM2 elliptic curve public key cryptography algorithm.

[0187] S511. The fingerprint U-shield uses the fingerprint U-shield's signature private key to sign the identity authentication identifier, user registration code, fingerprint U-shield's encryption public key, and fingerprint U-shield's signature public key to obtain first signature data, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0188] Optionally, the fingerprint U-shield uses the identity authentication identifier CPSN as the signature identifier, and performs digital signature verification operation based on the SM2 elliptic curve public key cryptography algorithm on the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield based on the signature private key of the fingerprint U-shield to obtain the first signature data Csignature_msg.

[0189] That is, the first signature data Csignature_msg=SM2_SIGN(|User registration identifier USERID||Encryption public key of fingerprint U-shield||Signing public key of fingerprint U-shield).

[0190] The S512 and fingerprint U-shield send the first signature data to the client.

[0191] Optionally, the fingerprint U-shield sends the first signature data Csignature_msg to the client, so that the client can generate an authorization challenge request message based on the second ciphertext CSM2_RC2, the third ciphertext CENC_MSG, and the first signature data Csignature_msg.

[0192] In this embodiment, the fingerprint U-shield generates a third random number and sends it to the client. The client performs an XOR operation on the second and third random numbers to generate a first encryption key. The fingerprint U-shield encrypts the third random number using the server's encryption public key to obtain a second ciphertext, which is then sent to the client. Based on the third random number and the first encryption key, the fingerprint U-shield encrypts the identity authentication identifier, user registration identifier, the fingerprint U-shield's encryption public key, and the fingerprint U-shield's signature public key to obtain a third ciphertext, which is then sent to the client. Finally, the fingerprint U-shield signs the user registration code, the fingerprint U-shield's encryption public key, and the fingerprint U-shield's signature public key using its signature private key to obtain first signature data, which is then sent to the client. This allows the client to generate an authorization challenge request message based on the second ciphertext, the third ciphertext, and the first signature data.

[0193] Figure 7 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 6 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 7 As shown, in the above steps, the fingerprint U-shield generates third-party return data based on the authorization challenge response data and the identity authentication identifier, and sends the third-party return data to the client, including: S601. The client sends the fourth ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield.

[0194] Optionally, the client sends the fourth ciphertext SSM2_RS2 in the authorization challenge response data and the encryption private key of the fingerprint U-shield to the fingerprint U-shield to instruct the fingerprint U-shield to perform decryption operations.

[0195] S602. The fingerprint U-shield decrypts the fourth ciphertext based on the encryption private key of the fingerprint U-shield to obtain the fourth random number, which is generated by the hardware cryptographic module deployed on the server.

[0196] Optionally, the fingerprint U-shield uses the encryption private key of the fingerprint U-shield as the decryption key to perform a decryption operation on the fourth ciphertext SSM2_RS2 based on the SM2 elliptic curve public key cryptography algorithm to obtain the fourth random number RS2. The fourth random number RS2 is generated by the hardware cryptographic module deployed on the server.

[0197] That is, the fourth random number RS2 = SM2_DEC(SSM2_RS2).

[0198] S603 and fingerprint U-shield send the fourth random number to the client.

[0199] Optionally, the fingerprint U-shield sends a fourth random number RS2 to the client.

[0200] S604. The client performs an XOR operation on the third random number and the fourth random number to generate the second encryption key.

[0201] Optionally, the client performs an XOR operation on the fourth random number RS2 and the third random number RC2 to generate the second encryption key RSCkey.

[0202] S605, the client sends the second encryption key, the fifth ciphertext, and the fourth random number to the fingerprint U-shield.

[0203] Optionally, the client sends the second encryption key RSCkey, the fifth ciphertext SENC_MSG, and the fourth random number RS2 to the fingerprint U-shield to instruct the fingerprint U-shield to perform SM4 decryption.

[0204] S606 and the fingerprint U-shield decrypt the fifth ciphertext based on the fourth random number and the second encryption key to obtain the second decrypted plaintext. The second decrypted plaintext includes the server's identifier and the user registration identifier. The server's identifier is generated by the hardware cryptographic module deployed on the server by performing a hash operation on the hardware cryptographic module's identifier and the fifth random number generated by the hardware cryptographic module.

[0205] Optionally, the fingerprint U-shield uses the fourth random number RS2 as the IV and the second encryption key RSCkey as the decryption key to perform SM4 decryption on the fifth ciphertext SENC_MSG to obtain the second decrypted plaintext. The second decrypted plaintext includes the server's identifier SSID and the user's registration identifier USERID. That is, the second decrypted plaintext = SM4_CBC_DEC(the fifth ciphertext SENC_MSG).

[0206] The server identifier SSID is generated by the hardware cryptographic module deployed on the server by performing an SM3 hash operation on the hardware cryptographic module identifier HSN and the fifth random number SR generated by the hardware cryptographic module. That is, the server identifier SSID = SM3(SR||HSN).

[0207] S607 and fingerprint U-shield send the second decrypted plaintext to the client.

[0208] Optionally, the fingerprint U-shield sends the second decrypted plaintext, namely the server's identifier SSID and the user's registration identifier USERID, to the client.

[0209] S608: The client sends the identity authentication identifier and user registration identifier to the fingerprint U-shield.

[0210] Optionally, the client sends the server's identifier SSID and the user registration identifier USERID to the fingerprint U-shield to instruct the fingerprint U-shield to perform SM3 hash operation.

[0211] S609 and the fingerprint U-shield perform a hash operation on the identity authentication identifier and the user registration identifier to obtain the first hash result.

[0212] Optionally, the fingerprint U-shield performs an SM3 hash operation on the server's identifier SSID and the user registration identifier USERID to obtain the first hash result UCID.

[0213] That is, the first hash result UCID=SM3(User Registration Identifier USERID||Authentication Identifier CPSN).

[0214] The S610 and fingerprint U-shield send the first hash result to the client.

[0215] Optionally, the fingerprint U-shield sends the first hash result, UCID, to the client.

[0216] S611, The client sends the server's identifier, user registration identifier, first hash result, and the server's signature public key to the fingerprint U-shield.

[0217] Optionally, the client sends the server's identifier SSID, the user registration identifier USERID, the first hash result UCID, and the server's signature public key to the fingerprint U-shield to instruct the fingerprint U-shield to perform signature verification calculation.

[0218] S612, the fingerprint U-shield obtains the first verification data based on the server's identifier, the user registration identifier, the first hash result, and the server's signature public key, wherein the verification identifier of the first verification data is the server's identifier.

[0219] Optionally, the fingerprint U-shield uses the server's identifier SSID as the signature verification identifier and the server's signature public key as the signature verification public key. It performs a digital signature operation based on the SM2 elliptic curve public key cryptography algorithm on the server's identifier SSID, the user registration identifier USERID, and the first hash result UCID to obtain the first signature verification data Ssignature_msg_c.

