Trusted call enhanced authentication methods, systems, devices, and media
By performing biometric authentication on the called terminal and using the target's private key to sign and generate an authentication response message, combined with an online fast authentication protocol, the problems of caller ID spoofing attacks and cross-network interconnection are solved, achieving a high-security call connection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA FINANCIAL CERTIFICATION AUTHORITY
- Filing Date
- 2026-03-10
- Publication Date
- 2026-06-26
AI Technical Summary
Existing technologies cannot effectively defend against caller ID spoofing attacks, cannot achieve end-to-end identity binding and intent confirmation, and are difficult to adapt to interconnection scenarios across operators and industry private networks. They also cannot meet the high-security requirements for hardware-level secure storage and privacy protection of user keys.
By sending an initial call request to the called terminal, receiving a biometric authentication response message, and generating an identity authentication response message using a locally pre-stored target private key and a random number, and performing signature verification in conjunction with an online fast identity verification protocol, the credibility of the call connection is ensured.
It effectively prevents malicious attacks, avoids unauthorized users from initiating calls when the device is lost or remotely controlled, enhances the non-repudiation and security of identity authentication, and ensures the credibility of call connections.
Smart Images
Figure CN122293299A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of communication technology, and in particular to a trusted call enhancement authentication method, system, device, and medium. Background Technology
[0002] With the popularization of communication technology and the advancement of digital transformation, trusted calling has been widely used in multi-party collaboration scenarios where the authenticity and security of identities are highly critical. The core requirement of trusted calling is to achieve reliable authentication of the identities of both the caller and the called party, prevent security risks such as malicious calls, identity forgery, and call tampering, while protecting the privacy of user identity information, controlling the access rights of trusted identities, and preventing the abuse and theft of trusted identities.
[0003] Currently, to standardize the trusted call identity authentication process, the main approach is to use static whitelist authentication technology based on operator network-side subscription data. This involves pre-configuring the mapping relationship between the calling user's identity information and number in core network signaling exchange equipment (such as STP, SCP) or intelligent network platform, and building a centralized identity index database. When a calling party initiates a call, the network exchange equipment automatically queries this database to verify whether the calling number is in the whitelist or whether it has completed real-name subscription. If a match is found, the network-side equipment directly inserts a trusted identifier or display tag into the signaling stream and transmits it to the called terminal through the IMS network for display.
[0004] However, the aforementioned identity verification only focuses on the number dimension and cannot confirm that the current operator is indeed the true holder of the number. It lacks authorization control over the user's identity usage process and cannot achieve end-to-end identity binding and intent confirmation. This allows malicious attackers to bypass static verification on the network side by forging caller ID signaling, leading to identity spoofing risks and making it impossible to defend against caller ID deception attacks. Furthermore, the aforementioned identity verification methods heavily rely on the closed environment of the operator's core network equipment, making them unsuitable for interconnection scenarios across operators and industries. They also cannot meet the requirements for hardware-level secure storage and privacy protection of user keys in high-security scenarios, and thus cannot build a comprehensive and reliable authentication system. Summary of the Invention
[0005] This invention provides a trusted call enhancement authentication method, system, device, and medium to address the shortcomings of existing technologies that suffer from identity forgery risks, making it impossible to defend against caller ID spoofing attacks. It can effectively avoid the risk of unauthorized users initiating calls when the device is lost or remotely controlled, and ensure the trustworthiness of the call connection.
[0006] This invention provides a trusted call enhanced authentication method, comprising: sending an initial call request to a called terminal; receiving an authentication response message returned by the called terminal and performing biometric authentication; the authentication response message includes a first random number; in response to biometric authentication, obtaining a locally pre-stored target private key associated with a trusted identity credential, and signing it using the target private key according to the random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application to an issuing center; sending a target call request carrying the identity authentication response message to the called terminal, so that the called terminal verifies the identity authentication response message using the pre-stored target public key and the first random number based on the target call request, and establishes a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast identity verification protocol.
