WO2021243592A1 - 用于第三方认证的身分的注册与接入控制方法 - Google Patents

用于第三方认证的身分的注册与接入控制方法 Download PDF

Info

Publication number
WO2021243592A1
WO2021243592A1 PCT/CN2020/094083 CN2020094083W WO2021243592A1 WO 2021243592 A1 WO2021243592 A1 WO 2021243592A1 CN 2020094083 W CN2020094083 W CN 2020094083W WO 2021243592 A1 WO2021243592 A1 WO 2021243592A1
Authority
WO
WIPO (PCT)
Prior art keywords
identity
data
user
identity data
registration
Prior art date
Application number
PCT/CN2020/094083
Other languages
English (en)
French (fr)
Inventor
许乃赫
李纪广
陈俞任
Original Assignee
铨鸿资讯有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 铨鸿资讯有限公司 filed Critical 铨鸿资讯有限公司
Priority to PCT/CN2020/094083 priority Critical patent/WO2021243592A1/zh
Publication of WO2021243592A1 publication Critical patent/WO2021243592A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention is related to identity authentication, and particularly relates to a method for registration and access control of identity used for third-party authentication.
  • the main purpose of the present invention is to provide a method for registration and access control for third-party authentication, which can confirm whether the user actually holds the identity certificate for registration during the registration process, and can be used for data access control
  • a third-party authentication method is used to provide the user's real identity data to the website.
  • the present invention provides a method for registration and access control of a third-party authentication identity, which includes the following steps: obtaining an identity image of a user’s identity certificate from a client computer device in a registration mode, wherein the identity image It is obtained by capturing the identity data page of the identity document by the image capture module; performing optical character recognition processing and identity analysis processing on the identity image to obtain the parsed identity data; obtaining the embedded identity data through the communication module of the client computer equipment itself ; When comparing the parsed identity data and the embedded identity data at least in part, set the user’s identity data according to at least one of the parsed identity data and the embedded identity data and register; in the access control mode at the client When the computer device receives an identity access request from the requesting computer device, it verifies the identity of the current user; and, when the current user passes the identity verification, generates a return identity data based on the user’s identity data and the identity access request , And send it back to the requesting computer equipment.
  • the invention can effectively ensure the authenticity of registered users, prevent the registration of fake accounts, greatly simplify the authentication process, and improve the security of identity access control.
  • Fig. 1 is a structural diagram of an identity access control system according to an embodiment of the present invention.
  • Fig. 2 is a flowchart of identity registration according to the first embodiment of the present invention.
  • Fig. 3 is a flowchart of identity access control according to the second embodiment of the present invention.
  • Fig. 4 is a flowchart of identity registration according to the third embodiment of the present invention.
  • Fig. 5 is a partial flowchart of identity registration according to the fourth embodiment of the present invention.
  • Fig. 6 is a flowchart of identity access control according to the fifth embodiment of the present invention.
  • Fig. 7 is a schematic diagram of an identity registration operation according to an embodiment of the present invention.
  • Fig. 8 is a first schematic diagram of an identity access control operation according to an embodiment of the present invention.
  • Fig. 9 is a second schematic diagram of an identity access control operation according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of saving identity data according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of saving identity data according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of saving identity data according to an embodiment of the present invention.
  • FIG. 1 is a structural diagram of an identity access control system according to an embodiment of the present invention.
  • the present invention discloses an identity access control system 1, which can be used to perform the identity registration and access control methods for third-party authentication described later.
  • the identity access control system 1 can accept user registration and verify the authenticity of the identity certificate provided by the user, so as to obtain the real identity data of the user.
  • the identity access control system 1 can also provide a third-party authentication function to provide the user’s real identity data to the designated requesting computer device 32 (such as the registration server of the website) to quickly complete the identity authentication, so that the user is not Manual registration is required to use the services provided by the request-side computer device 32.
  • the designated requesting computer device 32 such as the registration server of the website
  • the identity document 20 held by the user is provided with a computing unit 200 (such as a chip passport or a chip identity card) instead of a simple paper document.
  • the aforementioned computing unit 200 stores the user's electronic identity data (such as name, date of birth, certificate number and/or nationality, etc., that is, embedded identity data).
  • the embedded identity data stored in the aforementioned computing unit 200 includes all or part of the content presented by the identity document 20 in printing (that is, the content recorded in the embedded identity data page of the identity document 20).
  • the computing unit 200 may also store the content of the identity document 20 that is not presented in a printed manner (such as user biometric characteristics such as fingerprint characteristics or iris characteristics, or personal data such as the user's address or phone number, etc.). ).
  • the identity access control system 1 includes a client computer device 10.
  • the user-side computer equipment 10 (such as smart phones, wearable devices, tablet computers, notebook computers, etc.) can be held by the user, and may include an image capture module 101, a communication module 102, a networking module 103, and electrical connections
  • the processing module 100 of the above-mentioned module can be held by the user, and may include an image capture module 101, a communication module 102, a networking module 103, and electrical connections
  • the processing module 100 of the above-mentioned module.
  • the image capturing module 101 (such as a camera) is used to capture external images.
  • the communication module 102 is used to establish short-distance (including contact) communication with an external device (such as the computing unit 200 of the identity document 20).
  • the networking module 103 (such as a mobile network module, a Wi-Fi module or an Ethernet module) is used to connect to the network 30 (such as the Internet) for data communication.
  • the processing module 100 is used to control the client computer device 10.
  • the communication module 102 may be a wireless short-range communication module, such as an NFC module, a Bluetooth module, an ultrasonic module, etc., or a contact communication module, such as a contact IC card reader.
  • the identity document 20 may include a communication interface electrically connected to the computing unit 200. The aforementioned communication interface adopts a communication technology compatible with the communication module 102, and can perform data communication with the communication module 102.
  • the present invention uses short-range communication to obtain the embedded identity data stored in the computing unit 200 of the identity document 20 to ensure that the user really holds the identity document 20 and avoid the theft of the identity document 20.
  • the client computer device 10 further includes a human-machine interface 105 (such as an input module such as a button module and a touch module and/or an output module such as a display module and an indicator light) electrically connected to the processing module 100.
  • the man-machine interface 105 is used to accept user operations and provide user information.
  • the client computer device 10 further includes a storage module 106 electrically connected to the processing module 100.
  • the storage module 106 is used to store data.
  • the storage module 106 may include a non-transitory storage medium.
  • the aforementioned non-transitory storage medium stores a computer program 1060 (such as an application program), and the computer program 1060 includes computer executable program code.
  • the processing module 100 can further implement the method of each embodiment of the present invention by executing the aforementioned computer executable program code.
  • the identity registration and access control method for third-party authentication of the present invention mainly includes a registration process (that is, the registration mode described later) and an access control process (that is, the registration mode described later). The following will describe the registration process and the access control process respectively.
  • FIG. 2 is a flowchart of the identity registration according to the first embodiment of the present invention
  • FIG. 7 is a schematic diagram of the identity registration operation according to an embodiment of the present invention.
  • the registration process of this embodiment includes the following steps.
  • Step S10 The client computer device 10 switches to the registration mode according to the user's operation (or when the specified conditions are met) to start the identity registration for the user.
  • Step S11 The processing module 100 obtains the identity image of the user's identity certificate.
  • the identity document 70 possessed by the user may be provided with a computing unit 701 (the computing unit 701 is the same as or similar to the foregoing computing unit 200, and will not be repeated here), and has a printed form 'S identity data page.
  • the identity data page may include the user's photo 702, and multiple field data 703 of the user's identity data (take FIG. 7 as an example, the name is Andy Lee, the place of issue is Taipei City, and the date of birth is January 1, 1980).
  • the user can operate the client computer device 10 to use the image capturing module 101 to capture the identity data page of the identity document 70 to obtain the identity image 71.
  • the client computer device 10 can display the captured identity image 71 in real time via the human-machine interface 105 (shown in FIG. 7 as an example of the display module 40) for the user to confirm the image quality.
  • the identity data page of the identity document 70 may further record a set of mechanically readable codes 704.
  • the mechanically readable code 704 (eg, generated by encoding the encrypted multiple field data 703) is an anti-counterfeiting mechanism used to verify the authenticity of the field data 703, and the specific verification method will be described later.
  • Step S12 The processing module 100 performs optical character recognition processing on the obtained identity image to recognize multiple characters and their arrangement in the identity image 71, and further performs identity analysis processing on the multiple characters and their arrangement as shown in the figure.
  • the analytical identity data is obtained by analyzing multiple characters and their arrangement, that is, the aforementioned analytical identity data is recorded with multiple field data 703 and/or mechanically readable codes 704.
  • Step S13 The processing module 100 obtains the embedded identity data through the communication module 102 itself.
  • the communication module 102 may be an NFC module (also can be changed to an RFID module), and the identity document 70 may include an NFC communication interface electrically connected to the computing unit 701.