[0220] That is, the first signature verification data Ssignature_msg_c = SM2_Verify(server identifier SSID || user registration identifier USERID || first hash result UCID).

[0221] S613 and fingerprint U-shield send the first signature verification data to the client.

[0222] Optionally, the fingerprint U-shield sends the first signature verification data Ssignature_msg_c to the client so that the client can verify whether the first signature verification data Ssignature_msg_c is the same as the second signature data Ssignature_msg_s, thereby determining whether the client's authorization challenge is successful.

[0223] In this embodiment, the fingerprint U-shield decrypts the fourth ciphertext using its private encryption key to obtain a fourth random number, which is then sent to the client. The client performs an XOR operation on the third and fourth random numbers to generate a second encryption key, which is then sent to the fingerprint U-shield. The fingerprint U-shield decrypts the fifth ciphertext using the fourth random number and the second encryption key to obtain a second decrypted plaintext, which is then sent to the client. The fingerprint U-shield performs a hash operation on the authentication identifier and user registration identifier sent by the client to obtain a first hash result, which is then sent to the client. The fingerprint U-shield verifies the signature using the server's identifier, user registration identifier, the first hash result, and the server's signature public key to obtain first verification data, which is then sent to the client. This allows the client to verify whether the first verification data matches the second signature data, thereby determining whether the client's authorization challenge was successful.

[0224] Figure 8 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 7 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 8 As shown, in the above steps, the client establishes a secure channel for information exchange with the server based on the identity authentication identifier, and performs a third-stage encrypted information exchange with the fingerprint U-shield based on the identity authentication identifier to determine whether the client's authorization authentication is successful, and whether a secure connection has been established between the client and the server, including: S701 and fingerprint U-shield generate fourth return data based on identity authentication identifier. The fourth return data includes sixth ciphertext and third signature data.

[0225] Optionally, the fingerprint U-shield obtains the sixth ciphertext CSM2_UCRLC through encryption operations based on the SM2 elliptic curve public key cryptography algorithm.

[0226] The fingerprint U-shield uses the identity authentication identifier CPSN sent by the client to perform digital signature operation based on the SM2 elliptic curve public key cryptography algorithm to obtain the third signature data LC_Signature_msg.

[0227] Among them, the sixth ciphertext CSM2_UCRLC and the third signature data LC_Signature_msg are the fourth returned data.

[0228] S702 and fingerprint U-shield will send the fourth return data to the client.

[0229] Optionally, the fingerprint U-shield sends the sixth ciphertext CSM2_UCRLC and the third signature data LC_Signature_msg from the fourth returned data to the client.

[0230] S703, The client generates a secure channel establishment request message based on the fourth returned data.

[0231] Optionally, the client generates a secure channel establishment request message based on the sixth ciphertext CSM2_UCRLC and the third signature data LC_Signature_msg in the fourth returned data.

[0232] The data format of the secure channel establishment request message can be (third signature data LC_Signature_msg||sixth ciphertext CSM2_UCRLC).

[0233] S704. The client sends a secure channel establishment request message to the server.

[0234] Optionally, the client sends a secure channel establishment request message to the server. The server parses the secure channel establishment request message and obtains the third signature data LC_Signature_msg and the sixth ciphertext CSM2_UCRLC.

[0235] The server-side hardware cryptography module uses the server's encrypted private key as the decryption key to perform a decryption operation on the sixth ciphertext CSM2_UCRLC based on the SM2 elliptic curve public key cryptography algorithm. The resulting decrypted plaintext includes the user registration identifier USERID and the sixth random number RLC. The sixth random number RLC is a high-quality random number generated by the random number generator in the fingerprint U-shield. That is, (User Registration Identifier USERID || Sixth Random Number RLC) = SM2_DEC(Sixth Ciphertext CSM2_UCRLC).

[0236] The server queries the first hash result UCID, the encryption public key of the fingerprint U-shield inserted in the client, and the signature public key of the fingerprint U-shield based on the user registration identifier USERID.

[0237] The server obtains the signature verification data LC_Signature_msg_c by performing a digital signature verification operation based on the SM2 elliptic curve public key cryptography algorithm on the first hash result UCID and the sixth random number RLC using the user registration identifier USERID as the signature verification identifier. That is, the signature verification data LC_Signature_msg_c = SM2_Verify(first hash result UCID||sixth random number RLC).

[0238] The server compares the value of the third signature data LC_Signature_msg with the verification data LC_Signature_msg_c to determine if the verification data LC_Signature_msg_c is correct. After confirming that the verification data LC_Signature_msg_c is correct, the server obtains the seventh random number RLS from the hardware cryptographic module and uses the public key of the fingerprint U-shield as the encryption key to perform encryption operations on the seventh random number RLS based on the SM2 elliptic curve public key cryptography algorithm to obtain the seventh ciphertext SSM2_RLS, i.e., SSM2_RLS=SM2_ENC(seventh random number RLS).

[0239] The server obtains the hash result obtained by the hardware password module through the SM3 hash operation of the server's identifier SSID, the first hash result UCID, the seventh random number RLS, and the sixth random number RLC. This hash result is the Session Key, which is defined as Session Key = SM3(Server Identifier SSID||First Hash Result UCID||Seventh Random Number RLS||Sixth Random Number RLC).

[0240] The server obtains the hardware cryptographic module using the session key (SessionKey) as the encryption key. It then performs an encryption operation based on the SM4 block cipher algorithm in Electronic Codebook (ECB) mode on the statement "Establish a secure channel" to obtain the eighth ciphertext, SMSG_FINISH. The eighth ciphertext, SMSG_FINISH, is equal to SM4_ECB_ENC("Establish a secure channel"). Here, "Establish a secure channel" means "secure channel established".

[0241] The server obtains the fourth signature data Auth_Signature_msg_s by performing a digital signature operation based on the SM2 elliptic curve public key cryptography algorithm on the seventh random number RLS and the eighth ciphertext SMSG_FINISH using the server's signature private key as the signature key and the server's identifier SSID as the signature identifier.

[0242] That is, the fourth signature data Auth_Signature_msg_s=SM2_SIGN(seventh random number RLS||eighth ciphertext SMSG_FINISH), where the signature identifier is the server's identifier SSID.

[0243] The server generates a secure channel establishment response message based on the seventh ciphertext SSM2_RLS, the eighth ciphertext SMSG_FINISH, and the fourth signature data Auth_Signature_msg_s. The data format of the secure channel establishment response message can be (seventh ciphertext SSM2_RLS||eighth ciphertext SMSG_FINISH||fourth signature data Auth_Signature_msg_s).

[0244] S705: The client receives the secure channel establishment response message sent by the server.

[0245] Optionally, the server sends a secure channel establishment response message to the client, and the client receives the secure channel establishment response message sent by the server. The secure channel establishment response message is generated by the server based on the seventh ciphertext SSM2_RLS, the eighth ciphertext SMSG_FINISH, and the fourth signature data Auth_Signature_msg_s.