[0007] According to a trusted call enhancement authentication method provided by the present invention, an authentication response message is generated by signing a target private key based on a random number and call context information. The method includes: generating call data to be signed based on call context information and signing it using the target private key to obtain a call signature; generating a cryptographic token and adding it as extended data to the authentication data structure of an online fast authentication protocol to obtain a combined cryptographic token, and combining it with a first random number to obtain an assertion to be signed; performing assertion signing on the assertion to be signed using the target private key to obtain an assertion signature, and combining it with the call signature to generate an authentication response message.
[0008] According to a trusted call enhancement authentication method provided by the present invention, the called terminal is configured to: after sending a target call request carrying an authentication response message to the called terminal, extract a call signature, an assertion signature, and an assertion to be signed from the authentication response message based on the target call request; verify the assertion signature using a pre-stored target public key and a first random number based on the assertion to be signed; the target public key and the first random number are obtained and stored by the called terminal through the verification processing platform based on the initial call request; the target public key and the first random number are obtained and stored by the called terminal through the verification processing platform based on the initial call request; verify the call signature using the target public key based on the successful assertion signature verification; and establish a trusted call connection based on the successful call signature verification.
[0009] According to the trusted call enhanced authentication method provided by the present invention, the target call request includes a trusted identity credential; the trusted call connection is established after the called terminal has successfully verified both the assertion signature and the call signature, extracted the caller's number from the call signature, queried the credential query system to obtain the corresponding trusted identity credential, and verified the trusted identity credential. The verification includes: verifying the signature value of the trusted identity credential using the previously obtained public key of the issuing center; verifying the validity period of the trusted identity credential; and determining whether the trusted identity credential is in the credential cancellation list.
[0010] According to the trusted call enhancement authentication method provided by the present invention, the initial call request is generated based on the basic call parameters and sent to the called terminal using a preset session protocol; the authentication response message is generated by the called terminal sending an authentication request to the verification processing platform based on the initial call request, and the verification processing platform generates a first random number based on the authentication request and obtains the corresponding previously stored target public key.
[0011] According to a trusted call enhancement authentication method provided by the present invention, before sending an initial call request to the called terminal, the method includes: sending an identity credential application to an issuing center; receiving a verification registration message returned by the issuing center and performing biometric authentication; the verification registration message is obtained by the issuing center calling the biometric authentication function of the verification processing platform based on the biometric identifier in the identity credential application and an authentication policy message; in response to biometric authentication, generating a target private key and a target public key; generating a registration information response message based on the target public key and the second random number, and signing the target public key and the second random number in the registration information response message using a preset device private key to obtain a signature value; sending the registration information response message and the signature value to the verification processing platform so that the verification processing platform verifies the signature value and determines that the registration information response message is legal, and instructing the issuing center to issue a trusted identity credential containing the target public key; and receiving the trusted identity credential issued by the issuing center.
[0012] According to the trusted call enhanced authentication method provided by the present invention, the trusted identity credential is generated by the issuing center based on the registration success message sent by the verification processing platform, the target public key returned by the verification processing platform, and the issuing center's private key for signing; the registration success message is generated by the verification processing platform after verifying the signature value through the metadata public key, and saving the target public key in the registration information response message based on the successful verification.
[0013] This invention also provides a trusted call enhanced authentication system, comprising: a call request module, which sends an initial call request to the called terminal, receives an authentication response message returned by the called terminal, and performs biometric authentication; the authentication response message includes a first random number; an identity authentication response module, which, in response to biometric authentication, obtains a locally pre-stored target private key associated with a trusted identity credential, and, based on the random number and call context information, uses the target private key to sign and generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application to an issuing center; and a trusted connection module, which sends a target call request carrying the identity authentication response message to the called terminal, so that the called terminal verifies the identity authentication response message based on the target call request using a pre-stored target public key and the first random number, and establishes a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast identity verification protocol.