  • the processing module 100 can request embedded identity data from the computing unit 701 via the communication module 102 and the NFC communication interface (and provide the power required for the operation of the computing unit 701 and the NFC communication interface), and the computing unit 701 can return the embedded identity data.
  • the identity data is sent to the client computer device 10.
  • the communication module 102 may be a contact IC card reader, and the user may insert the identity document 20 into the communication module 102 even if the communication module 102 contacts the computing unit 200. In this way, the client computer device 10 can obtain the embedded identity data from the computing unit 200.
  • Step S14 The processing module 100 compares whether the parsed identity data obtained through optical recognition and the embedded identity data obtained through electronic communication are consistent (for example, whether the content completely matches or partially matches).
  • the processing module 100 determines that the identity data and the embedded identity data are completely consistent with each other, but it is not limited thereto.
  • the processing module 100 can determine that the two are consistent.
  • the processing module 100 compares and analyzes whether the mechanically readable code 704 in the identity data matches the mechanically readable code recorded in the embedded identity data.
  • the processing module 100 decodes and parses the mechanically readable code 704 in the identity data into multiple field data, and compares the multiple parsed field data obtained by the decoding with the multiple records recorded in the embedded identity data. Whether the embedded field data matches.
  • step S15 If the processing module 100 compares and analyzes the identity data to match the embedded identity data, step S15 is executed. Otherwise, the processing module 100 executes step S17.
  • Step S15 The processing module 100 sets the user's identity data according to the parsed identity data and the embedded identity data.
  • the processing module 100 can directly set the resolved identity data as the user's identity data, or directly set the embedded identity data as the user's identity data. Since errors may occur in the optical character recognition and identity analysis processing, when the embedded identity data is directly set as the user’s identity data, it can avoid the above processing errors that cause the incorrect identity data to be set.
  • Step S16 The processing module 100 performs identity registration according to the set user's identity data.
  • the user's identity data is uploaded to the network 30 or stored in the storage module 106, which is not limited.
  • step S14 if the processing module 100 compares and analyzes the identity data and the embedded identity data does not match, then execute step S17: the processing module 100 sends out an error prompt (such as issuing a warning sound or displaying an error message) via the man-machine interface 105 to indicate User registration fails, that is, the content of the identity information page of the identity document 20 does not match the data of the computing unit 200.
  • the identity document 20 may be forged, or the resolved identity data obtained by optical recognition may be wrong.
  • the present invention can effectively ensure the authenticity of the registered user through double verification of the identity certificate for registration, and prevent malicious users from using forged certificates to register or input forged identity data.
  • FIG. 3 is a flowchart of identity access control according to the second embodiment of the present invention. Specifically, the user can use the quick authentication function after completing the registration of the identity data.
  • the access control process of this embodiment includes the following steps to implement the fast authentication function.
  • Step S20 The processing module 100 of the client computer device 10 switches to the access control mode according to the user's operation (or when the specified conditions are met) to start the quick identity authentication for the user.
  • Step S21 The processing module 100 determines whether an identity access request from the requesting computer device 32 is received.
  • the networking module 103 of the user-side computer device 10 can connect to the request-side computer device 32 (such as a server of a shopping website or other service website) via a network 30.
  • the request-side computer device 32 such as a server of a shopping website or other service website
  • the requesting computer device 32 may generate an identity access request to request the user's identity data from the client computer device 10 to verify the user's identity.
  • step S22 is executed. Otherwise, the processing module 100 executes step S21 again.
  • Step S22 The processing module 100 performs identity verification on the current user to confirm whether the current user is the registered user himself.
  • the aforementioned identity verification can be biometric verification (such as fingerprint recognition, iris recognition, vein recognition, etc.), facial image verification (that is, comparing the current user's face image with the pre-stored registered Whether the user’s face image matches), password verification (such as checking whether the string password or graphic password entered by the current user matches the default string password or graphic password), operation verification (comparing the current user’s input Whether the operation behavior is consistent with the preset operation behavior, such as pressing a designated button) or question and answer verification (such as displaying the default question, and judging whether the answer answered by the current user is correct).
  • biometric verification such as fingerprint recognition, iris recognition, vein recognition, etc.
  • facial image verification that is, comparing the current user's face image with the pre-stored registered Whether the user’s face image matches
  • password verification such as checking whether the string password or graphic password entered by the current user matches the default string password or graphic password
  • operation verification comparing the current user’s input Whether the operation behavior is consistent with the preset operation behavior, such as
  • the aforementioned identity verification may be a software lock (such as a screen lock) of the client computer device 10, for example, when the client computer device 10 has unlocked the screen, it is determined that the current user passes the identity verification.
  • a software lock such as a screen lock
  • step S23 is executed. Otherwise, the processing module 100 executes step S26.
  • Step S23 The processing module 100 obtains the previously registered identity data of the user who has passed the identity verification.
  • Step S24 The processing module 100 generates returned identity data according to the user's identity data and the identity access request.
  • the identity data report includes multiple field data (such as photo, name, date of birth, address, etc.).
  • the processing module 100 selects parts of multiple field data according to the identity access request, and uses the selected field data to generate returned identity data. In this way, it is possible to avoid providing unnecessary field data, which may cause the outflow of other identity data of the user.
  • Step S25 The processing module 100 returns the generated return identity data to the requesting computer device 32. Then, the requesting computer device 32 authenticates the user according to the received identity data, and after the authentication is passed, authorizes the user to use the website service.
  • step S26 is executed: the processing module 100 issues an error prompt via the man-machine interface 105 to indicate that the identity verification has failed, that is, the current user is not a registered user. Moreover, in this case, the processing module 100 does not generate or transmit the returned identity data of the registered user to the requesting computer device 32 to avoid the outflow of the identity data of the registered user.
  • FIG. 8 is a first schematic diagram of an identity access control operation according to an embodiment of the present invention
  • FIG. 9 is a second schematic diagram of an identity access control operation according to an embodiment of the present invention.
  • Figures 8 and 9 are used to exemplarily illustrate an implementation of the quick authentication function of the present invention.
  • the user can operate the image capturing module 101 of the client computer device 10 to capture the two-dimensional barcode 60 to obtain the input barcode image 61, and decode the input barcode image 61 to obtain the identity access request.
  • the client computer device 10 can parse the identity access request, and display the information 62 obtained by the analysis (such as the name of the requester, the requested field data, whether the requester has passed the verification, etc.) on the display module 40.
  • the information 62 obtained by the analysis such as the name of the requester, the requested field data, whether the requester has passed the verification, etc.
  • the client computer device 10 also provides a consent request button 63. After the user passes the identity verification, the user can directly press the consent request button 63 to allow identity access, that is, send back identity data to the requesting computer device 32.
  • the requesting computer device 32 determines that the returned identity data is authenticated, it can display the authentication result information 64 (such as login completion), and allow the external computer device 5 to use the service. In this way, the user does not need to manually register on the requesting computer device 32 to complete the identity authentication and use the service.
  • the present invention provides identity data only after the user passes the identity verification, which can improve the security of identity access control.
  • the present invention provides real user identity data required by the website through a third-party authentication method, which can greatly simplify the authentication procedure, allow users to quickly use the services of the website, and eliminate the registration of fake accounts.
  • FIG. 4 is a flowchart of identity registration according to the third embodiment of the present invention.
  • different implementations are proposed for user authentication.
  • the registration process of this embodiment includes the following steps.
  • Step S30 the client computer device 10 switches to the registration mode.
  • Step S31 The processing module 100 obtains the identity image of the user's identity certificate via the image capturing module 101.
  • Step S32 The processing module 100 performs optical character recognition processing and identity analysis processing on the identity image to obtain parsed identity data.
  • Step S33 The processing module 100 obtains the embedded identity data through the communication module 102's own certificate.
  • the embedded identity data further includes embedded facial images and/or embedded biological features.
  • Step S34 The processing module 100 captures a user through the image capturing module 101 to obtain a facial image of the user.
  • Step S35 The processing module 100 captures the user's biometric characteristics of the user via the biometric capture module.
  • the client computer device 10 further includes a biometric capture module 104 (such as a fingerprint recognition module, an iris recognition module, a vein recognition module, etc.) electrically connected to the processing module 100.
  • the biometric feature extraction module 104 can be used to capture the user's biometric feature (fingerprint feature, iris feature, vein feature, etc.).
  • Step S36 The processing module 100 compares whether the embedded identity data conforms to the analytic identity data and is consistent with the user (for example, whether the user's facial image conforms to the embedded facial image of the embedded identity data, and/or whether the user's biological characteristics match Embedded biometrics with embedded identity data).
