TW201741922A - Biological feature based safety certification method and device - Google Patents
Biological feature based safety certification method and device Download PDFInfo
- Publication number
- TW201741922A TW201741922A TW106116582A TW106116582A TW201741922A TW 201741922 A TW201741922 A TW 201741922A TW 106116582 A TW106116582 A TW 106116582A TW 106116582 A TW106116582 A TW 106116582A TW 201741922 A TW201741922 A TW 201741922A
- Authority
- TW
- Taiwan
- Prior art keywords
- terminal
- authentication
- biometric
- public key
- certificate
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4014—Identity check for transactions
- G06Q20/40145—Biometric identity checks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3821—Electronic credentials
- G06Q20/38215—Use of certificates or encrypted proofs of transaction rights
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3825—Use of electronic signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3231—Biological data, e.g. fingerprint, voice or retina
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Strategic Management (AREA)
- Computer Hardware Design (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Finance (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- General Business, Economics & Management (AREA)
- General Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Health & Medical Sciences (AREA)
- Life Sciences & Earth Sciences (AREA)
- Biodiversity & Conservation Biology (AREA)
- Collating Specific Patterns (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
本發明屬於電腦應用技術領域，尤其是關於一種基於生物特徵的安全認證方法及裝置。 The invention belongs to the field of computer application technology, and in particular relates to a biometric-based security authentication method and device.
隨著諸如智慧手機、平板電腦、智慧電視等智慧終端機的不斷發展和利用，人們利用智慧終端機設備越來越多地進行交易、獲取服務，然而其中不可避免地會關係到身份認證的問題。比如，使用者在進行網上交易的過程中，需要將使用者的支付資訊提交給伺服器端以實現支付功能，再比如，用戶在網上獲取某種服務時，需要將使用者帳戶資訊提交給伺服器端以實現登錄和服務獲取。 With the continuous development and utilization of smart terminals such as smart phones, tablets, smart TVs, etc., people use smart terminal devices to conduct transactions and obtain services more and more, but inevitably related to identity authentication. . For example, in the process of conducting an online transaction, the user needs to submit the payment information of the user to the server to implement the payment function. For example, when the user obtains a certain service on the Internet, the user account information needs to be submitted. Give the server side login and service acquisition.
關於身份認證的具體過程以現有的指紋認證技術舉例來說：當使用者需要進行認證時，首先用戶端通過指紋感測器採集到用戶指紋，然後提取指紋特徵碼，與指紋庫中已保存的指紋特徵識別樣本進行特徵匹配，該比對過程有兩種模式：一種是在設備本地進行匹配，再將比對結果上傳至伺服器端；另一種是將指紋特徵上傳到伺服器端，在伺服器端進行匹配。最後如果匹配成功則認證通過。由於現有的指紋認證技術對於設備底層實現及傳輸過程的安全未做定義，所以就有可能導致匹配結果在設備上被協力廠商惡意軟體等攻擊者竊取或者篡改，或者在傳輸過程中被攻擊 者竊取或者篡改，一旦被篡改，假設一個本來認證失敗應該被取消的交易，卻因為認證通過導致交易成功，因此使用者的帳戶安全就存在極大的安全隱患。 The specific process of identity authentication uses the existing fingerprint authentication technology as an example: when the user needs to perform authentication, the user first collects the user fingerprint through the fingerprint sensor, and then extracts the fingerprint feature code, which is saved in the fingerprint database. Fingerprint feature recognition samples are used for feature matching. The comparison process has two modes: one is to match locally on the device, and then the comparison result is uploaded to the server; the other is to upload the fingerprint feature to the server, in the servo Match the end. Finally, if the match is successful, the certificate passes. Because the existing fingerprint authentication technology does not define the security of the underlying implementation of the device and the transmission process, it may cause the matching result to be stolen or tampered by the attacker such as the malicious software of the third party, or attacked during the transmission. Theft or tampering, once falsified, assumes that a transaction that the original authentication failure should be canceled, but because the authentication succeeds, the user's account security has great security risks.
考慮金融領域對於支付交易的高安全性要求，目前的身份認證技術仍存在較大的安全隱患，因此亟需一種改進之後的身份認證方法可以避免現有的安全性漏洞。 Considering the high security requirements of the financial field for payment transactions, the current identity authentication technology still has a large security risk. Therefore, an improved identity authentication method is needed to avoid the existing security vulnerability.
本發明實施例提供一種基於生物特徵的安全認證方法及裝置，用以解決現有身份認證存在安全隱患的問題。 The embodiment of the invention provides a biometric-based security authentication method and device, which is used to solve the problem that the existing identity authentication has security risks.
本發明方法一種基於生物特徵的安全認證方法，該方法包括：終端根據接收的生物特徵認證請求，獲取第一生物特徵；該終端將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果；該終端使用該終端的安全證書的私密金鑰對該匹配結果加密得到第一密文資料，該安全證書唯一對應該終端；該終端向認證端發送該第一密文資料及該安全證書的公開金鑰證書，該認證端為伺服器或該終端。 The method of the present invention is a biometric-based security authentication method, the method includes: the terminal acquiring the first biometric according to the received biometric authentication request; the terminal matching the first biometric with the preset second biometric, Generating a matching result; the terminal encrypts the matching result by using the private key of the security certificate of the terminal to obtain the first ciphertext data, and the security certificate uniquely corresponds to the terminal; the terminal sends the first ciphertext data to the authentication end and the The public key certificate of the security certificate, which is the server or the terminal.
基於同樣的發明構思，本發明實施例進一步地提供一種基於生物特徵的安全認證裝置，該裝置包括：收發單元，用於接收的生物特徵認證請求；感測器，用於獲取第一生物特徵；匹配單元，用於將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果；簽名單元，用於使用該終端的安全證書的私密金鑰對該匹配結果加密 得到第一密文資料，該安全證書唯一對應該終端；收發單元，還用於向認證端發送該第一密文資料及該安全證書的公開金鑰證書，該認證端為伺服器或該終端。 Based on the same inventive concept, the embodiment of the present invention further provides a biometric-based security authentication device, the device includes: a transceiver unit, configured to receive a biometric authentication request; and a sensor for acquiring the first biometric feature; a matching unit, configured to match the first biometric with a preset second biometric to generate a matching result; and a signature unit, configured to encrypt the matching result by using a private key of the security certificate of the terminal Obtaining a first ciphertext data, the security certificate uniquely corresponding to the terminal; the transceiver unit is further configured to send the first ciphertext data and the public key certificate of the security certificate to the authentication end, where the authentication end is a server or the terminal .
本發明實施例一方面獲取伺服器端發送的關於生物特徵的認證請求；根據該認證請求獲取第一認證資訊集合，並將第一認證資訊集合與安全存儲區中第二認證資訊集合進行匹配，該第一認證資訊集合至少包括採集的第一生物特徵，該第二認證資訊集合至少包括預設的第二生物特徵；另一方面利用預置的公私密金鑰對匹配結果進行加密，並將簽名後的匹配結果發送至伺服器端，以便該伺服器端根據驗簽後匹配結果生成認證結果。可見，通過對匹配結果的簽名保護，就可以保證匹配結果在傳輸過程中不被攻擊者竊取或者篡改，進而得出正確的認證結果，保證了用戶帳戶的安全。 The embodiment of the present invention obtains an authentication request about the biometric sent by the server, obtains the first authentication information set according to the authentication request, and matches the first authentication information set with the second authentication information set in the secure storage area. The first authentication information set includes at least the collected first biometric feature, and the second authentication information set includes at least a preset second biometric feature; on the other hand, the matching public privacy key is used to encrypt the matching result, and The signed matching result is sent to the server end, so that the server end generates an authentication result according to the matching result after the verification. It can be seen that the signature protection of the matching result can ensure that the matching result is not stolen or tampered by the attacker during the transmission process, thereby obtaining the correct authentication result and ensuring the security of the user account.
S101-S104、S201-S209、S301-S307、S401-S416、S501-S514‧‧‧步驟 S101-S104, S201-S209, S301-S307, S401-S416, S501-S514‧‧‧ steps
401‧‧‧收發單元 401‧‧‧ transceiver unit
402‧‧‧感測器 402‧‧‧ Sensor
403‧‧‧匹配單元 403‧‧‧Matching unit
404‧‧‧可信執行環境 404‧‧‧Certified Execution Environment
405‧‧‧認證端 405‧‧‧Authentication
為了更清楚地說明本發明實施例中的技術方案，下面將對實施例描述中所需要使用的附圖作簡要介紹，顯而易見地，下面描述中的附圖僅僅是本發明的一些實施例，對於本領域的普通技術人員來講，在不付出創造性勞動的前提下，還可以根據這些附圖獲得其他的附圖：圖1為本發明實施例提供一種基於生物特徵的安全認證方法流程示意圖；圖2為本發明實施例提供一種安全證書分發架構； 圖3為本發明實施例提供一種基於生物特徵的安全認證系統；圖4為本發明實施例提供一種基於生物特徵的連線安全認證方法流程示意圖；圖5為本發明實施例提供一種基於生物特徵的離線安全認證方法流程示意圖；圖6為本發明實施例提供一種認證端的解密過程；圖7為本發明實施例提供一種基於生物特徵的紋認證的開通和綁定過程；圖8為本發明實施例提供一種基於生物特徵的指紋認證替代密碼的安全認證過程；圖9為本發明實施例提供一種基於生物特徵的安全認證裝置示意圖。 In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, A person skilled in the art can obtain other drawings according to the drawings without any creative work: FIG. 1 is a schematic flowchart diagram of a biometric-based security authentication method according to an embodiment of the present invention; 2 provides a security certificate distribution architecture according to an embodiment of the present invention; FIG. 3 is a schematic diagram of a biometric-based security authentication system according to an embodiment of the present invention; FIG. 4 is a schematic flowchart of a biometric-based connection security authentication method according to an embodiment of the present invention; FIG. FIG. 6 is a schematic diagram of a decryption process of an authentication end according to an embodiment of the present invention; FIG. 7 is a process for opening and binding a biometric-based texture authentication according to an embodiment of the present invention; FIG. 8 is an implementation of the present invention; An example provides a security authentication process based on biometric-based fingerprint authentication instead of a password. FIG. 9 is a schematic diagram of a biometric-based security authentication device according to an embodiment of the present invention.