[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the trusted call enhancement authentication method as described above.
[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the trusted call enhancement authentication method as described above.
[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the trusted call enhancement authentication method as described above.
[0017] The trusted call enhancement authentication method, system, device, and medium provided by this invention send an initial call request to the called terminal and receive an authentication response message returned by the called terminal. This introduces a first random number returned by the called terminal, ensuring the timeliness and uniqueness of subsequent authentication information and preventing malicious third parties from intercepting historical authentication messages for replay attacks. Simultaneously, it combines biometric authentication, mandating user presence and active authorization, effectively avoiding the risk of unauthorized users initiating calls when the device is lost or remotely controlled. Furthermore, it stores the core target private key in a secure execution environment to build a robust hardware-level security barrier, preventing… To prevent key leakage, and because the use of the private key must be bound by biometric authorization, dual authentication combining hardware factors and biometric factors is achieved, which greatly improves the non-repudiation and security of identity authentication. The identity authentication response message generated based on the target private key signature is sent to the called terminal, which uses the pre-stored target public key and the first random number pair for signature verification. The called terminal does not need to rely on traditional SMS verification codes or easily forged caller ID, and can quickly and independently verify the authenticity of the caller's identity locally. This strong authentication mechanism based on cryptography effectively prevents caller number forgery and ensures the credibility of the call connection. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0019] Figure 1 This is one of the flowcharts of the trusted call enhancement authentication method provided by the present invention; Figure 2 This is a schematic diagram of the process for issuing trusted identity credentials provided by the present invention; Figure 3 This is the second flowchart of the trusted call enhancement authentication method provided by the present invention; Figure 4 This is a schematic diagram of the trusted call enhancement authentication system provided by the present invention; Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0021] Figure 1 This is a flowchart illustrating the trusted call enhancement authentication method provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: S11, send an initial call request to the called terminal, receive the authentication response message returned by the called terminal and perform biometric authentication; the authentication response message includes a first random number; S12, in response to biometric authentication, obtain the target private key pre-stored locally and associated with the trusted identity credential, and use the target private key to sign based on the random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application to the issuing center; S13, a target call request carrying an authentication response message is sent to the called terminal, so that the called terminal can verify the authentication response message using the pre-stored target public key and the first random number based on the target call request, and establish a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on the online fast authentication protocol.
[0022] It should be noted that the main execution subject of this manual is the terminal. The following details will be provided in conjunction with... Figures 2-3 The Trusted Call Enhancement Authentication Method of the present invention is described.
[0023] Step S11: Send an initial call request to the called terminal, receive the authentication response message returned by the called terminal and perform biometric authentication; the authentication response message includes a first random number.
[0024] In this embodiment, the initial call request is generated based on the basic call parameters and sent to the called terminal using a preset session protocol; the authentication response message is generated by the called terminal sending an authentication request to the verification processing platform based on the initial call request, and the verification processing platform generating a first random number based on the authentication request and obtaining the corresponding previously stored target public key.
[0025] It should be added that the default session protocol can be selected according to actual usage needs, such as the SIP INVITE protocol, etc., without further limitation here. Additionally, the initial call request does not include the FIDO online fast authentication field.
[0026] In addition, the verification processing platform is used to: generate a first random number based on the authentication request according to the preset online fast identity standard protocol, encode it and write it into the target field of the pre-generated message; write it into the dependent party information of the message according to the calling number; find the user's public key identifier according to the calling number and write it into the corresponding message; clarify the verification method that the client must perform, such as biometric authentication, and encapsulate it into an authentication response message.
[0027] Specifically, the calling terminal sends an initial call request to the called terminal; the called terminal initiates trusted authentication and calls the verification processing platform to generate a first random number, which is then encapsulated in conjunction with the corresponding queried target public key to obtain an authentication response message, and the authentication response message, the target public key, and the first random number are returned to the called terminal; the called terminal temporarily stores the target public key and the first random number, and loads the authentication response message through the SIP 100 Trying signaling message and passes it through to the calling terminal.
