WO2022012080A1 - 一种智能密钥设备登录***的方法及装置 - Google Patents

一种智能密钥设备登录***的方法及装置 Download PDF

Info

Publication number
WO2022012080A1
WO2022012080A1 PCT/CN2021/082644 CN2021082644W WO2022012080A1 WO 2022012080 A1 WO2022012080 A1 WO 2022012080A1 CN 2021082644 W CN2021082644 W CN 2021082644W WO 2022012080 A1 WO2022012080 A1 WO 2022012080A1
Authority
WO
WIPO (PCT)
Prior art keywords
operating system
verification
key device
smart key
information
Prior art date
Application number
PCT/CN2021/082644
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US17/834,689 priority Critical patent/US20230161858A1/en
Publication of WO2022012080A1 publication Critical patent/WO2022012080A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/33—User authentication using certificates
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

  • the invention relates to a method and a device for logging in an intelligent key device, belonging to the field of information security.
  • the user's identity verification and login are usually completed through the interaction between the operating system and the smart key device, and the verification methods used mainly include two, one is the PIN code input by the user through the smart key device. The second is to verify the biometric features input by the user through the smart key device.
  • the operating system only supports one of these two verification methods, and the security is not high. Therefore, how to log in to the operating system more securely is an urgent problem to be solved.
  • the purpose of the present invention is to provide a method and device for logging in a system with an intelligent key device, which can make the login of an intelligent key device more secure.
  • a method for logging in a system with an intelligent key device comprising:
  • the device When the fourth function of the device is called by the operating system, the device sends an instruction to acquire the login verification method to the smart key device, and receives the verification mode information returned by the smart key device, and the device Organizing the verification mode information into a fifth data structure and returning it to the operating system;
  • the device When the fifth function of the device is called by the operating system, the device obtains the login interface window handle in the fifth function parameter, saves the login interface window handle in the second data structure, and sends the login interface window handle to the The operating system returns the call response value;
  • the device pops up a verification prompt box according to the login interface window handle in the second data structure, and prompts the user to input the PIN code.
  • the device When receiving the PIN code input by the user , send a verification PIN instruction to the smart key device;
  • the device When the device receives the PIN code verification result data returned by the smart key device, it determines whether the PIN code verification is successful, and if so, prompts the user to input biometric information on the smart key device for verification, and sends The intelligent key device sends a verification biometric instruction, otherwise it prompts that the PIN code verification fails;
  • the device When the device receives the biometric verification result data returned by the smart key device, it determines whether the biometric verification is successful, and if yes, returns the verification success information to the operating system, otherwise it indicates that the biometric verification failed;
  • the device When the seventh function of the device is called by the operating system, the device sends the data to be signed to the smart key device, receives the signature data returned by the smart key device, and the device sends the signature data to the smart key device. Organizing credential information back to the operating system;
  • the apparatus sends the encrypted data to the smart key device, receives the decrypted data returned by the smart key device, and the apparatus organizes the decrypted data
  • the verification data is returned to the operating system.
  • a device for logging in to a system with a smart key device comprising:
  • a fourth operation module a fifth operation module, a sixth operation module, a seventh operation module, and an eighth operation module;
  • the fourth operation module is used to send an instruction to obtain a login verification method to the smart key device, receive the verification method information returned by the smart key device, and organize the verification method information into a fifth data structure to return to the operating system;
  • the fifth operation module is used to obtain the login interface window handle in the fifth function parameter, save the login interface window handle in the second data structure, and return a call response value to the operating system;
  • the sixth operation module is used for popping up a verification prompt box according to the login interface window handle stored in the second data structure according to the fifth operation, prompting the user to input a PIN code, receiving the PIN code input by the user, and reporting to the smart password.
  • the key device sends a verification PIN command;
  • the sixth operation module is further configured to receive the PIN code verification result data returned by the smart key device, determine whether the PIN code verification is successful, and if so, prompt the user to input biometric information on the smart key device Carry out verification, and send the verification biometric instruction to the intelligent key device, otherwise it is prompted that the PIN code verification fails;
  • the sixth operation module is further configured to receive the biometric verification result data returned by the smart key device, determine whether the biometric verification is successful, and if yes, return verification success information to the operating system, otherwise prompt the biometric verification failure ;
  • the seventh operation module is configured to send the data to be signed to the smart key device, receive the signature data returned by the smart key device, organize the signature data into credential information and return it to the operating system;
  • the eighth operation module is configured to send encrypted data to the smart key device, receive decrypted data returned by the smart key device, organize the decrypted data into verification data and return it to the operating system.