[0246] S706. The client parses the secure channel establishment response message sent by the server to obtain the secure channel establishment response data, which includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data.

[0247] Optionally, the client parses the secure channel establishment response message sent by the server to obtain secure channel establishment response data. This data includes the seventh ciphertext SSM2_RLS, the eighth ciphertext SMSG_FINISH, and the fourth signature data Auth_Signature_msg_s.

[0248] S707: The client sends the secure channel establishment response data to the fingerprint U-shield.

[0249] Optionally, the client sends the seventh ciphertext SSM2_RLS and the eighth ciphertext SMSG_FINISH from the secure channel establishment response data to the fingerprint U-shield, which instructs the fingerprint U-shield to decrypt the seventh ciphertext SSM2_RLS and the eighth ciphertext SMSG_FINISH, and to verify the signature based on the decryption result.

[0250] The S708 and fingerprint U-shield generate fifth return data based on the security channel establishment response data and identity authentication identifier. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

[0251] Optionally, the fingerprint U-shield decrypts the seventh ciphertext SSM2_RLS in the secure channel establishment response data sent by the client, and verifies the signature based on the decryption result and the eighth ciphertext SMSG_FINISH to obtain the second signature verification data Auth_Signature_msg_c.

[0252] The fingerprint U-shield also performs a hash operation based on the decryption result to obtain the session key, and then performs SMSG_FINISH decryption on the eighth ciphertext based on the session key to obtain the third decrypted plaintext, Plaintext_msg.

[0253] Among them, the second signature verification data Auth_Signature_msg_c, the session key SessionKey, and the third decrypted plaintext Plaintext_msg are the fifth returned data.

[0254] S709 and fingerprint U-shield will send the fifth returned data to the client.

[0255] Optionally, the fingerprint U-shield sends the second signature verification data Auth_Signature_msg_c, the session key SessionKey, and the third decrypted plaintext_msg from the fifth returned data to the client.

[0256] S710: The client determines whether the client's authorization and authentication were successful based on the secure channel establishment response data and the fifth returned data, and determines whether a secure connection has been established between the client and the server.

[0257] Optionally, the client determines whether the client's authorization and authentication were successful based on the fourth signature data Auth_Signature_msg_s in the response data established by the secure channel and the second verification data Auth_Signature_msg_c in the fifth returned data, and determines whether a secure connection has been established between the client and the server based on the third decrypted plaintext_msg.

[0258] Specifically, if the client verifies whether the second signature verification data Auth_Signature_msg_c is the same as the fourth signature data Auth_Signature_msg_s, and they are different, the authorization authentication is determined to have failed and a secure connection with the server cannot be established; if they are the same, the authorization authentication is successful, and the client further determines whether a secure connection has been established between the client and the server based on the third decrypted plaintext msg.

[0259] If the third decrypted plaintext_msg is “Establish a secure channel”, then a secure connection is established between the client and the server.

[0260] In this embodiment, the fingerprint U-shield generates fourth return data based on the identity authentication identifier and sends it to the client. The client generates a secure channel establishment request message based on the fourth return data and sends it to the server. The client receives and parses the secure channel establishment response message sent by the server, obtains secure channel establishment response data, sends it to the fingerprint U-shield, and receives fifth return data sent by the fingerprint U-shield based on the secure channel establishment response data and the identity authentication identifier. The client determines whether the client's authorization authentication was successful based on the secure channel establishment response data and the fifth return data, and determines whether a secure connection has been established between the client and the server. By exchanging secure channel establishment information between the client and the server based on the identity authentication identifier, and exchanging third-stage encrypted information between the client and the fingerprint U-shield based on the identity authentication identifier, the security of authorization authentication and the reliability of establishing a secure connection are improved.

[0261] Figure 9 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 8 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 9 As shown, in the above steps, the fingerprint U-shield generates fourth return data based on the identity authentication identifier and sends the fourth return data to the client, including: S801, the fingerprint U-shield generates the sixth random number.

[0262] Optionally, the fingerprint U-shield obtains a high-quality sixth random number RLC from a random number generator.

[0263] S802, the fingerprint U-shield sends the sixth random number to the client.

[0264] Optionally, the fingerprint U-shield sends a sixth random number RLC to the client.

[0265] S803: The client sends the user registration identifier, the sixth random number, and the server's encrypted public key to the fingerprint U-shield.

[0266] Optionally, the client sends the user registration identifier USERID, the sixth random number RLC, and the server's encryption public key to the fingerprint U-shield to instruct the fingerprint U-shield to perform decryption operations.

[0267] S804 and the fingerprint U-shield encrypt the sixth random number and the user registration identifier based on the server's decryption public key to obtain the sixth ciphertext.

[0268] Optionally, the fingerprint U-shield uses the server's encrypted private key as the encryption key to perform encryption operations on the user registration identifier USERID and the sixth random number RLC based on the SM2 elliptic curve public key cryptography algorithm to obtain the sixth ciphertext CSM2_UCRLC.

[0269] That is, the sixth ciphertext CSM2_UCRLC = SM2_ENC (user registration identifier USERID || sixth random number RLC).

[0270] S805 and fingerprint U-shield send the sixth ciphertext to the client.

[0271] Optionally, the fingerprint U-shield sends the sixth ciphertext CSM2_UCRLC to the client.

[0272] S806, the client sends the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield to the fingerprint U-shield.

[0273] Optionally, the client sends the first hash result UCID, the sixth random number RLC, the user registration identifier USERID, and the fingerprint U-shield's signature private key to the fingerprint U-shield to instruct the fingerprint U-shield to perform signature calculations.

[0274] S807 and the fingerprint U-shield use the fingerprint U-shield's signature private key to sign the first hash result and the sixth random number to obtain the third signature data, where the signature identifier of the third signature data is the user registration identifier.

[0275] Optionally, the fingerprint U-shield uses the user registration identifier USERID as the signature identifier and the fingerprint U-shield's signature private key as the signature key to perform a digital signature operation based on the SM2 elliptic curve public key cryptography algorithm on the first hash result UCID and the sixth random number RLC to obtain the third signature data LC_Signature_msg.

[0276] That is, the third signature data LC_Signature_msg = SM2_SING(first hash result UCID || sixth random number RLC).

[0277] The S808 and fingerprint U-shield send the third signature data to the client.

[0278] Optionally, the fingerprint U-shield sends the third signature data LC_Signature_msg to the client, so that the client can generate a secure channel establishment request message based on the sixth ciphertext CSM2_UCRLC and the third signature data LC_Signature_msg.

[0279] In this embodiment, the fingerprint U-shield generates a sixth random number and sends it to the client. The client receives the user registration identifier, the sixth random number, and the server's encryption public key. Based on the server's decryption public key, the sixth random number and the user registration identifier are encrypted to obtain a sixth ciphertext, which is then sent to the client. The fingerprint U-shield, using its signature private key, signs the first hash result and the sixth random number to obtain third signature data, which is then sent to the client. This allows the client to generate a secure channel establishment request message based on the sixth ciphertext and the third signature data.

