WO2021077627A1 - 一种智能密钥设备及其验证方法 - Google Patents

一种智能密钥设备及其验证方法 Download PDF

Info

Publication number
WO2021077627A1
WO2021077627A1 PCT/CN2020/070169 CN2020070169W WO2021077627A1 WO 2021077627 A1 WO2021077627 A1 WO 2021077627A1 CN 2020070169 W CN2020070169 W CN 2020070169W WO 2021077627 A1 WO2021077627 A1 WO 2021077627A1
Authority
WO
WIPO (PCT)
Prior art keywords
instruction
key
biometric verification
module
identifier
Prior art date
Application number
PCT/CN2020/070169
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US17/431,378 priority Critical patent/US11972651B2/en
Priority to EP20879656.5A priority patent/EP4050837A4/en
Publication of WO2021077627A1 publication Critical patent/WO2021077627A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/00174—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys
    • G07C9/00563—Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
    • G07C9/25—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition
    • G07C9/257—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder using biometric data, e.g. fingerprints, iris scans or voice recognition electronically
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps

Definitions

  • the invention relates to an intelligent key device and a verification method thereof, and belongs to the technical field of information security.
  • the smart key device is a small hardware device with a processor and a memory, which can be connected to the computer through the computer's data communication interface.
  • the smart key device uses the built-in single-chip microcomputer or smart card chip to complete the generation of the key and the secure storage of the key.
  • the encryption algorithm function can be preset, and the operations related to the key run completely inside the smart key device, making the smart key
  • the key device has the characteristics of anti-attack and extremely high security.
  • the smart key device sets an identity verification method for the password area. For example, when the device receives a signature instruction, it determines whether the key required for the signature instruction requires PIN code verification, and uses the key to complete the signature according to the PIN code verification result. .
  • this existing verification method has defects: users have different verification requirements for the key used in different application scenarios, but the existing authentication method set in the key zone is too It is too singular and cannot meet the different authentication requirements of users in different application scenarios, resulting in insufficient personalization of the product and poor user physical examination.
  • the purpose of the present invention is to provide a smart key device and a verification method thereof, which can meet different verification requirements of users for keys used in different application scenarios.
  • a smart key device verification method which includes the following steps:
  • the smart key device receives the instructions issued by the host computer
  • the smart key device judges the instruction type.
  • the instruction type is an operation instruction involving the key, execute step s3, and when the instruction type is other instructions, execute the corresponding operation and return to step s1;
  • the smart key device determines the key area according to the operation instruction related to the key, and executes step s4;
  • the smart key device obtains the biometric verification identifier corresponding to the key area, and determines the biometric verification method corresponding to the key area according to the biometric verification identifier.
  • step s5 is executed.
  • step s6 is executed, and when the biometric verification method is the third method, step s7 is executed;
  • the smart key device obtains the operation key corresponding to the key area according to the operation instruction involving the key, executes the corresponding operation according to the operation key, returns the operation result to the upper computer, and executes step s1;
  • the smart key device verifies the biometrics and judges whether the biometric verification is passed. If yes, obtain and record the time of the timer when the biometrics verification passes, obtain the operation key corresponding to the key area according to the operation instruction, and execute according to the operation key For the corresponding operation, return the operation result to the upper computer, and execute step s1, otherwise return an error code, and execute step s1;
  • Step s6 The smart key device obtains the current time of the timer and the time of the timer when the biometric verification is passed, and judges whether it is necessary to verify the biometrics according to the obtained current time and the time of the timer when the biometric verification is passed. Step s6 is executed, otherwise, the operation key corresponding to the key area is obtained according to the operation instruction, the corresponding operation is executed according to the operation key, the operation result is returned to the upper computer, and step s1 is executed.
  • a smart key device which includes:
  • Receiving module judgment module, determination module, acquisition module, verification module, execution module and sending module
  • the receiving module is used to receive instructions issued by the upper computer
  • the judgment module is used to judge the instruction type of the instruction received by the receiving module
  • the determination module is used to determine the key area according to the operation instruction when the instruction type of the instruction is determined by the judgment module to be an operation instruction involving a key, obtain the biometric verification identifier corresponding to the key area, and determine the key area according to the biometric verification identifier Corresponding biometric verification method;
  • the obtaining module is used to obtain the operation key in the key area, and execute the corresponding operation according to the operation key to obtain the operation result;
  • Verification module used to verify biometrics
  • the judging module is also used to judge whether the biometric verification by the verification module passes;
  • the obtaining module is also used to obtain and record the time of the timer when the biometric verification passes when the judgment module judges that the verification module passes the verification of the biometrics;
  • the acquiring module is also used to acquire the current time of the timer and the recorded time of the timer when the biometric verification passes when the determining module determines that the biometric verification mode is the third mode;
  • the judging module is also used for judging whether it is necessary to verify the biometrics according to the current time obtained by the obtaining module and the time of the timer when the biometric verification is passed;
  • Sending module used to return the operation result to the upper computer
  • the sending module is also used to return an error to the upper computer when the judgment module judges that the verification module fails to verify the biometrics;
  • the execution module is used to execute the corresponding operation when the judgment module judges that the instruction type of the instruction is another instruction.
  • the user in the process of using the smart key device to verify, the user can realize multiple verification methods of biometrics according to the key area, which meets the user's different biometric verification requirements for the key used in different application scenarios.
  • FIG. 1 is a flowchart of a method for verifying a smart key device according to Embodiment 1 of the present invention
  • FIG. 2 is a block diagram of a smart key device provided by Embodiment 2 of the present invention.
  • Embodiment 1 of the present invention provides a smart key device verification method, which includes:
  • Step 101 The smart key device receives the instruction issued by the host computer
  • the command received by the smart key device conforms to the APDU format, specifically: CLA INS P1 P2 LC Data Le;
  • CLA indicates the application type of the instruction
  • INS indicates the execution type of the instruction
  • P1 and P2 indicate the parameters of the instruction
  • LC indicates the length of the data field (Data) of the instruction
  • Le indicates that the upper-level application hopes to be intelligent The number of data bytes answered when the key device responds.
  • Step 102 The smart key device judges the instruction type.
  • the instruction type is an operation instruction involving a key
  • execute step 103 and when the instruction type is another instruction, execute the corresponding operation, and return to step 101;
  • the smart key device determines the instruction type specifically as follows: the smart key device parses the received instruction, obtains the instruction type identifier according to the specified byte in the instruction, and determines the instruction type according to the instruction type identifier;
  • the smart key device obtains the instruction type identifier according to the INS byte in the instruction, and determines the instruction type according to the instruction type identifier; the INS byte represents the execution category of the instruction;
  • the instruction type is an application-selection instruction.
  • the instruction type is a verification PIN code instruction.
  • the instruction type is an operation instruction involving a key. ;
  • the operation instructions involving the key include: signature operation, encryption operation, authentication operation, etc.
  • the specific instruction is: 87 07 9a 0b 1f 03 8b 72 1c d5 86 41 3d 38 1f .
  • Step 103 The smart key device determines the key area according to the operation instruction related to the key, and executes step 104;
  • the smart key device determines the key zone according to the operation instruction related to the key specifically as follows: the smart key device parses the operation instruction, obtains the key zone identifier according to the specified byte in the instruction, and according to the key zone Identify the key area;
  • the key area identifier includes 9a, 9c, 9d, and 9e; the smart key device obtains the key area identifier according to the P2 byte in the instruction;
  • Step 104 The smart key device obtains the biometric verification identifier corresponding to the key area, and determines the biometric verification method corresponding to the key area according to the biometric verification identifier.
  • step 105 is executed.
  • step 106 performs step 106
  • step 107 performs step 107;
  • the biological characteristics include: fingerprint, iris, hand shape, face shape, retina, pulse, auricle, etc.;
  • fingerprints are used as an example for biometrics.
  • the biometric verification identifier is a fingerprint identifier;
  • the biometric verification methods include the first method 01, the second method 02, and the third method 03.
  • the verification method is the first method, the first method specifically means that there is no need to verify the biometric characteristics corresponding to the operation key during the operation in response to the operation instruction;
  • the fingerprint verification identifier is 02, the verification method is the second method, the second method Specifically, within the preset time range, in the process of responding to the operation instruction, only the biometric corresponding to the operation key needs to be verified once;