為了使本發明的目的、技術方案和優點更加清楚，下面將結合附圖對本發明作進一步地詳細描述，顯然，所描述的實施例僅僅是本發明一部份實施例，而不是全部的實施例。基於本發明中的實施例，本領域普通技術人員在沒有做出創造性勞動前提下所獲得的所有其它實施例，都屬於本發明保護的範圍。 The present invention will be further described in detail with reference to the accompanying drawings, in which . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.
本發明所關係到的終端可以包括具有生物特徵認證功能的手持設備、車載設備、可穿戴設備、計算設備或連接到無線數據機的其它處理設備，以及各種形式的使用者設備(User Equipment，簡稱UE)，移動台(Mobile station，簡稱MS)，終端(terminal)，終端設備(Terminal Equipment) 等等。為方便描述，本發明簡稱為終端。其中，所謂生物特徵指的是指紋、虹膜、人臉、聲紋等特徵。 The terminal related to the present invention may include a handheld device having a biometric authentication function, an in-vehicle device, a wearable device, a computing device, or other processing device connected to the wireless data device, and various forms of user equipment (User Equipment, referred to as UE), mobile station (MS), terminal, terminal equipment (Terminal Equipment) and many more. For convenience of description, the present invention is simply referred to as a terminal. Among them, the so-called biometrics refer to features such as fingerprints, irises, faces, and voice prints.
參見圖1所示，本發明實施例提供一種基於生物特徵的安全認證方法流程示意圖，具體地實現方法包括：步驟S101，終端根據接收的生物特徵認證請求，獲取第一生物特徵；步驟S102，該終端將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果；步驟S103，該終端使用該終端的安全證書的私密金鑰對該匹配結果加密得到第一密文資料，該安全證書唯一對應該終端；步驟S104，該終端向認證端發送該第一密文資料及該安全證書的公開金鑰證書，該認證端為伺服器或該終端。 As shown in FIG. 1 , an embodiment of the present invention provides a schematic diagram of a biometric-based security authentication method. The specific implementation method includes: Step S101: A terminal acquires a first biometric according to a received biometric authentication request; and step S102 The terminal matches the first biometric with the preset second biometric to generate a matching result. In step S103, the terminal encrypts the matching result to obtain the first ciphertext data by using the private key of the security certificate of the terminal. The security certificate uniquely corresponds to the terminal; in step S104, the terminal sends the first ciphertext data and the public key certificate of the security certificate to the authentication end, and the authentication end is a server or the terminal.
其中，生物特徵認證請求中包含的要認證的生物特徵是指紋、虹膜、聲紋或者人臉等特徵，所以當終端收到認證請求之後，向使用者發出關於該生物特徵採集的提示資訊，使用者輸入該生物特徵之後，感測器採集相應的生物特徵，當然，該感測器可以集成在終端的內部，也可以作為單獨的模組與終端通過介面連接，如下內容以感測器在終端內部的情景進行進一步地論述。 The biometrics to be authenticated included in the biometric authentication request are fingerprints, irises, voiceprints, or faces, so when the terminal receives the authentication request, the user is prompted to use the biometric feature collection information. After inputting the biometric feature, the sensor collects the corresponding biometric feature. Of course, the sensor can be integrated in the terminal, or can be connected as a separate module to the terminal through the interface, and the following is the sensor at the terminal. The internal scenarios are further discussed.
因為考慮到終端內部生成的匹配結果存在被篡改的風險，所以本發明實施例對匹配結果進行加密，具體做法是通過每個終端的安全證書對匹配結果進行數位簽章，其中，終端的安全證書是通過證書系統按照設定規則分發得到的，例如圖2所示，證書授權中心(CA)授權指紋服務證書註冊系統(RA)，由RA給終端製造商頒佈證書。終端製造商負責自行 頒發並管理終端的公開金鑰證書，RA不再參與頒發。當然若終端製造商不具備證書管理的能力，可由RA通過虛擬廠商的方式代替為每個終端頒發終端的安全證書。另外，終端製造商為終端頒發終端的公開金鑰證書可以包含圖中的三種類型：匹配單元證書、簽名單元證書、感測器證書。其中：簽名單元證書為必需，其作用是為了驗證後續驗證匹配結果的真偽並將匹配結果進行簽名後發送給認證端；而匹配單元證書和感測器證書為可選，其作用主要是為了建立第一安全通道和第二安全通道，保證安全通信，當然也可以採取其他不低於TLS2.0安全級別的認證方式進行替代。 In the embodiment of the present invention, the matching result is encrypted. The specific method is that the matching result is digitally signed by the security certificate of each terminal, where the security certificate of the terminal is used. It is distributed through the certificate system according to the set rules. For example, as shown in Figure 2, the Certificate Authority (CA) authorizes the Fingerprint Service Certificate Registration System (RA), and the RA issues a certificate to the terminal manufacturer. The terminal manufacturer is responsible for itself The public key certificate of the terminal is issued and managed, and the RA is no longer involved in the issuance. Of course, if the terminal manufacturer does not have the capability of certificate management, the RA may replace the security certificate of the terminal for each terminal by means of a virtual manufacturer. In addition, the terminal manufacturer's public key certificate for the terminal issuing terminal may include three types in the figure: a matching unit certificate, a signature unit certificate, and a sensor certificate. The signature unit certificate is required, and the function is to verify the authenticity of the subsequent verification matching result and sign the matching result to the authentication end; and the matching unit certificate and the sensor certificate are optional, and the main purpose is to The first secure channel and the second secure channel are established to ensure secure communication, and of course, other authentication methods not lower than the TLS2.0 security level may be adopted instead.
當終端具有證書系統下發的安全證書時，利用匹配單元證書和感測器證書預先建立第一安全通道和第二安全通道，進一步地，該終端將感測器採集的第一生物特徵通過第一安全通道發送給該終端的匹配單元；該匹配單元將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果，並將該匹配結果通過第二安全通道發送給該終端的簽名單元，該匹配單元中存儲有該第二生物特徵；該簽名單元使用先使用雜湊函數對該匹配結果生成匹配結果的摘要，再使用該終端的安全證書對該摘要加密，得到簽名資料，該簽名單元中存儲有該終端的安全證書。 When the terminal has the security certificate issued by the certificate system, the first secure channel and the second secure channel are pre-established by using the matching unit certificate and the sensor certificate, and further, the terminal passes the first biometric feature collected by the sensor through the first a matching channel sent by the secure channel to the terminal; the matching unit matches the first biometric with the preset second biometric, generates a matching result, and sends the matching result to the terminal through the second secure channel. a signature unit, wherein the second biometric is stored in the matching unit; the signature unit uses a hash function to generate a digest of the matching result, and then encrypts the digest using the security certificate of the terminal to obtain signature data. The security certificate of the terminal is stored in the signature unit.
可見，感測器用於採集生物特徵；匹配單元用於將採集到的生物特徵與預先存儲的生物特徵進行匹配，生成匹配結果；簽名單元用於對匹配結果進行數位簽章，匹配單元和簽名單元為集成在終端內部的單元，增加安全通道的目的是保證無論是指紋等生物特徵的傳輸，還是匹配成功或者是失敗的匹配結果均在安全通道中傳輸，保證這類敏感性資料不會在 傳輸過程中被竊取或篡改，進而保證通信安全。 It can be seen that the sensor is used for collecting biometrics; the matching unit is configured to match the collected biometrics with the pre-stored biometrics to generate a matching result; the signature unit is configured to perform digital signature, matching unit and signature unit on the matching result. For the unit integrated in the terminal, the purpose of adding a secure channel is to ensure that the transmission of biometrics such as fingerprints, or the matching results of successful or failed matches are transmitted in the secure channel, ensuring that such sensitive data will not be It is stolen or tampered with during transmission to ensure communication security.
其中，在終端啟動時建立第一安全通道和第二安全通道，該感測器與該匹配單元通過握手協定完成單向或者雙向身份認證和工作階段金鑰交換，從而建立該第一安全通道；該匹配單元與該簽名單元通過握手協定完成單向或者雙向身份認證和工作階段金鑰交換，從而建立該第二安全通道。 The first secure channel and the second secure channel are established when the terminal is started, and the sensor and the matching unit complete one-way or two-way identity authentication and work phase key exchange through a handshake agreement, thereby establishing the first secure channel; The matching unit and the signature unit complete one-way or two-way identity authentication and work phase key exchange through a handshake agreement, thereby establishing the second secure channel.
具體地，安全通道的建立協定由握手協定和記錄協定兩部分組成。其中握手協定用於完成匹配單元和簽名單元之間的雙向身份認證和工作階段金鑰的交換過程，也用於完成匹配單元和感測器之間的雙向身份認證和工作階段金鑰交換過程。記錄協定用於完成應用資料的加密傳輸。另外，安全通道的建立協議遵循TLS 2.0及以上版本規範要求，或採取其他不低於TLS2.0安全級別的認證方式。 Specifically, the establishment agreement of the secure channel consists of two parts: a handshake agreement and a record agreement. The handshake protocol is used to complete the two-way identity authentication and the work phase key exchange process between the matching unit and the signature unit, and is also used to complete the two-way identity authentication and the work phase key exchange process between the matching unit and the sensor. The recording agreement is used to complete the encrypted transmission of the application data. In addition, the establishment protocol of the secure channel complies with the requirements of the TLS 2.0 and above specifications, or adopts other authentication methods that are not lower than the TLS2.0 security level.
這樣做的目的是限定終端應使用簽名單元進行指紋的簽名認證，以及保證使用者標識代碼(PIN)等敏感資訊的安全輸入和加密處理，並且支援感測器對採集後的指紋資料加密傳輸，支援指紋範本資料與終端綁定後加密存儲。具有生物特徵認證的終端能夠安全地存儲金鑰，禁止外部對金鑰的直接訪問，並通過有效的安全機制防止金鑰被非法注入、替換和使用，並保證用於安全認證的簽名單元和匹配單元不被非法攻擊。 The purpose of this is to limit the terminal to use the signature unit to perform fingerprint signature verification, as well as to ensure the secure input and encryption processing of sensitive information such as the user identification code (PIN), and to support the sensor to encrypt and transmit the collected fingerprint data. Support fingerprint template data and terminal binding and encrypt storage. Terminals with biometric authentication can securely store keys, prohibit external direct access to keys, and prevent illegal injection, replacement, and use of keys through effective security mechanisms, and ensure signature units and matching for secure authentication. The unit is not illegally attacked.