[0280] Figure 10 Flowchart of the authorization and authentication method provided in the embodiments of this application Figure 9 Taking the interaction between the client and the fingerprint U-shield in the authorization and authentication system as an example, the process of the authorization and authentication method will be further explained. Figure 10 As shown, in the above steps, the fingerprint U-shield generates fifth return data based on the security channel establishment response data and identity authentication identifier, and sends the fifth return data to the client, including: S901. The client sends the seventh ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield.

[0281] Optionally, the client sends the encrypted private key of the fingerprint U-shield and the seventh ciphertext SSM2_RLS in the secure channel establishment response data to the fingerprint U-shield to instruct the fingerprint U-shield to perform decryption operations.

[0282] S902, the fingerprint U-shield decrypts the seventh ciphertext based on the encryption private key of the fingerprint U-shield to obtain the seventh random number, which is generated by the hardware cryptographic module deployed on the server.

[0283] Optionally, the fingerprint U-shield uses its encryption private key as the decryption password to perform a decryption operation on the seventh ciphertext SSM2_RLS based on the SM2 elliptic curve public key cryptography algorithm to obtain the seventh random number RLS, i.e., the seventh random number RLS = SM2_DEC(SSM2_RLS). The seventh random number RLS is generated by a hardware cryptographic module deployed on the server.

[0284] S903 and fingerprint U-shield send the seventh random number to the client.

[0285] Optionally, the fingerprint U-shield sends a seventh random number (RLS) to the client.

[0286] S904. The client sends the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier to the fingerprint U-shield.

[0287] Optionally, the client sends the seventh random number RLS, the eighth ciphertext SMSG_FINISH, the server's signature public key, and the server's identifier SSID to the fingerprint U-shield to instruct the fingerprint U-shield to perform signature verification calculations.

[0288] The S905 fingerprint U-shield obtains the second signature verification data based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier.

[0289] Optionally, the fingerprint U-shield uses the server's identifier SSID as the signature verification identifier and the server's signature public key as the signature verification key to perform digital signature verification operation based on the SM2 elliptic curve public key cryptography algorithm on the seventh random number RLS and the eighth ciphertext SMSG_FINISH to obtain the second signature verification data Auth_Signature_msg_c.

[0290] That is, the second signature verification data Auth_Signature_msg_c=SM2_Vevify(seventh random number RLS||eighth ciphertext SMSG_FINISH).

[0291] S906 and fingerprint U-shield send the second signature verification data to the client.

[0292] Optionally, the fingerprint U-shield sends the second signature verification data Auth_Signature_msg_c to the client.

[0293] S907, the client sends the server's identifier, the first hash result, the seventh random number, and the sixth random number to the fingerprint U-shield.

[0294] Optionally, the client verifies whether the second signature data Auth_Signature_msg_c is the same as the fourth signature data Auth_Signature_msg_s in the secure channel establishment response data. If they are the same, the authorization and authentication are successful.

[0295] After successful authorization and authentication, the client sends the server's identifier SSID, the first hash result UCID, the seventh random number RLS, and the sixth random number RLC to the fingerprint U-shield to instruct the fingerprint U-shield to perform hash operations.

[0296] The S908 fingerprint U-shield performs a hash operation on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain the session key.

[0297] Optionally, the fingerprint U-shield performs an SM3 hash operation on the server's identifier SSID, the first hash result UCID, the seventh random number RLS, and the sixth random number RLC to obtain the session key SessionKey.

[0298] That is, SessionKey = SM3(Server identifier SSID || First hash result UCID || Seventh random number RLS || Sixth random number RLC).

[0299] The S909 and fingerprint U-shield send the session key to the client.

[0300] Optionally, the fingerprint U-shield sends the SessionKey to the client.

[0301] S910: The client sends the session key and the eighth ciphertext to the fingerprint U-shield.

[0302] Optionally, the client sends the session key (SessionKey) and the eighth ciphertext (SMSG_FINISH) to the fingerprint U-shield to instruct the fingerprint U-shield to perform decryption operations.

[0303] The S911 fingerprint U-shield decrypts the eighth ciphertext based on the session key to obtain the third decrypted plaintext.

[0304] Optionally, the fingerprint U-shield uses the session key (SessionKey) as the decryption key to perform decryption operations on the eighth ciphertext (SMSG_FINISH) in ECB mode based on the SM4 block cipher algorithm to obtain the third decrypted plaintext (Plaintext_msg).

[0305] In other words, the third decrypted plaintext Plaintext_msg = SM4_ECB_DEC (the eighth ciphertext SMSG_FINISH).

[0306] The S912 and fingerprint U-shield send the third decrypted plaintext to the client.

[0307] Optionally, the fingerprint U-shield sends the third decrypted plaintext, Plaintext_msg, to the client so that the client can determine whether the third decrypted plaintext, Plaintext_msg, is "Establish a secure channel". If so, it determines that a secure connection has been established between the client and the server.

[0308] In this embodiment, the fingerprint U-shield decrypts the seventh ciphertext using its encrypted private key to obtain a seventh random number, which is then sent to the client. Based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier, it obtains second verification data and sends it to the client. The client verifies whether the second verification data matches the fourth signature data in the secure channel establishment response data; if they match, authorization and authentication are successful. After successful authorization and authentication, the fingerprint U-shield performs a hash operation on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain a session key, which is then sent to the client. Based on the session key, it decrypts the eighth ciphertext to obtain a third decrypted plaintext, which is also sent to the client. This allows the client to determine whether a secure connection has been established between the client and the server based on the third decrypted ciphertext.

[0309] Based on the same inventive concept, this application also provides an authorization and authentication device corresponding to the authorization and authentication method executed by the client. Since the principle of the device in this application is similar to the authorization and authentication method executed by the client in the above-mentioned application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0310] Figure 11 A module structure diagram of an authorization and authentication device provided in this application embodiment is shown below. Figure 11 As shown, the device includes: The first determining module 1101 is used to exchange authorization request information with the server, exchange first-stage encrypted information with the fingerprint U-shield, and determine whether the client's registration challenge is successful.

[0311] The second determining module 1102 is used to, if so, perform authorization challenge information exchange between the client and the server based on the client's identity authentication identifier, and perform second-stage encrypted information exchange between the identity authentication identifier and the fingerprint U-shield, and determine whether the client's authorization challenge is successful. The identity authentication identifier is generated based on the user's fingerprint data and the device identifier of the fingerprint U-shield.

[0312] The third determining module 1103 is used to, if yes, establish information exchange between the client and the server based on the identity authentication identifier and establish information exchange between the client and the fingerprint U-shield in the third stage, and determine whether the client's authorization authentication is successful, and whether a secure connection is established between the client and the server.

[0313] As an optional implementation, the first determining module 1101 is specifically used for: Receive the first random number sent by the fingerprint U-shield, and send an authorization request message to the server based on the first random number.

