Security hardware identity authentication method and device, electronic equipment and program product

Abstract

The application discloses a kind of identity authentication method of secure hardware and its device, electronic equipment, program product, it is related to information security and identity authentication technical field, wherein, the identity authentication method includes: to the first secure hardware is authenticated, and establishes authentication session, in the authentication state of identity authentication is successful, the authentication session information of authentication session is generated;Authentication session information is migrated to second running environment, and the initial serial number of second secure hardware is reconstructed, and the serial number of second secure hardware is obtained;Second secure hardware serial number is written to second secure hardware, and second secure hardware is accessed to second running environment, to complete the identity authentication of second secure hardware in second running environment by inheriting the authentication state of first secure hardware in first running environment.The present application solves the technical problem that the complexity is higher when re-authentication or modifying authentication logic in the related art, reduces the technical problem of business efficiency.

Description

Technical Field

[0001] This invention relates to the field of information security and identity authentication technology, and more specifically, to an identity authentication method, apparatus, electronic device, and program product for secure hardware. Background Technology

[0002] In scenarios with high security requirements, authentication typically relies on secure hardware, and login status is maintained through authentication sessions. Existing authentication mechanisms usually strongly bind authentication sessions to the identity of the secure hardware, and subsequently verify whether the current secure hardware matches the identity bound to the authentication session through periodic presence checks. Therefore, if the secure hardware used in the operating environment is inconsistent with the secure hardware used in the authentication phase, even if the authentication session already exists, the system will still determine that the authentication has failed due to identity inconsistency.

[0003] When business systems run in special operating scenarios such as virtual machines, bastion hosts, cloud desktops, remote operation and maintenance platforms, and isolated test environments, the original certified security hardware cannot be used in the target operating environment due to limitations such as USB (Universal Serial Bus) redirection capabilities, direct hardware connection restrictions, security domain isolation policies, or remote access architectures. Re-certification or modification of the certification logic will change the original system mechanism or add additional complexity, thereby affecting business continuity.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and program product for identity authentication of secure hardware, which at least solves the technical problem in related technologies where the complexity of re-authentication or modification of authentication logic is high, reducing business efficiency.

[0006] According to one aspect of the embodiments of this application, a method for authenticating security hardware is provided, comprising: authenticating a first security hardware and establishing an authentication session; generating authentication session information of the authentication session if the authentication status is successful, wherein the authentication is performed in a first operating environment and the first security hardware corresponds to a first security hardware serial number; migrating the authentication session information to a second operating environment and reconstructing the initial serial number of the second security hardware based on the first security hardware serial number to obtain a second security hardware serial number; writing the second security hardware serial number to the second security hardware and connecting the second security hardware with the second security hardware serial number to the second operating environment, so as to complete the authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0007] Furthermore, before generating the authentication session information for the authentication session, the process includes: reading the first security hardware serial number of the first security hardware; binding the first security hardware serial number to the authentication session; and representing the first security hardware serial number as the identity identifier of the authentication session.

[0008] Furthermore, the first operating environment is different from the second operating environment, the first security hardware cannot access the second operating environment, and the serial number of the first security hardware is the same as the serial number of the second security hardware.

[0009] Furthermore, the step of reconstructing the initial serial number of the second security hardware based on the first security hardware serial number to obtain the second security hardware serial number includes: reconstructing the initial serial number of the second security hardware using a preset tool to obtain the second security hardware serial number; or, reconstructing the initial serial number of the second security hardware using a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

[0010] Furthermore, after the second security hardware, which has been written into the second security hardware sequence, is connected to the second operating environment, the process includes: calling the second security hardware to perform detection based on a preset period and obtaining the detection result; and determining the identity authentication status of the second security hardware within the preset period based on the detection result.

[0011] Furthermore, the step of calling the second security hardware to perform detection based on a preset cycle and obtaining the detection result includes: reading the second security hardware sequence of the second security hardware and determining whether the second security hardware sequence is the same as the first security hardware serial number; if the second security hardware sequence is the same as the first security hardware serial number, the authentication success is determined as the detection result; if the second security hardware sequence is different from the first security hardware serial number, the authentication failure is determined as the detection result.