因為認證端可以是伺服器也可以是終端自身，所以就存在連線認證和離線認證這樣兩種場景，當連線認證時，認證端就可以是應用APP對應的伺服器；當離線認證時，認證端就可以是終端內部的應用APP，以生物特徵認證是指紋認證為例，圖3示例性地示出了連線認證和離線認證 對應的認證系統，其中，該系統中包括：指紋感測器、指紋匹配單元、指紋簽名單元、終端收發單元、應用的APP、應用的伺服器、證書授權中心，具體地： 指紋感測器負責指紋採集，並將採集到的指紋範本資訊加密傳輸給指紋服務；指紋匹配單元負責指紋範本資訊加密存儲、指紋運算、指紋比對等基礎應用功能；指紋簽名單元作為設備安全基礎，提供安全認證服務，負責對指紋比對結果等關鍵資料進行數位簽章；終端收發單元對指紋認證相關的介面調用進行封裝，為上層應用程式調用底層功能提供統一的介面；應用APP，比如PC端的支付閘道頁面或者是移動端的APP，主要是提供使用者交互介面，通過調用指紋服務的應用程式介面來調用設備的指紋功能。並且應用APP可以對簽名後的第一密文資料進行離線驗簽，並認證該筆交易和使用者身份的合法性；應用的伺服器，比如即支付應用後台業務系統，負責支付請求的發起和回應，預存儲使用者銀行帳戶、終端標識及綁定關係等敏感性資料，並且對簽名後的第一資料進行連線驗簽，並認證該筆交易和使用者身份的合法性。 Because the authentication end can be either the server or the terminal itself, there are two scenarios of connection authentication and offline authentication. When the connection is authenticated, the authentication end can be the server corresponding to the application APP; when offline authentication, The authentication end may be an application APP inside the terminal, and biometric authentication is a fingerprint authentication. FIG. 3 exemplarily shows connection authentication and offline authentication. Corresponding authentication system, wherein the system comprises: a fingerprint sensor, a fingerprint matching unit, a fingerprint signature unit, a terminal transceiver unit, an application APP, an application server, and a certificate authority, specifically: The fingerprint sensor is responsible for fingerprint collection, and encrypts and transmits the collected fingerprint template information to the fingerprint service; the fingerprint matching unit is responsible for basic application functions such as fingerprint template information encryption storage, fingerprint operation, fingerprint comparison, etc.; fingerprint signature unit as the basis of equipment security Provide security authentication service, responsible for digital signature of key data such as fingerprint comparison result; terminal transceiver unit encapsulates interface call related to fingerprint authentication, provides a unified interface for upper layer application to call the underlying function; application APP, such as PC The payment gateway page of the terminal or the APP of the mobile terminal mainly provides a user interaction interface, and invokes the fingerprint function of the device by calling the application interface of the fingerprint service. And the application APP can perform offline verification on the signed first ciphertext data, and authenticate the legality of the transaction and the user identity; the application server, such as the payment application background service system, is responsible for the initiation of the payment request and In response, the sensitive data such as the user's bank account, terminal identifier and binding relationship are pre-stored, and the signed first data is checked and authenticated, and the legality of the transaction and the user identity is authenticated.
基於圖3所示的系統架構，如圖4所示，本發明實施例提供了一種連線認證場景下的安全認證方法，連線認證場景即終端聯網狀態下，通過後台業務系統伺服器進行生物特徵的認證，以指紋認證為例。該方法適用於線上支付場景，通過終端的通信接入互聯網，系統中各單元的處理及交互過程如下：步驟S201，終端啟動初始化工作，即建立第一安全通道和第二安全通道，即建立簽名單和匹配單元之間的第二安全通道，並建立匹配單元和感 測器之間的第一安全通道；步驟S202，當使用者進行訂單交易需要指紋認證時，交易對應的應用程式發出認證請求；步驟S203，感測器採集指紋資訊，並通過第一安全通道，將指紋資訊回傳給匹配單元；步驟S204，匹配單元進行指紋比對、指紋存儲等操作，得到指紋匹配的結果；步驟S205，匹配單元通過第二安全通道，將結果發送給簽名單元，請求簽名單元進行簽名，簽名單元對指紋匹配結果進行簽名；步驟S206，簽名單元將將第一密文資料發送給應用程式；步驟S207，應用APP將終端的第一密文資料等發送給應用APP的後台伺服器進行驗證；步驟S208，應用APP的後台伺服器對第一密文資料進行驗證，以確認匹配結果是否可信；步驟S209，應用APP的後台伺服器將認證結果回傳給應用程式，應用程式根據認證結果繼續後續的交易步驟。 Based on the system architecture shown in FIG. 3, as shown in FIG. 4, the embodiment of the present invention provides a security authentication method in a connection authentication scenario, where a connection authentication scenario, that is, a terminal networking state, is performed by a background service system server. Feature authentication, taking fingerprint authentication as an example. The method is applicable to an online payment scenario, and accesses the Internet through communication of the terminal. The processing and interaction process of each unit in the system is as follows: Step S201, the terminal starts the initialization work, that is, the first secure channel and the second secure channel are established, that is, the signature is established. a second secure channel between the single and matching units and establish a matching unit and sense The first secure channel between the detectors; in step S202, when the user needs fingerprint authentication for the order transaction, the corresponding application of the transaction issues an authentication request; in step S203, the sensor collects the fingerprint information and passes the first secure channel. Returning the fingerprint information to the matching unit; in step S204, the matching unit performs operations such as fingerprint matching and fingerprint storage to obtain a result of fingerprint matching; in step S205, the matching unit sends the result to the signature unit through the second secure channel to request signature The unit performs signature, and the signature unit signs the fingerprint matching result; in step S206, the signature unit sends the first ciphertext data to the application; in step S207, the application APP sends the first ciphertext data of the terminal to the background of the application APP. The server performs verification; in step S208, the background server of the application APP verifies the first ciphertext data to confirm whether the matching result is trusted; in step S209, the background server of the application APP returns the authentication result to the application, and the application The program continues the subsequent transaction steps based on the certification results.
當然，在進行安全認證之前，需要先開通身份認證，即使用者在終端預先保存指紋範本，然後操作應用APP，判斷「生物識別類型」，若為「指紋認證」，則繼續判斷「安全等級」，檢驗安全等級是否滿足金融應用要求(等級2或3)，若安全等級滿足金融應用要求，則繼續判斷「後台業務隨機因子」，校驗後台業務隨機因子是否與已存儲的後台業務隨機因子一致。若後台業務隨機因子與已存儲的後台業務隨機因子一致，則所有 的步驟都成功通過認證，後台將卡號、設備、指紋綁定存儲，開通成功。 Of course, before performing security authentication, the user needs to be authenticated first, that is, the user pre-stores the fingerprint template in the terminal, and then operates the application APP to determine the "biometric type". If it is "fingerprint authentication", the user continues to determine the "security level". Check whether the security level meets the financial application requirements (level 2 or 3). If the security level meets the financial application requirements, continue to judge the "background service random factor" and verify whether the background service random factor is consistent with the stored background service random factor. . If the background service random factor is consistent with the stored background service random factor, then all The steps are successfully authenticated, and the card number, device, and fingerprint are bound and stored in the background, and the activation is successful.
另外，如圖5所示，本發明實施例提供了一種離線認證場景下的安全認證方法，離線認證即終端不聯網狀態下，通過終端自身的應用程式進行指紋認證。適用於線下支付場景，通過終端的非接觸式近場通信與POS終端進行資訊交互，具體各單元的處理及交互過程如下：步驟S301~步驟S306同連線認證的步驟S201~步驟S206，不再贅述。 In addition, as shown in FIG. 5, the embodiment of the present invention provides a security authentication method in an offline authentication scenario, where offline authentication, that is, when the terminal is not in a network state, performs fingerprint authentication through the terminal's own application. Applicable to the offline payment scenario, the non-contact near field communication of the terminal is used for information interaction with the POS terminal. The processing and interaction process of each unit is as follows: Steps S301 to S306 are the same as the connection authentication step S201 to step S206, Let me repeat.
步驟S307，應用程式直接驗證第一密文資料，以確認匹配結果是否可信，並根據匹配結果進行後續操作。 In step S307, the application directly verifies the first ciphertext data to confirm whether the matching result is credible, and performs subsequent operations according to the matching result.
為了進一步地保證安全認證的可靠性，該匹配單元與該簽名單元在安全運行環境中運行，其中，該安全運行環境包括可信執行環境TEE或者安全晶片，其中，該安全運行環境中設置有滿足不同交易許可權的安全等級。當匹配單元在TEE中且簽名單元在安全晶片中時，則安全級別屬於較高級別，意味著對應業務範圍為大額交易；當比對單元和簽名單元都在TEE中時，則安全級別屬於較低級別，意味著對應的業務範圍為小額交易。 In order to further ensure the reliability of the security authentication, the matching unit and the signature unit operate in a secure operating environment, wherein the secure operating environment comprises a trusted execution environment TEE or a security chip, wherein the secure operating environment is set to meet The security level of different trading permissions. When the matching unit is in the TEE and the signature unit is in the security chip, the security level belongs to a higher level, meaning that the corresponding service range is a large transaction; when the comparison unit and the signature unit are both in the TEE, the security level belongs to The lower level means that the corresponding business scope is a small transaction.
進一步地，該終端將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果，還包括：若該第一生物特徵與預設的第二生物特徵匹配，則獲取匹配的第二生物特徵的許可權；生成關於該認證請求對應的待認證業務與該第二生物特徵的許可權是否匹配的結果。 Further, the terminal matches the first biometric with the preset second biometric to generate a matching result, and further includes: if the first biometric matches the preset second biometric, acquiring the matching The permission of the second biometric; generating a result of whether the authentication service corresponding to the authentication request matches the permission of the second biometric.