[0028] Furthermore, the calling terminal sends an initial call request to the called terminal, including: generating a Session Initiation Protocol (SIP) Invitation INVITE message containing basic call parameters, wherein the Invitation INVITE message does not contain the Online Fast Authentication (FIDO) authentication field; and sending the Invitation INVITE message to the called terminal.
[0029] In addition, the called terminal loads the FIDO authentication message and transmits it to the calling terminal via the SIP 100 Trying signaling message. This includes: after receiving the INVITE message, the called terminal sends an authentication request to the verification processing platform and receives the authentication response message returned by the verification processing platform; the called terminal constructs a SIP 100 Trying response message and embeds the authentication response message into the message to send the corresponding message to the calling terminal; the calling terminal parses the received message to obtain the authentication response message to trigger the FIDO client to perform biometric authentication.
[0030] In one alternative embodiment, reference Figure 2Before sending the initial call request to the called terminal, the process includes: sending an identity credential application to the issuing center; receiving a verification registration message returned by the issuing center and performing biometric authentication; the verification registration message is obtained by the issuing center calling the biometric authentication function of the verification processing platform based on the biometric identifier in the identity credential application, generating a second random number and an authentication policy message; in response to biometric authentication, generating a target private key and a target public key; generating a registration information response message based on the target public key and the second random number, and signing the target public key and the second random number in the registration information response message using a preset device private key to obtain a signature value; sending the registration information response message and the signature value to the verification processing platform so that the verification processing platform can verify the signature value and determine that the registration information response message is legal, and instructing the issuing center to issue a trusted identity credential containing the target public key; and receiving the trusted identity credential issued by the issuing center.
[0031] It should be noted that by calling the verification processing platform through the issuance center to send a verification registration message containing a second random number, the real-time nature and uniqueness of the registration request are ensured, preventing attackers from intercepting historical registration information and submitting it repeatedly. Simultaneously, combined with biometric authentication, this ensures the user's unique ownership of biometric features, eliminating the possibility of fraudulent registration at the source. Furthermore, the private key is generated locally and never uploaded, guaranteeing absolute security of user privacy. Additionally, the registration information is signed using a pre-installed device private key to prove to the verification processing platform that the current device is an authenticated and legitimate device. This achieves a dual trusted binding of legitimate user (biometrics) and legitimate device (device private key), greatly enhancing the security of identity credential applications. Moreover, by verifying the device signature, the verification processing platform transfers the trust chain from the hardware device to the issuance center, ensuring the accuracy of the credential issuance recipient. Moreover, the entire process does not require the transmission of sensitive original user biometric data or private key data; only random numbers and public keys are exchanged, effectively reducing the risk of leakage during data transmission and improving the efficiency and security of registration and authentication.
[0032] Specifically, the verification registration message is obtained by the issuing center calling the verification processing platform to generate a second random number and encapsulate it when it determines that FIDO enhanced mode needs to be enabled based on the biometric identifier in the identity credential application.
[0033] In addition, the trusted identity credential is generated by the issuing center based on the registration success message sent by the verification processing platform, the target public key returned by the verification processing platform, and the signing of the credential using the issuing center's private key; the registration success message is generated by the verification processing platform after verifying the signature value through the metadata public key and saving the target public key in the registration information response message based on the successful verification.
[0034] It should be added that when using the private key of the issuing center to issue trusted credentials, they need to be generated according to the credential format in the corresponding actual standard, and no further restrictions are made here.
[0035] Step S12: In response to biometric authentication, obtain the target private key pre-stored locally and associated with the trusted identity credential, and use the target private key to sign based on the random number and call context information to generate an identity authentication response message; the target private key is stored in the secure execution environment (TEE / SE) and bound to the biometric authorization, and the trusted credential is obtained by applying to the issuing center.