  • the device obtains the verification mode supported by the intelligent key device, and returns the verification type to the operating system according to the verification method, so that the operating system organizes the login interface window handle according to the verification type, and receives the login interface window handle sent by the operating system, A verification prompt box pops up based on the window handle of the login interface, prompting the user to verify the PIN code and biometric information. Therefore, by adopting the present invention, the user's identity can be double-checked by PIN code and biometric feature at each time of verification and login, which improves the security of the user logging in to the operating system using the smart key device, thereby ensuring the interests of the user.
  • FIG. 1 is a flowchart of a method for logging in to a system with an intelligent key device according to Embodiment 1 of the present invention
  • FIG 2-1 and Figure 2-2 are flowcharts of a method for logging in to a system with an intelligent key device according to Embodiment 2 of the present invention
  • FIG. 3 is an apparatus block diagram of an intelligent key device login system according to Embodiment 3 of the present invention.
  • Embodiment 1 of the present invention provides a method for logging in a system with an intelligent key device, and the method is applied to a system including a device, an operating system, and an intelligent key device. As shown in FIG. 1 , the method includes:
  • the device When the fourth function of the device is called by the operating system, the device sends an instruction to acquire the login verification mode to the smart key device, receives the verification mode information returned by the smart key device, and organizes the verification mode information into a fifth data structure and returns it to operating system;
  • the device When the fifth function of the device is called by the operating system, the device obtains the login interface window handle in the fifth function parameter, saves the login interface window handle in the second data structure, and returns information to the operating system;
  • the device pops up a verification prompt box according to the window handle of the login interface in the second data structure, prompting the user to input the PIN code, and when receiving the PIN code input by the user, the device sends a message to the smart key device Send a verification PIN instruction;
  • the device When the device receives the PIN code verification result data returned by the smart key device, it determines whether the PIN code verification is successful, and if yes, prompts the user to input biometric information on the smart key device for verification, and sends the verification biometric feature to the smart key device. command, otherwise it will prompt PIN code verification failure;
  • the device When the device receives the biometric verification result data returned by the smart key device, it determines whether the biometric verification is successful, and if yes, returns the verification success information to the operating system, otherwise it prompts that the biometric verification fails;
  • the device When the seventh function of the device is called by the operating system, the device sends the data to be signed to the smart key device, receives the signature data returned by the smart key device, and the device organizes the signature data into credential information and returns it to the operating system;
  • the device sends the encrypted data to the smart key device, receives the decrypted data returned by the smart key device, and organizes the decrypted data into verification data and returns it to the operating system.
  • the device organizes the verification mode information into a fifth data structure and returns it to the operating system, specifically: the device obtains the verification policy identifier from the verification mode information returned by the received smart key device, and according to The verification strategy identification determines whether it is biometric verification. If yes, the verification type is set to the first preset value, otherwise, the verification type is set to the second preset value, and the fifth data structure is organized according to the set verification type, and the fifth data The structure is returned to the operating system;
  • the method further includes: when the third function of the device is called by the operating system, the device sends an instruction to acquire the public key information of the specified index container to the smart key device according to the incoming parameters, and receives The public key information returned by the smart key device organizes the public key information into a fourth data structure and returns it to the operating system;
  • the method further includes: when the second function of the device is called by the operating system, the device obtains the incoming parameter file name, and sends an instruction to obtain the file information to the smart key device according to the file name , receive the file information returned by the smart key device, organize it into a third structure data according to the file information and return it to the operating system;
  • the device obtains the incoming parameter file name, sends an instruction to obtain file information to the smart key device according to the file name, receives the file information returned by the smart key device, and organizes the first
  • the three-structure data returned to the operating system specifically includes:
  • the device obtains the incoming parameter file name, and judges the obtained file name. If the file name is the first file name, the device sends an instruction to obtain the serial number of the smart key device to the smart key device according to the first file name, and receives the smart key device. For the first file information returned by the device, obtain the serial number in the first file information, organize it into a third data structure according to the serial number, and return it to the operating system;
  • the device obtains the incoming parameter file name, sends an instruction to obtain file information to the smart key device according to the file name, receives the file information returned by the smart key device, and organizes the first
  • the three-structure data returned to the operating system specifically includes:
  • the device obtains the incoming parameter file name, determines the obtained file name, and if the file name is the second file name, the device sends an instruction to obtain the certificate stored in the smart key device to the smart key device according to the second file name, and receives
  • the certificate information returned by the smart key device organizes the obtained certificate information into a third data structure and returns it to the operating system;
  • the device obtains the incoming parameter file name, sends an instruction to obtain file information to the smart key device according to the file name, receives the file information returned by the smart key device, and organizes the first
  • the three-structure data returned to the operating system specifically includes:
  • the device obtains the incoming parameter file name, and judges the obtained file name. If the file name is the third file name, the device organizes the content of the obtained certificate into a data structure and returns it to the operating system;
  • the method further includes: when the first function of the device is called by the operating system, the device returns the function address list to the operating system;
  • the device returns the function address list to the operating system, specifically: the device initializes the first data structure, and obtains the second function address, the third function address, the fourth function address, and the fifth function address. , the sixth function address, the seventh function address, and the eighth function address, create a self-defined second data structure and save it into the first data structure, and return the first data structure to the operating system.