  • the fingerprint verification identifier is 03, the verification method is the third method, and the third method specifically indicates In the process of operating in response to operating instructions, the biometrics corresponding to the operating key must be verified each time;
  • Step 105 The smart key device obtains the operation key corresponding to the key area according to the operation instruction, executes the corresponding operation according to the operation key, returns the operation result to the upper computer, and executes step 101;
  • the smart key device obtains the signature key in the key area, signs the corresponding data with the signature key according to the preset algorithm, returns the signature result to the upper computer, and executes step 101 .
  • Step 106 The smart key device verifies the biometric characteristics and judges whether the biometric verification is passed. If yes, obtain and record the time of the timer when the biometric verification passes, and obtain the operation key corresponding to the key area according to the operation instruction, and according to the operation key Perform the corresponding operation, return the operation result to the host computer, and perform step 101, otherwise return an error code, and perform step 101;
  • the smart key device to verify the biometrics is specifically: the smart key device prompts the user to verify the biometrics through the prompt module, and compares the obtained biometric information with the biometric information stored by itself, if they are consistent Then the biometric verification is successful, otherwise the biometric verification fails.
  • Step 107 The smart key device obtains the current time of the timer and the time of the timer when the biometric verification is passed, and judges whether the biometric verification needs to be verified according to the obtained current time and the time of the timer when the biometric verification is passed. If yes, go to step 106, otherwise, obtain the operation key corresponding to the key area according to the operation instruction, execute the corresponding operation according to the operation key, return the operation result to the upper computer, and go to step 101.
  • the smart key device calculates the difference between the current time and the recorded biometric verification passed timer time Value to determine whether the difference exceeds the preset value, if it exceeds the preset value, it needs to verify the biometrics, if it does not exceed the preset value, it does not need to verify the biometrics.
  • the preset value may be 2 minutes.
  • the biometric verification mode when the biometric verification mode is the third mode, it further includes: the smart key device determines whether the recorded biometric verification passes the timer time, and when the smart key device can obtain When the time of the timer when the recorded biometric verification passes, step 107 is executed; when the smart key device cannot obtain the time of the timer when the recorded biometric verification passes, step 106 is executed.
  • other instructions specifically include: application selection instruction; when the instruction type is application selection instruction, the corresponding operation performed is specifically: the smart key device selects the corresponding application according to the application identifier in the application selection instruction Application, the host computer returns the response data for selecting the application, and step 101 is executed.
  • the smart key device selects the corresponding application according to the application identifier in the application selection instruction: the smart key device obtains the AID identification (Application Identification, application identifier) in the application selection instruction data field, and finds itself according to the AID identification Whether there is a matching AID identifier in the saved application identifier list, if there is the same AID identifier, select the corresponding application;
  • AID identification Application Identification, application identifier
  • the application selection response data returned to the host computer includes application selection success response data or application selection failure response data;
  • the selection application instruction is: 00a4 04 00 09a0 00 03 97 42 54 46 59; including selection header: 00a404 00 and application number: a0 00 00 03 97 42 54 46 59;
  • the information of successful application selection includes: the status code of successful application selection; the information of failed application selection includes: the failure status code of application selection;
  • the status code for successful application selection is: 9000, and the status code for application selection failure: 0000.
  • other instructions specifically include: generate a key pair instruction; when the instruction type is a generate key pair instruction, the corresponding operation is specifically performed as follows: the smart key device determines the secret key according to the generate key pair instruction. In the key area, obtain the biometric verification identifier in the instruction, set the biometric verification method corresponding to the key area according to the obtained biometric verification identifier, obtain the key pair and store it in the key area, and return the response data to the upper computer, and execute the steps 101.
  • the smart key device determining the key zone according to the key pair generation instruction is specifically: the smart key device parses the key pair generation instruction, obtains the key zone identifier according to the specified byte in the instruction, and determines it according to the key zone identifier Key area
  • the smart device is divided into 4 key areas, and the 4 key areas store different key pairs and certificates, and have different key functions.
  • One key area can correspond to multiple different operations; among them, the secret
  • the key area identifiers include 9a, 9c, 9d, and 9e; specifically, 9a is the authentication key area; 9c is the digital signature key area; 9d is the key management key area; 9e is the card authentication key area;
  • the smart key device obtains the key area identifier according to the designated byte P2 in the instruction, and determines the key area according to the key area identifier;
  • the smart key device parses the biometric verification mode instruction set, and according to the data in the instruction Set the label for the domain acquisition biometric verification method, set the label according to the biometric verification method to obtain the biometric verification method identification, the smart key device obtains the biometric verification method label corresponding to the key area, and assigns the acquired biometric verification method identification to the biometrics Verification method label;
  • the biometric verification method is set to bc; the biometric verification method is identified as 01, 02, 03;
  • the corresponding identifier can be set, and an error can also be returned to the upper computer;
  • the smart key device acquiring the key pair and storing it in the key area specifically includes: the smart key device generates the key pair according to the set biometric verification mode instruction and saves the key pair in the key area;
  • the smart key device obtaining the key pair and storing it in the key area specifically further includes: the smart key device obtains the key pair contained in the instruction data field according to the set biometric verification mode instruction and saves the key pair in the key area;
  • other instructions specifically include: verify PIN code instruction; when the instruction type is verify PIN code instruction, the corresponding operation is specifically: the smart key device verifies the PIN code according to the verify PIN code instruction, If the verification is passed, the PIN status flag is set, the verification result is returned to the upper computer, and step 101 is executed.
  • the smart key device to verify the PIN code according to the verify PIN code instruction is specifically: the smart key device obtains the PIN code in the instruction data field according to the verify PIN code instruction, and obtains the PIN code and the PIN saved by itself. The codes are compared, if they are the same, the PIN code verification is successful, otherwise the PIN code verification fails;
  • setting the PIN status identifier bit is specifically: the smart key device searches for the PIN status identifier, and modifies the PIN status identifier corresponding to the PIN status identifier to a specified value; for example, the PIN status identifier is: F_UNLOCKED, when the value corresponding to the PIN status flag is 00, it means the PIN status flag is reset, and when the value corresponding to the PIN status flag is 01, it means the PIN status flag is set;
  • the verification result returned to the host computer includes: successful data verification of the PIN code or data verification failure of the PIN code.
  • the smart key device determines the key area according to the operation instruction related to the key, it further includes: the smart key device obtains the PIN code verification identifier corresponding to the key area, and determines the key area according to the PIN code verification identifier Corresponding PIN code verification method, when the PIN code verification method is the first method, go to step 104;
  • the smart key device obtains the PIN status identification bit corresponding to the key zone, and judges the status of the PIN status identification bit. If the PIN status identification bit is set, step 104 is executed, if When the status of the PIN status flag is reset, an error message is sent to the upper computer, and step 101 is executed.
  • the method further includes: the smart key device resets the PIN state identification bit.
  • the PIN code verification method includes the first method 01, the second method 02, and the third method 03.
  • the PIN code verification method is the first method
  • the first method specifically indicates the smart key device In the process of responding to operation instructions, there is no need to verify the PIN code corresponding to the operation key
  • the PIN code verification method is the second method
  • the second method specifically indicates that the smart key device is in the first time
  • the PIN code verification method is the third method.
  • the third method specifically indicates that the smart key device needs to verify the PIN code corresponding to the operation key during each operation in response to the operation instruction;
  • the PIN status flag is: F_UNLOCKED; when the value corresponding to the PIN status flag is 00, it means the PIN status flag is reset, and when the value corresponding to the PIN status flag is 01, it means the PIN status flag is set.
  • other instructions specifically include: a two-way authentication request instruction;
  • the smart key device parses the two-way authentication request instruction, obtains the two-way authentication request data, generates and saves the challenge value according to the request data, and generates the authentication request response data according to the challenge value Send to the host computer, and execute step 101;
  • the challenge value generated by the smart key device is specifically as follows:
  • the generated challenge value is: 3c9b0ea8731313e6;
  • other instructions specifically include: a two-way authentication response instruction;