[0012] Furthermore, the authentication session information can be migrated to the second runtime environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication status restoration.

[0013] According to another aspect of the embodiments of this application, an identity authentication device for security hardware is also provided, comprising: a generation unit, configured to perform identity authentication on a first security hardware and establish an authentication session, and generate authentication session information of the authentication session when the authentication status of the identity authentication is successful, wherein the identity authentication is performed in a first operating environment, and the first security hardware corresponds to a first security hardware serial number; a construction unit, configured to migrate the authentication session information to a second operating environment, and reconstruct the initial serial number of the second security hardware based on the first security hardware serial number to obtain a second security hardware serial number; and a writing unit, configured to write the second security hardware serial number to the second security hardware, and connect the second security hardware after writing the second security hardware serial number to the second operating environment, so as to complete the identity authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0014] Furthermore, the identity authentication device for the security hardware includes: a first reading module, used to read the first security hardware serial number of the first security hardware before generating authentication session information for the authentication session; and a first characterization module, used to bind the first security hardware serial number to the authentication session and characterize the first security hardware serial number as the identity identifier of the authentication session.

[0015] Furthermore, the first operating environment is different from the second operating environment, the first security hardware cannot access the second operating environment, and the serial number of the first security hardware is the same as the serial number of the second security hardware.

[0016] Furthermore, the building unit includes: a first building module, used to reconstruct the initial serial number of the second security hardware using a preset tool to obtain the second security hardware serial number; and a second building module, used to reconstruct the initial serial number of the second security hardware using a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

[0017] Furthermore, the identity authentication device for the security hardware also includes: a first invocation module, used to invoke the second security hardware for detection based on a preset period after the second security hardware, which has been written into the second security hardware sequence, is connected to the second operating environment, and obtain the detection result; and a first determination module, used to determine the identity authentication status of the second security hardware within the preset period based on the detection result.

[0018] Furthermore, the first calling module includes: a first reading submodule, used to read the second security hardware sequence of the second security hardware and determine whether the second security hardware sequence is the same as the first security hardware serial number; a first determining submodule, used to determine successful authentication as the detection result if the second security hardware sequence is the same as the first security hardware serial number; and a second determining submodule, used to determine failed authentication as the detection result if the second security hardware sequence is different from the first security hardware serial number.

[0019] Furthermore, the authentication session information can be migrated to the second runtime environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication status restoration.

[0020] According to another aspect of the embodiments of this application, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the authentication method of any of the above-mentioned security hardware.

[0021] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the authentication method of any of the above-described security hardware.

[0022] In this invention, the first security hardware is authenticated, and an authentication session is established. If the authentication status is successful, authentication session information is generated. The authentication is performed in a first operating environment, and the first security hardware has a corresponding first security hardware serial number. The authentication session information is migrated to a second operating environment, and the initial serial number of the second security hardware is reconstructed based on the first security hardware serial number to obtain a second security hardware serial number. The second security hardware serial number is written to the second security hardware, and the second security hardware with the second security hardware serial number is connected to the second operating environment. By inheriting the authentication status of the first security hardware in the first operating environment, the second security hardware completes the authentication in the second operating environment. This solves the technical problem in related technologies where the complexity of re-authentication or modification of authentication logic is high, reducing business efficiency.

[0023] In this invention, under the premise that the first security hardware has successfully authenticated, the system migrates the authentication session information of the first security hardware to the second operating environment. To continue the authentication status, the second security hardware is used as a substitute access device. Based on the serial number of the first security hardware bound in the migrated authentication session information, the initial serial number of the second security hardware is reconstructed so that the device identifier returned externally is completely consistent with the serial number of the first security hardware, thereby forming the second security hardware serial number. Subsequently, the reconstructed serial number is written to the firmware storage area of ​​the second security hardware to complete the identity consistency construction. By inheriting the authentication status of the first security hardware in the first operating environment, the second security hardware completes the identity authentication in the second operating environment. Without breaking the original security policy or increasing the system complexity, seamless inheritance of the authentication status between heterogeneous environments is achieved, solving the problems of business interruption, efficiency reduction and increased operation and maintenance costs caused by forced re-authentication or modification of the authentication process due to hardware access restrictions. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an authentication method for secure hardware is shown.