比如說，手機終端內部保存了多個指紋，其中，只有一個指紋是擁有付款的許可權的，軟體實現時，為具有付款許可權的指紋增加一 個設定的標識，這樣，當指紋匹配完成時，再次判斷該指紋是否擁有付款的許可權，即判斷該指紋是否有設定的標識，若有的話則說明該指紋擁有付款的許可權，可繼續後面的步驟例如進行付款交易等操作，否則，則提示沒有許可權，交易終止，又或者是，手機終端內部保存了一個使用者的多個指紋，每個指紋用途不同，因為在軟體實現時，為該用戶的所有指紋設置對應的許可權，即增加一個陣列，陣列中每個不同的枚舉值代表不同的指紋的許可權，當收到關於該認證請求對應的待認證業務後，分析該業務對應的枚舉值，然後當指紋匹配完成時，分析該指紋對應的枚舉值與該業務對應的枚舉值是否一致，進而確定該指紋是否有處理該筆業務的許可權，這樣可以有效地避免誤操作，比如家庭成員中孩子會經常使用父母的手機，有存在誤交易的風險，所以此時可以為每個指紋設定交易許可權，當然也可以是其它許可權，如登錄許可權等。 For example, a mobile phone terminal internally stores a plurality of fingerprints, wherein only one fingerprint is a license for payment, and when the software is implemented, a fingerprint having a payment permission is added. The set identifier, so that when the fingerprint matching is completed, it is judged again whether the fingerprint has the permission to pay, that is, whether the fingerprint has a set identifier, and if yes, the fingerprint has the permission to pay, and can continue The following steps are performed, for example, to perform a payment transaction, otherwise, the user is prompted to have no permission, the transaction is terminated, or the mobile terminal internally stores a plurality of fingerprints of a user, and each fingerprint is used differently, because when the software is implemented, The corresponding permission is set for all the fingerprints of the user, that is, an array is added, and each different enumeration value in the array represents the permission of different fingerprints. After receiving the service to be authenticated corresponding to the authentication request, the analysis is performed. The enumeration value corresponding to the service, and then, when the fingerprint matching is completed, analyze whether the enumeration value corresponding to the fingerprint is consistent with the enumeration value corresponding to the service, and further determine whether the fingerprint has permission to process the service, which can be effective. Avoid misuse, such as children in family members often use their parents' mobile phones, there is a risk of mis-transactions. At this point you can set permissions for each transaction fingerprint, of course, be other permissions, such as permission to log on and so on.
進一步地，該終端的安全證書的私密金鑰包括該終端的私密金鑰、該終端的安全證書的公開金鑰證書包括該終端的公開金鑰證書、該終端製造商的公開金鑰證書，其中，該終端的公開金鑰證書為使用該終端製造商的私密金鑰對該終端的公開金鑰進行簽名得到，該終端製造商的公開金鑰證書為使用認證平臺的私密金鑰對該終端製造商的公開金鑰進行簽名得到。 Further, the private key of the security certificate of the terminal includes the private key of the terminal, and the public key certificate of the security certificate of the terminal includes a public key certificate of the terminal, and a public key certificate of the terminal manufacturer, wherein The public key certificate of the terminal is obtained by signing the public key of the terminal using the private key of the terminal manufacturer, and the public key certificate of the terminal manufacturer is manufactured by using the private key of the authentication platform for the terminal. The public key of the merchant is signed.
如圖6所示，在簽名認證處理中，應用APP的伺服器或者應用程式使用公開金鑰驗證技術驗證終端的公開金鑰證書，並且驗證第一密文資料。具體地驗簽的步驟如下：步驟一，檢索CA根公開金鑰：後台根據廠商公開金鑰證書中的頒發機 構金鑰識別字確定使用哪一個CA根公開金鑰；步驟二，獲取終端製造商公開金鑰：後台使用CA根公開金鑰驗證終端製造商公開金鑰證書，驗證正確則取出證書中的終端製造商公開金鑰；步驟三，獲取簽名單元公開金鑰：後台使用終端製造商公開金鑰驗證簽名單元公開金鑰證書，驗證正確則取出證書中的簽名單元公開金鑰；步驟四，驗證簽名的關鍵資料：後台使用簽名單元公開金鑰驗證簽名的第一密文資料。 As shown in FIG. 6, in the signature authentication process, the server or application of the application APP verifies the public key certificate of the terminal using the public key authentication technology, and verifies the first ciphertext data. The specific steps of the verification are as follows: Step 1: Retrieve the CA root public key: the background is based on the issuing machine in the manufacturer's public key certificate. The key identification word determines which CA root public key is used; in step 2, the terminal manufacturer public key is obtained: the terminal manufacturer public key certificate is verified in the background using the CA root public key, and the terminal in the certificate is taken out after the verification is correct. The manufacturer public key; step three, obtain the signature unit public key: the background manufacturer public key is used to verify the signature unit public key certificate, and if the verification is correct, the signature unit public key in the certificate is taken out; step four, verify the signature Key information: The first ciphertext data of the signature is verified by the signature unit public key in the background.
步驟五，如果所有的步驟都成功，簽名驗證通過。 Step 5. If all the steps are successful, the signature verification is passed.
其中，簽名單元需對匹配單元提供的指紋比對結果進行數位簽章，即先使用雜湊函數生成關鍵資料的摘要，再使用簽名單元的私密金鑰對摘要進行加密從而生成數位簽章；匹配單元將簽名資料和公開金鑰證書一起發送給後台；後端業務平臺(連線認證模式下)或應用程式(離線認證模式下)使用公開金鑰技術驗證簽名資料的合法性，從而保證被簽名的第一密文資料是由終端上的簽名單元創建的，即簽名單元無法否認創建過該消息、該資料在傳輸過程中並未被協力廠商篡改過。 The signature unit needs to digitally sign the fingerprint matching result provided by the matching unit, that is, first use the hash function to generate a summary of the key data, and then use the private key of the signature unit to encrypt the digest to generate a digital signature; Send the signature data together with the public key certificate to the background; use the public key technology to verify the legality of the signature data in the back-end service platform (in the connection authentication mode) or the application (offline authentication mode), thus ensuring the signature The first ciphertext data is created by the signature unit on the terminal, that is, the signature unit cannot deny that the message was created, and the data has not been tampered with by the third party during the transmission process.
進一步地，該終端發送該安全證書的公開金鑰證書給該認證端；該終端在收到該認證端發送的設備認證通過後，發送該第一密文資料給該認證端。 Further, the terminal sends the public key certificate of the security certificate to the authentication end; after receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the authentication end.
該發送該第一密文資料給該認證端之後，包括：該認證端通過以下方式解析密文資料：該認證端根據該終端製造商的公開金鑰證書和預存的該認證平臺的公開金鑰獲得該終端製造商的公開金鑰； 該認證端根據該終端製造商的公開金鑰和該終端的公開金鑰證書獲得該終端的公開金鑰；若該認證端獲得該終端的公開金鑰則確定該終端的設備認證通過，並使用該終端的公開金鑰驗證該第一密文資料，得到該匹配結果。 After the sending the first ciphertext data to the authentication end, the method includes: the authentication end parses the ciphertext data by: the authentication end is based on the public key certificate of the terminal manufacturer and the pre-stored public key of the authentication platform Obtaining the public key of the terminal manufacturer; The authentication end obtains the public key of the terminal according to the public key of the terminal manufacturer and the public key certificate of the terminal; if the authentication end obtains the public key of the terminal, it determines that the device authentication of the terminal passes and uses The public key of the terminal verifies the first ciphertext data to obtain the matching result.
如圖6所示，認證端利用公開金鑰驗證技術根據該終端製造商的公開金鑰證書和預存的該認證平臺的公開金鑰獲得該終端製造商的公開金鑰PMF，然後根據該終端製造商的公開金鑰和該終端的公開金鑰證書獲得該終端的公開金鑰PD，當得到終端的公開金鑰就可以認為該終端是合法終端，進一步地用終端的公開金鑰對第一密文資料進行解密，得到解密之後的匹配結果，若為匹配成功，認證端可以進行後續的交易步驟，否則認證端就可以提示交易失敗，終止交易。 As shown in FIG. 6, the authentication end obtains the terminal manufacturer's public key PMF according to the terminal manufacturer's public key certificate and the pre-stored public key of the authentication platform by using the public key verification technology, and then manufactures according to the terminal. The public key of the quotient and the public key certificate of the terminal obtain the public key PD of the terminal, and when the public key of the terminal is obtained, the terminal can be regarded as a legitimate terminal, and the first key is further used by the public key of the terminal. The text data is decrypted, and the matching result after decryption is obtained. If the matching is successful, the authentication end can perform subsequent transaction steps, otherwise the authentication end can prompt the transaction to fail and terminate the transaction.
進一步地，該終端使用該終端的安全證書的私密金鑰對關鍵資訊進行加密，得到第二密文資料；該終端將該第二密文資料發送給該認證端。其中，該關鍵資訊至少包含終端標識、銀行卡帳號中的一種。 Further, the terminal encrypts the key information by using the private key of the security certificate of the terminal to obtain the second ciphertext data; the terminal sends the second ciphertext data to the authentication end. The key information includes at least one of a terminal identifier and a bank card account.
需要說明的是，上述步驟中終端使用該終端的安全證書的私密金鑰對關鍵資訊進行加密與步驟S103中對該匹配結果加密得到第一密文資料之間並沒有嚴格的執行順序，也就是說二者可以同時執行，即對匹配結果和關鍵資訊作為整體一起進行加密，將加密之後得到的密文資料一起發送至認證端，當然也可以先執行步驟S103，再對關鍵資訊進行加密，又或者先對關鍵資訊進行加密，再執行步驟S103，具體的執行順序根據實際需要確定。 It should be noted that, in the foregoing step, the terminal uses the private key of the security certificate of the terminal to encrypt the key information, and the step S103 encrypts the matching result to obtain the first ciphertext data, and there is no strict execution order, that is, It can be said that the two can be executed at the same time, that is, the matching result and the key information are encrypted together as a whole, and the ciphertext data obtained after the encryption is sent to the authentication end together, of course, step S103 can be performed first, and then the key information is encrypted, and then Alternatively, the key information is encrypted first, and then step S103 is performed, and the specific execution sequence is determined according to actual needs.