  • the smart key device parses the two-way authentication response instruction, obtains the two-way authentication response data, obtains the pre-stored key, and responds to the two-way authentication through the pre-stored key according to the preset algorithm
  • the data is decrypted to obtain the first plaintext
  • the first plaintext is compared with the saved challenge value to obtain the comparison result
  • the comparison result is sent to the host computer, and step 101 is executed.
  • the pre-stored key is specifically a communication key that the smart key device and the host computer have agreed to save in advance;
  • the preset algorithm is specifically an encryption algorithm, for example: encryption algorithm DesEcb;
  • the two-way authentication response data obtained by the smart key device is specifically: bd50f30c85b48906.
  • Embodiment 2 of the present invention provides a smart key device.
  • the device 100 includes: a receiving module 11, a judgment module 12, a determination module 13, an acquisition module 14, a verification module 15, an execution module 16, and a sending module 17;
  • the receiving module 11 is used to receive instructions issued by the upper computer;
  • the command received by the receiving module 11 conforms to the APDU format, specifically: CLA INS P1 P2 LC Data Le;
  • CLA indicates the application type of the instruction
  • INS indicates the execution type of the instruction
  • P1 and P2 indicate the parameters of the instruction
  • LC indicates the length of the data field (Data) of the instruction
  • Le indicates that the upper-level application hopes to be intelligent The number of data bytes answered when the key device responds.
  • the judging module 12 is used to judge the instruction type of the instruction received by the receiving module 11;
  • the judging module 12 when the judging module 12 is used to judge the instruction type, the judging module 12 is specifically used to analyze the received instruction, obtain the instruction type identifier according to the designated byte in the instruction, and determine the instruction type according to the instruction type identifier.
  • the determining module 13 is used to determine the key area according to the operation instruction when the instruction type of the instruction is determined by the judging module 12 to be an operation instruction involving a key, obtain the biometric verification identifier corresponding to the key area, and verify the identifier according to the biometric. Determine the biometric verification method corresponding to the key zone;
  • the determining module 13 when the determining module 13 is used to determine the key area according to the operation instruction, the determining module 13 is specifically used to: parse the operation instruction, obtain the key area identifier according to the specified byte in the instruction, and determine the key according to the key area identifier Area.
  • the obtaining module 14 is used to obtain the operation key in the key area, and execute a corresponding operation according to the operation key to obtain the operation result;
  • the verification module 15 is used to verify biological characteristics
  • the judgment module 12 is also used to judge whether the biometric verification by the verification module passes;
  • the acquiring module 14 is also used to acquire and record the time of the timer when the biometric verification passes when the judgment module 12 determines that the verification module passes the verification of the biometrics;
  • the obtaining module 14 is also used for obtaining the current time of the timer and the time of the timer when the recorded biometric verification passes when the determining module 13 determines that the biometric verification mode is the third mode;
  • the acquisition module 14 includes a first acquisition sub-module
  • the first acquisition sub-module is specifically used to acquire the current time of the timer and the time of the timer when the recorded biometric verification passes;
  • the determination module 12 is also used to determine whether the recorded biometric verification passes the timer time, and is also used when the determination module 12 determines that the record can be obtained.
  • the biometric verification passes the time of the timer, trigger the first acquisition sub-module, which is also used to trigger the verification module 15 when the judgment module 12 determines that the recorded biometric verification passes the timer time.
  • the judging module 12 is also used for judging whether it is necessary to verify the biometrics according to the current time obtained by the obtaining module 14 and the time of the timer when the biometric verification is passed;
  • the judging module 12 when the judging module 12 is used to judge whether it is necessary to verify the biometrics according to the current time obtained by the obtaining module 14 and the time of the timer when the biometric verification is passed, the judging module 12 specifically includes: a first calculation unit and a first calculation unit. Judgment unit
  • the first calculating unit is used to calculate the difference between the current time and the time of the timer when the recorded biometric verification passes;
  • the first judging unit is used to judge whether the difference value exceeds a preset value, if it exceeds the preset value, it needs to verify the biological characteristics, if it does not exceed the preset value, it does not need to verify the biological characteristics.
  • the sending module 17 is used to return the operation result to the upper computer;
  • the sending module 17 is also used to return an error to the upper computer when the judgment module 12 judges that the verification module 15 fails to verify the biometrics;
  • the execution module 16 is used to execute corresponding operations when the judgment module 12 judges that the instruction type of the instruction is another instruction.
  • the other instructions specifically include: select application instructions;
  • the execution module 16 includes: an application selection unit and a first sending unit;
  • the application selection unit is used to select the corresponding application according to the application identifier in the application selection instruction
  • the first sending unit is used to return the application selection response data to the upper computer.
  • the other instructions specifically include: generating a key pair instruction
  • the execution module 16 includes: a determining unit, a first acquiring unit, a first setting unit, a generating unit, and a second sending unit;
  • the determining unit is used to determine the key area according to the key pair generation instruction
  • the first obtaining unit is configured to obtain the biometric verification identifier in the key pair generation instruction
  • the first setting unit is configured to set the biometric verification mode corresponding to the key zone according to the obtained biometric verification identifier
  • the generating unit is used to generate a key pair and store it in the key area;
  • the second sending unit is used to return response data to the upper computer.
  • the determining unit is specifically configured to: parse the key pair generation instruction, obtain the key area identifier according to the designated byte in the key pair generation instruction, and determine the key area according to the key area identifier.
  • the obtaining unit is specifically configured to: parse the key pair generation instruction, obtain the biometric verification mode setting label according to the data field in the key pair generation command, obtain the biometric verification mode identifier according to the biometric verification mode setting label, and obtain the secret code.
  • the biometric verification method label corresponding to the key area;
  • the first setting unit is specifically configured to: assign the acquired biometric verification mode identifier to the biometric verification mode label.
  • other instructions specifically include: verify PIN code instruction;
  • the execution module 16 includes: a verification unit, a second setting unit, and a third sending unit;
  • the verification unit is used to perform PIN code verification according to the verification PIN code instruction
  • the second setting unit is used to set the PIN status identification bit to the set state when the verification unit passes the verification;
  • the third sending unit is used to send the verification result to the upper computer.
  • the obtaining module 14 is also used to obtain the PIN code verification identifier corresponding to the key zone;
  • the determining module 13 is also used to determine the PIN code verification method corresponding to the key zone according to the PIN code verification identifier;
  • the acquiring module 14 includes: a second acquiring sub-module
  • the second acquiring sub-module is used to acquire the biometric verification identifier corresponding to the key zone; when the determining module determines that the PIN code verification mode is the first method, the determining module triggers the second acquiring sub-module;
  • the execution module 16 is also used to obtain the PIN status identification bit corresponding to the key area when the determination module determines that the PIN code verification mode is the second method, and determine the status of the PIN status identification bit, if the status of the PIN status identification bit is set When the time, the second acquisition sub-module is triggered, and if the state of the PIN status flag is reset, the receiving module 11 is triggered.
  • the execution module 16 includes a second setting unit
  • the second setting unit is used to reset the PIN status identification bit when the execution module 16 determines that the status of the PIN status identification bit is set to trigger the second acquisition sub-module.
  • the other instructions specifically include: a two-way authentication request instruction;
  • the execution module 16 is specifically configured to parse the two-way authentication request instruction, obtain two-way authentication request data, generate and save a challenge value according to the request data, and generate and send authentication request response data according to the challenge value to the upper computer.
  • the other instructions specifically include: a two-way authentication response instruction;
  • the execution module 16 is specifically configured to: parse the two-way authentication response instruction, obtain the two-way authentication response data, obtain the pre-stored key, decrypt the two-way authentication response data through the pre-stored key according to the preset algorithm to obtain the first plaintext, and save the first plaintext with The challenge value is compared to obtain the comparison result, and the comparison result is sent to the host computer.
  • the operation instructions related to the key specifically include: signature instructions, and/or authentication instructions, and/or encryption instructions, and/or decryption instructions.
  • the user can realize multiple biometric verification methods according to the key area during the verification process of the smart key device, which meets the user's different biometric verification requirements for the key used in different application scenarios.
  • the method provided by the present invention further ensures the security in the process of using the key.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Computer Hardware Design (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Human Computer Interaction (AREA)
  • Collating Specific Patterns (AREA)
  • Lock And Its Accessories (AREA)