  • step S37 If the processing module 100 determines that the data matches, step S37 is executed. Otherwise, the processing module 100 executes step S39.
  • Step S37 The processing module 100 sets the identity data of the user according to the embedded identity data.
  • Step S38 The processing module 100 performs identity registration according to the set user's identity data.
  • step S39 the processing module 100 issues an error prompt via the human-machine interface 105.
  • the present invention can effectively improve the verification security and effectively determine whether the current user is alive (that is, avoid using electronic data to counterfeit registration).
  • FIG. 5 is a partial flow chart of identity registration according to a fourth embodiment of the present invention
  • Figure 10 is an embodiment of saving identity according to the present invention.
  • FIG. 11 is a schematic diagram of saving identity data according to an embodiment of the present invention
  • FIG. 12 is a schematic diagram of saving identity data according to an embodiment of the present invention.
  • step S14 of the registration process further includes steps S40-S41
  • step S16 further includes steps S42-S44.
  • the client computer device 10 can perform the following steps after obtaining the resolved identity data (step S12) and the embedded identity data (step S13).
  • Step S40 The processing module 100 performs encryption processing on the multiple analytical field data of the analytical identity data to generate analytical ciphertext data.
  • the aforementioned encryption processing is irreversible encryption, such as hash processing.
  • the processing module 100 performs hash processing on the parsed identity data to obtain a set of hash values as parsed ciphertext data.
  • the processing module 100 performs hash processing on the multiple analytical field data of the parsed identity data to obtain multiple sets of hash values, and then generates parsed ciphertext data based on the multiple sets of hash values (for example, for multiple sets of hash values). The value is hashed again).
  • Step S41 The processing module 100 compares the parsed ciphertext data with the embedded ciphertext data of the embedded identity data to determine whether the parsed identity data matches the embedded identity data.
  • the processing module 100 can obtain a set of public keys according to the embedded identity data (for example, obtained through public key infrastructure (PKI)), and compare whether the public key is the same as the ciphertext data and the embedded ciphertext data. Match to determine the authenticity of the identity document 20.
  • PKI public key infrastructure
  • step S15 If the processing module 100 matches the data, the client computer device 10 sets the user's identity data according to the embedded identity data (or parsed identity data) (step S15). If the comparison data by the processing module 100 does not match, step S17 is executed to issue an error prompt.
  • the processing module 100 may set multiple field data of the user's identity data according to one or more embedded field data of the embedded identity data.
  • the client computer device 10 executes at least one of the following steps S42-S44 to register the user's identity data.
  • Step S42 The networking module 103 can connect to the cloud server 31 or the blockchain 33 via the network 30, and the processing module 100 can encrypt the user's identity data into ciphertext identity data, and upload the ciphertext identity data to the blockchain 33 or the cloud Server 31.
  • Step S43 The processing module 100 encrypts the user's identity data into ciphertext identity data via the security module 107 of the client computer device 10, and stores the ciphertext identity data in the storage module 106 of the client computer device 10.
  • the client computer device 10 further includes a security module 107 (such as a Titan M chip of Google) that is electrically connected to the processing module 100.
  • the security module 107 is set independently and can operate independently without being restricted by the processing module 100.
  • the security module 107 can be used to independently encrypt the smart data (such as identity data) stored in the storage module 106 to generate encrypted data (such as ciphertext identity data), or to decrypt the encrypted data to restore it to unidentified data. Encrypted smart data. Since the processing module 100 cannot know the encryption algorithm and key of the smart data, and cannot decrypt the encrypted data by itself, this further improves the security of the data.
  • the client computer device 10 further includes a security input module 108 (such as a physical button or sensor) electrically connected to the security module 107.
  • the security module 107 performs encryption or decryption on data only after the security input module 108 is triggered. Since the security input module 108 is not connected to the processing module 100, the processing module 100 cannot simulate the trigger signal of the security input module 108 in a software manner to trick the security module 107 into performing encryption/decryption, which further improves data security.
  • the client computer device 10 is provided with a security module 82 and a security input module 820 (herein, a physical button).
  • a security input module 820 herein, a physical button.
  • the user can directly press the security input module 820 to control the security module 82 to perform encryption or decryption, instead of performing encryption or decryption through the processing module 100. Decrypted.
  • Step S44 The processing module 100 transmits the user's identity data to the arithmetic unit 210 of the user's identity registration card 21 via the communication module 102 to encrypt and store the user's identity data in the arithmetic unit 210.
  • the identity access control system 1 may include an identity registration card 21.
  • the identity registration card 21 includes an arithmetic unit 210.
  • the user-end computer device 10 can store the obtained user's identity data in the identity chip 210 of the identity registration card 21 via the communication module 102.
  • the present invention can avoid the leakage of the user's identity data due to the loss of the client computer device 10 by storing the identity data in the independent identity registration card 21.
  • the identity registration card 21 may include a communication interface electrically connected to the computing unit 210.
  • the aforementioned communication interface adopts a communication technology compatible with the communication module 102, and can perform data communication with the communication module 102.
  • the identity registration card 21 may further include a verification input module 211 and an indication module 212 electrically connected to the computing unit 210.
  • the verification input module 211 (such as a fingerprint recognition module, a key set or other input modules that can generate different input signals) is used to accept user verification input (such as fingerprint or password input) for the computing unit 210 to verify whether the input is correct (such as with The pre-stored fingerprint or password matches). If the arithmetic unit 210 verifies that the input is correct, the identity registration card 21 may be allowed to receive and store the identity data from the receiving client computer device 10, or read and transmit the user's identity data to the identity data.
  • the identity registration card 80 includes an NFC communication interface.
  • the identity registration card 80 can be brought close to the communication module 102 of the client computer device 10 to establish an NFC connection.
  • the user can input a password (such as a fingerprint or a string password) via the input module 801 of the identity registration card 80.
  • the arithmetic unit 800 of the identity registration card 80 can allow the client computer device 10 to read (in the access control mode) or write (in the registration mode) the identity data when verifying that the password is correct.
  • the identity registration card 81 is a detachable connection to the communication module 102.
  • the identity registration card 81 When the user inserts the identity registration card 81 into the communication module 102, the aforementioned identity data reading and writing function can be realized.
  • the present invention can provide a variety of ways to safely store the user's identity data, which can improve information security and prevent identity data from being stolen.
  • FIG. 6 is a flowchart of identity access control according to the fifth embodiment of the present invention.
  • the access control process of this embodiment includes the following steps to implement the fast authentication function.
  • Step S50 The processing module 100 of the client computer device 10 switches to the access control mode.
  • Step S51 The processing module 100 determines whether the processing module 100 receives an identity access request from the requesting computer device 32.
  • step S52 is executed. Otherwise, the processing module 100 executes step S51 again.
  • Step S52 The processing module 100 parses the identity access request to extract the requester digital signature of the identity access request, and performs requester verification on the requester digital signature, that is, verifies whether the requester digital signature is legally authenticated or is valid.
  • step S53 is executed. Otherwise, the processing module 100 executes step S58.
  • Step S53 The processing module 100 The processing module 100 performs identity verification on the current user.
  • step S54 If the processing module 100 determines that the current user passes the identity verification, step S54 is executed. Otherwise, the processing module 100 executes step S58.
  • Step S54 The processing module 100 obtains the ciphertext identity data corresponding to the user, and decrypts the ciphertext identity data to obtain plaintext identity data.
  • the processing module 100 obtains the ciphertext identity data corresponding to the user from the blockchain 33 or the cloud server 31, and uses a decryption key to decrypt the ciphertext identity data to obtain the plaintext identity data.
  • Identity data is a decryption key to decrypt the ciphertext identity data to obtain the plaintext identity data.
  • the processing module 100 reads the ciphertext identity data corresponding to the user from the storage module 106 of the client computer device 10, and (in the secure input module 108 (or secure input module) 820) When triggered) the ciphertext identity data is decrypted via the security module 107 (or the security module 82) of the client computer device 10 to obtain the plaintext identity data.
  • the processing module 100 is connected to the identity registration card 21 (or identity registration cards 80, 81) via the communication module 102, and the computing unit 210 (or identity registration).
  • the arithmetic unit 800 of the card 80 determines that the current user passes the identity verification, decrypts the stored ciphertext identity data to obtain the plaintext identity data, and transmits the plaintext identity data to the client computer device 10 via the communication module 102.
  • Step S55 The processing module 100 selects multiple field data parts of the user's identity data according to the identity access request.
  • Step S56 The processing module 100 generates returned identity data according to the selected partial field data.
  • Step S57 The processing module 100 returns the generated return identity data to the requesting computer device 32.
  • the selected part of the multiple field data is recorded in the returned identity data in a plaintext or reversible encryption method.
  • step S58 the processing module 100 sends an error prompt via the man-machine interface 105 to indicate that the requesting end has failed the verification or the identity verification has failed.
  • the present invention can ensure the authenticity of the requester and reduce the risk of identity data theft.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Collating Specific Patterns (AREA)