[0036] In this embodiment, reference Figure 3 Based on a random number and call context information, the system uses the target private key to sign and generate an authentication response message. This includes: generating call data to be signed based on the call context information, and signing it using the target private key to obtain a call signature; generating a cryptographic token and adding it as extended data to the authentication data structure of the online fast authentication protocol to obtain a combined cryptographic token, and combining it with the first random number to obtain a pre-signed assertion; using the target private key to perform an assertion signature on the pre-signed assertion to obtain an assertion signature, and combining it with the call signature to generate an authentication response message.
[0037] It should be noted that by signing data containing call context information, it is ensured that the authentication request corresponds strictly one-to-one with the current specific call behavior, preventing attackers from intercepting authentication messages and misapplying them to other illegal call sessions, thereby improving business-level security. Furthermore, by integrating the generated cryptographic token as extended data, an additional security verification dimension is added without breaking the standard protocol structure. At the same time, combined with the first random number, it is ensured that each generated assertion has unpredictable timeliness, thereby effectively resisting replay attacks. Moreover, by generating call signatures for business context and assertion signatures for identity assertions respectively, a dual security barrier is constructed. The called terminal can verify the integrity of the call content and the authenticity of the user's identity separately, thereby achieving decoupling and deep integration of identity authentication and business verification, and improving the rigor of the trusted call establishment process.
[0038] It should be added that the call context information includes the signature time, the called number, the calling number, and the call purpose; based on the call context information, the call data to be signed is generated, including: encoding the signature time, the called number, the calling number, and the call purpose according to the preset identity credential standard format, and generating the call data to be signed.
[0039] For example, the default identity credential standard format corresponding to the call data to be signed can be: { signatureTimeGeneralizedTime, — Signature time becalledTelephoneNumberPrintableString, ——— The called number calledTelephoneNumberPrintableString, — Caller ID messageUTF8StringOPTIONAL — The purpose of the call } In addition, the online fast authentication protocol can be selected according to actual design requirements, such as the FIDO2.0 WebAuthn / CTAP protocol. FIDO2.0: the second generation standard for fast online authentication, namely WebAuthn and CTAP; WebAuthn: Web Authentication, a browser authentication standard based on public key encryption; CTAP: Client to Authenticator Protocol, is the client-to-authenticator protocol of FIDO2.0, which defines the communication specifications between external devices and the operating system / browser.
[0040] Step S13: Send a target call request carrying an authentication response message to the called terminal, so that the called terminal can verify the authentication response message using the pre-stored target public key and the first random number based on the target call request, and establish a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on the online fast authentication protocol.
[0041] In this embodiment, the called terminal is configured to: after sending a target call request carrying an authentication response message to the called terminal, extract a call signature, an assertion signature, and an assertion to be signed from the authentication response message based on the target call request; verify the assertion signature using a pre-stored target public key and a first random number based on the assertion to be signed; the target public key and the first random number are obtained and stored by the called terminal based on the initial call request by calling the verification processing platform; the target public key and the first random number are obtained and stored by the called terminal based on the initial call request by calling the verification processing platform; verify the call signature using the target public key based on the successful assertion signature verification; and establish a trusted call connection based on the successful call signature verification.
[0042] It should be noted that the called terminal uses the pre-stored target public key and the first random number from the previous interaction to verify the assertion signature. This verifies that the caller holds a legitimate private key while ensuring that the authentication message is generated in real time to ensure the uniqueness of the random number used in this call. This effectively prevents man-in-the-middle attacks and replay attacks, ensuring the real-time and authenticity of identity authentication. By obtaining and caching the target public key and random number from the verification processing platform during the initial call request stage, the called terminal can complete complex asymmetric encryption verification operations locally offline when it receives the target call request. This pre-fetching combined with local verification architecture significantly reduces the dependence on network stability, thereby greatly shortening the establishment latency of trusted calls, improving user experience, and constructing a layered verification logic: first, the user's identity is confirmed to be trustworthy through the assertion signature, and then the call context is confirmed to be unaltered through the call signature. Only when the authenticity of the identity and the integrity of the business data are both satisfied are the connection established. This eliminates the possibility that the caller may switch the call recipient or tamper with the session parameters after successful authentication, ensuring the absolute trustworthiness of the call connection.