進一步地，該終端將該第二密文資料發送給該認證端之後， 包括：該認證端通過以下方式解析密文資料：該認證端根據該終端製造商的公開金鑰證書和預存的該認證平臺的公開金鑰獲得該終端製造商的公開金鑰，根據該終端製造商的公開金鑰和該終端的公開金鑰證書獲得該終端的公開金鑰，若該認證端獲得該終端的公開金鑰則確定該終端的設備認證通過；使用該終端的公開金鑰驗證該第一密文資料，得到該匹配結果；若該匹配結果為匹配成功，則使用該終端的公開金鑰驗證該第二密文資料，得到該關鍵資訊；確定該關鍵資訊是否符合預設的認證規則，生成生物特徵認證結果發送給該終端。 Further, after the terminal sends the second ciphertext data to the authentication end, The authentication end parses the ciphertext data by: the authentication end obtains the public key of the terminal manufacturer according to the terminal manufacturer's public key certificate and the pre-stored public key of the authentication platform, and manufactures according to the terminal The public key of the quotient and the public key certificate of the terminal obtain the public key of the terminal, and if the authentication end obtains the public key of the terminal, it determines that the device authentication of the terminal passes; and uses the public key of the terminal to verify the The first ciphertext data is obtained, and if the matching result is successful, the public key of the terminal is used to verify the second ciphertext data to obtain the key information; and determining whether the key information meets the preset authentication The rule generates a biometric authentication result and sends the result to the terminal.
例如關鍵資訊是終端標識和銀行卡帳號，則終端安全證書的私密金鑰對終端標識和銀行卡帳號進行加密得到第二密文資料，然後將第二密文資料連同第一密文資料發送給應用APP的伺服器，應用APP的伺服器解密第一密文資料和第二密文資料後，進一步判定解密得到的第二密文資料是否與預存的終端標識和銀行卡帳號一致，若發現不一致，同樣認定該筆交易是不合法的，認定交易失敗，之所以這樣做是因為用終端標識和銀行帳號的綁定關係限定終端的交易，因為這種綁定關係是使用者常用交易，若是來自其它終端，則有可能存在因為使用者敏感資訊的洩露，使得非法分子在其它終端非法使用敏感性資料交易，所以進一步地通過綁定關係進行限定。 For example, the key information is the terminal identifier and the bank card account number, and the private key of the terminal security certificate encrypts the terminal identifier and the bank card account to obtain the second ciphertext data, and then sends the second ciphertext data together with the first ciphertext data to After applying the APP server, the application APP server decrypts the first ciphertext data and the second ciphertext data, and further determines whether the decrypted second ciphertext data is consistent with the pre-stored terminal identifier and the bank card account number. Similarly, the transaction was found to be illegal and the transaction was found to be unsuccessful. The reason for this is that the terminal's transaction is limited by the binding relationship between the terminal identifier and the bank account, because the binding relationship is a common transaction for the user, if it comes from For other terminals, there may be leakage of sensitive information of the user, which causes illegal elements to illegally use sensitive data transactions at other terminals, so it is further defined by the binding relationship.
為了更加系統地描述上述安全認證地過程，本發明實施例仍 然以指紋為例，通過圖7和圖8所示的交互過程，詳細闡述這一過程，其中圖7闡述指紋認證的開通和綁定過程，具體步驟如下：步驟S401，應用程式調用介面獲取終端關鍵資訊，包括：終端標識、用戶名、終端是否支援指紋認證功能、終端是否開啟指紋、終端是否已錄入指紋以及終端的安全等級。 In order to describe the above process of security authentication more systematically, embodiments of the present invention still Taking the fingerprint as an example, the process is elaborated through the interaction process shown in FIG. 7 and FIG. 8. FIG. 7 illustrates the process of opening and binding the fingerprint authentication. The specific steps are as follows: Step S401, the application calling interface acquires the terminal. Key information includes: terminal identification, user name, whether the terminal supports fingerprint authentication, whether the terminal has fingerprints, whether the terminal has entered fingerprints, and the security level of the terminal.
步驟S402，應用程式將獲取的終端關鍵資訊傳遞給應用程式的伺服器。 In step S402, the application passes the acquired terminal key information to the application server.
步驟S403，應用程式的伺服器判斷是否滿足開通條件，包括：終端支援指紋服務、設備滿足安全等級、當前卡片/使用者支援開通指紋支付、當前卡片/使用者未在該終端上開通指紋功能(即不存在相應綁定關係)等。若滿足開通條件，則進入下一步驟；步驟S404，應用程式的伺服器發起引導開通請求；步驟S405，應用程式引導使用者開通指紋認證，比如：在使用者完成了一筆交易且判斷該設備具備開通指紋認證的條件之後，可在交易成功頁面提示使用者開通指紋認證；步驟S406，使用者選擇開通指紋支付並同意協定後，若終端尚未錄入指紋，則提示使用者前往系統設置錄入指紋，或者直接跳轉至系統設置進行錄入；若已錄入，則應用程式將使用者資訊/卡號提供給後台(卡號可以根據當前已完成交易自動獲取，否則需要持卡人輸入)；步驟S407，後台生成業務隨機因子，如：亂數、時間戳記，並保存在資料庫中；步驟S408，後台發起指紋認證請求，請求中包含業務隨機因子； 步驟S409，應用程式顯示指紋驗證介面；步驟S410，應用程式調用指紋服務介面進行指紋輸入和驗證，介面參數包含業務隨機因子；步驟S411，指紋服務對使用者輸入的指紋進行驗證，即：驗證其是否與終端上已錄入的指紋相匹配。若系統未錄入指紋，還可跳轉至系統指紋錄入介面，錄入成功後再回傳並進行驗證(取決於系統是否提供該功能以及用戶體驗評估)；步驟S412，指紋服務回傳指紋驗證結果等關鍵資料及簽名、證書：如果驗證失敗，應用程式提示使用者是否重試指紋驗證功能，或者提示用戶取消；如果驗證成功，繼續下一步；步驟S413，應用程式將回傳的資料和使用者資訊/卡號發送給後台；步驟S414，後台驗證指紋驗證結果的簽名資料是否正確，如果驗簽成功，則提取資料項目並認證身份合法性，包括：判斷指紋驗證結果是否成功、生物識別類型是否正確、安全等級是否滿足要求、業務隨機因子是否與後台存儲一致等。若驗簽及認證均成功，則進入下一步；步驟S415，將使用者資訊/卡號與指紋ID、使用者ID和終端標識進行綁定並存儲在後台；步驟S416，提示使用者已成功開通指紋認證並綁定。 In step S403, the application server determines whether the opening condition is met, including: the terminal supports the fingerprint service, the device meets the security level, the current card/user supports the opening of the fingerprint payment, and the current card/user does not open the fingerprint function on the terminal ( That is, there is no corresponding binding relationship). If the provisioning condition is met, proceeding to the next step; in step S404, the application server initiates a boot request; in step S405, the application guides the user to open the fingerprint authentication, for example, the user completes a transaction and determines that the device has After the condition of fingerprint authentication is opened, the user may be prompted to open the fingerprint authentication on the transaction success page; in step S406, after the user selects to open the fingerprint payment and agrees to the agreement, if the terminal has not entered the fingerprint, the user is prompted to go to the system to set the fingerprint, or Directly jump to the system settings for entry; if entered, the application provides the user information/card number to the background (the card number can be automatically obtained according to the currently completed transaction, otherwise the cardholder needs to input); in step S407, the background generation service is randomly generated. a factor, such as: random number, time stamp, and stored in the database; step S408, the background initiates a fingerprint authentication request, the request includes a service random factor; Step S409, the application program displays a fingerprint verification interface; in step S410, the application program calls the fingerprint service interface to perform fingerprint input and verification, and the interface parameter includes a service random factor; in step S411, the fingerprint service verifies the fingerprint input by the user, that is, verifies the same. Whether it matches the fingerprint that has been entered on the terminal. If the fingerprint is not entered in the system, you can also jump to the system fingerprint entry interface. After the entry is successful, you can return it and verify it (depending on whether the system provides this function and user experience evaluation); in step S412, the fingerprint service returns the fingerprint verification result and other key. Data and signature, certificate: If the verification fails, the application prompts the user to retry the fingerprint verification function, or prompt the user to cancel; if the verification is successful, continue to the next step; in step S413, the application will return the data and user information / The card number is sent to the background; in step S414, the signature data of the fingerprint verification result is verified in the background. If the verification is successful, the data item is extracted and the identity of the identity is verified, including: determining whether the fingerprint verification result is successful, whether the biometric type is correct, and security. Whether the level meets the requirements, whether the service random factor is consistent with the background storage, and the like. If the verification and the authentication are successful, proceed to the next step; in step S415, the user information/card number is bound with the fingerprint ID, the user ID, and the terminal identifier, and stored in the background; in step S416, the user is prompted to successfully open the fingerprint. Authenticate and bind.
進一步地，當伺服器完成指紋開通過程之後，圖8示出了指紋認證替代密碼的安全認證過程，具體步驟如下：步驟S501，使用者操作應用程式，在應用程式發起訂單支付請求；步驟S502，應用程式調用指紋服務的介面獲取終端關鍵資訊，包括： 終端標識、使用者ID、終端是否支援指紋(即設備是否具備指紋感測器)、終端是否開啟指紋、設備是否已錄入指紋以及設備的安全等級。 Further, after the server completes the fingerprint opening process, FIG. 8 shows a secure authentication process of the fingerprint authentication substitute password, and the specific steps are as follows: Step S501, the user operates the application, and initiates an order payment request in the application; step S502, The application calls the fingerprint service interface to obtain key information about the terminal, including: Whether the terminal ID, user ID, terminal supports fingerprint (that is, whether the device has a fingerprint sensor), whether the terminal has a fingerprint, whether the device has entered a fingerprint, and the security level of the device.
步驟S503，應用程式將回傳的終端關鍵資訊傳遞給應用程式的伺服器。 In step S503, the application passes the returned terminal key information to the application server.