Abstract

本发明提出一种用于第三方认证的身分的注册与接入控制方法，包括注册步骤与接入控制步骤。注册步骤包括：于控制用户端计算机设备取得用户的身分证件的身分影像；对身分影像执行处理以获得解析身分数据；自身分证件取得内嵌身分数据；于比对数据相符时设定并注册身分数据。接入控制步骤包括：控制用户端计算机设备于收到来自身分接入请求时，对用户进行身分验证；于用户通过身分验证时，产生并回传对应的回传身分数据至请求端计算机设备。本发明可有效确保注册用户的真实性，杜绝假账号的注册，大幅简化注册流程，并提升身分接入控制的安全性。

Description

用于第三方认证的身分的注册与接入控制方法 技术领域
本发明与身分认证有关，特别有关于用于第三方认证的身分的注册与接入控制方法。
背景技术
于现有身分注册方式(如购物网站或其他服务网站的会员注册)中，多是由用户自行输入身分数据来完成注册。上述注册方式由于无法验证用户输入的身分数据进行真实性，而无法杜绝假账号的注册。
目前另有一种注册方式，用户必须于注册时提供身分证件的影像，以供验证所输入身分数据的真实性。上述注册方式由于无法验证身分证件的影像的真实性，并无法确认用户是否确实持有此身分证件，同样无法杜绝假账号的注册。
此外，于现有身分接入控制方式中，各个网站间并不能共享会员数据，这使得当用户欲使用不同网站的服务时，不仅需重新注册来达成身分认证，还必须同时记得多个网站的账号密码，这对用户造成相当大的不便。
是以，现有身分注册与接入控制方式存在上述问题，而亟待更有效的方案被提出。
发明内容
本发明的主要目的，在于提供一种用于第三方认证的身分的注册与接入控制方法，可于注册过程中确认用户是否确实持有用于注册的身分证件，并可于数据接入控制过程中以第三方认证方式来提供用户的真实的身分数据给网站。
为达上述目的，本发明提供一种用于第三方认证的身分的注册与接入控制方法，包括以下步骤：于注册模式下于用户端计算机设备取得用户的身分证件的身分影像，其中身分影像是经由影像撷取模块拍摄身分证件的身分数据页所获得；对身分影像执行光学文字识别处理及身份解析处理以获得解析身分数据；经由用户端计算机设备的通信模块自身分证件取得内嵌身分数据；于比对解析身分数据与内嵌身分数据至少部分相符时，依据解析身分数据与内嵌身分数据的至少其中的一设定用户的身分数据并进行注册；于接入控制模式下于用户端计算机设备收到来自请求端计算机设备的身分接入请求时，对当前的用户进行身分验证；及，于当前的用户通过身分验证时，依据用户的身分数据及身分接入请求产生回传身分数据，并 回传至请求端计算机设备。
本发明可有效确保注册用户的真实性，杜绝假账号的注册，大幅简化认证流程，并可提升身分接入控制的安全性。
附图说明
图1为本发明一实施例的身分接入控制***的架构图。
图2为本发明第一实施例的身分注册的流程图。
图3为本发明第二实施例的身分接入控制的流程图。
图4为本发明第三实施例的身分注册的流程图。
图5为本发明第四实施例的身分注册的部分流程图。
图6为本发明第五实施例的身分接入控制的流程图。
图7为本发明一实施例的身分注册操作的示意图。
图8为本发明一实施例的身分接入控制操作的第一示意图。
图9为本发明一实施例的身分接入控制操作的第二示意图。
图10为本发明一实施例的保存身分数据的示意图。
图11为本发明一实施例的保存身分数据的示意图。
图12为本发明一实施例的保存身分数据的示意图。
组件标号说明：
1…身分接入控制***
10…用户端计算机设备
100…处理模块
101…影像撷取模块
102…通信模块
103…连网模块
104…生物特征撷取模块
105...人机界面
106…存储模块
1060…计算机程序
107…安全模块
108…安全输入模块
20…身分证件
200…运算单元
21…身分注册卡
210…运算单元
211…验证输入模块
212…指示模块
30…网络
31…云端服务器
32…请求端计算机设备
33…区块链
40…显示模块
5…外部计算机设备
60-61...影像
62、64...信息
63…按键
70…身分证件
701…运算单元
702...照片
703…字段数据
704…机械可读取码
71...影像
80…身分注册卡
800…运算单元
801…输入模块
81…身分注册卡
82...安全模块
820…安全输入模块
S10-S17…第一注册步骤
S20-S26…第一接入控制步骤
S30-S39…第二注册步骤
S40-S41…数据比对步骤
S42-S44…注册步骤
S50-S58…第二接入控制步骤
具体实施方式
以下在实施方式中详细叙述本发明的详细特征以及优点，其内容足以使任何熟习相关技艺者了解本发明的技术内容并据以实施，且根据本说明书所揭露的内容、权利要求书及说明书附图，任何熟习相关技艺者可轻易地理解本发明相关的目的及优点。以下的实施例进一步详细说明本发明的观点，但非以任何观点限制本发明的范畴。
请参阅图1，为本发明一实施例的身分接入控制***的架构图。本发明公开了一种身分接 入控制***1，可用来执行后述的用于第三方认证的身分的注册与接入控制方法。身分接入控制***1可接受用户注册并验证用户所提供的身分证件的真实性，以取得用户的真实的身分数据。并且，身分接入控制***1还可提供第三方认证功能，来提供用户的真实的身分数据至指定的请求端计算机设备32(如网站的注册服务器)以快速地完成身分认证，而使用户不须进行手动注册即可使用请求端计算机设备32所提供的服务。
值得一提的是，于本发明中，使用者所持有的身分证件20设置有运算单元200(如芯片护照或是芯片身分证)，而不是单纯纸本证件。前述运算单元200存储有用户的电子的身分数据(如姓名、出生日期、证件编号及/或国籍等等，即内嵌身分数据)。
并且，前述运算单元200所存储的内嵌身分数据报括身分证件20以印刷方式呈现的内容(即身分证件20的内嵌身分数据页所记载的内容)的全部或部分。
在一实施例中，运算单元200还可存储身分证件20未以印刷方式呈现的内容(如指纹特征或虹膜特征之类的用户生物特征，或用户的地址或电话号码之类的个人数据等等)。
身分接入控制***1包括用户端计算机设备10。用户端计算机设备10(如智能型手机、穿戴式设备、平板计算机、笔记本电脑等等)可由用户所持有，并可包括影像撷取模块101、通信模块102、连网模块103及电性连接上述模块的处理模块100。
影像撷取模块101(如照相机)用以拍摄外部影像。通信模块102用以与外部设备(如身分证件20的运算单元200)建立近距离(包括接触式)通信。连网模块103(如行动网络模块、Wi-Fi模块或以太网络模块)用以连接网络30(如因特网)以进行数据通信。处理模块100用以控制用户端计算机设备10。