[0043] It should be added that, using the pre-stored target public key and the first random number, the assertion to be signed and the assertion signature are verified, including: obtaining the original text of the assertion signature based on the assertion to be signed and the pre-stored first random number, and hashing it using a preset hash algorithm to obtain the original text of the assertion; decrypting the assertion signature using the pre-stored target public key, and matching the corresponding decryption result with the original text of the assertion; if the matching is successful, the assertion signature verification is confirmed to be successful.
[0044] In addition, the target public key is used to verify the call data to be signed and the call signature, including: decrypting the call signature with the target public key and matching the corresponding decryption result with the call data to be signed. If the match is successful, the call signature verification is confirmed.
[0045] If both the assertion signature and the call signature are verified, the calling terminal is deemed trustworthy, and the trustworthy identity information of the corresponding calling terminal is displayed and the phone rings.
[0046] Furthermore, the target call request includes a trusted identity credential; the trusted call connection is established after the called terminal, after both the assertion signature and the call signature have been verified, extracts the caller's number from the call signature, queries the credential query system to obtain the corresponding trusted identity credential, and verifies the identity of the trusted identity credential. The identity verification includes: verifying the signature value of the trusted identity credential using the previously obtained public key of the issuing center; verifying the validity period of the trusted identity credential; and determining whether the trusted identity credential is on the credential cancellation list.
[0047] Furthermore, when the called terminal authenticates the trusted identity credential, the process includes: using the issuing center's public key to calculate a digest value for the trusted identity credential, confirming that the calculated digest value matches the digest value in the trusted identity credential, thus confirming that the signature value verification is successful; parsing the validity period field of the trusted identity credential, confirming that the current time is within the validity period, thus confirming that the validity period verification is successful; confirming that the trusted identity credential is not in the credential cancellation list, thus confirming that the status verification is successful; based on the above verifications being successful, the authentication is confirmed to be successful, the trusted identity information corresponding to the calling terminal is displayed and the phone rings, and the called user can choose to answer or hang up.
[0048] In addition, the called terminal is also used for: before establishing a trusted call connection based on successful call signature verification, extracting the caller's number from the call signature based on successful call signature verification, querying the credential query system based on the caller's number to obtain the stored public key corresponding to the caller's number, and matching it with the pre-stored target public key; establishing a trusted call connection based on successful target public key matching; or refusing to establish a communication connection based on verification failure.
[0049] In summary, this embodiment of the invention sends an initial call request to the called terminal and receives an authentication response message from the called terminal, thereby introducing a first random number returned by the called terminal to ensure the timeliness and uniqueness of subsequent authentication information, preventing malicious third parties from intercepting historical authentication messages for replay attacks. Simultaneously, by combining biometric authentication, it mandates user presence and active authorization, effectively avoiding the risk of unauthorized users initiating calls when the device is lost or remotely controlled. Furthermore, by storing the core target private key in a secure execution environment, it constructs a robust hardware-level security barrier to prevent key leakage. The use of the private key must be bound by biometric authorization, realizing dual authentication of hardware factors and biometric factors, thereby greatly improving the non-repudiation and security of identity authentication. The identity authentication response message generated based on the target private key signature is sent to the called terminal, and the pre-stored target public key and the first random number pair are used for signature verification. The called terminal does not need to rely on traditional SMS verification codes or easily forged caller ID, and can quickly and independently verify the authenticity of the caller's identity locally. This strong authentication mechanism based on cryptography effectively prevents the forgery of the caller's number and ensures the credibility of the call connection.
[0050] The trusted call enhancement authentication device provided by the present invention is described below. The trusted call enhancement authentication device described below can be referred to in correspondence with the trusted call enhancement authentication method described above.