[0026] Figure 2 This is a flowchart of the identity authentication method for security hardware according to Embodiment 1 of this application;

[0027] Figure 3 This is a flowchart of an authentication method based on authentication session inheritance and security hardware identity consistency according to an embodiment of this application;

[0028] Figure 4 This is a schematic diagram of an identity authentication device for security hardware according to an embodiment of this application;

[0029] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0033] Authentication session: A set of state information established by the system after a user or device has been authenticated, used to identify the current authenticated state during subsequent interactions.

[0034] Authentication session inheritance: Migrate an established authentication session from one runtime environment to another, enabling the target environment to directly reuse the authentication state.

[0035] Security hardware: refers to hardware devices with key storage and encryption / decryption capabilities, used to implement strong identity authentication. In this invention, Ukey (smart password key) is used as an example.

[0036] Security hardware identity identifier: Unique identification information provided by the security hardware, used to bind the device identity during the authentication process.

[0037] Ukey presence detection: The system uses a mechanism that periodically calls a secure hardware interface to verify whether the current device still exists and whether its identity has changed.

[0038] It should be noted that all relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with the relevant laws, regulations, and standards of the relevant regions, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. If the user chooses to refuse, the process enters the expert decision-making process.

[0039] In this invention, when the original authentication security hardware cannot be used in restricted environments such as virtual machines and bastion hosts, alternative security hardware can be used to maintain the authentication status. Without modifying the existing authentication process and in-situ detection mechanism, the authentication status is kept continuously valid, thereby ensuring the integrity of the system's authentication mechanism. This also improves the system's availability in complex deployment environments and solves the authentication failure problem caused by changes in the operating environment or hardware differences.

[0040] The present invention will now be described in detail with reference to various embodiments.

[0041] Example 1

[0042] According to an embodiment of this application, an embodiment of a security hardware authentication method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0043] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an authentication method for secure hardware is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0044] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0045] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the identity authentication method of the security hardware in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned identity authentication method of the security hardware. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0046] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0047] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0048] Under the aforementioned operating environment, this application provides the following: Figure 2 The authentication method for the security hardware shown. Figure 2 This is a flowchart of the identity authentication method for security hardware according to Embodiment 1 of this application, as follows: Figure 2 As shown, the method includes the following steps:

[0049] Step S201: Authenticate the first security hardware and establish an authentication session. If the authentication status is successful, generate authentication session information. The authentication is performed in the first operating environment, and the first security hardware has a corresponding first security hardware serial number.

[0050] In this embodiment of the invention, the first security hardware refers to the original UKey (smart password key, used for identity authentication) held by the operator and used to complete the initial identity authentication. The identity authentication process follows the original authentication mechanism, for example, by calling an interface and combining it with the PIN code (Personal Identification Number) entered by the user, performing digital signature or key negotiation to complete the identity validity verification. Subsequent operations only continue when the authentication status is returned as successful. At this time, authentication session information bound to the authentication process is generated. The authentication session information includes, but is not limited to, session identifiers, cookies (small text data set by the server through response headers and stored locally on the client when the user visits a website), tokens (credentials issued by the authentication server for identity verification), or local login credentials.

[0051] Identity authentication is performed in the first operating environment, also known as the local environment. The local environment can be a physical office terminal with full hardware access capabilities, a local computer, or other authentication environment that can directly connect to the original UKey. Simultaneously, during the authentication process, the unique device identifier, i.e., the first security hardware serial number (such as "UKEY-A-2024-001"), is read from the firmware of the first security hardware and permanently recorded in the binding relationship of the authentication session, serving as the sole verification basis for subsequent periodic presence checks.

[0052] Step S202: The authentication session information is migrated to the second operating environment, and the initial serial number of the second security hardware is reconstructed based on the first security hardware serial number to obtain the second security hardware serial number.