在一实施例中，通信模块102可为无线近距离通信模块，如NFC模块、蓝牙模块、超音波模块等等，或者为接触式通信模块，如接触式IC卡卡片阅读机。并且，身分证件20可包括电性连接运算单元200的通信接口。前述通信接口是采用与通信模块102兼容的通信技术，而可与通信模块102进行数据通信。
本发明经由采用近距离通信来取得身分证件20的运算单元200所存储的内嵌身分数据，可确保用户确实持有身分证件20，而避免身分证件20的盗用。
在一实施例中，用户端计算机设备10更包括电性连接处理模块100的人机接口105(如按键模块、触控模块等输入模块及/或显示模块、指示灯等输出模块)。人机接口105用以接受用户操作并提供用户信息。
在一实施例中，用户端计算机设备10更包括电性连接处理模块100的存储模块106。存储模块106用以存储数据。
在一实施例中，存储模块106可包括非瞬时存储媒体，前述非瞬时存储媒体存储有计算机程序1060(如应用程序)，计算机程序1060包括有计算机可执行程序代码。处理模块100通过执行前述计算机可执行程序代码，可进一步实现本发明各实施例的方法。
本发明的用于第三方认证的身分的注册与接入控制方法主要包括注册流程(即后述的注册模式)与接入控制流程(即后述的注册模式)。以下将分别就注册流程与接入控制流程进行说明。
续请同时参阅图1、图2及图7，图2为本发明第一实施例的身分注册的流程图，图7为本发明一实施例的身分注册操作的示意图。本实施例的注册流程包括以下步骤。
步骤S10：用户端计算机设备10依据用户操作(或于指定条件满足时)切换至注册模式，以开始为用户进行身分注册。
步骤S11：处理模块100取得用户的身分证件的身分影像。
在一实施例中，如图7所示，用户所拥有的身分证件70可设置有运算单元701(运算单元701是与前述运算单元200相同或相似，于此不再赘述)，并有印刷形式的身分数据页。身分数据页可包括用户的照片702、用户的身分数据的多个字段数据703(以图7为例，姓名为Andy Lee，发照地为Taipei City，出生日期为1980年1月1日)。用户可操作用户端计算机设备10使用影像撷取模块101拍摄身分证件70的身分数据页以获得身分影像71。并且，用户端计算机设备10可经由人机接口105(图7以显示模块40为例)实时显示所拍摄的身分影像71以供用户确认影像质量。
在一实施例中，身分证件70的身分数据页可进一步记载一组机械可读取码704。机械可读取码704(如对加密多个字段数据703进行编码所产生)是用以验证字段数据703的真实性的防伪机制，其具体验证方式将于后续进行说明。
步骤S12：处理模块100对所获得的身分影像执行光学文字识别处理以识别身分影像71中的多个字符与其排列方式，并进一步对所示别出的多个字符与其排列方式执行身份解析处理以经由分析多个字符与其排列方式来获得解析身分数据，即前述的解析身分数据是记录有多个字段数据703及/或机械可读取码704。
步骤S13：处理模块100经由通信模块102自身分证件取得内嵌身分数据。
在一实施例中，如图7所示，通信模块102可为NFC模块(亦可改为RFID模块)，身分证件70可包括电性连接运算单元701的NFC通信接口。用户可于通信模块102被致能后将身分证件70靠近通信模块102以进行近场感应通信。藉此，处理模块100可经由通信模块102及NFC通信界面向运算单元701请求内嵌身分数据(并提供运算单元701与NFC通信接口运作所需电力)，并且，运算单元701可回传内嵌身分数据至用户端计算机设备10。
在一实施例中，通信模块102可为接触式IC卡卡片阅读机，用户可将身分证件20***通信模块102，即使通信模块102接触运算单元200。藉此，用户端计算机设备10可自运算单元200取得内嵌身分数据。
步骤S14：处理模块100比对经由光学识别所获得的解析身分数据与经由电子通信所获得的内嵌身分数据是否相符(如比较内容是否完全相符或部分相符)。
在一实施例中，处理模块100是与解析身分数据与内嵌身分数据完全相符时才判定两者相符，但不以此限定。
在一实施例中，只要解析身分数据与内嵌身分数据有相符时(即有部分数据内容是重复的)，处理模块100便可判定两者相符。
在一实施例中，如图7所示，处理模块100是比对解析身分数据中的机械可读取码704与内嵌身分数据所记录的机械可读取码是否相符。
在一实施例中，处理模块100是译码解析身分数据中的机械可读取码704为多个字段数据，并比较译码获得的多个解析字段数据与内嵌身分数据所记录的多个内嵌字段数据是否相符。
若处理模块100比对解析身分数据与内嵌身分数据相符，则执行步骤S15。否则，处理模块100执行步骤S17。
步骤S15：处理模块100依据解析身分数据与内嵌身分数据设定用户的身分数据。
具体而言，处理模块100可将解析身分数据直接设定为用户的身分数据，或将内嵌身分数据直接设定为用户的身分数据。由于光学文字辨识与身分解析处理有可能发生错误，当直接将内嵌身分数据设定为用户的身分数据时，可避免上述处理错误造成设定了错误的身分数据。
步骤S16：处理模块100依据所设定用户的身分数据进行身分注册，如将此用户的身分数据上传至网络30或者存储于存储模块106，不加以限定。
于步骤S14中，若处理模块100比对解析身分数据与内嵌身分数据不符，则执行步骤S17：处理模块100经由人机接口105发出错误提示(如发出警示声或显示错误信息)，以指示用户注册失败，即身分证件20的身分信息页的内容与运算单元的200的数据不符，如身分证件20可能是伪造的，或是光学识别所获得的解析身分数据可能有误。
本发明经由对注册用的身分证件进行双重验证可有效确保注册用户的真实性，避免恶意用户使用伪造证件进行注册或输入伪造的身分数据。
续请同时参阅图1及图3，图3为本发明第二实施例的身分接入控制的流程图。具体而言， 用户于完成身分数据的注册后，即可使用快速认证功能。本实施例的接入控制流程包括用以实现快速认证功能的以下步骤。
步骤S20：用户端计算机设备10的处理模块100依据用户操作(或于指定条件满足时)切换至接入控制模式，以开始为用户进行身分的快速认证。
步骤S21：处理模块100判断是否收到来自请求端计算机设备32的身分接入请求。
具体而言，如图1所示，用户端计算机设备10的连网模块103可经由网络30连接请求端计算机设备32(如购物网站或其他服务网站的服务器)。当用户欲使用服务而必须进行身分认证(如登入网站)时，请求端计算机设备32可产生身分接入请求来向用户端计算机设备10请求用户的身分数据以认证用户的身分。
若处理模块100收到来自请求端计算机设备32的身分接入请求时，则执行步骤S22。否则，处理模块100再次执行步骤S21。
步骤S22：处理模块100对当前的用户进行身分验证以确认当前的用户是否为已注册的用户本人。