[0051] Figure 4 A schematic diagram of a trusted call enhanced authentication system is shown. The system includes: The request call module 41 sends an initial call request to the called terminal, receives the authentication response message returned by the called terminal, and performs biometric authentication; the authentication response message includes a first random number; The identity authentication response module 42 responds to biometric authentication by obtaining the target private key pre-stored locally and associated with the trusted identity credential, and using the target private key to sign based on a random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained by applying to the issuing center; The trusted connection module 43 sends a target call request carrying an authentication response message to the called terminal, so that the called terminal can verify the authentication response message using a pre-stored target public key and a first random number based on the target call request, and establish a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast authentication protocol.
[0052] It should be noted that the specific principles of the embodiments of the present invention are the same as those of the method embodiments described above. For details, please refer to the method embodiments above. More detailed explanations will not be repeated here.
[0053] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can invoke logical instructions in the memory 530 to execute a trusted call enhanced authentication method. This method includes: sending an initial call request to the called terminal; receiving an authentication response message returned by the called terminal and performing biometric authentication; the authentication response message includes a first random number; in response to biometric authentication, obtaining a locally pre-stored target private key associated with a trusted identity credential, and signing it using the target private key based on the random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application from an issuing center; sending a target call request carrying the identity authentication response message to the called terminal, so that the called terminal verifies the identity authentication response message using the pre-stored target public key and the first random number based on the target call request, and establishes a trusted call connection after successful verification; the target public key and target private key are generated in pairs based on an online fast identity verification protocol.
[0054] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0055] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the trusted call enhancement authentication method provided by the above methods. The method includes: sending an initial call request to the called terminal, receiving an authentication response message returned by the called terminal and performing biometric authentication; the authentication response message includes a first random number; in response to biometric authentication, obtaining a locally pre-stored target private key associated with a trusted identity credential, and signing it using the target private key according to the random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application to an issuing center; sending a target call request carrying the identity authentication response message to the called terminal, so that the called terminal verifies the identity authentication response message using the pre-stored target public key and the first random number based on the target call request, and establishes a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast identity verification protocol.
[0056] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the trusted call enhancement authentication method provided by the above methods. The method includes: sending an initial call request to a called terminal; receiving an authentication response message returned by the called terminal and performing biometric authentication; the authentication response message includes a first random number; in response to biometric authentication, obtaining a locally pre-stored target private key associated with a trusted identity credential, and signing it using the target private key according to the random number and call context information to generate an identity authentication response message; the target private key is stored in a secure execution environment and bound to biometric authorization, and the trusted credential is obtained based on an application to an issuing center; sending a target call request carrying the identity authentication response message to the called terminal, so that the called terminal verifies the identity authentication response message using the pre-stored target public key and the first random number based on the target call request, and establishes a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast identity verification protocol.
[0057] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0058] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A trusted call enhancement authentication method, characterized in that, include: Send an initial call request to the called terminal, receive the authentication response message returned by the called terminal and perform biometric authentication; The authentication response message includes a first random number; In response to the biometric authentication, a target private key associated with a trusted identity credential is obtained from a locally pre-stored database, and a signature is generated using the target private key based on the random number and call context information to generate an identity authentication response message. The target private key is stored in a secure execution environment and is bound to biometric authorization; the trusted credential is obtained by applying to the issuing center. A target call request carrying the authentication response message is sent to the called terminal, so that the called terminal can verify the authentication response message based on the target call request using a pre-stored target public key and a first random number, and establish a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast authentication protocol.
2. The trusted call enhancement authentication method according to claim 1, characterized in that, Based on the random number and call context information, a signature is generated using the target private key to produce an authentication response message, including: Based on the call context information, call data to be signed is generated, and the target private key is used to sign it to obtain the call signature; A password token is generated and added as extended data to the authentication data structure of the online fast authentication protocol to obtain a combined password token. Combined with the first random number, a signature assertion is obtained. The target private key is used to perform an assertion signature on the assertion to be signed, resulting in an assertion signature, which is then combined with the call signature to generate an authentication response message.