步驟S504，應用程式的伺服器根據設備關鍵資訊判斷是否滿足使用指紋認證來進行支付/登錄的條件，包括：設備支援、開啟並錄入了指紋、設備滿足安全等級、設備對應使用者/卡號開通了指紋認證(即存在相應綁定關係)、訂單金額滿足限額條件等。若滿足，則進入下一步；步驟S505，應用程式的伺服器生成業務隨機因子，如：亂數、時間戳記，並保存在資料庫中；步驟S506，應用程式的伺服器發起指紋認證請求，請求中包含業務隨機因子；步驟S507，應用程式顯示指紋驗證介面；步驟S508，應用程式調用指紋服務介面進行指紋輸入和驗證，介面參數包含業務隨機因子；步驟S509，指紋服務對使用者輸入的指紋進行驗證，即：驗證其是否與設備上已錄入的指紋相匹配；步驟S510，指紋服務回傳指紋驗證結果等關鍵資料及簽名、證書：如果驗證失敗，應用程式提示使用者是否重試指紋驗證功能，或者放棄指紋驗證轉為傳統支付/登錄方式；如果驗證成功，繼續下一步；步驟S511，應用程式將回傳的資料和使用者資訊(如卡號)發送給後台； 步驟S512，應用程式的伺服器驗證指紋驗證結果的簽名資料是否正確，如果驗簽成功，則提取資料項目並認證身份及交易合法性，包括：判斷指紋驗證結果是否成功，生物識別類型是否正確，安全等級是否滿足當前交易金額，業務隨機因子是否與後台存儲一致，指紋ID、使用者ID和設備ID以及卡號/使用者資訊是否與後台存儲的綁定關係一致。若驗簽及認證均成功，則下一步；步驟S513，應用程式的伺服器認證成功後向應用程式授權交易合法。 Step S504, the application server determines, according to the key information of the device, whether the condition for using the fingerprint authentication to perform payment/login is satisfied, including: the device supports, opens and inputs the fingerprint, the device meets the security level, and the device corresponding user/card number is opened. Fingerprint authentication (that is, there is a corresponding binding relationship), the order amount meets the quota condition, and the like. If yes, go to the next step; in step S505, the application server generates a service random factor, such as: random number, time stamp, and saves in the database; in step S506, the application server initiates a fingerprint authentication request, request The service randomization factor is included; in step S507, the application displays a fingerprint verification interface; in step S508, the application invokes the fingerprint service interface to perform fingerprint input and verification, and the interface parameter includes a service random factor; and in step S509, the fingerprint service performs a fingerprint input by the user. Verification, that is, verify whether it matches the fingerprint that has been entered on the device; in step S510, the fingerprint service returns the key data such as the fingerprint verification result and the signature and certificate: if the verification fails, the application prompts the user to retry the fingerprint verification function. , or abandon the fingerprint verification to the traditional payment/login mode; if the verification is successful, continue to the next step; in step S511, the application sends the returned data and user information (such as the card number) to the background; Step S512, the application server verifies whether the signature data of the fingerprint verification result is correct. If the verification is successful, the data item is extracted and the identity and transaction legality are verified, including: determining whether the fingerprint verification result is successful, and whether the biometric type is correct, Whether the security level satisfies the current transaction amount, whether the service random factor is consistent with the background storage, and whether the fingerprint ID, the user ID and the device ID, and the card number/user information are consistent with the background storage binding relationship. If the verification and the authentication are successful, the next step; in step S513, the application server is authorized to authorize the transaction after the server authentication is successful.
步驟S514，應用程式完成指紋支付或者指紋登錄等操作。 In step S514, the application completes operations such as fingerprint payment or fingerprint login.
基於相同的技術構思，本發明實施例還提供一種基於生物特徵的安全認證裝置，該裝置可執行上述方法實施例。本發明實施例提供的裝置如圖9所示，包括：收發單元401、感測器402、匹配單元403、簽名單元404，其中：收發單元401，用於接收生物特徵認證請求；感測器402，用於獲取第一生物特徵；匹配單元403，用於將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果；簽名單元404，用於使用該終端的安全證書的私密金鑰對該匹配結果加密得到第一密文資料，該安全證書唯一對應該終端；收發單元401，還用於向認證端發送該第一密文資料及該安全證書的公開金鑰證書，該認證端為伺服器或該終端。 Based on the same technical concept, the embodiment of the present invention further provides a biometric-based security authentication device, which can execute the foregoing method embodiments. The device provided by the embodiment of the present invention, as shown in FIG. 9, includes: a transceiver unit 401, a sensor 402, a matching unit 403, and a signature unit 404, wherein: the transceiver unit 401 is configured to receive a biometric authentication request; and the sensor 402 And the matching unit 403 is configured to match the first biometric with the preset second biometric to generate a matching result, and the signature unit 404 is configured to use the privacy of the security certificate of the terminal. The key is encrypted to obtain the first ciphertext data, and the security certificate uniquely corresponds to the terminal; the transceiver unit 401 is further configured to send the first ciphertext data and the public key certificate of the security certificate to the authentication end, The authentication end is the server or the terminal.
進一步地，該感測器402具體用於：將採集的第一生物特徵通過第一安全通道發送給該匹配單元403； 該匹配單元403具體用於：將該第一生物特徵與預設的第二生物特徵進行匹配，生成匹配結果，並將該匹配結果通過第二安全通道發送給該簽名單元404，該匹配單元中存儲有該第二生物特徵；該簽名單元404具體用於：先使用雜湊函數對該匹配結果生成匹配結果的摘要，再使用該終端的安全證書對該摘要加密，得到簽名資料，該簽名單元中存儲有該終端的安全證書。 Further, the sensor 402 is specifically configured to: send the collected first biometric feature to the matching unit 403 through the first secure channel; The matching unit 403 is specifically configured to: match the first biometric with the preset second biometric, generate a matching result, and send the matching result to the signature unit 404 through the second secure channel, where the matching unit is The second biometric is stored; the signature unit 404 is specifically configured to: first generate a digest of the matching result by using the hash function, and then encrypt the digest using the security certificate of the terminal to obtain signature data, where the signature unit is A security certificate for the terminal is stored.
進一步地，該感測器402與該匹配單元403通過握手協定完成單向或者雙向身份認證和工作階段金鑰交換，從而建立該第一安全通道；該匹配單元403與該簽名單元404通過握手協定完成單向或者雙向身份認證和工作階段金鑰交換，從而建立該第二安全通道。 Further, the sensor 402 and the matching unit 403 complete one-way or two-way identity authentication and work phase key exchange through a handshake protocol, thereby establishing the first secure channel; the matching unit 403 and the signature unit 404 pass a handshake agreement. The one-way or two-way identity authentication and the work phase key exchange are completed, thereby establishing the second secure channel.
進一步地，還包括：該匹配單元與該簽名單元在安全運行環境中運行，其中，該安全運行環境包括可信執行環境TEE或者安全晶片，其中，該安全運行環境中設置有滿足不同交易許可權的安全等級。 Further, the method further includes: the matching unit and the signature unit are operated in a secure operating environment, wherein the secure operating environment includes a trusted execution environment TEE or a security chip, wherein the secure operating environment is configured to satisfy different transaction permissions Security level.
進一步地，該匹配單元403還用於：若該第一生物特徵與預設的第二生物特徵匹配，則獲取匹配的第二生物特徵的許可權；生成關於該認證請求對應的待認證業務與該第二生物特徵的許可權是否匹配的結果。 Further, the matching unit 403 is further configured to: if the first biometric is matched with the preset second biometric, acquire a permission of the matched second biometric; generate a to-be-authenticated service corresponding to the authentication request Whether the permission of the second biometric matches the result.
其中，還包括：該終端的安全證書的私密金鑰包括該終端的私密金鑰、該終端的安全證書的公開金鑰證書包括該終端的公開金鑰證書、該終端製造商的公開金鑰證書，其中，該終端的公開金鑰證書為使用該終端製造商的私密金鑰簽名該終端的公開金鑰得到，該終端製造商的公開金 鑰證書為使用認證平臺的私密金鑰簽名該終端製造商的公開金鑰得到。 The method further includes: the private key of the security certificate of the terminal includes a private key of the terminal, and the public key certificate of the security certificate of the terminal includes a public key certificate of the terminal, and a public key certificate of the terminal manufacturer. Wherein the public key certificate of the terminal is obtained by signing the public key of the terminal using the private key of the terminal manufacturer, and the terminal manufacturer's disclosure fund The key certificate is obtained by signing the terminal manufacturer's public key using the private key of the authentication platform.
進一步地，該收發單元401具體用於：該終端發送該安全證書的公開金鑰證書給該認證端；該終端在收到該認證端發送的設備認證通過後，發送該第一密文資料給該認證端；或者，該終端發送該安全證書的公開金鑰證書和第一密文資料給該認證端，以使該認證端根據安全證書的公開金鑰證書認證該終端是否為合法終端。 Further, the transceiver unit 401 is specifically configured to: the terminal sends the public key certificate of the security certificate to the authentication end; after receiving the device authentication sent by the authentication end, the terminal sends the first ciphertext data to the terminal The authentication end; or the terminal sends the public key certificate and the first ciphertext data of the security certificate to the authentication end, so that the authentication end authenticates whether the terminal is a legitimate terminal according to the public key certificate of the security certificate.
進一步地，還包括：認證端405，用於通過以下方式解析密文資料：根據該終端製造商的公開金鑰證書和預存的該認證平臺的公開金鑰獲得該終端製造商的公開金鑰；根據該終端製造商的公開金鑰和該終端的公開金鑰證書獲得該終端的公開金鑰；若該認證端獲得該終端的公開金鑰則確定該終端的設備認證通過，並使用該終端的公開金鑰驗證該第一密文資料，得到該匹配結果。 Further, the method further includes: an authentication end 405, configured to parse the ciphertext data by: obtaining the public key of the terminal manufacturer according to the public key certificate of the terminal manufacturer and the pre-stored public key of the authentication platform; Obtaining a public key of the terminal according to the public key of the terminal manufacturer and the public key certificate of the terminal; if the authentication end obtains the public key of the terminal, determining that the device authentication of the terminal passes, and using the terminal The public key verifies the first ciphertext data to obtain the matching result.
進一步地，該簽名單元404還用於：使用該終端的安全證書的私密金鑰對關鍵資訊進行數位簽章，得到第二密文資料；將該第二密文資料發送給該認證端。 Further, the signature unit 404 is further configured to: perform a digital signature on the key information by using a private key of the security certificate of the terminal to obtain a second ciphertext data; and send the second ciphertext data to the authentication end.