在一实施例中，前述身分验证可为生物特征验证(如指纹辨识、虹膜辨识、静脉辨识等等)、人脸影像验证(即比对当前的用户的人脸影像与预存的为已注册的用户人脸影像是否相符)、密码验证(如比对当前的用户所输入的字符串密码或图形密码是否与默认的字符串密码或图形密码相符)、操作验证(比对当前的用户所输入的操作行为是否与预设的操作行为相符，如按压指定的按键)或问答验证(如显示默认的问题，并判断当前的用户所回答的答案是否正确)。
在一实施例中，前述身分验证可为用户端计算机设备10的软件锁(如屏幕锁定)，如于用户端计算机设备10已解除屏幕锁定时判定当前的用户通过身分验证。
若处理模块100判断当前的用户通过身分验证，则执行步骤S23。否则，处理模块100执行步骤S26。
步骤S23：处理模块100取得已通过身分验证的用户先前注册的身分数据。
步骤S24：处理模块100依据用户的身分数据及身分接入请求产生回传身分数据。
在一实施例中，身分数据报括多个字段数据(如照片、姓名、出生日期、住址等等)。处理模块100是依据身分接入请求选择多个字段数据的部分，并以所选择的字段数据来产生回传身分数据。藉此，可避免提供非必要的字段数据，而造成用户的其他身分数据外流。
步骤S25：处理模块100回传所产生的回传身分数据至请求端计算机设备32。接着，请求端计算机设备32依据所收到的回传身分数据对用户进行认证，并于认证通过后，授权用户使用网站服务。
若处理模块100判断当前的用户未通过身分验证，则执行步骤S26：处理模块100经由人机接口105发出错误提示，以指示身分验证失败，即当前的用户并非已注册的用户。并且，于此情况下，处理模块100不会产生或传送已注册用户的回传身分数据至请求端计算机设备32，以避免已注册用户的身分数据外流。
请同时参阅图8及图9，图8为本发明一实施例的身分接入控制操作的第一示意图，图9为本发明一实施例的身分接入控制操作的第二示意图。图8及图9用以示例性说明本发明的快速认证功能的一种实施方式。
首先，如图8所示，当用户希望于使用外部计算机设备5(如台式计算机)使用请求端计算机设备32的服务时，需先进行身分认证，请求端计算机设备32可将前述身分接入请求嵌入于二维条形码60中(亦可改用其他机械可读取格式)并传送至外部计算机设备5以显示于外部计算机设备5的显示器。
接着，用户可操作用户端计算机设备10的影像撷取模块101拍摄二维条形码60以获得输入条形码影像61，并对输入条形码影像61进行译码以获得身分接入请求。
接着，如图9所示，用户端计算机设备10可解析身分接入请求，并将解析获得的信息62(如请求者名称、请求的字段数据、请求者是否通过验证等等)显示于显示模块40。
更进一步地，用户端计算机设备10还提供同意请求键63，当用户通过身分验证后可直接按下同意请求键63来允许身分接入，即发送回传身分数据至请求端计算机设备32。
最后，请求端计算机设备32于判断回传身分数据通过认证后，可显示认证结果信息64(如登入完成)，并允许外部计算机设备5使用服务。藉此，用户不须手动于请求端计算机设备32进行注册也可完成身分认证并使用服务。
本发明经由于用户通过身分验证后才提供身分数据，可提升身分接入控制的安全性。
并且，本发明经由以第三方认证方式来提供网站所需的真实的用户的身分数据，可大幅简化认证程序，让用户快速使用网站的服务，并杜绝假账号的注册。
续请同时参阅图1及图4，图4为本发明第三实施例的身分注册的流程图。于本实施例中，对于用户的本人验证提出了不同的实施方式。本实施例的注册流程包括以下步骤。
步骤S30：用户端计算机设备10切换至注册模式。
步骤S31：处理模块100经由影像撷取模块101取得用户的身分证件的身分影像。
步骤S32：处理模块100对身分影像执行光学文字识别处理及身份解析处理以获得解析身分数据。
步骤S33：处理模块100经由通信模块102自身分证件取得内嵌身分数据。
在一实施例中，内嵌身分数据更包括内嵌脸部影像及/或内嵌生物特征。
步骤S34：处理模块100经由影像撷取模块101拍摄用户以获得用户脸部影像。
步骤S35：处理模块100经由生物特征撷取模块撷取用户的用户生物特征。
具体而言，如图1所示，用户端计算机设备10更包括电性连接处理模块100的生物特征撷取模块104(如指纹辨识模块、虹膜辨识模块或静脉辨识模块等等)。生物特征撷取模块104可用来撷取用户的生物特征(指纹特征、虹膜特征或静脉特征等等)。
步骤S36：处理模块100比对内嵌身分数据是否符合解析身分数据，且与用户本人相符(如用户脸部影像是否符合内嵌身分数据的内嵌脸部影像、及/或用户生物特征是否符合内嵌身分数据的内嵌生物特征)。
若处理模块100判断数据相符时，则执行步骤S37。否则，处理模块100执行步骤S39。
步骤S37：处理模块100依据内嵌身分数据设定此用户的身分数据。
步骤S38：处理模块100依据所设定用户的身分数据进行身分注册。
若处理模块100判断数据不符时，则执行步骤S39：处理模块100经由人机接口105发出错误提示。
本发明经由结合用户的脸部与生物特征进行验证，可有效提升验证安全性，并有效判断当前用户是否为活体(即避免使用电子数据来仿冒注册)。
续请同时参阅图1、图2、图5、图10、图11及图12，图5为本发明第四实施例的身分注册的部分流程图，图10为本发明一实施例的保存身分数据的示意图，图11为本发明一实施例的保存身分数据的示意图，图12为本发明一实施例的保存身分数据的示意图。相较于图2所示的注册流程，于本实施例中，注册流程的步骤S14更包括步骤S40-S41，步骤S16更包括步骤S42-S44。
具体而言，用户端计算机设备10于取得解析身分数据(步骤S12)及取得内嵌身分数据(步骤S13)后可执行以下步骤。
步骤S40：处理模块100对解析身分数据的多个解析字段数据执行加密处理以产生解析密文数据。
在一实施例中，前述加密处理是不可逆的加密，如哈希(hash)处理。处理模块100是对解析身分数据执行哈希处理来获得一组哈希值(hash value)并作为解析密文数据。
更进一步地，处理模块100是对解析身分数据的多个解析字段数据分别执行哈希处理来获得多组哈希值，再依据多组哈希值产生解析密文数据(如对多组哈希值再执行一次哈希处理)。
步骤S41：处理模块100比对解析密文数据与内嵌身分数据的内嵌密文数据是否相符，以判断解析身分数据与内嵌身分数据是否相符。
在一实施例中，处理模块100可依据内嵌身分数据取得一组公钥(如经由公钥基础建设(PKI)取得)，并比对公钥是否与解析密文数据及内嵌密文数据相符，以判断身分证件20的真实性。
若处理模块100比对数据相符，则用户端计算机设备10依据内嵌身分数据(或解析身分数据)来设定用户的身分数据(步骤S15)。若处理模块100比对数据不符，则执行步骤S17以发出错误提示。