[0314] Receive and parse the authorization response message sent by the server to obtain the authorization response data, which includes the cipher suite identifier, the first ciphertext, and the authentication code.

[0315] Send the authorization response data to the fingerprint U-shield.

[0316] Receive the first return data sent by the fingerprint U-shield. The first return data includes the first decrypted plaintext and the verification code.

[0317] The success of the client's registration challenge is determined based on the authorization response data and the first returned data.

[0318] As an optional implementation, the first determining module 1101 is specifically used for: Receive the temporary data encryption key sent by the fingerprint U-shield.

[0319] Send the temporary data encryption key and the first ciphertext to the fingerprint U-shield.

[0320] The system receives the first decrypted plaintext sent by the fingerprint U-shield. The first decrypted plaintext includes at least the server's encryption public key, the server's signature public key, and a second random number from the hardware cryptographic module deployed on the server.

[0321] Send the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield.

[0322] Receive the verification code sent by the fingerprint U-shield.

[0323] As an optional implementation, the second determining module 1102 is specifically used for: The second return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The second return data includes a second ciphertext, a third ciphertext, and a first signature data. The third ciphertext includes the encrypted identity authentication identifier.

[0324] Based on the second returned data, an authorization challenge request message is sent to the server.

[0325] Receive and parse the authorization challenge response message sent by the server to obtain the authorization challenge response data, which includes the fourth ciphertext, the fifth ciphertext, and the second signature data.

[0326] Send the authorization challenge response data to the fingerprint U-shield.

[0327] The third return data received by the fingerprint U-shield based on the identity authentication identifier includes the second decrypted plaintext, the first hash result, and the first signature verification data.

[0328] The success of the client's authorization challenge is determined based on the authorization challenge response data and the third-party return data.

[0329] As an optional implementation, the second determining module 1102 is specifically used for: Receive the third random number sent by the fingerprint U-shield.

[0330] Perform an XOR operation on the second random number and the third random number to generate the first encryption key, and send the third random number and the server's encryption public key to the fingerprint U-shield.

[0331] Receive the second encrypted message sent by the fingerprint U-shield.

[0332] Send the identity authentication identifier, user registration code, public key of the fingerprint U-shield, public key of the fingerprint U-shield, third random number and first encryption key to the fingerprint U-shield.

[0333] Receive the third encrypted message sent by the fingerprint U-shield.

[0334] Send the identity authentication identifier, user registration code, fingerprint U-shield encryption public key, fingerprint U-shield signature public key, and fingerprint U-shield signature private key to the fingerprint U-shield.

[0335] Receive the first signature data sent by the fingerprint U-shield, wherein the signature identifier of the first signature data is the identity authentication identifier.

[0336] As an optional implementation, the second determining module 1102 is specifically used for: Send the fourth ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield.

[0337] Receive the fourth random number sent by the fingerprint U-shield, where the fourth random number is generated by the hardware password module deployed on the server.

[0338] Perform an XOR operation on the third and fourth random numbers to generate the second encryption key, and then send the second encryption key, the fifth ciphertext, and the fourth random number to the fingerprint U-shield.

[0339] The system receives the second decrypted plaintext sent by the fingerprint U-shield. The second decrypted plaintext includes the server's identifier and the user registration identifier. The server's identifier is generated by the hardware cryptographic module deployed on the server, which performs a hash operation on the hardware cryptographic module's identifier and the fifth random number generated by the hardware cryptographic module.

[0340] Send the identity authentication identifier and user registration identifier to the fingerprint U-shield.

[0341] Receive the first hash result sent by the fingerprint U-shield.

[0342] Send the server's identifier, user registration identifier, first hash result, and server's signature public key to the fingerprint U-shield.

[0343] Receive the first signature verification data sent by the fingerprint U-shield.

[0344] As an optional implementation, the third determining module 1103 is specifically used for: The fourth return data is received from the fingerprint U-shield based on the identity authentication identifier. The fourth return data includes the sixth ciphertext and the third signature data.

[0345] Based on the fourth returned data, a secure channel establishment request message is sent to the server.

[0346] Receive and parse the secure channel establishment response message sent by the server to obtain the secure channel establishment response data, which includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data.

[0347] Send the security channel establishment response data to the fingerprint U-shield.

[0348] The fifth return data is received based on the identity authentication identifier and the fingerprint U-shield. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

[0349] Based on the response data established by the secure channel and the fifth returned data, it is determined whether the client's authorization and authentication were successful, and whether a secure connection has been established between the client and the server.

[0350] As an optional implementation, the third determining module 1103 is specifically used for: Receive the sixth random number sent by the fingerprint U-shield.

[0351] Send the user registration identifier, the sixth random number, and the server's encrypted public key to the fingerprint U-shield.

[0352] Receive the sixth ciphertext sent by the fingerprint U-shield.

[0353] Send the first hash result, the sixth random number, the user registration identifier, and the fingerprint U-shield's signature private key to the fingerprint U-shield.

[0354] Receive third signature data sent by the fingerprint U-shield.

[0355] As an optional implementation, the third determining module 1103 is specifically used for: Send the seventh ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield.

[0356] Receive the seventh random number sent by the fingerprint U-shield, where the seventh random number is generated by the hardware password module deployed on the server.

[0357] Send the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier to the fingerprint U-shield.

[0358] Receive the second signature verification data sent by the fingerprint U-shield.

[0359] Send the server's identifier, the first hash result, the seventh random number, and the sixth random number to the fingerprint U-shield.

[0360] Receive the session key sent by the fingerprint U-shield.

[0361] Send the session key and the eighth ciphertext to the fingerprint U-shield.

[0362] Receive the third decrypted plaintext sent by the fingerprint U-shield.

[0363] Based on the same inventive concept, this application also provides an authorization and authentication device corresponding to the authorization and authentication method performed by the fingerprint U-shield. Since the principle of the device in this application is similar to the authorization and authentication method performed by the fingerprint U-shield in the above-mentioned application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0364] Figure 12 A module structure diagram of another authorization and authentication device provided in the embodiments of this application is shown below. Figure 12 As shown, the device includes: The first interaction module 1201 is used to exchange encrypted information with the client in the first stage, so that the client can determine whether the client's registration challenge is successful.

[0365] The second interaction module 1202 is used to conduct a second-stage encrypted information exchange between the client and the client based on the client's identity authentication identifier, so that the client can determine whether the client's authorization challenge is successful. The identity authentication identifier is generated in advance by the fingerprint U-shield based on the user's fingerprint data and the device identifier of the fingerprint U-shield.

[0366] The third interaction module 1203 is used to exchange third-stage encrypted information with the client based on the identity authentication identifier, so that the client can determine whether the client's authorization authentication is successful.

[0367] As an optional implementation, the first interaction module 1201 is specifically used for: Generate a first random number and send it to the client.