當終端將該第二密文資料發送給該認證端之後，該認證端405還用於：通過以下方式解析密文資料：根據該終端製造商的公開金鑰證書和預存的該認證平臺的公開金鑰獲 得該終端製造商的公開金鑰，根據該終端製造商的公開金鑰和該終端的公開金鑰證書獲得該終端的公開金鑰，若該認證端獲得該終端的公開金鑰則確定該終端的設備認證通過；使用該終端的公開金鑰驗證該第一密文資料，得到該匹配結果；若該匹配結果為匹配成功，則使用該終端的公開金鑰驗證該第二密文資料，得到該關鍵資訊；確定該關鍵資訊是否符合預設的認證規則，生成生物特徵認證結果發送給該終端。 After the terminal sends the second ciphertext data to the authenticating end, the authenticating end 405 is further configured to: parse the ciphertext data by: publicizing the public key certificate of the terminal manufacturer and pre-existing the publicity of the authentication platform Key Obtaining the public key of the terminal manufacturer, obtaining the public key of the terminal according to the public key of the terminal manufacturer and the public key certificate of the terminal, and determining the terminal if the authentication end obtains the public key of the terminal Passing the device authentication; verifying the first ciphertext data by using the public key of the terminal, and obtaining the matching result; if the matching result is successful, verifying the second ciphertext data by using the public key of the terminal, The key information is determined whether the key information meets the preset authentication rule, and the biometric authentication result is generated and sent to the terminal.
其中，該關鍵資訊至少包含終端標識、銀行卡帳號中的一種。 The key information includes at least one of a terminal identifier and a bank card account.
綜上所述，本發明實施例一方面獲取伺服器端發送的關於生物特徵的認證請求；根據該認證請求獲取第一認證資訊集合，並將第一認證資訊集合與安全存儲區中第二認證資訊集合進行匹配，該第一認證資訊集合至少包括採集的第一生物特徵，該第二認證資訊集合至少包括預設的第二生物特徵；另一方面利用預置的公開金鑰證書對比對結果等關鍵資訊進行數位簽章，並將簽名資料發送至伺服器端或者該終端，以便該伺服器端或者該終端驗簽後根據解密後匹配比對結果等關鍵資訊生成認證結果。可見，通過公開金鑰證書對匹配比對結果的數位簽章保護，就可以認證發送方(終端)的合法性，保證被簽名的關鍵資訊是由合法終端創建的、防止交易抵賴發生、保證匹配比對結果在傳輸過程中不被攻擊者竊取或者篡改的完整性，進而得出正確合法的認證結果，保證了用戶帳戶的安全。 In summary, the embodiment of the present invention obtains an authentication request for a biometric sent by a server, obtains a first authentication information set according to the authentication request, and sets a first authentication information set and a second authentication in the secure storage area. The information set is matched, the first authentication information set includes at least the collected first biometric feature, the second authentication information set includes at least a preset second biometric feature, and the comparison result is compared by using a preset public key certificate. The key information is digitally signed, and the signature data is sent to the server or the terminal, so that the server or the terminal can generate the authentication result according to the key information such as the matching result after the decryption. It can be seen that by using the public key certificate to match the digital signature protection of the matching result, the legitimacy of the sender (terminal) can be authenticated, and the key information to be signed is created by the legal terminal, preventing the transaction from being rejected, and ensuring matching. The comparison result is not stolen or falsified by the attacker during the transmission process, and the correct legal authentication result is obtained, thereby ensuring the security of the user account.
本發明是參照根據本發明實施例的方法、設備(系統)、和 電腦程式產品的流程圖和/或方框圖來描述的。應理解可由電腦程式指令實現流程圖和/或方框圖中的每一流程和/或方框、以及流程圖和/或方框圖中的流程和/或方框的結合。可提供這些電腦程式指令到通用電腦、專用電腦、嵌入式處理機或其他可程式設計資料處理設備的處理器以產生一個機器，使得通過電腦或其他可程式設計資料處理設備的處理器執行的指令產生用於實現在流程圖一個流程或多個流程和/或方框圖一個方框或多個方框中指定的功能的裝置。 The present invention is directed to a method, apparatus (system), and A flowchart and/or block diagram of a computer program product is described. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine for executing instructions by a processor of a computer or other programmable data processing device Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.
這些電腦程式指令也可存儲在能引導電腦或其他可程式設計資料處理設備以特定方式工作的電腦可讀記憶體中，使得存儲在該電腦可讀記憶體中的指令產生包括指令裝置的製造品，該指令裝置實現在流程圖一個流程或多個流程和/或方框圖一個方框或多個方框中指定的功能。 The computer program instructions can also be stored in a computer readable memory that can boot a computer or other programmable data processing device to operate in a particular manner, such that instructions stored in the computer readable memory produce an article of manufacture including the instruction device. The instruction means implements the functions specified in one or more blocks of the flow or in a flow or block diagram of the flowchart.
這些電腦程式指令也可裝載到電腦或其他可程式設計資料處理設備上，使得在電腦或其他可程式設計設備上執行一系列操作步驟以產生電腦實現的處理，從而在電腦或其他可程式設計設備上執行的指令提供用於實現在流程圖一個流程或多個流程和/或方框圖一個方框或多個方框中指定的功能的步驟。 These computer program instructions can also be loaded onto a computer or other programmable data processing device to perform a series of operational steps on a computer or other programmable device to produce computer-implemented processing on a computer or other programmable device. The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.
儘管已描述了本發明的優選實施例，但本領域內的技術人員一旦得知了基本創造性概念，則可對這些實施例作出另外的變更和修改。所以，所附權利要求意欲解釋為包括優選實施例以及落入本發明範圍的所有變更和修改。 While the preferred embodiment of the invention has been described, it will be understood that Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and
顯然，本領域的技術人員可以對本發明進行各種改動和變型而不脫離本發明的精神和範圍。這樣，倘若本發明的這些修改和變型屬於 本發明權利要求及其等同技術的範圍之內，則本發明也意圖包含這些改動和變型在內。 It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the invention belong to The invention is also intended to cover such modifications and variations within the scope of the appended claims.
S101-S104‧‧‧步驟 S101-S104‧‧‧Steps
Claims (22)
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610343447.8A CN105959287A (en) | 2016-05-20 | 2016-05-20 | Biological feature based safety certification method and device |
| ??201610343447.8 | 2016-05-20 |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| TW201741922A true TW201741922A (en) | 2017-12-01 |
| TWI667585B TWI667585B (en) | 2019-08-01 |
Family
ID=56909347
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| TW106116582A TWI667585B (en) | 2016-05-20 | 2017-05-19 | Method and device for safety authentication based on biological characteristics |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN105959287A (en) |
| TW (1) | TWI667585B (en) |
| WO (1) | WO2017197974A1 (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| TWI724681B (en) * | 2019-03-29 | 2021-04-11 | 開曼群島商創新先進技術有限公司 | Managing cryptographic keys based on identity information |
| TWI728587B (en) * | 2019-03-29 | 2021-05-21 | 開曼群島商創新先進技術有限公司 | Computer-implemented methods, systems, apparatus for securely performing cryptographic operations |
| US11023620B2 (en) | 2019-03-29 | 2021-06-01 | Advanced New Technologies Co., Ltd. | Cryptography chip with identity verification |
| US11063749B2 (en) | 2019-03-29 | 2021-07-13 | Advanced New Technologies Co., Ltd. | Cryptographic key management based on identity information |
| TWI747052B (en) * | 2018-10-24 | 2021-11-21 | 大陸商廣州印芯半導體技術有限公司 | Optical sensor with encryption function and image data encryption method |
| TWI748443B (en) * | 2019-12-11 | 2021-12-01 | 大陸商支付寶（杭州）信息技術有限公司 | Method and device for opening, receiving and settlement of dual offline payment |
| TWI782502B (en) * | 2020-07-03 | 2022-11-01 | 大陸商支付寶（杭州）信息技術有限公司 | Information verification method, device and equipment |
Families Citing this family (44)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105959287A (en) * | 2016-05-20 | 2016-09-21 | ***股份有限公司 | Biological feature based safety certification method and device |
| CN106897164B (en) * | 2017-03-08 | 2020-08-14 | Oppo广东移动通信有限公司 | Fingerprint input control method and device |
| CN107092819B (en) * | 2017-03-08 | 2020-04-14 | Oppo广东移动通信有限公司 | Fingerprint input inspection method and device |
| CN107025389B (en) * | 2017-03-14 | 2020-08-07 | Oppo广东移动通信有限公司 | Fingerprint input method and terminal |
| CN107038584A (en) * | 2017-04-12 | 2017-08-11 | 杭州纳戒科技有限公司 | Stored value card management method and system |
| CN107016537A (en) * | 2017-04-12 | 2017-08-04 | 杭州纳戒科技有限公司 | Stored value card management method and device |
| WO2018218541A1 (en) * | 2017-05-31 | 2018-12-06 | 华为技术有限公司 | Connection establishment method and device |
| CN107358698A (en) * | 2017-07-17 | 2017-11-17 | 惠州Tcl移动通信有限公司 | A kind of unlocking method and system based on mobile terminal fingerprint recognition |
| CN107392055A (en) * | 2017-07-20 | 2017-11-24 | 深圳市金立通信设备有限公司 | A kind of dual system safety chip control method, terminal, computer-readable recording medium and the dual system framework based on safety chip |
| EP3674936A4 (en) * | 2017-08-23 | 2021-04-21 | Tae Sik Yoon | Authentication terminal, authentication device and authentication method and system using authentication terminal and authentication device |
| JP7013193B2 (en) * | 2017-10-10 | 2022-01-31 | キヤノン株式会社 | System, system control method, voice control device, voice control device control method, and program |
| CN117195188A (en) | 2017-11-06 | 2023-12-08 | 维萨国际服务协会 | Biometric sensor on portable device |
| JP7066380B2 (en) * | 2017-11-17 | 2022-05-13 | キヤノン株式会社 | Systems, methods in systems, information processing equipment, methods in information processing equipment, and programs |
| CN108038694B (en) | 2017-12-11 | 2019-03-29 | 飞天诚信科技股份有限公司 | A kind of fiscard and its working method with fingerprint authentication function |
| CN108563934B (en) * | 2018-03-09 | 2020-07-10 | 青岛海信移动通信技术股份有限公司 | Fingerprint unlocking method and device |
| CN108833379A (en) * | 2018-05-31 | 2018-11-16 | 中国工商银行股份有限公司 | A kind of data encryption and transmission method and device |
| CN109194624B (en) * | 2018-08-09 | 2021-03-26 | 顾宏超 | Method for authenticating use of engineering machinery equipment, equipment and storage medium thereof |
| CN109508562B (en) * | 2018-11-30 | 2022-03-25 | 四川长虹电器股份有限公司 | TEE-based trusted remote verification method |
| CN109547451B (en) * | 2018-11-30 | 2021-05-25 | 四川长虹电器股份有限公司 | TEE-based trusted authentication service authentication method |