  • Embodiment 2 of the present invention provides a method for logging in to a system with an intelligent key device.
  • the method is applied to a system including a device, an operating system, and an intelligent key device, as shown in Figures 2-1 and 2-2, including:
  • the operating system When the operating system receives the login trigger information, it prompts the user to insert the smart key device; when the operating system detects that the smart key device is inserted, the first function is called;
  • Step 101 when the first function is called, the device returns the function address list to the operating system;
  • the first function is CardAcquireContext
  • the incoming parameters include: a first data structure
  • the device returning the function address list to the operating system includes: initializing the first data structure, acquiring the second function address, third function address, fourth function address, fifth function address, sixth function address, seventh function address, eighth function address, create a custom second data structure and save it to the first data structure ;
  • the operating system will call the corresponding function according to the second function address, the third function address, the fourth function address, the fifth function address, the sixth function address, the seventh function address, and the eighth function address; preferably, the second function address
  • the address, the third function address, the fourth function address, the fifth function address, the sixth function address, the seventh function address, and the eighth function address are the second function pointer, the third function pointer, the fourth function pointer, and the fifth function address. pointer, sixth function pointer, seventh function pointer, eighth function pointer;
  • Step 102 the operating system judges whether the initialization is successful according to the return value of the first function, if yes, the operating system calls the corresponding second function according to the second function pointer, and executes step 103, otherwise ends;
  • step 102 is specifically as follows: the operating system judges the return value of the first function, if it is a function address list, the initialization is successful, otherwise the initialization fails;
  • Step 103 when the second function is called, the device obtains the corresponding file content from the smart key device according to the file name and organizes it into a third structure data and returns it to the operating system;
  • the second function is CardReadFile
  • the incoming parameters include file names; wherein, the first name is CardID, the second name is Cmapfile, and the third name is cardcf, kxc00, and kxc01;
  • the device obtains the corresponding file content according to the file name and returns it to the operating system, specifically: the device obtains the incoming parameter file name, determines the file name, and executes step A1 if the device determines that the file name is the first name; Step A2 is executed when the name is the second name; Step A3 is executed when the file name is the third name;
  • Step A1 the device sends an instruction to obtain the serial number of the smart key device to the smart key device, and organizes the received serial number into a data structure and returns it to the operating system;
  • Step A2 The device sends the obtained certificate stored in the smart key device to the smart key device, and judges whether the certificate information returned by the smart key device is received. If yes, organize the obtained certificate information into a data structure and return it to the operating system, otherwise Finish;
  • the certificate information specifically includes: the number of certificates, key type, length, function, etc.;
  • the obtained certificate information is organized into a data structure CMapFile as:
  • Step A3 The device organizes the content of the obtained certificate into a data structure and returns it to the operating system.