[0053] In this embodiment of the invention, the second operating environment is a restricted operating environment. This restricted operating environment can be a virtual machine, a bastion host, a cloud desktop, a remote testing environment, or a special environment where, for some reason, immediate and stable access to the original UKey is not possible. After successful authentication, the authentication session information from the local environment is migrated to the restricted operating environment. The migrated information may include cookies from the browser, session data, local login status, and authentication context saved by the system, allowing the restricted operating environment to inherit the authenticated status from the local environment without re-executing the complete login authentication process. Furthermore, the identity parameters (i.e., the initial serial number) of the replacement UKey (i.e., the second security hardware) are adjusted to obtain the second security hardware serial number, ensuring that the identity identifier returned externally is consistent with the original UKey.

[0054] Step S203: Write the second security hardware serial number to the second security hardware, and connect the second security hardware after writing the second security hardware serial number to the second operating environment, so as to complete the identity authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0055] In this embodiment of the invention, by reconstructing the serial number of the second security hardware and connecting the second security hardware with the rewritten serial number to the second operating environment, the second security hardware now possesses identity consistency (i.e., its externally presented identity is completely consistent with the original device (i.e., the first security hardware)). Without altering the original authentication logic, the system recognizes the alternative device in the restricted operating environment as the original device, thereby seamlessly continuing the authentication state and completing the identity authentication of the second security hardware in the second operating environment.

[0056] Figure 3 This is a flowchart illustrating an authentication method based on authentication session inheritance and security hardware identity consistency according to an embodiment of this application, as shown below. Figure 3As shown, the prerequisite for this method is that the operator legally possesses the first Ukey, the second Ukey, and their passwords, and has the authority to log in to the application system in both the first and second environments. First, the user completes the login operation in the first environment (i.e., the local environment) using the first Ukey and entering the password, establishing a binding relationship between the first Ukey and the application system (e.g., the current authentication session - the serial number of the first Ukey), exporting the session information, and then migrating the authentication session information from the first environment to the second environment (i.e., the restricted operating environment) to inherit the authentication status of the first Ukey. The second Ukey is then inserted into the second environment, and through system principle checks, the session remains valid without interrupting the business process.

[0057] In summary, by completing legitimate identity authentication and establishing an authentication session for the first security hardware in the first operating environment, the authentication session information is migrated to the restricted second operating environment. Simultaneously, based on the serial number of the first security hardware, the initial serial number of the second security hardware is reconstructed using the firmware parameter rewriting mechanism provided by the manufacturer to be completely consistent with the serial number of the first security hardware. This serial number is then written into the second security hardware and connected to the second operating environment, so that the system considers it to be completely consistent with the identity of the first security hardware. Without modifying the original authentication process, breaking the security verification rules, or exporting the private key or certificate, seamless inheritance and continuous validity of the authentication status are achieved in scenarios of physical device replacement and operating environment isolation. This solves the technical problem of high complexity and reduced business efficiency when re-authenticating or modifying the authentication logic in related technologies.

[0058] To improve the correlation between the first security hardware serial number and the authentication session, in the security hardware authentication method provided in Embodiment 1 of this application, the first security hardware serial number of the first security hardware is read; the first security hardware serial number is bound to the authentication session, and the first security hardware serial number is represented as the identity identifier of the authentication session.

[0059] In this embodiment of the invention, during the authentication process, the device serial number (first security hardware serial number) of the original UKey (i.e., the first security hardware) can be read through a standard security interface, and this serial number is used as the unique identifier bound to the authentication session. After successful authentication, the system generates corresponding authentication session information and establishes the following binding relationship: current authentication session - original UKey serial number. When the system subsequently performs periodic presence checks, it primarily relies on this serial number to determine whether the currently accessing device is still the original authentication device.

[0060] In the identity authentication method for security hardware provided in Embodiment 1 of this application, the first operating environment is different from the second operating environment, the first security hardware cannot access the second operating environment, and the serial number of the first security hardware is the same as the serial number of the second security hardware.