在一实施例中，处理模块100可依据内嵌身分数据的一或多个内嵌字段数据设定用户的身分数据的多个字段数据。
于设定完成，用户端计算机设备10接着执行以下步骤S42-S44的至少其中之一来对用户的身分数据进行注册。
步骤S42：连网模块103可经由网络30连接云端服务器31或区块链33，处理模块100可加密用户的身分数据为密文身分数据，并将密文身分数据上传至区块链33或云端服务器31。
步骤S43：处理模块100经由用户端计算机设备10的安全模块107加密用户的身分数据为密文身分数据，并将密文身分数据存储于用户端计算机设备10的存储模块106。
具体而言，如图1所示，用户端计算机设备10更包括电性连接处理模块100的安全模块107(如Google的Titan M芯片)。安全模块107是独立设置而可独立运作不受处理模块100的限制。
于本发明中，安全模块107可用来对存储于存储模块106的机敏数据(如身分数据)进行独立加密以产生加密数据(如密文身分数据)，或者对已加密数据进行解密以还原为未加密的机敏数据。由于处理模块100并无法得知机敏数据的加密算法与密钥为何，并无法自行对加密数据进行解密，这进一步提升了数据的安全性。
在一实施例中，用户端计算机设备10更包括电性连接安全模块107的安全输入模块108(如实体按键或传感器)。安全模块107是于安全输入模块108被触发后才会对数据执行加密或解密。由于安全输入模块108并未连接处理模块100，处理模块100无法以软件方式仿真安全输入模块108的触发信号来欺骗安全模块107执行加密/解密，更进一步提升了数据的安全性。
举例来说，如图12所示，用户端计算机设备10设置有安全模块82，并设置有安全输入模块820(于此为实体按键)。当欲对数据执行加密或解密(如图9所示显示模块40的画面)时， 用户可直接按下安全输入模块820以控制安全模块82执行加密或解密，而不是经由处理模块100执行加密或解密。
步骤S44：处理模块100经由通信模块102传输用户的身分数据至用户的身分注册卡21的运算单元210以将用户的身分数据加密存储于运算单元210。
具体而言，如图1所示，身分接入控制***1可包括身分注册卡21。身分注册卡21包括运算单元210。用户端计算机设备10可经由通信模块102将所取得的用户的身分数据存储于身分注册卡21的身分芯片210。本发明经由将身分数据保存于独立的身分注册卡21，可避免因遗失用户端计算机设备10而导致用户的身分数据外泄。更进一步地，身分注册卡21可包括电性连接运算单元210的通信接口。前述通信接口是采用与通信模块102兼容的通信技术，而可与通信模块102进行数据通信。
在一实施例中，身分注册卡21可进一步包括电性连接运算单元210的验证输入模块211与指示模块212。验证输入模块211(如指纹辨识模块、按键组或其他可产生不同输入信号的输入模块)用以接受用户的验证输入(如输入指纹或密码)，以供运算单元210验证输入是否正确(如与预存的指纹或密码相符)。若运算单元210验证输入正确，则可允许身分注册卡21自接收用户端计算机设备10接收并存储身分数据，或者读取并传送用户的身分数据至身分数据。
举例来说，如图10所示，身分注册卡80包括NFC通信界面。当用户欲接入身分数据时，可将身分注册卡80靠近用户端计算机设备10的通信模块102以建立NFC联机。
接着，用户可经由身分注册卡80的输入模块801输入密码(如指纹或字符串密码)。身分注册卡80的运算单元800于验证密码正确时可允许用户端计算机设备10读取(于接入控制模式下)或写入(于注册模式下)身分数据。
于另一例子中，如图11所示，身分注册卡81是可卸式连接通信模块102。当用户将身分注册卡81***通信模块102中时，可实现前述的身分数据读写功能。
藉此，本发明可提供多种安全存放用户的身分数据的方式，而可提升信息安全，避免身分数据遭窃取。
续请同时参阅图1及图6，图6为本发明第五实施例的身分接入控制的流程图。本实施例的接入控制流程包括用以实现快速认证功能的以下步骤。
步骤S50：用户端计算机设备10的处理模块100切换至接入控制模。
步骤S51：处理模块100处理模块100判断是否收到来自请求端计算机设备32的身分接入请求。
若处理模块100收到来自请求端计算机设备32的身分接入请求时，则执行步骤S52。否 则，处理模块100再次执行步骤S51。
步骤S52：处理模块100对身分接入请求进行解析以取出身分接入请求的请求端数字签名，并对请求端数字签名进行请求端验证，即验证请求端数字签名是否经过合法认证或是否有效。
若处理模块100判断身分接入请求的请求端数字签名通过验证，则执行步骤S53。否则，处理模块100执行步骤S58。
步骤S53：处理模块100处理模块100对当前的用户进行身分验证。
若处理模块100判断当前的用户通过身分验证，则执行步骤S54。否则，处理模块100执行步骤S58。
步骤S54：处理模块100取得用户所对应的密文身分数据，并对密文身分数据进行解密以获得明文的身分数据。
在一实施例中，如图1所示，处理模块100自区块链33或云端服务器31取得用户所对应的密文身分数据，并使用解密密钥对密文身分数据进行解密以获得明文的身分数据。
在一实施例中，如图1、12所示，处理模块100自用户端计算机设备10的存储模块106读取用户所对应的密文身分数据，并(于安全输入模块108(或安全输入模块820)被触发时)经由用户端计算机设备10的安全模块107(或安全模块82)对密文身分数据进行解密以获得明文的身分数据。
在一实施例中，如图1、10、11所示，处理模块100经由通信模块102连接身分注册卡21(或身分注册卡80、81)，身分注册卡21的运算单元210(或身分注册卡80的运算单元800)判断当前的用户通过身分验证时，对所存储的密文身分数据进行解密以获得明文的身分数据，并经由通信模块102传送明文的身分数据至用户端计算机设备10。
步骤S55：处理模块100依据身分接入请求选择用户的身分数据的多个字段数据的部分。
步骤S56：处理模块100依据所选择的部分字段数据产生回传身分数据。
步骤S57：处理模块100回传所产生的回传身分数据至请求端计算机设备32。
在一实施例中，所选择的部分多个字段数据是以明文方式或可逆加密方式被记录于回传身分数据。
若处理模块100判断请求端数字签名未通过验证或用户未通过身分验证，则执行步骤S58：处理模块100经由人机接口105发出错误提示以指示请求端验证失败或身分验证失败。
藉此，本发明可确保请求端的真实性，并降低身分数据遭窃的风险。
虽然本发明以前述的实施例揭露如上，然其并非用以限定本发明。在不脱离本发明的精 神和范围内，所为的更动与润饰，均属本发明的权利要求范围。关于本发明所界定的保护范围请参考所附的权利要求书。