3. The trusted call enhancement authentication method according to claim 2, characterized in that, The called terminal is used for: After sending a target call request carrying the authentication response message to the called terminal, the call signature, assertion signature, and assertion to be signed are extracted from the authentication response message based on the target call request. Based on the assertion to be signed, the signature of the assertion is verified using the pre-stored target public key and the first random number; The target public key and the first random number are obtained and stored by the called terminal based on the initial call request by calling the verification processing platform; the target public key and the first random number are obtained and stored by the called terminal based on the initial call request by calling the verification processing platform. Based on the successful assertion signature verification, the call signature is verified using the target public key; A trusted call connection is established once the call signature verification is successful.
4. The trusted call enhancement authentication method according to claim 3, characterized in that, The target call request includes trusted identity credentials; The trusted call connection is established after the called terminal has successfully verified both the assertion signature and the call signature, by extracting the caller's number from the call signature, querying the credential query system to obtain the corresponding trusted identity credential, and verifying the identity credential. The authentication includes: The signature value of the trusted identity credential is verified using the previously obtained public key of the issuing center. The validity period of the trusted identity credential is verified, and it is determined whether the trusted identity credential is on the credential cancellation list.
5. The trusted call enhancement authentication method according to claim 1, characterized in that, The initial call request is generated based on basic call parameters and sent to the called terminal using a preset session protocol; The authentication response message is generated when the called terminal sends an authentication request to the verification processing platform based on the initial call request. The verification processing platform generates a first random number based on the authentication request and obtains the corresponding previously stored target public key.
6. The trusted call enhancement authentication method according to claim 1, characterized in that, Before sending the initial call request to the called terminal, the process includes: Send an identity credential application to the issuing center, receive a verification registration message returned by the issuing center, and perform biometric authentication; the verification registration message is obtained by the issuing center based on the biometric identifier in the identity credential application, calling the biometric authentication function of the verification processing platform to generate a second random number and an authentication strategy message; In response to the biometric authentication, a target private key and a target public key are generated; Based on the target public key and the second random number, a registration information response message is generated, and the target public key and the second random number in the registration information response message are signed using a preset device private key to obtain a signature value; The registration information response message and the signature value are sent to the verification processing platform so that the verification processing platform can verify the signature value and determine that the registration information response message is valid. Then, the platform instructs the issuing center to issue a trusted identity credential containing the target public key. Receive the trusted identity credential issued by the issuing center.
7. The trusted call enhancement authentication method according to claim 1, characterized in that, The trusted identity credential is generated by the issuing center based on the registration success message sent by the verification processing platform, according to the target public key returned by the verification processing platform, and then issued using the private key of the issuing center. The registration success message is generated by the verification processing platform after verifying the signature value using the metadata public key and saving the target public key in the registration information response message based on the successful verification.
8. A trusted call enhancement authentication system, characterized in that, include: The request call module sends an initial call request to the called terminal, receives the authentication response message returned by the called terminal, and performs biometric authentication. The authentication response message includes a first random number; The identity authentication response module, in response to the biometric authentication, obtains the target private key pre-stored locally and associated with the trusted identity credential, and uses the target private key to sign according to the random number and call context information to generate an identity authentication response message. The target private key is stored in a secure execution environment and is bound to biometric authorization; the trusted credential is obtained by applying to the issuing center. The trusted connection module sends a target call request carrying the authentication response message to the called terminal, so that the called terminal can verify the authentication response message based on the target call request using a pre-stored target public key and a first random number, and establish a trusted call connection after successful verification; the target public key and the target private key are generated in pairs based on an online fast authentication protocol.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the trusted call enhancement authentication method as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the trusted call enhancement authentication method as described in any one of claims 1 to 7.