[0368] Receive authorization response data sent by the client. The authorization response data includes the cipher suite identifier, the first ciphertext, and the authentication code.

[0369] The first return data is generated based on the authorized response data and sent to the client. The first return data includes the first decrypted plaintext and the verification code.

[0370] As an optional implementation, the first interaction module 1201 is specifically used for: A hash operation is performed on the cipher suite identifier, the client's device type, the client's application type, and the first random number to obtain a temporary data encryption key, which is then sent to the client.

[0371] Receive the temporary data encryption key and the first ciphertext sent by the client.

[0372] The first ciphertext is decrypted based on the temporary data encryption key to obtain the first decrypted plaintext, wherein the first decrypted plaintext includes at least the server's encryption public key, the server's signature public key, and a second random number from the hardware cryptographic module deployed on the server.

[0373] Send the first decrypted plaintext to the client.

[0374] Receive the first decrypted plaintext and the temporary data encryption key sent by the client.

[0375] Based on the first decrypted plaintext and the temporary data encryption key, the verification code is obtained and sent to the client.

[0376] As an optional implementation, the second interaction module 1202 is specifically used for: The second return data is generated based on the identity authentication identifier and sent to the client. The second return data includes a second ciphertext, a third ciphertext, and a first signature data. The third ciphertext includes the encrypted identity authentication identifier.

[0377] Receive authorization challenge response data sent by the client. The authorization challenge response data includes the fourth ciphertext, the fifth ciphertext, and the second signature data.

[0378] The third return data is generated based on the authorized challenge response data and the identity authentication identifier, and then sent to the client. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data.

[0379] As an optional implementation, the second interaction module 1202 is specifically used for: Generate a third random number and send it to the client.

[0380] Receive a third random number sent by the client and the server's encrypted public key.

[0381] The third random number is encrypted using the server's public key to obtain the second ciphertext, which is then sent to the client.

[0382] The system receives the following information from the client: the authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, the third random number, and the first encryption key.

[0383] Based on the third random number and the first encryption key, the identity authentication identifier, user registration code, encryption public key of fingerprint U-shield, and signature public key of fingerprint U-shield are encrypted to obtain the third ciphertext, which is then sent to the client.

[0384] The system receives the authentication identifier, user registration code, encryption public key of fingerprint U-shield, signature public key of fingerprint U-shield, and signature private key of fingerprint U-shield sent by the client.

[0385] Based on the signature private key of the fingerprint U-shield, the identity authentication identifier, user registration code, encryption public key of the fingerprint U-shield, and signature public key of the fingerprint U-shield are signed to obtain the first signature data, and the first signature data is sent to the client. The signature identifier of the first signature data is the identity authentication identifier.

[0386] As an optional implementation, the second interaction module 1202 is specifically used for: Receive the fourth ciphertext sent by the client and the encrypted private key of the fingerprint U-shield.

[0387] The fourth ciphertext is decrypted using the encrypted private key of the fingerprint U-shield to obtain the fourth random number, which is then sent to the client. The fourth random number is generated by the hardware cryptographic module deployed on the server.

[0388] Receive the second encryption key, the fifth ciphertext, and the fourth random number sent by the client.

[0389] Based on the fourth random number and the second encryption key, the fifth ciphertext is decrypted to obtain the second decrypted plaintext, which is then sent to the client. The second decrypted plaintext includes the server's identifier and the user registration identifier. The server's identifier is generated by the hardware cryptographic module deployed on the server, which performs a hash operation on the hardware cryptographic module's identifier and the fifth random number generated by the hardware cryptographic module.

[0390] Receive the authentication identifier and user registration identifier sent by the client.

[0391] Perform a hash operation on the identity authentication identifier and the user registration identifier to obtain the first hash result, and send the first hash result to the client.

[0392] The server receives the server's identifier, user registration identifier, first hash result, and server's signature public key sent by the client.

[0393] Based on the server's identifier, the user's registration identifier, the first hash result, and the server's signature public key, the first signature verification data is obtained and sent to the client.

[0394] As an optional implementation, the third interaction module 1203 is specifically used for: The fourth return data is generated based on the identity authentication identifier and sent to the client. The fourth return data includes the sixth ciphertext and the third signature data.

[0395] The system receives secure channel establishment response data sent by the client. The secure channel establishment response data includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data.

[0396] The fifth return data is generated based on the secure channel establishment response data and identity authentication identifier, and then sent to the client. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

[0397] As an optional implementation, the third interaction module 1203 is specifically used for: Generate a sixth random number and send it to the client.

[0398] Receive the sixth random number sent by the client, the user registration identifier, and the server's encrypted public key.

[0399] The sixth random number and the user registration identifier are encrypted using the server's decryption public key to obtain the sixth ciphertext, which is then sent to the client.

[0400] Receive the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield sent by the client.

[0401] Based on the signature private key of the fingerprint U-shield, the first hash result and the sixth random number are signed to obtain the third signature data, which is then sent to the client. The signature identifier of the third signature data is the user registration identifier.

[0402] As an optional implementation, the third interaction module 1203 is specifically used for: Receive the seventh ciphertext sent by the client and the encrypted private key of the fingerprint U-shield.

[0403] The seventh ciphertext is decrypted using the encrypted private key of the fingerprint U-shield to obtain the seventh random number, which is then sent to the client. The seventh random number is generated by the hardware cryptographic module deployed on the server.

[0404] The client sends a seventh random number, an eighth ciphertext, the server's signature public key, and the server's identifier.

[0405] The second verification data is obtained based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier, and then sent to the client.

[0406] Receive the server identifier, first hash result, seventh random number, and sixth random number sent by the client.

[0407] Perform a hash operation on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain the session key, and then send the session key to the client.

[0408] Receive the session key and the eighth ciphertext sent by the client.

[0409] Based on the session key, the eighth ciphertext is decrypted to obtain the third decrypted plaintext, which is then sent to the client.

[0410] This application also provides an electronic device, which can be the aforementioned client or fingerprint USB key. For example... Figure 13 The diagram shown is a schematic representation of the structure of an electronic device provided in an embodiment of this application, including: a processor 131, a memory 132, and a bus 133. The memory 132 stores machine-readable instructions executable by the processor 131 (e.g., ...). Figure 11 The execution instructions corresponding to the first determining module 1101, the second determining module 1102, and the third determining module 1103 in the device, or, Figure 12 The device contains the execution instructions corresponding to the first interaction module 1301, the second interaction module 1302, and the third interaction module 1303. When the electronic device 130 is running, the processor 131 and the memory 132 communicate through the bus 133. When the machine-readable instructions are executed by the processor 131, the method steps executed by the client or fingerprint U-shield are performed.

[0411] This application provides an authorization and authentication system, such as... Figure 1 As shown, the authorization and authentication system includes: a client, a fingerprint U-shield, and a server. The fingerprint U-shield communicates with the client.

[0412] The client and the fingerprint U-shield are used to execute the steps described in the foregoing embodiments.