Abstract

一种智能密钥设备及其验证方法，该验证方法通过智能密钥设备判断指令类型，根据指令类型确定密钥区，获取密钥区对应的生物特征验证标识，根据生物特征验证标识确定密钥区对应的生物特征验证方式，根据生物特征验证方式执行相应的操作。根据本发明，用户在使用智能密钥设备进行验证的过程中能够根据密钥区实现生物特征的多种验证方式，满足了用户在不同的应用场景下对所使用密钥时不同的验证需求。

Description

一种智能密钥设备及其验证方法 技术领域
本发明涉及一种智能密钥设备及其验证方法，属于信息安全技术领域。
背景技术
智能密钥设备是一种带有处理器和存储器的小型硬件装置，它可通过计算机的数据通讯接口与计算机连接。智能密钥设备通过内置的单片机或智能卡芯片完成密钥的生成以及密钥的安全存储，其中可预置加密算法功能，且与密钥相关的运算完全在智能密钥设备内部运行，使得智能密钥设备具有抗攻击的特性，安全性极高。
现有技术中，智能密钥设备针对密码区设定了身份验证方式，例如设备接收到签名指令时，判断签名指令所需密钥是否需要PIN码验证，根据PIN码验证结果使用密钥完成签名。发明人在发明过程中发现现有的这种验证方式存在缺陷：用户在不同的应用场景下对所使用的密钥有不同的验证需求，然而现有的密钥区设定的身份验证方式太过于单一，不能满足用户在不同的应用场景下所需密钥的不同验证需求，导致产品不够个性化，用户体检差。
发明内容
本发明的目的是提供了一种智能密钥设备及其验证方法，能够满足用户在不同的应用场景下对所使用密钥的不同验证需求。
为此，根据本发明的一个方面，提供了一种智能密钥设备验证方法，其包括如下步骤：
s1)智能密钥设备接收上位机下发的指令；
s2)智能密钥设备判断指令类型，当指令类型为涉及密钥的操作指令时，执行步骤s3，当指令类型为其他指令时，执行相应的操作，返回步骤s1；
s3)智能密钥设备根据涉及密钥的操作指令确定密钥区，执行步骤s4；
s4)智能密钥设备获取密钥区对应的生物特征验证标识，根据生物特征验证标识确定密钥区对应的生物特征验证方式，当生物特征验证方式为第一方式时，执行步骤s5，当生物特征验证方式为第二方式时，执行步骤s6，当生物特征验证方式为第三方式时，执行步骤s7；
s5)智能密钥设备根据涉及密钥的操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回上位机，执行步骤s1；
s6)智能密钥设备验证生物特征，判断生物特征验证是否通过，是则获取并记录生物特征验证通过时计时器的时间，根据操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回上位机，执行步骤s1，否则返回错误码，执行步骤s1；
s7)智能密钥设备获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间，根据获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征，是则执行步骤s6，否则根据操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回上位机，执行步骤s1。
根据本发明的另外一个方面，提供了一种智能密钥设备，其包括：
接收模块、判断模块、确定模块、获取模块、验证模块、执行模块和发送模块；
其中，接收模块，用于接收上位机下发的指令；
判断模块，用于判断接收模块接收的指令的指令类型；
确定模块，用于当判断模块判断指令的指令类型为涉及密钥的操作指令时，根据操作指 令确定密钥区，获取密钥区对应的生物特征验证标识，根据生物特征验证标识确定密钥区对应的生物特征验证方式；
获取模块，用于获取密钥区中的操作密钥，根据操作密钥执行相应的操作得到操作结果；
验证模块，用于验证生物特征；
判断模块，还用于判断验证模块验证生物特征是否通过；
获取模块，还用于当判断模块判断验证模块验证生物特征通过时，获取并记录生物特征验证通过时计时器的时间；
获取模块，还用于当确定模块确定生物特征验证方式为第三方式时，获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间；
判断模块，还用于根据获取模块获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征；
发送模块，用于将操作结果返回上位机；
发送模块，还用于当判断模块判断验证模块验证生物特征未通过时，向上位机返回错误；
执行模块，用于当判断模块判断指令的指令类型为其他指令时，执行相应的操作。
根据本发明，在使用智能密钥设备验证过程中，用户能够根据密钥区实现生物特征多种验证方式，满足了用户在不同的应用场景下对所使用密钥时不同的生物特征验证需求。
附图说明
图1是本发明实施例1提供的一种智能密钥设备验证方法流程图；
图2是本发明实施例2提供的一种智能密钥设备框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例1：
本发明实施例1提供了一种智能密钥设备验证方法，该方法包括：
步骤101、智能密钥设备接收上位机下发的指令；
本实施例1中，智能密钥设备接收的指令符合APDU格式，具体为：CLA INS P1 P2 LC Data Le；
具体地，在本实施例1中，CLA表示指令的应用类型，INS表示指令的执行类别，P1、P2表示指令的参数，LC表示指令的数据域(Data)的长度，Le表示上层应用希望智能密钥设备响应时回答的数据字节数。
步骤102、智能密钥设备判断指令类型，当指令类型为涉及密钥的操作指令时，执行步骤103，当指令类型为其他指令时，执行相应的操作，返回步骤101；
在本实施例1中，智能密钥设备判断指令类型具体为：智能密钥设备解析接收到的指令，根据指令中的指定字节获取指令类型标识，根据指令类型标识确定指令类型；
具体地，智能密钥设备根据指令中的INS字节获取指令类型标识，根据指令类型标识确定指令类型；INS字节表示指令的执行类别；
例如，当INS字节为04时，指令类型为选应用指令，当INS字节为20时，指令类型为验证PIN码指令，当INS字节为87时，指令类型为涉及密钥的操作指令；
其中，涉及密钥的操作指令包括：签名操作、加密操作、认证操作等，涉及密钥的操作指令为签名操作时，指令具体为：1087079aff7c8201068200818201000003ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003031300d0609608648016503040201050004203d4510354b4d288504edef18917e429f7c6623547800 87 07 9a 0b 1f 03 8b 72 1c d5 86 41 3d 38 1f。
步骤103、智能密钥设备根据涉及密钥的操作指令确定密钥区，执行步骤104；
在本实施例1中，智能密钥设备根据涉及密钥的操作指令确定密钥区具体为：智能密钥设备解析操作指令，根据指令中的指定字节获取密钥区标识，根据密钥区标识确定密钥区；
具体地，密钥区标识包括9a、9c、9d、9e；智能密钥设备根据指令中的P2字节获取密钥区标识；
步骤104、智能密钥设备获取密钥区对应的生物特征验证标识，根据生物特征验证标识确定密钥区对应的生物特征验证方式，当生物特征验证方式为第一方式时，执行步骤105，当生物特征验证方式为第二方式时，执行步骤106，当生物特征验证方式为第三方式时，执行步骤107；
优选地，生物特征包括：指纹、虹膜、手形、脸形、视网膜、脉搏、耳廓等；