Claims (16)

  1. 一种用于第三方认证的身分的注册与接入控制方法，其特征为，包括以下步骤：
    a)于一注册模式下于一用户端计算机设备取得一用户的一身分证件的一身分影像，其中该身分影像是经由一影像撷取模块拍摄该身分证件的身分数据页所获得；
    b)对该身分影像执行一光学文字识别处理及一身份解析处理以获得解析身分数据；
    c)经由该用户端计算机设备的一通信模块自该身分证件取得内嵌身分数据；
    d)于比对该解析身分数据与该内嵌身分数据至少部分相符时，依据该解析身分数据与该内嵌身分数据的至少其中之一设定该用户的身分数据并进行注册；
    e)于一接入控制模式下于该用户端计算机设备收到来自一请求端计算机设备的一身分接入请求时，对当前的该用户进行一身分验证；及
    f)于当前的该用户通过该身分验证时，依据该用户的该身分数据及该身分接入请求产生回传身分数据，并回传至该请求端计算机设备。
  2. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该通信模块为一NFC模块或一蓝芽模块，该步骤c)是于该通信模块感应到该身分证件的一运算单元时，自该运算单元接收该内嵌身分数据。
  3. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该通信模块为一智能卡读写模块，该步骤c)是于该通信模块接触该身分证件的一运算单元时，自该运算单元接收该内嵌身分数据。
  4. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该解析身分数据报括多个解析字段数据；
    该步骤d)包括以下步骤：
    d1)对该解析身分数据的该多个字段数据执行一加密处理以产生解析密文数据；及
    d2)于比对该解析密文数据与该内嵌身分数据的内嵌密文数据相符时，判定该解析身分数据与该内嵌身分数据相符。
  5. 如权利要求4所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该内嵌身分数据报括多个内嵌字段数据，该步骤d)更包括以下步骤：
    d3)依据该内嵌字段数据设定该用户的该身分数据的多个字段数据；及
    d4)对该用户的该身分数据进行注册。
  6. 如权利要求5所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤d4)包括加密该用户的该身分数据为一密文身分数据，并将该密文身分数据上传至一区块链或一云端服务器。
  7. 如权利要求5所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤d4)包括经由该用户端计算机设备的一安全模块加密该用户的该身分数据为一密文身分数据，并将该密文身分数据存储于该用户端计算机设备。
  8. 如权利要求5所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤d4)包括经由该通信模块传输该用户的该身分数据至该用户的一身分注册卡的一运算单元以将该用户的该身分数据加密存储于该身分注册卡的该运算单元。
  9. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该身分验证为一生物特征验证、一人脸影像验证、一密码验证、一操作验证或一问答验证。
  10. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤f)包括以下步骤：
    f1)于当前的该用户通过该身分验证时，取得该用户所对应的一密文身分数据，并对该密文身分数据进行解密以获得明文的该身分数据；
    f2)依据该身分接入请求选择该用户的该身分数据的多个字段数据的部分；及
    f3)依据所选择的部分该多个字段数据产生该回传身分数据，并回传至该请求端计算机设备，其中所选择的部分该多个字段数据是以明文方式或可逆加密方式被记录于该回传身分数据。
  11. 如权利要求10所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤f1)包括自一区块链或一云端服务器取得该用户所对应的该密文身分数据，并使用一解密密钥对该密文身分数据进行解密以获得明文的该身分数据。
  12. 如权利要求10所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤f1) 包括自该用户端计算机设备读取该用户所对应的该密文身分数据，并经由该用户端计算机设备的一安全模块对该密文身分数据进行解密以获得明文的该身分数据。
  13. 如权利要求10所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤f1)包括于一身分注册卡的一运算单元判断当前的该用户通过该身分验证时，对所存储的该密文身分数据进行解密以获得明文的该身分数据，并经由该通信模块传送明文的该身分数据至该用户端计算机设备。
  14. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，于该步骤d)之前更包括一步骤g)于注册模式下于该用户端计算机设备经由该影像撷取模块拍摄该用户以获得一用户脸部影像；
    该步骤d)是于该解析身分数据与该内嵌身分数据相符且该用户脸部影像符合该内嵌身分数据的一内嵌脸部影像时，设定该用户的该身分数据并进行注册。
  15. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，于该步骤d)之前更包括一步骤h)于注册模式下于该用户端计算机设备经由一生物特征撷取模块撷取该用户的一用户生物特征；
    该步骤d)是于该解析身分数据与该内嵌身分数据相符且该用户生物特征符合该内嵌身分数据的一内嵌生物特征时，设定该用户的该身分数据并进行注册。
  16. 如权利要求1所述的用于第三方认证的身分的注册与接入控制方法，其特征为，该步骤f)之前更包括一步骤i)于该接入控制模式下于该用户端计算机设备收到来自该请求端计算机设备的该身分接入请求时，对该身分接入请求的一请求端数字签名进行一请求端验证；
    该步骤f)是于当前的该用户通过该身分验证且该身分接入请求通过该请求端验证时，产生该回传身分数据，并回传至该请求端计算机设备。
PCT/CN2020/094083 2020-06-03 2020-06-03 用于第三方认证的身分的注册与接入控制方法 WO2021243592A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/094083 WO2021243592A1 (zh) 2020-06-03 2020-06-03 用于第三方认证的身分的注册与接入控制方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/094083 WO2021243592A1 (zh) 2020-06-03 2020-06-03 用于第三方认证的身分的注册与接入控制方法

Publications (1)

Publication Number Publication Date
WO2021243592A1 true WO2021243592A1 (zh) 2021-12-09

Family

ID=78831636

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/094083 WO2021243592A1 (zh) 2020-06-03 2020-06-03 用于第三方认证的身分的注册与接入控制方法

Country Status (1)

Country Link
WO (1) WO2021243592A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106157025A (zh) * 2016-07-05 2016-11-23 清华大学深圳研究生院 基于身份证的移动终端安全支付方法及***
CN107682545A (zh) * 2017-09-28 2018-02-09 山西特信环宇信息技术有限公司 基于生物识别技术的人证机合一手机终端***及操作方法
CN110443740A (zh) * 2019-07-30 2019-11-12 广州大白互联网科技有限公司 一种身份认证方法及***
CN111225377A (zh) * 2018-11-23 2020-06-02 财团法人工业技术研究院 网络服务***及网络服务方法
US20200382300A1 (en) * 2019-06-03 2020-12-03 Quanhong Technology Co.,Ltd. Method of registration and access control of identity for third-party certification

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106157025A (zh) * 2016-07-05 2016-11-23 清华大学深圳研究生院 基于身份证的移动终端安全支付方法及***
CN107682545A (zh) * 2017-09-28 2018-02-09 山西特信环宇信息技术有限公司 基于生物识别技术的人证机合一手机终端***及操作方法
CN111225377A (zh) * 2018-11-23 2020-06-02 财团法人工业技术研究院 网络服务***及网络服务方法
US20200382300A1 (en) * 2019-06-03 2020-12-03 Quanhong Technology Co.,Ltd. Method of registration and access control of identity for third-party certification
EP3748522A1 (en) * 2019-06-03 2020-12-09 Quanhong Technology Co., Ltd. Method of registration and access control of identity for third-party certification
JP2020198100A (ja) * 2019-06-03 2020-12-10 チュアンホン テクノロジー カンパニー リミテッド 第三者認証に用いる身元の登録及びアクセス制御方法
KR20200139641A (ko) * 2019-06-03 2020-12-14 콴홍 테크놀로지 컴퍼니 리미티드 제 3자 검증에 사용되는 신분 등록 및 액세스 제어 방법
CN110443740A (zh) * 2019-07-30 2019-11-12 广州大白互联网科技有限公司 一种身份认证方法及***

Similar Documents

Publication Publication Date Title
CN106575326B (zh) 利用非对称加密实施一次性密码的***和方法
CN106575416B (zh) 用于向装置验证客户端的***和方法
US9124433B2 (en) Remote authentication and transaction signatures
JP6264674B2 (ja) Ｑｒコードを用いた認証システム及びその方法
US9338163B2 (en) Method using a single authentication device to authenticate a user to a service provider among a plurality of service providers and device for performing such a method
US9647840B2 (en) Method for producing a soft token, computer program product and service computer system
US20140344160A1 (en) Universal Authentication Token
CN113302894B (zh) 安全账户访问
US10855473B1 (en) Systems and methods for biometric electronic signature agreement and intention
US11665157B2 (en) Systems and methods for authenticating users within a computing or access control environment
US10003971B2 (en) Compartmentalized multi-factor authentication for mobile devices
KR102375287B1 (ko) 제 3자 검증에 사용되는 신분 등록 및 액세스 제어 방법
US11949785B1 (en) Biometric authenticated biometric enrollment
CN114556356B (zh) 用户认证框架
CN113711560A (zh) 用于有效质询-响应验证的***和方法
US10671718B2 (en) System and method for authentication
US11681787B1 (en) Ownership validation for cryptographic asset contracts using irreversibly transformed identity tokens
WO2021243592A1 (zh) 用于第三方认证的身分的注册与接入控制方法
US11496469B2 (en) Apparatus and method for registering biometric information, apparatus and method for biometric authentication
TW202134911A (zh) 身分認證方法
KR20110005612A (ko) 생체 인식을 이용한 오티피 운영 방법 및 시스템과 이를 위한 오티피 장치 및 기록매체
KR101792494B1 (ko) 사용자 인증 방법 및 이를 수행하는 장치
WO2021243594A1 (zh) 基于集体验证的部分数据验证方法
TWI772648B (zh) 基於集體驗證的部分資料驗證方法
KR20120107043A (ko) 카메라를 이용한 비대면 인증 제공 방법 및 시스템과 이를 위한 휴대단말

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20938682

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20938682

Country of ref document: EP

Kind code of ref document: A1