[0061] In this embodiment of the invention, the first operating environment refers to a trusted environment with complete physical access capabilities, such as an office terminal or local computer equipped with a USB interface. Here, the user can directly insert and use their dedicated first security hardware (such as a certain model UKey) to complete the system's native authentication process. The second operating environment, on the other hand, is a restricted operating environment, such as a virtual machine, bastion host, cloud desktop, or remote operation and maintenance platform. Due to security isolation policies, lack of USB redirection capabilities, or virtualization architecture limitations, such environments cannot physically access the first security hardware. Even if the user possesses the device, they cannot insert it or recognize it in this environment.

[0062] In order to accurately obtain the second security hardware serial number, in the security hardware authentication method provided in Embodiment 1 of this application, the initial serial number of the second security hardware is reconstructed by a preset tool to obtain the second security hardware serial number; or, the initial serial number of the second security hardware is reconstructed by a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

[0063] In this embodiment of the invention, the second security hardware refers to a backup UKey used to replace the first security hardware in a second operating environment. It comes with a unique initial serial number at the factory, for example, UKEY-B-789. This value is different from the serial number of the first security hardware (e.g., UKEY-A-2024-001). If directly connected to a restricted operating environment, it will cause the system's presence detection to fail. Therefore, the initial serial number of the second security hardware needs to be reconstructed so that the serial number returned externally is completely consistent with that of the first security hardware. This can be done by using preset tools (such as low-level management tools or initialization tools, which can be officially certified device management programs provided by the security hardware manufacturer) to call the configuration commands built into the second security hardware and modify the device serial number field in the non-volatile storage area. Alternatively, a new serial number value (i.e., the second security hardware serial number) can be written to the UKey's chip firmware through low-level APDU (Application Protocol Data Unit) instructions or a manufacturer's proprietary protocol (i.e., firmware parameter rewriting mechanism). This operation does not involve modification of the private key, certificate, or encryption module; it only updates the identifier string reported externally by the device.

[0064] To improve the determination of the identity authentication status of the second security hardware within a preset period, the identity authentication method for security hardware provided in Embodiment 1 of this application calls the second security hardware for detection based on the preset period to obtain the detection result; and determines the identity authentication status of the second security hardware within the preset period based on the detection result.

[0065] In this embodiment of the invention, following the original security mechanism, the UKey interface is periodically called for presence detection (i.e., based on a preset period, a second security hardware is called for detection to obtain the detection result) to confirm whether the authentication subject is continuously online (i.e., to obtain the identity authentication status). Presence detection may include: querying the serial number of the currently accessed UKey, checking the device's online status, and performing device heartbeat detection. For example, by reading the current device serial number and comparing it with the serial number recorded when the authentication session was established, since the currently returned serial number is consistent with the original recorded serial number, the detection result is successful authentication, thus determining that the current authentication subject is still legitimately online. This achieves the goals of not triggering re-login, not requiring the original UKey to be reinserted, not interrupting the current business process, maintaining the authentication session's continued validity, and continuing to execute related business functions that rely on UKey authentication. Ultimately, without modifying the system code or changing the security verification rules, a substitute UKey can stably inherit the legitimate authentication status established by the original UKey in a restricted operating environment, ensuring the continuous availability of the business system in special environments.

[0066] In order to obtain accurate detection results, in the authentication method of the security hardware provided in Embodiment 1 of this application, the second security hardware sequence of the second security hardware is read, and it is determined whether the second security hardware sequence is the same as the first security hardware serial number; if the second security hardware sequence is the same as the first security hardware serial number, the authentication is determined to be successful as the detection result; if the second security hardware sequence is different from the first security hardware serial number, the authentication is determined to be unsuccessful as the detection result.

[0067] In this embodiment of the invention, only string equality judgment is performed. If the second security hardware sequence is completely consistent with the first security hardware sequence number, the current device identity can be determined to be legitimate, and authentication success can be taken as the detection result. If they are inconsistent, the identity is determined to be mismatched, authentication failure can be taken as the detection result, and security responses such as session interruption and forced logout can be triggered.