本实施例1中生物特征以指纹为例，具体地，生物特征验证标识为指纹标识；生物特征验证方式包括第一方式01、第二方式02、第三方式03，当指纹验证标识为01时，验证方式为第一方式，第一方式具体表示在响应操作指令进行操作过程中，无需验证操作密钥对应的生物特征；当指纹验证标识为02时，验证方式为第二方式，第二方式具体表示在预设时间范围内，在响应操作指令进行操作过程中，只需验证一次操作密钥对应的生物特征；当指纹验证标识为03时，验证方式为第三方式，第三方式具体表示在响应操作指令进行操作过程中，每次都需验证操作密钥对应的生物特征；
步骤105、智能密钥设备根据操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回上位机，执行步骤101；
具体地，当操作指令为签名操作时，智能密钥设备获取密钥区中的签名密钥，根据预设算法通过签名密钥对相应的数据进行签名，将签名结果返回上位机，执行步骤101。
步骤106、智能密钥设备验证生物特征，判断生物特征验证是否通过，是则获取并记录生物特征验证通过时计时器的时间，根据操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回所述上位机，执行步骤101，否则返回错误码，执行步骤101；
在本实施例1中，智能密钥设备验证生物特征具体为：智能密钥设备通过提示模块提示用户验证生物特征，并将获取的生物特征信息与自身保存的生物特征信息进行比对，若一致则生物特征验证成功，否则生物特征验证失败。
步骤107、智能密钥设备获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间，根据获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征，是则执行步骤106，否则根据操作指令获取密钥区对应的操作密钥，根据操作密钥执行相应的操作，将操作结果返回上位机，执行步骤101。
优选地，根据获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要 验证生物特征具体为：智能密钥设备计算当前时间与记录的生物特征验证通过时计时器的时间的差值，判断差值是否超过预设值，若超过预设值则需要验证生物特征，若没有超过预设值则不需要验证生物特征。
优选地，预设值可以是2分钟。
优选地，本实施例1中，当生物特征验证方式为第三方式时还包括：智能密钥设备判断是否能获取到记录的生物特征验证通过时计时器的时间，当智能密钥设备能获取到记录的生物特征验证通过时计时器的时间时，执行步骤107；当智能密钥设备不能获取到记录的生物特征验证通过时计时器的时间时，执行步骤106。
优选地，本实施例1中，其他指令具体包括：选应用指令；当指令类型为选应用指令时，执行的相应的操作具体为：智能密钥设备根据选应用指令中的应用标识选择相应的应用，向上位机返回选应用响应数据，执行步骤101。
具体地，智能密钥设备根据选应用指令中的应用标识选择相应的应用具体为：智能密钥设备获取选应用指令数据域中的AID标识(Application Identification，应用标识符)，根据AID标识查找自身保存的应用标识列表中是否有匹配的AID标识，如果有相同AID标识则选择相应的应用；
具体地，向上位机返回的选应用响应数据包括选应用成功响应数据或选应用失败响应数据；
其中，选应用指令为：00a4 04 00 09a0 00 00 03 97 42 54 46 59；其中包括选择头：00a404 00和应用编号：a0 00 00 03 97 42 54 46 59；
选应用成功的信息包括：选应用成功状态码；选应用失败的信息包括：选应用失败状态码；
例如，选应用成功的状态码为：9000，选应用失败的状态码为：0000。
优选地，本实施例1中，其他指令具体包括：生成密钥对指令；当指令类型为生成密钥对指令时，执行相应的操作具体为：智能密钥设备根据生成密钥对指令确定密钥区，获取指令中的生物特征验证标识，根据获取的生物特征验证标识设置密钥区对应的生物特征验证方式，获取密钥对存入密钥区，并向上位机返回响应数据，执行步骤101。
具体地，智能密钥设备根据生成密钥对指令确定密钥区具体为：智能密钥设备解析生成密钥对指令，根据指令中的指定字节获取密钥区标识，根据密钥区标识确定密钥区；
优选地，智能设备中分有4个密钥区域，4个密钥区域存储有不同的密钥对和证书，具有不同的密钥功能，一个密钥区可以对应多个不同操作；其中，密钥区标识包括9a、9c、9d、9e；具体地，9a为认证密钥区；9c为数字签名密钥区；9d为密钥管理密钥区；9e为卡认证密钥区；
智能密钥设备根据指令中的指定字节P2获取密钥区标识，根据密钥区标识确定密钥区；
具体地，获取指令中的生物特征验证标识，根据获取的生物特征验证标识设置密钥区对应的生物特征验证方式，具体为：智能密钥设备解析设置生物特征验证方式指令，根据指令中的数据域获取生物特征验证方式设置标签，根据生物特征验证方式设置标签获取生物特征验证方式标识，智能密钥设备获取密钥区对应的生物特征验证方式标签，将获取生物特征验证方式标识赋值给生物特征验证方式标签；
例如，生物特征验证方式设置标签为bc；生物特征验证方式标识为01、02、03；
优选地，当智能密钥设备获取的生物特征验证标识为其他时，可以设置相应的标识，还可以向上位机返回错误；
优选地，智能密钥设备获取密钥对存入密钥区具体包括：智能密钥设备根据设置生物特征验证方式指令生成密钥对并保存在密钥区；
优选地，智能密钥设备获取密钥对存入密钥区具体还包括：智能密钥设备根据设置生物特征验证方式指令获取指令数据域中包含的密钥对并保存在密钥区；
优选地，本实施例1中，其他指令具体包括：验证PIN码指令；当指令类型为验证PIN码指令时，执行相应的操作具体为：智能密钥设备根据验证PIN码指令进行验证PIN码，验证通过则将PIN状态标识位置位，将验证结果返回给上位机，执行步骤101。
在本实施例1中，智能密钥设备根据验证PIN码指令进行验证PIN码具体为：智能密钥设备根据验证PIN码指令获取指令数据域中的PIN码，将获取PIN码与自身保存的PIN码进行比对，若一致则验证PIN码成功，否则验证PIN码失败；
优选地，智能密钥设备验证通过则将PIN状态标识位置位具体为：智能密钥设备查找PIN状态标识，将PIN状态标识对应的PIN状态标识位修改为指定数值；例如，PIN状态标识为：F_UNLOCKED，PIN状态标识位对应的数值为00时表示PIN状态标识复位，PIN状态标识位对应的数值为01时表示PIN状态标识置位；
具体地，返回给所述上位机的验证结果包括：验证PIN码成功数据或验证PIN码失败数据。
在本实施例1中，智能密钥设备根据涉及密钥的操作指令确定密钥区之后还包括：智能密钥设备获取密钥区对应的PIN码验证标识，根据PIN码验证标识确定密钥区对应的PIN码验证方式，当PIN码验证方式为第一方式时，执行步骤104；
当PIN码验证方式为第二方式，智能密钥设备获取密钥区对应的PIN状态标识位，判断PIN状态标识位的状态，若PIN状态标识位的状态为置位时，执行步骤104，若PIN状态标识位的状态为复位时，向上位机发送错误信息，执行步骤101。
优选地，智能密钥设备判断PIN状态标识位的状态为置位时，还包括：智能密钥设备将PIN状态标识位复位。
优选地，PIN码验证方式包括第一方式01、第二方式02、第三方式03，当PIN码验证标识为01时，PIN码验证方式为第一方式，第一方式具体表示智能密钥设备在响应操作指令进行操作过程中，无需验证操作密钥对应的PIN码；当PIN码验证标识为02时，PIN码验证方式为第二方式，第二方式具体表示智能密钥设备在第一次选应用成功到第二次选应用之间，响应操作指令进行操作过程中，只需验证一次操作密钥对应的PIN码；当PIN码验证标识为03时，PIN码验证方式为第三方式，第三方式具体表示智能密钥设备在响应操作指令进行操作过程中，每次操作都需验证操作密钥对应的PIN码；
PIN状态标识为：F_UNLOCKED；PIN状态标识位对应的数值为00时表示PIN状态标识复位，PIN状态标识位对应的数值为01时表示PIN状态标识置位。优选地，在本实施例1中，其他指令具体包括：双向认证请求指令；