[0413] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0414] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0415] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An authorization and authentication method, characterized in that, A client application used in an authorization and authentication system, the client communicating with a fingerprint USB key; the method includes: The system exchanges authorization request information with the server and first-stage encrypted information with the fingerprint U-shield, and determines whether the client's registration challenge is successful. If so, authorization challenge information is exchanged between the client's identity authentication identifier and the server, and a second-stage encrypted information exchange is conducted between the identity authentication identifier and the fingerprint U-shield, and it is determined whether the client's authorization challenge is successful. The identity authentication identifier is generated based on the user's fingerprint data and the device identifier of the fingerprint U-shield. If so, a secure channel is established between the identity authentication identifier and the server for information exchange, and a third-stage encrypted information exchange is conducted between the identity authentication identifier and the fingerprint U-shield. It is also determined whether the client's authorization authentication is successful and whether a secure connection is established between the client and the server.

2. The method according to claim 1, characterized in that, The process of exchanging authorization request information with the server, exchanging first-stage encrypted information with the fingerprint U-shield, and determining whether the client's registration challenge was successful includes: Receive the first random number sent by the fingerprint U-shield, and send an authorization request message to the server according to the first random number; The system receives and parses the authorization response message sent by the server to obtain authorization response data, which includes a cipher suite identifier, a first ciphertext, and an authentication code. The authorization response data is sent to the fingerprint USB key; Receive the first return data sent by the fingerprint U-shield, the first return data including the first decrypted plaintext and the verification code; The success of the client's registration challenge is determined based on the authorization response data and the first returned data.

3. The method according to claim 2, characterized in that, The first return data received from the fingerprint U-shield includes: Receive the temporary data encryption key sent by the fingerprint U-shield; Send the temporary data encryption key and the first ciphertext to the fingerprint U-shield; The system receives the first decrypted plaintext sent by the fingerprint U-shield, wherein the first decrypted plaintext includes at least the encryption public key of the server, the signature public key of the server, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext and the temporary data encryption key to the fingerprint U-shield; Receive the verification code sent by the fingerprint U-shield.

4. The method according to claim 1, characterized in that, The process involves exchanging authorization challenge information between the client's authentication identifier and the server, and exchanging second-stage encrypted information between the authentication identifier and the fingerprint USB key, to determine whether the client's authorization challenge was successful. This includes: The second return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Based on the second returned data, an authorization challenge request message is sent to the server. The authorization challenge response message sent by the server is received and parsed to obtain authorization challenge response data, which includes a fourth ciphertext, a fifth ciphertext, and a second signature data; Send the authorization challenge response data to the fingerprint U-shield; The third return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data. The success of the client's authorization challenge is determined based on the authorization challenge response data and the third return data.

5. The method according to claim 4, characterized in that, The second return data received from the fingerprint U-shield based on the identity authentication identifier includes: Receive the third random number sent by the fingerprint U-shield; Perform an XOR operation on the second random number and the third random number to generate the first encryption key, and send the third random number and the server's encryption public key to the fingerprint U-shield; Receive the second ciphertext sent by the fingerprint U-shield; The identity authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number and first encryption key are sent to the fingerprint U-shield; Receive the third ciphertext sent by the fingerprint U-shield; Send the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; The system receives the first signature data sent by the fingerprint U-shield, wherein the signature identifier of the first signature data is the identity authentication identifier.

6. The method according to claim 4, characterized in that, The third return data received from the fingerprint U-shield based on the identity authentication identifier includes: Send the fourth ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive a fourth random number sent by the fingerprint U-shield, wherein the fourth random number is generated by a hardware cryptographic module deployed on the server. Perform an XOR operation on the third random number and the fourth random number to generate a second encryption key, and send the second encryption key, the fifth ciphertext, and the fourth random number to the fingerprint U-shield; The system receives a second decrypted plaintext sent by the fingerprint U-shield. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server by performing a hash operation on the identifier of the hardware cryptographic module and a fifth random number generated by the hardware cryptographic module. Send the identity authentication identifier and the user registration identifier to the fingerprint U-shield; Receive the first hash result sent by the fingerprint U-shield; Send the server's identifier, the user registration identifier, the first hash result, and the server's signature public key to the fingerprint U-shield; Receive the first signature verification data sent by the fingerprint U-shield.

7. The method according to claim 1, characterized in that, The process of establishing a secure channel and exchanging information based on the identity authentication identifier with the server, and exchanging third-stage encrypted information based on the identity authentication identifier with the fingerprint U-shield, determining whether the client's authorization authentication was successful, and determining whether a secure connection was established between the client and the server, includes: The fourth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fourth return data includes the sixth ciphertext and the third signature data. Based on the fourth returned data, a secure channel establishment request message is sent to the server. Receive and parse the secure channel establishment response message sent by the server to obtain secure channel establishment response data, which includes the seventh ciphertext, the eighth ciphertext, and the fourth signature data; Send the security channel establishment response data to the fingerprint U-shield; The fifth return data sent by the fingerprint U-shield is received based on the identity authentication identifier. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext. Based on the established response data of the secure channel and the fifth returned data, it is determined whether the client's authorization authentication was successful, and whether a secure connection was established between the client and the server.

8. The method according to claim 7, characterized in that, The fourth return data received from the fingerprint U-shield based on the identity authentication identifier includes: Receive the sixth random number sent by the fingerprint U-shield; Send the user registration identifier, the sixth random number, and the server-side encryption public key to the fingerprint U-shield; Receive the sixth ciphertext sent by the fingerprint U-shield; Send the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield to the fingerprint U-shield; Receive the third signature data sent by the fingerprint U-shield.

9. The method according to claim 7, characterized in that, The fifth return data received from the fingerprint U-shield based on the identity authentication identifier includes: Send the seventh ciphertext and the encryption private key of the fingerprint U-shield to the fingerprint U-shield; Receive the seventh random number sent by the fingerprint U-shield, wherein the seventh random number is generated by the hardware cryptographic module deployed on the server; Send the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier to the fingerprint U-shield; Receive the second signature verification data sent by the fingerprint U-shield; The server identifier, the first hash result, the seventh random number, and the sixth random number are sent to the fingerprint U-shield; Receive the session key sent by the fingerprint U-shield; Send the session key and the eighth ciphertext to the fingerprint U-shield; Receive the third decrypted plaintext sent by the fingerprint U-shield.

10. An authorization and authentication method, characterized in that, A fingerprint USB shield used in an authorization and authentication system, wherein the fingerprint USB shield is communicatively connected to a client; the method includes: A first-stage encrypted information exchange is performed with the client so that the client can determine whether the client's registration challenge is successful; The client performs a second-stage encrypted information exchange with the client based on the client's identity authentication identifier, so that the client can determine whether the client's authorization challenge is successful. The identity authentication identifier is generated in advance by the fingerprint U-shield based on the user's fingerprint data and the device identifier of the fingerprint U-shield. A third-stage encrypted information exchange is conducted between the identity authentication identifier and the client, enabling the client to determine whether the client's authorization authentication was successful.