  • Step 104 the operating system judges whether the acquisition of the file is successful according to the return value of the second function, if yes, the operating system calls the corresponding third function according to the third function pointer, and executes step 105, otherwise ends;
  • Step 105 When the third function is called, the device sends an instruction to acquire the public key information of the specified index container to the smart key device according to the incoming parameters, receives the public key information returned by the smart key device, and organizes the public key information into the fourth data structure is returned to the operating system;
  • the third function is CardGetContainerInfo
  • the parameters passed in by the system are: specify the index container ID;
  • the fourth data structure ContainerInfo is:
  • Step 106 the operating system judges whether the acquisition of the public key information is successful according to the return value of the third function, if yes, the operating system calls the corresponding fourth function according to the fourth function pointer, and executes step 107, otherwise ends;
  • Step 107 when the fourth function is called, the device sends an instruction to obtain the login verification mode to the smart key device, receives the verification mode information returned by the smart key device, organizes it into a fifth data structure and returns it to the operating system;
  • the fourth function is CardGetProperty
  • the incoming parameters include a fifth data structure
  • organizing it into a fifth data structure and returning it to the operating system is specifically: the smart key device received by the device from the Obtain the verification strategy identifier from the returned verification method information, and determine whether it is fingerprint verification according to the verification strategy identifier. If yes, set the verification type to the first preset value, otherwise, set the verification type to the second preset value. The type organizes the fifth data structure, and returns the fifth data structure to the operating system,;
  • setting the verification type to the first preset value indicates that the login verification method is fingerprint verification
  • setting the verification type to the second preset value indicates that the login verification method is PIN code verification
  • the authentication policy identifier is TouchPolicy; the authentication type is PinType; the first preset value ExternalPinType; the second preset value AuthenticationPin;
  • the fifth data structure PIN_INFO is:
  • Step 108 the operating system judges the login verification type through the return value of the fourth function, if the login verification type is the first preset value, the operating system calls the corresponding fifth function according to the fifth function pointer, and executes step 109, otherwise ends;
  • the operating system organizes the login interface window handle according to the verification type in the fifth data structure
  • the login interface window handle obtained by the organization is passed in as a parameter.
  • Step 109 when the fifth function is called, the device obtains the login interface window handle in the fifth function parameter, saves the login interface window handle in the second data structure, and returns the calling response value to the operating system;
  • the fifth function is CardSetProperty
  • the incoming parameters are the first data structure and the login interface window handle
  • saving the login interface window handle into the second data structure is specifically: the device stores the login interface window handle The window handle is stored in the second data structure in the first data structure;
  • Step 110 the operating system obtains and displays all user certificates, and prompts the user to select the certificate used for logging in; when the operating system receives the certificate used by the user to selectively log in, it calls the corresponding sixth function according to the sixth function pointer, Go to step 111;
  • Step 111 When the sixth function is called, the device pops up a verification prompt box according to the login interface window handle in the second data structure, prompting the user to input a PIN code, and when receiving the PIN code input by the user, sends a message to the smart key device Verify the PIN command; the device receives the verification result data, and determines whether the verification is successful, and if so, executes step 112; otherwise, it prompts that the verification fails;
  • the sixth function is CardAuthenticateEx
  • the device prompting the PIN code verification failure specifically includes: the device judging whether the remaining number of times of PIN code input is 0, and if so, prompting the smart key device to be locked, and ending; otherwise, waiting for the user to input the PIN code;
  • Step 112 The device prompts the user to input fingerprint information on the smart key device for verification, and sends a verification fingerprint instruction to the smart key device; the device receives the verification result data, determines whether the verification is successful, and returns the verification success information to the operating system, and executes Step 113; otherwise, prompt verification failure;
  • the device prompting the fingerprint verification failure specifically includes: the device judging whether the remaining number of fingerprint verification times is 0, and if yes, prompting the smart key device to be locked, and ending; otherwise, waiting to receive user input fingerprint information;
  • Step 113 the operating system calls the corresponding seventh function according to the seventh function pointer, and executes step 114;
  • the seventh function is CardSignData; the system calls the seventh function with the container index, the signature algorithm identifier, and the data to be signed as parameters;
  • Step 114 When the seventh function is called, the device sends the data to be signed to the smart key device, the smart key device uses the parameters of the seventh function to locate the signature private key and the signature algorithm, and uses the signature private key to treat the signature according to the signature algorithm.