[0068] Since the main identity information verified during authentication establishment and periodic in-situ detection is the UKey serial number, without further verification of the certificate chain or the unique identity parameters at the chip level, the system cannot distinguish whether the currently connected device is the original device or the replacement device, thus achieving effective replacement of the original UKey by the replacement UKey.

[0069] In order to accurately migrate authentication session information to the second operating environment, the authentication method for security hardware provided in Embodiment 1 of this application migrates authentication session information to the second operating environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication status restoration.

[0070] In this embodiment of the invention, the migration process can be achieved through browser configuration copying (e.g., copying the contents of the user configuration file directory of the local browser to the corresponding directory of the second runtime environment), automated script injection (e.g., dynamically writing the Cookie or Token obtained from the local environment into the browser memory through script injection or pushing the authentication context from the local environment to the remote environment through the browser's extended application programming interface), environment synchronization (e.g., deploying a lightweight synchronization proxy service between the local environment and the target environment to encrypt and transmit the authentication session information to the second runtime environment), or authentication status restoration, etc.

[0071] The security hardware authentication method provided in this application can migrate a legally established authentication session from a first operating environment to a second operating environment without changing the original authentication system, through an authentication session inheritance mechanism. Simultaneously, in the second operating environment, the identity consistency of the replacement UKey is constructed, ensuring that the identity identifier it provides externally is consistent with the original UKey bound to the original authentication session. Therefore, through the system's original UKey presence detection mechanism, it essentially continues the legitimate authentication state, rather than re-authenticating or forging identity, and does not involve any illegal attack behavior, thus achieving the continuous operation of legitimate business processes.

[0072] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0073] Example 2

[0074] This application also provides an identity authentication device for security hardware. It should be noted that the identity authentication device for security hardware provided in this application can be used to execute the identity authentication method for security hardware provided in this application. The identity authentication device for security hardware provided in this application is described below.

[0075] According to an embodiment of this application, an apparatus for implementing the above-described authentication method for security hardware is also provided. Figure 4 This is a schematic diagram of an identity authentication device for security hardware according to an embodiment of this application, such as... Figure 4 As shown, the identity authentication device of the security hardware may include: a generation unit 40, a construction unit 41, and a writing unit 42.

[0076] The generation unit 40 is used to authenticate the first security hardware and establish an authentication session. When the authentication status of the authentication is successful, it generates authentication session information of the authentication session. The authentication is performed in the first operating environment, and the first security hardware has a corresponding first security hardware serial number.

[0077] The construction unit 41 is used to migrate the authentication session information to the second runtime environment and reconstruct the initial serial number of the second security hardware based on the first security hardware serial number to obtain the second security hardware serial number.

[0078] The writing unit 42 is used to write the second security hardware serial number to the second security hardware and connect the second security hardware after writing the second security hardware serial number to the second operating environment, so as to complete the identity authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0079] The security hardware authentication device provided in this application embodiment can authenticate the first security hardware through the generation unit 40 and establish an authentication session. When the authentication status is successful, authentication session information of the authentication session is generated. The authentication session information can be migrated to the second operating environment through the construction unit 41. Based on the serial number of the first security hardware, the initial serial number of the second security hardware is reconstructed to obtain the second security hardware serial number. The second security hardware serial number can be written to the second security hardware through the writing unit 42. The second security hardware after writing the second security hardware serial number is connected to the second operating environment so as to complete the authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0080] Optionally, the authentication device for the security hardware includes: a first reading module, used to read the first security hardware serial number of the first security hardware before generating authentication session information for the authentication session; and a first characterization module, used to bind the first security hardware serial number to the authentication session and characterize the first security hardware serial number as the identity identifier of the authentication session.

[0081] Optionally, the first operating environment is different from the second operating environment, the first security hardware cannot access the second operating environment, and the serial number of the first security hardware is the same as the serial number of the second security hardware.