当指令类型为双向认证请求指令时，执行相应的操作具体为：智能密钥设备解析双向认证请求指令，获取双向认证请求数据，根据请求数据生成挑战值并保存，根据挑战值生成认证请求响应数据发送给所述上位机，执行步骤101；
具体地，智能密钥设备生成挑战值具体为：
例如，生成的挑战值为：3c9b0ea8731313e6；
优选地，在本实施例1中，其他指令具体包括：双向认证响应指令；
当指令类型为双向认证响应指令时，执行相应的操作具体为：智能密钥设备解析双向认 证响应指令，获取双向认证响应数据，获取预存密钥，根据预设算法通过预存密钥对双向认证响应数据进行解密得到第一明文，将第一明文与保存的挑战值进行比对得到比对结果，将比对结果发送给所述上位机，执行步骤101。
具体地，预存密钥具体是智能密钥设备与上位机协商一致提前保存的通信密钥；其中，预设算法具体为加密算法，例如：加密算法DesEcb；
具体地，智能密钥设备获取的双向认证响应数据具体为：bd50f30c85b48906。
实施例2：
本发明实施例2提供了一种智能密钥设备，该设备100包括：接收模块11、判断模块12、确定模块13、获取模块14、验证模块15、执行模块16和发送模块17；
其中，接收模块11，用于接收上位机下发的指令；
本实施例2中，接收模块11接收的指令符合APDU格式，具体为：CLA INS P1 P2 LC Data Le；
具体地，在本实施例2中，CLA表示指令的应用类型，INS表示指令的执行类别，P1、P2表示指令的参数，LC表示指令的数据域(Data)的长度，Le表示上层应用希望智能密钥设备响应时回答的数据字节数。
其中，判断模块12，用于判断接收模块11接收的指令的指令类型；
优选地，当判断模块12用于判断指令类型时，判断模块12具体用于：解析接收到的指令，根据指令中的指定字节获取指令类型标识，根据指令类型标识确定指令类型。
其中，确定模块13，用于当判断模块12判断指令的指令类型为涉及密钥的操作指令时，根据操作指令确定密钥区，获取密钥区对应的生物特征验证标识，根据生物特征验证标识确定密钥区对应的生物特征验证方式；
优选地，当确定模块13用于根据操作指令确定密钥区时，确定模块13具体用于：解析操作指令，根据指令中的指定字节获取密钥区标识，根据密钥区标识确定密钥区。
其中，获取模块14，用于获取密钥区中的操作密钥，根据操作密钥执行相应的操作得到操作结果；
其中，验证模块15，用于验证生物特征；
其中，判断模块12，还用于判断验证模块验证生物特征是否通过；
其中，获取模块14，还用于当判断模块12判断验证模块验证生物特征通过时，获取并记录生物特征验证通过时计时器的时间；
其中，获取模块14，还用于当确定模块13确定生物特征验证方式为第三方式时，获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间；
具体地，获取模块14包括第一获取子模块；
第一获取子模块，具体用于获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间；
当确定模块13确定生物特征验证方式为第三方式时，判断模块12还用于判断是否能获取到记录的生物特征验证通过时计时器的时间，还用于当判断模块12判断能获取到记录的生物特征验证通过时计时器的时间时，触发第一获取子模块，还用于当判断模块12判断不能获取到记录的生物特征验证通过时计时器的时间时，触发验证模块15。
其中，判断模块12，还用于根据获取模块14获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征；
优选地，当判断模块12用于根据获取模块14获取的当前时间和记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征时，判断模块12具体包括：第一计算单元和第一判断单元；
第一计算单元，用于计算当前时间与记录的生物特征验证通过时计时器的时间的差值；
第一判断单元，用于判断差值是否超过预设值，若超过预设值则需要验证生物特征，若没有超过预设值则不需要验证生物特征。
其中，发送模块17，用于将操作结果返回上位机；
其中，发送模块17，还用于当判断模块12判断验证模块15验证生物特征未通过时，向上位机返回错误；
其中，执行模块16，用于当判断模块12判断指令的指令类型为其他指令时，执行相应的操作。
优选地，其他指令具体包括：选应用指令；
执行模块16包括：选应用单元和第一发送单元；
选应用单元，用于根据选应用指令中的应用标识选择相应的应用；
第一发送单元，用于向上位机返回选应用响应数据。
优选地，其他指令具体包括：生成密钥对指令；
执行模块16包括：确定单元、第一获取单元、第一设置单元、生成单元和第二发送单元；
确定单元，用于根据生成密钥对指令确定密钥区；
第一获取单元，用于获取生成密钥对指令中的生物特征验证标识；
第一设置单元，用于根据获取的生物特征验证标识设置密钥区对应的生物特征验证方式；
生成单元，用于生成密钥对存入密钥区；
第二发送单元，用于向上位机返回响应数据。
优选地，确定单元具体用于：解析生成密钥对指令，根据生成密钥对指令中的指定字节获取密钥区标识，根据密钥区标识确定密钥区。
优选地，获取单元具体用于：解析生成密钥对指令，根据生成密钥对指令中的数据域获取生物特征验证方式设置标签，根据生物特征验证方式设置标签获取生物特征验证方式标识，获取密钥区对应的生物特征验证方式标签；
第一设置单元具体用于：将获取的生物特征验证方式标识赋值给生物特征验证方式标签。
优选地，其他指令具体包括：验证PIN码指令；
执行模块16包括：验证单元、第二设置单元和第三发送单元；
验证单元，用于根据验证PIN码指令进行PIN码验证；
第二设置单元，用于当验证单元验证通过时，将PIN状态标识位设置成置位状态；
第三发送单元，用于向上位机发送验证结果。
优选地，获取模块14还用于获取密钥区对应的PIN码验证标识；
确定模块13还用于根据PIN码验证标识确定密钥区对应的PIN码验证方式；
获取模块14包括：第二获取子模块；
第二获取子模块，用于获取密钥区对应的生物特征验证标识；当确定模块确定PIN码验证方式为第一方式时，确定模块触发第二获取子模块；
执行模块16，还用于当确定模块确定PIN码验证方式为第二方式时，获取密钥区对应的PIN状态标识位，判断PIN状态标识位的状态，若PIN状态标识位的状态为置位时，触发第二获取子模块，若PIN状态标识位的状态为复位时，触发接收模块11。
优选地，执行模块16包括第二设置单元；
第二设置单元，用于当执行模块16判断PIN状态标识位的状态为置位时，将PIN状态标识位复位，触发第二获取子模块。
优选地，其他指令具体包括：双向认证请求指令；
执行模块16具体用于：解析双向认证请求指令，获取双向认证请求数据，根据请求数据生成挑战值并保存，根据挑战值生成认证请求响应数据发送给上位机。
优选地，其他指令具体包括：双向认证响应指令；
执行模块16具体用于：解析双向认证响应指令，获取双向认证响应数据，获取预存密钥，根据预设算法通过预存密钥对双向认证响应数据进行解密得到第一明文，将第一明文与保存的挑战值进行比对得到比对结果，将比对结果发送给上位机。
优选的，涉及密钥的操作指令具体包括：签名指令、和/或认证指令、和/或加密指令、和/或解密指令。
根据本发明，用户在使用智能密钥设备验证过程中能够根据密钥区实现生物特征多种验证方式，满足了用户在不同的应用场景下对所使用密钥时不同的生物特征验证需求，采用本发明提供的方法，进一步确保了密钥使用过程中的安全性。
以上对本发明所提供的一种智能密钥设备及其验证方法及***进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上，本说明书内容不应理解为对本发明的限制。