  • the data is operated to generate the credential information required to log in to the operating system, and the device returns the credential information to the operating system;
  • the smart key device uses the parameters of the seventh function to locate the signature private key and the signature algorithm includes: the smart key device respectively identifies the container index and the signature algorithm according to the parameters of the seventh function. Obtain the signature private key and signature algorithm in the corresponding container; if the signature of the smart key device fails, return the signature failure message to the operating system, and the seventh function returns an error message;
  • the data to be signed in this embodiment 2 may include: user name, domain name, random number, etc.;
  • the credential information is:
  • Step 115 The operating system judges whether the calculation of the signature is successful through the return value of the seventh function, and if yes, executes Step 116, otherwise it prompts that the login fails, and ends;
  • Step 116 the operating system verifies the credential information using the certificate selected by the user, if the verification succeeds, executes Step 117, and if the verification fails, refuses to log in;
  • the signature result is verified by using the certificate selected by the user, specifically: the operating system decrypts the signature result by using the signature public key in the certificate selected by the user, and performs hash calculation on the data to be signed, Determine whether the hash calculation result is consistent with the decryption result, if yes, the verification succeeds, otherwise the verification fails;
  • Step 117 the operating system calls the corresponding eighth function according to the eighth function pointer, and executes step 118;
  • Step 118 When the eighth function is called, the device sends the encrypted data to the smart key device, and the smart key device uses the parameters of the eighth function to locate the decryption private key and the decryption algorithm, and uses the decryption private key to encrypt the encrypted data according to the decryption algorithm. Perform operation to generate verification data required for logging in to the operating system, and the device returns the verification data to the operating system;
  • the eighth function is CardRSADecrypt; the system calls the eighth function with the container index, the encryption algorithm identifier, and the encrypted data as parameters;
  • the validation data is:
  • Step 119 the operating system verifies the verification data, if the verification is successful, the login is allowed, and if the verification fails, the login is refused;
  • the operating system verifies the verification data, specifically: the operating system determines whether the verification data is consistent with the data before encryption, and if yes, the verification succeeds, otherwise the verification fails.
  • the smart key device can be replaced with a smart card, wherein when the smart card is inserted into the operating system by means of a card reader, the smart card and the smart key device can also implement the solution provided in Embodiment 2 of the present invention.
  • Embodiment 3 of the present invention provides an apparatus for logging in a system with an intelligent key device.
  • the apparatus includes: a fourth operation module 301 , a fifth operation module 302 , a sixth operation module 303 , and a seventh operation module 304 , the eighth operation module 305;
  • the fourth operation module 301 is used to send an instruction to obtain the login verification mode to the smart key device, receive the verification mode information returned by the smart key device, organize the verification mode information into a fifth data structure and return it to the operating system;
  • the fifth operation module 302 is used to obtain the login interface window handle in the fifth function parameter, save the login interface window handle in the second data structure, and return a call response value to the operating system;
  • the sixth operation module 303 is used for popping up a verification prompt box according to the login interface window handle stored in the second data structure according to the fifth operation, prompting the user to input the PIN code, receiving the PIN code input by the user, and sending the verification PIN to the smart key device instruction;
  • the sixth operation module 303 is further configured to receive the PIN code verification result data returned by the smart key device, and determine whether the PIN code verification is successful. The device sends a verification biometric command, otherwise it prompts that the PIN code verification fails;
  • the sixth operation module 303 is further configured to receive the biometric verification result data returned by the smart key device, and determine whether the biometric verification is successful, and if yes, return the verification success information to the operating system, otherwise, prompt that the biometric verification fails;
  • the seventh operation module 304 is configured to send the data to be signed to the smart key device, receive the signature data returned by the smart key device, organize the signature data into credential information and return it to the operating system;