[0082] Optionally, the building unit 41 includes: a first building module, used to reconstruct the initial serial number of the second security hardware using a preset tool to obtain the second security hardware serial number; and a second building module, used to reconstruct the initial serial number of the second security hardware using a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

[0083] Optionally, the identity authentication device for the security hardware further includes: a first invocation module, used to invoke the second security hardware for detection based on a preset period after the second security hardware, which has been written into the second security hardware sequence, is connected to the second operating environment, and obtain the detection result; and a first determination module, used to determine the identity authentication status of the second security hardware within the preset period based on the detection result.

[0084] Optionally, the first calling module includes: a first reading submodule, used to read the second security hardware sequence of the second security hardware and determine whether the second security hardware sequence is the same as the first security hardware serial number; a first determining submodule, used to determine successful authentication as the detection result if the second security hardware sequence is the same as the first security hardware serial number; and a second determining submodule, used to determine failed authentication as the detection result if the second security hardware sequence is different from the first security hardware serial number.

[0085] Alternatively, authentication session information can be migrated to a second runtime environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication state restoration.

[0086] The aforementioned security hardware authentication device may also include a processor and a memory. The aforementioned generation unit 40, construction unit 41, writing unit 42, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0087] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured to write a second security hardware serial number to the second security hardware by adjusting kernel parameters. The second security hardware, after having its serial number written, is then connected to the second operating environment. By inheriting the authentication status of the first security hardware in the first operating environment, the second security hardware completes its authentication in the second operating environment.

[0088] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0089] It should be noted that the generation unit 40, construction unit 41, and writing unit 42 mentioned above correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0090] Example 3

[0091] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0092] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0093] In this embodiment, the computer terminal can execute the program code for the following steps in the security hardware authentication method: authenticating the first security hardware and establishing an authentication session; generating authentication session information if the authentication status is successful, wherein the authentication is performed in a first operating environment and the first security hardware has a corresponding first security hardware serial number; migrating the authentication session information to a second operating environment, and reconstructing the initial serial number of the second security hardware based on the first security hardware serial number to obtain a second security hardware serial number; writing the second security hardware serial number to the second security hardware, and connecting the second security hardware with the second security hardware serial number to the second operating environment, so as to complete the authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

[0094] Optionally, the computer terminal described above can execute program code for the following steps in the authentication method for security hardware: reading the first security hardware serial number; binding the first security hardware serial number to the authentication session, and representing the first security hardware serial number as the identity identifier of the authentication session.

[0095] Optionally, the computer terminal described above can execute program code for the following steps in the authentication method for security hardware: the first operating environment is different from the second operating environment, the first security hardware cannot access the second operating environment, and the serial number of the first security hardware is the same as the serial number of the second security hardware.

[0096] Optionally, the aforementioned computer terminal may execute program code for the following steps in the authentication method for security hardware: reconstructing the initial serial number of the second security hardware using a preset tool to obtain the second security hardware serial number; or, reconstructing the initial serial number of the second security hardware using a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

[0097] Optionally, the aforementioned computer terminal may execute program code for the following steps in the authentication method of the security hardware: based on a preset period, calling the second security hardware to perform detection and obtaining the detection result; based on the detection result, determining the authentication status of the second security hardware within the preset period.

[0098] Optionally, the computer terminal described above can execute the program code for the following steps in the authentication method of the security hardware: reading the second security hardware sequence of the second security hardware and determining whether the second security hardware sequence is the same as the first security hardware serial number; if the second security hardware sequence is the same as the first security hardware serial number, determining successful authentication as the detection result; if the second security hardware sequence is different from the first security hardware serial number, determining failed authentication as the detection result.

[0099] Optionally, the computer terminal described above can execute program code for the following steps in the authentication method of the security hardware: the authentication session information is migrated to the second runtime environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication state restoration.

[0100] Optionally, Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0101] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the authentication method and apparatus for the security hardware in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned authentication method for the security hardware. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0102] The processor can access the information and application programs stored in the memory via the transmission device to execute the aforementioned steps in the authentication method of the aforementioned security hardware.