11. The method according to claim 10, characterized in that, The first-stage encrypted information exchange with the client includes: Generate a first random number and send the first random number to the client; Receive authorization response data sent by the client, the authorization response data including a cipher suite identifier, a first ciphertext, and an authentication code; First return data is generated based on the authorized response data, and the first return data is sent to the client. The first return data includes a first decrypted plaintext and a verification code.

12. The method according to claim 11, characterized in that, The step of generating first return data based on the authorization response data and sending the first return data to the client includes: A hash operation is performed on the cipher suite identifier, the client's device type, the client's application type, and the first random number to obtain a temporary data encryption key, and the temporary data encryption key is sent to the client; Receive the temporary data encryption key and the first ciphertext sent by the client; The first ciphertext is decrypted based on the temporary data encryption key to obtain the first decrypted plaintext, wherein the first decrypted plaintext includes at least the server's encryption public key, the server's signature public key, and a second random number from the hardware cryptographic module deployed on the server. Send the first decrypted plaintext to the client; Receive the first decrypted plaintext and the temporary data encryption key sent by the client; Based on the first decrypted plaintext and the temporary data encryption key, the verification code is obtained and sent to the client.

13. The method according to claim 10, characterized in that, The second-stage encrypted information exchange between the client and the client based on the client's identity authentication identifier includes: The second return data is generated based on the identity authentication identifier and sent to the client. The second return data includes a second ciphertext, a third ciphertext, and a first signature data, wherein the third ciphertext includes the encrypted identity authentication identifier. Receive authorization challenge response data sent by the client, the authorization challenge response data including fourth ciphertext, fifth ciphertext and second signature data; The third return data is generated based on the authorized challenge response data and the identity authentication identifier, and the third return data is sent to the client. The third return data includes the second decrypted plaintext, the first hash result, and the first signature verification data.

14. The method according to claim 13, characterized in that, The step of generating second return data based on the identity authentication identifier and sending the second return data to the client includes: Generate a third random number and send the third random number to the client; Receive the third random number sent by the client and the server's encryption public key; The third random number is encrypted using the server's public key to obtain the second ciphertext, and the second ciphertext is sent to the client. The system receives the authentication identifier, user registration code, encryption public key of the fingerprint U-shield, signature public key of the fingerprint U-shield, third random number, and first encryption key sent by the client. Based on the third random number and the first encryption key, the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are encrypted to obtain the third ciphertext, and the third ciphertext is sent to the client. Receive the authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, the signature public key of the fingerprint U-shield, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the identity authentication identifier, the user registration code, the encryption public key of the fingerprint U-shield, and the signature public key of the fingerprint U-shield are signed to obtain the first signature data, and the first signature data is sent to the client, wherein the signature identifier of the first signature data is the identity authentication identifier.

15. The method according to claim 13, characterized in that, The step of generating third return data based on the authorized challenge response data and the identity authentication identifier, and sending the third return data to the client, includes: Receive the fourth ciphertext sent by the client and the encryption private key of the fingerprint U-shield; The fourth ciphertext is decrypted based on the encryption private key of the fingerprint U-shield to obtain a fourth random number, and the fourth random number is sent to the client. The fourth random number is generated by a hardware cryptographic module deployed on the server. Receive the second encryption key, the fifth ciphertext, and the fourth random number sent by the client; Based on the fourth random number and the second encryption key, the fifth ciphertext is decrypted to obtain the second decrypted plaintext, and the second decrypted plaintext is sent to the client. The second decrypted plaintext includes the identifier of the server and the user registration identifier. The identifier of the server is generated by the hardware cryptographic module deployed on the server in advance by performing a hash operation on the identifier of the hardware cryptographic module and the fifth random number generated by the hardware cryptographic module. Receive the authentication identifier and the user registration identifier sent by the client; Perform a hash operation on the identity authentication identifier and the user registration identifier to obtain the first hash result, and send the first hash result to the client; Receive the server's identifier, the user registration identifier, the first hash result, and the server's signature public key sent by the client; The first signature verification data is obtained based on the server's identifier, the user registration identifier, the first hash result, and the server's signature public key, and then sent to the client.

16. The method according to claim 10, characterized in that, The third-stage encrypted information exchange between the authentication identifier and the client includes: The fourth return data is generated based on the identity authentication identifier and sent to the client. The fourth return data includes the sixth ciphertext and the third signature data. The system receives secure channel establishment response data sent by the client, which includes a seventh ciphertext, an eighth ciphertext, and a fourth signature data. The fifth return data is generated based on the established response data of the secure channel and the identity authentication identifier, and then sent to the client. The fifth return data includes the second signature verification data, the session key, and the third decrypted plaintext.

17. The method according to claim 16, characterized in that, The step of generating fourth return data based on the identity authentication identifier and sending the fourth return data to the client includes: Generate a sixth random number and send the sixth random number to the client; Receive the sixth random number, user registration identifier, and server encryption public key sent by the client; The sixth random number and the user registration identifier are encrypted using the server's decryption public key to obtain the sixth ciphertext, and the sixth ciphertext is sent to the client. Receive the first hash result, the sixth random number, the user registration identifier, and the signature private key of the fingerprint U-shield sent by the client; Based on the signature private key of the fingerprint U-shield, the first hash result and the sixth random number are signed to obtain the third signature data, and the third signature data is sent to the client, wherein the signature identifier of the third signature data is the user registration identifier.

18. The method according to claim 16, characterized in that, The step of generating fifth return data based on the established response data of the secure channel and the identity authentication identifier, and sending the fifth return data to the client, includes: Receive the seventh ciphertext sent by the client and the encryption private key of the fingerprint U-shield; Based on the encrypted private key of the fingerprint U-shield, the seventh ciphertext is decrypted to obtain the seventh random number, and the seventh random number is sent to the client. The seventh random number is generated by a hardware cryptographic module deployed on the server. Receive the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier sent by the client; The second signature verification data is obtained based on the seventh random number, the eighth ciphertext, the server's signature public key, and the server's identifier, and then the second signature verification data is sent to the client. Receive the server's identifier, first hash result, seventh random number, and sixth random number sent by the client; A hash operation is performed on the server's identifier, the first hash result, the seventh random number, and the sixth random number to obtain the session key, and the session key is sent to the client. Receive the session key and the eighth ciphertext sent by the client; Based on the session key, the eighth ciphertext is decrypted to obtain the third decrypted plaintext, and the third decrypted plaintext is sent to the client.

19. An authorization and authentication system, characterized in that, The authorization and authentication system includes: a client, a fingerprint U-shield, and a server, wherein the fingerprint U-shield is communicatively connected to the client; The client is used to perform the steps of the method according to any one of claims 1-9; The fingerprint U-shield is used to perform the steps of the method described in any one of claims 10-18.

Images