Claims (20)

  1. 一种智能密钥设备验证方法，其特征在于，所述方法包括如下步骤：
    A1)智能密钥设备接收上位机下发的指令；
    A2)所述智能密钥设备判断指令类型，当指令类型为涉及密钥的操作指令时，执行步骤A3，当指令类型为其他指令时，执行相应的操作，返回步骤A1；
    A3)所述智能密钥设备根据所述操作指令确定密钥区，执行步骤A4；
    A4)所述智能密钥设备获取所述密钥区对应的生物特征验证标识，根据所述生物特征验证标识确定密钥区对应的生物特征验证方式，当所述生物特征验证方式为第一方式时，执行步骤A5，当所述生物特征验证方式为第二方式时，执行步骤A6，当所述生物特征验证方式为第三方式时，执行步骤A7；
    A5)所述智能密钥设备根据所述操作指令获取所述密钥区对应的操作密钥，根据所述操作密钥执行相应的操作，将操作结果返回所述上位机，执行步骤A1；
    A6)所述智能密钥设备验证生物特征，判断生物特征验证是否通过，是则获取并记录生物特征验证通过时计时器的时间，根据所述操作指令获取所述密钥区对应的操作密钥，根据所述操作密钥执行相应的操作，将操作结果返回所述上位机，执行步骤A1，否则返回错误码，执行步骤A1；以及
    A7)所述智能密钥设备获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间，根据获取的所述当前时间和所述记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征，是则执行步骤A6，否则根据所述操作指令获取所述密钥区对应的操作密钥，根据所述操作密钥执行相应的操作，将操作结果返回所述上位机，执行步骤A1。
  2. 根据权利要求1所述的方法，其特征在于，所述智能密钥设备判断指令类型具体为：所述智能密钥设备解析接收到的指令，根据指令中的指定字节获取指令类型标识，根据指令类型标识确定指令类型。
  3. 根据权利要求1所述的方法，其特征在于，所述智能密钥设备根据所述操作指令确定密钥区具体为：所述智能密钥设备解析所述操作指令，根据指令中的指定字节获取密钥区标识，根据所述密钥区标识确定密钥区。
  4. 根据权利要求1所述的方法，其特征在于，在步骤A7中，所述根据获取的所述当前时间和所述记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征具体为：所述智能密钥设备计算所述当前时间与所述记录的生物特征验证通过时计时器的时间的差值，判断所述差值是否超过预设值，若超过预设值则需要验证生物特征，若没有超过预设值则不需要验证生物特征。
  5. 根据权利要求1所述的方法，其特征在于，所述当所述生物特征验证方式为第三方式时还包括：所述智能密钥设备判断是否能获取到记录的生物特征验证通过时计时器的时间，当所述智能密钥设备能获取到记录的生物特征验证通过时计时器的时间时，执行步骤A7；当所述智能密钥设备不能获取到记录的生物特征验证通过时计时器的时间时，执行步骤A6。
  6. 根据权利要求1所述的方法，其特征在于，所述其他指令具体包括：选应用指令；
    所述执行相应的操作具体为：所述智能密钥设备根据所述选应用指令中的应用标识选择相应的应用，向所述上位机返回选应用响应数据，执行步骤A1。
  7. 根据权利要求1所述的方法，其特征在于，所述其他指令具体包括：生成密钥对指令；
    所述执行相应的操作具体为：所述智能密钥设备根据所述生成密钥对指令确定密钥区，获取所述生成密钥对指令中的生物特征验证标识，根据获取的生物特征验证标识设置密钥区 对应的生物特征验证方式，获取密钥对存入密钥区，并向所述上位机返回响应数据，执行步骤A1。
  8. 根据权利要求7所述的方法，其特征在于，所述获取所述生成密钥对指令中的生物特征验证标识，根据获取的生物特征验证标识设置密钥区对应的生物特征验证方式，具体为：所述智能密钥设备解析生成密钥对指令，根据指令中的数据域获取生物特征验证方式设置标签，根据所述生物特征验证方式设置标签获取生物特征验证方式标识，所述智能密钥设备获取密钥区对应的生物特征验证方式标签，将获取生物特征验证方式标识赋值给生物特征验证方式标签。
  9. 根据权利要求1所述的方法，其特征在于，所述其他指令具体包括：双向认证请求指令；
    所述执行相应的操作具体为：所述智能密钥设备解析所述双向认证请求指令，获取双向认证请求数据，根据请求数据生成挑战值并保存，根据所述挑战值生成认证请求响应数据发送给所述上位机，执行步骤A1。
  10. 根据权利要求1所述的方法，其特征在于，所述其他指令具体包括：双向认证响应指令；
    所述执行相应的操作具体为：所述智能密钥设备解析所述双向认证响应指令，获取双向认证响应数据，获取预存密钥，根据预设算法通过所述预存密钥对所述双向认证响应数据进行解密得到第一明文，将所述第一明文与保存的挑战值进行比对得到比对结果，将比对结果发送给所述上位机，执行步骤A1。
  11. 一种智能密钥设备，其特征在于，所述设备包括：接收模块、判断模块、确定模块、获取模块、验证模块、执行模块和发送模块；
    所述接收模块，用于接收上位机下发的指令；
    所述判断模块，用于判断所述接收模块接收的指令的指令类型；
    所述确定模块，用于当所述判断模块判断所述指令的指令类型为涉及密钥的操作指令时，根据所述操作指令确定密钥区，获取所述密钥区对应的生物特征验证标识，根据所述生物特征验证标识确定所述密钥区对应的生物特征验证方式；
    所述获取模块，用于获取所述密钥区中的操作密钥，根据所述操作密钥执行相应的操作得到操作结果；
    所述验证模块，用于验证生物特征；
    所述判断模块，还用于判断所述验证模块验证生物特征是否通过；
    所述获取模块，还用于当所述判断模块判断所述验证模块验证生物特征通过时，获取并记录生物特征验证通过时计时器的时间；
    所述获取模块，还用于当所述确定模块确定所述生物特征验证方式为第三方式时，获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间；
    所述判断模块，还用于根据所述获取模块获取的所述当前时间和所述记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征；
    所述发送模块，用于将操作结果返回上位机；
    所述发送模块，还用于当所述判断模块判断所述验证模块验证生物特征未通过时，向上位机返回错误；以及
    所述执行模块，用于当所述判断模块判断所述指令的指令类型为其他指令时，执行相应的操作。
  12. 根据权利要求11所述的设备，其特征在于，当所述判断模块用于判断指令类型时，所述判断模块具体用于：解析接收到的指令，根据指令中的指定字节获取指令类型标识，根据指令类型标识确定指令类型。
  13. 根据权利要求11所述的设备，其特征在于，当所述确定模块用于根据所述操作指令确定密钥区时，所述确定模块具体用于：解析所述操作指令，根据指令中的指定字节获取密钥区标识，根据密钥区标识确定密钥区。
  14. 根据权利要求11所述的设备，其特征在于，当所述判断模块用于根据所述获取模块获取的所述当前时间和所述记录的生物特征验证通过时计时器的时间判断是否需要验证生物特征时，所述判断模块具体包括：第一计算单元和第一判断单元；
    所述第一计算单元，用于计算所述当前时间与所述记录的生物特征验证通过时计时器的时间的差值；以及
    所述第一判断单元，用于判断所述差值是否超过预设值，若超过预设值则需要验证生物特征，若没有超过预设值则不需要验证生物特征。
  15. 根据权利要求11所述的设备，其特征在于，所述获取模块包括第一获取子模块；
    所述第一获取子模块，具体用于获取计时器的当前时间以及记录的生物特征验证通过时计时器的时间；以及
    当所述确定模块确定所述生物特征验证方式为第三方式时，所述判断模块还用于判断是否能获取到记录的生物特征验证通过时计时器的时间，还用于当所述判断模块判断能获取到记录的生物特征验证通过时计时器的时间时，触发第一获取子模块，还用于当所述判断模块判断不能获取到记录的生物特征验证通过时计时器的时间时，触发验证模块。
  16. 根据权利要求11所述的设备，其特征在于，所述其他指令具体包括：选应用指令；
    所述执行模块包括：选应用单元和第一发送单元；
    所述选应用单元，用于根据所述选应用指令中的应用标识选择相应的应用；以及
    所述第一发送单元，用于向所述上位机返回选应用响应数据。
  17. 根据权利要求11所述的设备，其特征在于，所述其他指令具体包括：生成密钥对指令；
    所述执行模块包括：确定单元、第一获取单元、第一设置单元、生成单元和第二发送单元；
    所述确定单元，用于根据所述生成密钥对指令确定密钥区；
    所述第一获取单元，用于获取所述生成密钥对指令中的生物特征验证标识；
    所述第一设置单元，用于根据获取的生物特征验证标识设置密钥区对应的生物特征验证方式；
    所述生成单元，用于生成密钥对存入密钥区；以及
    所述第二发送单元，用于向所述上位机返回响应数据。
  18. 根据权利要求11所述的设备，其特征在于，所述获取单元具体用于：解析生成密钥对指令，根据所述生成密钥对指令中的数据域获取生物特征验证方式设置标签，根据生物特征验证方式设置标签获取生物特征验证方式标识，获取密钥区对应的生物特征验证方式标签；以及
    所述第一设置单元具体用于：将获取的生物特征验证方式标识赋值给生物特征验证方式标签。
  19. 根据权利要求11所述的设备，其特征在于，所述其他指令具体包括：双向认证请求 指令；以及
    所述执行模块具体用于：解析所述双向认证请求指令，获取双向认证请求数据，根据请求数据生成挑战值并保存，根据挑战值生成认证请求响应数据发送给所述上位机。
  20. 根据权利要求11所述的设备，其特征在于，所述其他指令具体包括：双向认证响应指令；以及
    所述执行模块具体用于：解析所述双向认证响应指令，获取双向认证响应数据，获取预存密钥，根据预设算法通过预存密钥对双向认证响应数据进行解密得到第一明文，将所述第一明文与保存的挑战值进行比对得到比对结果，将比对结果发送给所述上位机。
PCT/CN2020/070169 2019-10-21 2020-01-03 一种智能密钥设备及其验证方法 WO2021077627A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/431,378 US11972651B2 (en) 2019-10-21 2020-01-03 Intelligent key device and verification method therefor
EP20879656.5A EP4050837A4 (en) 2019-10-21 2020-01-03 INTELLIGENT KEY DEVICE AND VERIFICATION METHOD THEREOF