[0103] The embodiments of this application provide a security hardware authentication scheme. First, after the original authentication is legally completed, the established authentication session is completely migrated to a restricted environment. Then, by rewriting the serial number of the replacement UKey, the externally presented identity is made completely consistent with the original UKey. This deceives the verification logic when the system performs the original presence detection, causing the system to determine that the replacement device is the original device. This is a cross-environment continuation of the legal authentication state, thereby solving the technical problem of high complexity and reduced business efficiency when re-authenticating or modifying authentication logic in related technologies.

[0104] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0105] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0106] Example 4

[0107] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the authentication method of the security hardware provided in Embodiment 1.

[0108] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0109] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing authentication method steps of security hardware.

[0110] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0111] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0113] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0114] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0115] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0116] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for authenticating identity on secure hardware, characterized in that, include: The first security hardware is authenticated and an authentication session is established. If the authentication status of the authentication is successful, the authentication session information of the authentication session is generated. The authentication is performed in the first operating environment, and the first security hardware has a corresponding first security hardware serial number. The authentication session information is migrated to the second operating environment, and the initial serial number of the second security hardware is reconstructed based on the first security hardware serial number to obtain the second security hardware serial number; Write the second security hardware serial number to the second security hardware, and connect the second security hardware after writing the second security hardware serial number to the second operating environment, so as to complete the identity authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

2. The authentication method for secure hardware according to claim 1, characterized in that, Before generating the authentication session information for the authentication session, the following is included: Read the serial number of the first security hardware; The first security hardware serial number is bound to the authentication session, and the first security hardware serial number is used as the identity identifier of the authentication session.

3. The authentication method for secure hardware according to claim 1, characterized in that, The first operating environment is different from the second operating environment. The first security hardware cannot access the second operating environment. The serial number of the first security hardware is the same as the serial number of the second security hardware.

4. The authentication method for secure hardware according to claim 1, characterized in that, The step of reconstructing the initial serial number of the second security hardware based on the first security hardware serial number to obtain the second security hardware serial number includes: The initial serial number of the second security hardware is reconstructed using a preset tool to obtain the second security hardware serial number; or, The initial serial number of the second security hardware is reconstructed through a firmware parameter rewriting mechanism to obtain the second security hardware serial number.

5. The authentication method for secure hardware according to claim 1, characterized in that, After the second security hardware, after being written into the second security hardware sequence, is connected to the second operating environment, the following steps are included: Based on a preset cycle, the second security hardware is invoked to perform detection, and the detection results are obtained. Based on the detection results, the identity authentication status of the second security hardware within the preset period is determined.

6. The authentication method for secure hardware according to claim 5, characterized in that, The steps for calling the second security hardware to perform detection based on a preset period and obtaining the detection results include: Read the second security hardware sequence of the second security hardware and determine whether the second security hardware sequence is the same as the first security hardware sequence number; If the second security hardware sequence number is the same as the first security hardware sequence number, the authentication success will be determined as the detection result. If the second security hardware sequence number is different from the first security hardware sequence number, the authentication failure will be determined as the detection result.

7. The authentication method for secure hardware according to claim 1, characterized in that, The authentication session information can be migrated to the second runtime environment in one of the following ways: browser configuration copying, automated script injection, environment synchronization, or authentication status restoration.

8. An identity authentication device for secure hardware, characterized in that, include: The generation unit is used to authenticate the first security hardware and establish an authentication session. If the authentication status of the authentication is successful, the generation unit generates authentication session information of the authentication session. The authentication is performed in a first operating environment, and the first security hardware has a corresponding first security hardware serial number. The construction unit is used to migrate the authentication session information to the second runtime environment and, based on the first security hardware serial number, reconstruct the initial serial number of the second security hardware to obtain the second security hardware serial number. The writing unit is used to write the second security hardware serial number to the second security hardware and connect the second security hardware after writing the second security hardware serial number to the second operating environment, so as to complete the identity authentication of the second security hardware in the second operating environment by inheriting the authentication status of the first security hardware in the first operating environment.

9. A computer program product, characterized in that, The device includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the authentication method of the security hardware according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the authentication method of the security hardware according to any one of claims 1 to 7.

Images