| CN109688149B (en) * | 2018-12-29 | 2022-02-15 | ***股份有限公司 | Identity authentication method and device |
| CN109766681A (en) * | 2019-01-11 | 2019-05-17 | 苏州国芯科技有限公司 | User ID authentication method, device, fingerprint logger and readable storage medium storing program for executing |
| CN110011985A (en) | 2019-03-19 | 2019-07-12 | 阿里巴巴集团控股有限公司 | For operating the method and system of internet of things equipment |
| CN111934853B (en) * | 2019-05-13 | 2023-08-01 | 科大国盾量子技术股份有限公司 | Personal identity authentication method and system based on biological recognition technology and wearable device |
| CN112019479A (en) * | 2019-05-29 | 2020-12-01 | 福州云豆网络科技有限公司 | Internet of things-based online bank user login encryption system |
| CN110677260B (en) | 2019-09-29 | 2023-04-21 | 京东方科技集团股份有限公司 | Authentication method, device, electronic equipment and storage medium |
| CN110796446B (en) * | 2019-10-18 | 2022-05-03 | 飞天诚信科技股份有限公司 | Key injection method, key injection device, electronic equipment and computer-readable storage medium |
| CN113918906A (en) * | 2020-07-07 | 2022-01-11 | 瑞昱半导体股份有限公司 | Authentication data transmission method and system |
| CN111784355B (en) * | 2020-07-17 | 2023-03-10 | 支付宝(杭州)信息技术有限公司 | Transaction security verification method and device based on edge calculation |
| CN111784549B (en) * | 2020-07-23 | 2024-02-02 | 嘉兴长润线业有限公司 | Real estate information interaction system and method thereof |
| CN111899029A (en) * | 2020-08-13 | 2020-11-06 | 北京字节跳动网络技术有限公司 | Identity verification method and device for electronic payment |
| CN112036861B (en) * | 2020-08-31 | 2024-05-10 | 百富计算机技术（深圳）有限公司 | Safety equipment |
| CN111954211B (en) * | 2020-09-07 | 2023-05-02 | 北京计算机技术及应用研究所 | Novel authentication key negotiation system of mobile terminal |
| CN112184243A (en) * | 2020-09-28 | 2021-01-05 | 中国建设银行股份有限公司 | Transaction method, device, equipment and storage medium based on biological recognition |
| CN112465503B (en) * | 2020-11-17 | 2021-10-29 | 深圳市快付通金融网络科技服务有限公司 | Information security protection method based on internet finance and biological recognition and cloud platform |
| CN113297552B (en) * | 2021-02-05 | 2023-11-17 | ***股份有限公司 | Verification method based on biological characteristic ID chain, verification system and user terminal thereof |
| CN112953970B (en) * | 2021-04-01 | 2023-04-18 | 国民认证科技（北京）有限公司 | Identity authentication method and identity authentication system |
| CN113127930A (en) * | 2021-05-17 | 2021-07-16 | 阳光电源股份有限公司 | Charging data processing method, device and computer readable storage medium |
| CN113742705B (en) * | 2021-08-30 | 2024-05-24 | 北京一砂信息技术有限公司 | Method and system for realizing authentication service based on IFAA numbers |
| CN116582554A (en) * | 2022-04-07 | 2023-08-11 | 武汉联影医疗科技有限公司 | Edge node access processing method and device, mobile terminal and edge node |
| CN114782022B (en) * | 2022-05-11 | 2022-12-06 | 保利长大工程有限公司 | Construction digital monitoring method and equipment based on identity authentication and storage medium |
| CN114710289B (en) * | 2022-06-02 | 2022-09-02 | 确信信息股份有限公司 | Internet of things terminal security registration and access method and system |
| CN115834074B (en) * | 2022-10-18 | 2023-07-21 | 支付宝(杭州)信息技术有限公司 | Identity authentication method, device and equipment |
| CN115941183B (en) * | 2023-02-27 | 2023-10-13 | 紫光同芯微电子有限公司 | Biological information processing method and related device |
| CN117240625B (en) * | 2023-11-14 | 2024-01-12 | 武汉海昌信息技术有限公司 | Tamper-resistant data processing method and device and electronic equipment |
Family Cites Families (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1514635A (en) * | 2003-04-29 | 2004-07-21 | 叶丰平 | Method of realizing mobile electronic business using finger print intelligence terminal and intelligent hand set |
| TW200816068A (en) * | 2006-09-27 | 2008-04-01 | Ming-Chih Tsai | A transaction payment method by using handheld communication devices |
| CN102081821B (en) * | 2009-11-27 | 2013-08-14 | ***股份有限公司 | IC (integrated circuit) card paying system and method as well as multi-application IC card and payment terminal |
| CN101741843B (en) * | 2009-12-10 | 2012-12-12 | 北京握奇数据***有限公司 | Method, device and system for realizing user authentication by utilizing public key infrastructure |
| US20130054473A1 (en) * | 2011-08-23 | 2013-02-28 | Htc Corporation | Secure Payment Method, Mobile Device and Secure Payment System |
| US9135496B2 (en) * | 2012-05-18 | 2015-09-15 | Apple Inc. | Efficient texture comparison |
| US20150095238A1 (en) * | 2013-09-30 | 2015-04-02 | Apple Inc. | Online payments using a secure element of an electronic device |
| CN104135368B (en) * | 2014-05-30 | 2017-10-03 | 哈尔滨工程大学 | A kind of data guard method of electronic chart |
| CN105227537A (en) * | 2014-06-16 | 2016-01-06 | 华为技术有限公司 | Method for authenticating user identity, terminal and service end |
| CN104102876A (en) * | 2014-07-17 | 2014-10-15 | 北京握奇智能科技有限公司 | Device for safeguarding operational security of client side |
| CN104660614A (en) * | 2015-03-16 | 2015-05-27 | 联想(北京)有限公司 | Authentication method, electronic equipment and server |
| CN105959287A (en) * | 2016-05-20 | 2016-09-21 | ***股份有限公司 | Biological feature based safety certification method and device |
-
2016
- 2016-05-20 CN CN201610343447.8A patent/CN105959287A/en active Pending
-
2017
- 2017-03-21 WO PCT/CN2017/077512 patent/WO2017197974A1/en active Application Filing
- 2017-05-19 TW TW106116582A patent/TWI667585B/en active
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| TWI747052B (en) * | 2018-10-24 | 2021-11-21 | 大陸商廣州印芯半導體技術有限公司 | Optical sensor with encryption function and image data encryption method |
| TWI724681B (en) * | 2019-03-29 | 2021-04-11 | 開曼群島商創新先進技術有限公司 | Managing cryptographic keys based on identity information |
| TWI728587B (en) * | 2019-03-29 | 2021-05-21 | 開曼群島商創新先進技術有限公司 | Computer-implemented methods, systems, apparatus for securely performing cryptographic operations |
| US11023620B2 (en) | 2019-03-29 | 2021-06-01 | Advanced New Technologies Co., Ltd. | Cryptography chip with identity verification |
| US11063749B2 (en) | 2019-03-29 | 2021-07-13 | Advanced New Technologies Co., Ltd. | Cryptographic key management based on identity information |
| US11088831B2 (en) | 2019-03-29 | 2021-08-10 | Advanced New Technologies Co., Ltd. | Cryptographic key management based on identity information |
| US11251941B2 (en) | 2019-03-29 | 2022-02-15 | Advanced New Technologies Co., Ltd. | Managing cryptographic keys based on identity information |
| US11251950B2 (en) | 2019-03-29 | 2022-02-15 | Advanced New Technologies Co., Ltd. | Securely performing cryptographic operations |
| US11258591B2 (en) | 2019-03-29 | 2022-02-22 | Advanced New Technologies Co., Ltd. | Cryptographic key management based on identity information |
| TWI748443B (en) * | 2019-12-11 | 2021-12-01 | 大陸商支付寶（杭州）信息技術有限公司 | Method and device for opening, receiving and settlement of dual offline payment |
| TWI782502B (en) * | 2020-07-03 | 2022-11-01 | 大陸商支付寶（杭州）信息技術有限公司 | Information verification method, device and equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN105959287A (en) | 2016-09-21 |
| TWI667585B (en) | 2019-08-01 |
| WO2017197974A1 (en) | 2017-11-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| TWI667585B (en) | Method and device for safety authentication based on biological characteristics | |
| CN109150548B (en) | Digital certificate signing and signature checking method and system and digital certificate system | |
| US9741033B2 (en) | System and method for point of sale payment data credentials management using out-of-band authentication | |
| CN108809659B (en) | Dynamic password generation method, dynamic password verification method, dynamic password system and dynamic password verification system | |
| JP6586446B2 (en) | Method for confirming identification information of user of communication terminal and related system | |
| US8739266B2 (en) | Universal authentication token | |
| US10142114B2 (en) | ID system and program, and ID method | |
| KR101666374B1 (en) | Method, apparatus and computer program for issuing user certificate and verifying user | |
| JP2018532301A (en) | User authentication method and apparatus | |
| CN110990827A (en) | Identity information verification method, server and storage medium | |
| KR101724401B1 (en) | Certification System for Using Biometrics and Certification Method for Using Key Sharing and Recording medium Storing a Program to Implement the Method | |
| CN109150535A (en) | A kind of identity identifying method, equipment, computer readable storage medium and device | |
| WO2009101549A2 (en) | Method and mobile device for registering and authenticating a user at a service provider | |
| KR20180013710A (en) | Public key infrastructure based service authentication method and system | |
| US20230133418A1 (en) | Personalised, server-specific authentication mechanism | |
| KR20090019576A (en) | Certification method and system for a mobile phone | |
| JP6370771B2 (en) | Method and system for providing secure transactions using cyber IDs | |
| KR101659847B1 (en) | Method for two channel authentication using smart phone | |
| CN101425901A (en) | Control method and device for customer identity verification in processing terminals | |
| JP2003338816A (en) | Service providing system for verifying personal information | |
| KR20160008012A (en) | User authentification method in mobile terminal | |
| CN111970117B (en) | Certificate downloading method, device and equipment | |
| TWI696963B (en) | Ticket issuing and admission verification system and method, and user terminal device used in ticket issuing and admission verification system | |
| KR102123405B1 (en) | System and method for providing security membership and login hosting service | |
| US20240129139A1 (en) | User authentication using two independent security elements |