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911002653.2A CN110740043B (zh) 2019-10-21 2019-10-21 一种智能密钥设备及其验证方法
CN201911002653.2 2019-10-21

Publications (1)

Publication Number Publication Date
WO2021077627A1 true WO2021077627A1 (zh) 2021-04-29

Family

ID=69270768

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/070169 WO2021077627A1 (zh) 2019-10-21 2020-01-03 一种智能密钥设备及其验证方法

Country Status (4)

Country Link
US (1) US11972651B2 (zh)
EP (1) EP4050837A4 (zh)
CN (1) CN110740043B (zh)
WO (1) WO2021077627A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113436376A (zh) * 2021-06-02 2021-09-24 杭州海康威视数字技术股份有限公司 一种门禁***、方法、装置及生物密钥卡

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7478233B2 (en) * 2002-05-30 2009-01-13 Microsoft Corporation Prevention of software tampering
WO2016049898A1 (zh) * 2014-09-30 2016-04-07 华为技术有限公司 身份认证的方法、装置及用户设备

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7191466B1 (en) * 2000-07-25 2007-03-13 Laurence Hamid Flexible system and method of user authentication for password based system
US8001387B2 (en) * 2006-04-19 2011-08-16 Dphi, Inc. Removable storage medium with biometric access
CN101820346B (zh) * 2010-05-04 2012-06-27 飞天诚信科技股份有限公司 一种安全数字签名方法
US9286455B2 (en) * 2012-10-04 2016-03-15 Msi Security, Ltd. Real identity authentication
WO2015019821A1 (ja) * 2013-08-05 2015-02-12 ソニー株式会社 情報処理装置、情報処理方法及びコンピュータプログラム
US9197414B1 (en) * 2014-08-18 2015-11-24 Nymi Inc. Cryptographic protocol for portable devices
US10609070B1 (en) * 2016-03-10 2020-03-31 Claude W. Farmer, III Device based user authentication
US10146924B2 (en) * 2016-12-14 2018-12-04 Fotonation Limited Systems and methods for authenticating a biometric device using a trusted coordinating smart device
GB2607846B (en) * 2018-06-06 2023-06-14 Istorage Ltd Dongle for ciphering data
CN108809982B (zh) * 2018-06-12 2020-10-27 飞天诚信科技股份有限公司 一种基于可信执行环境的免密认证方法及***
CN110730065B (zh) * 2018-07-17 2022-04-08 关楗股份有限公司 用于秘钥备份装置及秘钥备份***中的权标装置
CN109086588B (zh) * 2018-08-01 2020-08-07 飞天诚信科技股份有限公司 一种认证方法及认证设备
US11245700B2 (en) * 2018-12-06 2022-02-08 Fujitsu Limited Information processing apparatus, information processing method, and recording medium recording information processing program
TWI739086B (zh) * 2019-04-10 2021-09-11 歐生全科技股份有限公司 可攜式認證裝置與裝置內自行登錄認證資料的方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7478233B2 (en) * 2002-05-30 2009-01-13 Microsoft Corporation Prevention of software tampering
WO2016049898A1 (zh) * 2014-09-30 2016-04-07 华为技术有限公司 身份认证的方法、装置及用户设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4050837A4 *

Also Published As

Publication number Publication date
EP4050837A1 (en) 2022-08-31
US11972651B2 (en) 2024-04-30
EP4050837A4 (en) 2023-11-08
CN110740043A (zh) 2020-01-31
US20220245977A1 (en) 2022-08-04
CN110740043B (zh) 2020-08-07

Similar Documents

Publication Publication Date Title
US10205711B2 (en) Multi-user strong authentication token
CN106651363B (zh) 一种硬件钱包及其持有者身份验证方法
CN106330850B (zh) 一种基于生物特征的安全校验方法及客户端、服务器
EP2639726B1 (en) Service provision system and unit device
US8332637B2 (en) Methods and systems for nonce generation in a token
CN106612259B (zh) 身份识别、业务处理以及生物特征信息的处理方法和设备
US20080098469A1 (en) Authentication entity device, verification device and authentication request device
CN109359601A (zh) 身份验证识别方法、电子装置及计算机可读存储介质
CN108965222A (zh) 身份认证方法、***及计算机可读存储介质
WO2020035009A1 (zh) 认证***及其工作方法
CN104820814A (zh) 第二代身份证防伪验证***
WO2019114431A1 (zh) 一种具有指纹验证功能的金融卡及其工作方法
CN113591057A (zh) 生物特征离线身份识别方法及***
JP2004246715A (ja) 認証情報処理方法
WO2021077627A1 (zh) 一种智能密钥设备及其验证方法
JP3589579B2 (ja) 生体認証装置及びその処理プログラムを記録した記録媒体
WO2022042745A1 (zh) 一种密钥管理方法及装置
WO2009140911A1 (zh) 交互式身份认证方法
WO2018076163A1 (zh) 指纹算法库与指纹传感器的绑定认证方法及指纹识别***
WO2022012080A1 (zh) 一种智能密钥设备登录***的方法及装置
CN112532573B (zh) 一种认证关联性的认证方法以及安全装置
CN104134025B (zh) 基于sim卡的移动终端加锁方法、装置及移动终端
CN109344593B (zh) 生物信息验证方法以及验证服务器、录入和验证客户端
CN110740042B (zh) 一种智能密钥设备及其验证方法
CN103049686A (zh) 用Usb Key来实现数据库和用户信息验证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20879656

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020879656

Country of ref document: EP

Effective date: 20220523