  • the eighth operation module 305 is used to send the encrypted data to the smart key device, receive the decrypted data returned by the smart key device, organize the decrypted data into verification data and return it to the operating system;
  • the fourth operation module 301 is specifically configured to obtain the verification strategy identifier from the verification method information returned by the received smart key device, and determine whether it is biometric verification according to the verification strategy identifier, and if yes, then Set the verification type to the first preset value, otherwise set the verification type to the second preset value, organize the fifth data structure according to the set verification type, and return the fifth data structure to the operating system, so that the operating system Organize the login interface window handle according to the verification type in the fifth data structure;
  • the device further includes a third operation module
  • the third operation module is used to send an instruction to acquire the public key information of the specified index container to the smart key device according to the parameters passed in by the operating system, receive the public key information returned by the smart key device, and organize the public key information into fourth The data structure is returned to the operating system;
  • the device further includes a second operation module
  • the second operation module is used to obtain the parameter file name passed in by the operating system, send an instruction to obtain file information to the smart key device according to the file name, receive the file information returned by the smart key device, and organize into a third structure according to the file information data is returned to the operating system;
  • the second operation module is specifically used to obtain the incoming parameter file name, determine the obtained file name, and if the file name is the first file name, send the smart key to the smart key according to the first file name
  • the device sends an instruction to obtain the serial number of the smart key device, receives the first file information returned by the smart key device, obtains the serial number in the first file information, and organizes it into a third data structure according to the serial number and returns it to the operating system;
  • the second operation module is specifically used to obtain the incoming parameter file name, determine the obtained file name, and if the file name is the second file name, send the intelligent key to the The device sends an instruction to acquire the certificate stored in the smart key device, receives the certificate information returned by the smart key device, organizes the acquired certificate information into a third data structure and returns it to the operating system;
  • the second operation module is specifically used to obtain the incoming parameter file name, determine the obtained file name, and organize the obtained certificate content into a data structure if the file name is the third file name return to the operating system;
  • the device further includes a first operation module
  • the first operation module is used to return the function address list to the operating system
  • the first operation module is specifically configured to initialize the first data structure, obtain the second function address, the third function address, the fourth function address, the fifth function address, the sixth function address, the third function address, and the third function address.
  • the seventh function address and the eighth function address create a self-defined second data structure and save it into the first data structure, and return the first data structure to the operating system.
  • the technical scheme of the present invention improves the security of the user logging in to the Windows system by using the combination of the external PIN code verification and the fingerprint verification in the Window function.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

一种智能密钥登录***的方法，该方法包括：装置获取登录验证方式，并将其返回给操作***；如装置获取第四函数参数中的登录验证方式为生物特征验证方式时获取第五函数参数中的登录界面窗口句柄并保存；装置根据保存的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，以及指纹进行验证，验证成功则装置向操作***返回验证成功信息。采用本发明，能够在每次验证登录时对用户身份进行PIN码和生物特征进行双层验证，提高了用户使用智能密钥设备进行登录操作***的安全性，从而保证了用户的利益。

Description

一种智能密钥设备登录***的方法及装置 技术领域
本发明涉及一种智能密钥设备登录***的方法及装置，属于信息安全领域。
背景技术
现有技术中，通常是通过操作***和智能密钥设备进行交互来完成对用户身份的验证和登录，采用的验证方式主要包括两种，其一是通过智能密钥设备对用户输入的PIN码进行验证，其二是通过智能密钥设备对用户输入的生物特征进行验证，但是，在每次进行身份验证过程中，操作***只支持这两种验证方式中的一种，安全性不高，因此，如何更加安全的登录操作***是亟待解决的问题。
发明内容
本发明的目的是提供一种智能密钥设备登录***的方法及装置，其能够使得智能密钥设备登录更安全。
为此，根据本发明的一个方面，提供了一种智能密钥设备登录***的方法，该方法包括：
当所述装置的第四函数被所述操作***调用时，所述装置向所述智能密钥设备发送获取登录验证方式的指令，接收所述智能密钥设备返回的验证方式信息，所述装置将所述验证方式信息组织成第五数据结构返回给所述操作***；
当所述装置的第五函数被所述操作***调用时，所述装置获取第五函数参数中的登录界面窗口句柄，并将所述登录界面窗口句柄保存到第二数据结构中，向所述操作***返回调用响应值；
当所述装置的第六函数被所述操作***调用时，所述装置根据第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，当接收到用户输入的PIN码时，向所述智能密钥设备发送验证PIN指令；
当所述装置接收到所述智能密钥设备返回的PIN码验证结果数据时，判断所述PIN码验证是否成功，是则提示用户在所述智能密钥设备上输入生物特征信息进行验证，向所述智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
当所述装置接收到所述智能密钥设备返回的生物特征验证结果数据时，判断生物特征验证是否成功，是则向所述操作***返回验证成功信息，否则提示生物特征验证失败；
当所述装置的第七函数被所述操作***调用时，所述装置将待签名数据发送给所述智能密钥设备，接收所述智能密钥设备返回的签名数据，所述装置将签名数据组织成凭据信息返回给所述操作***；
当所述装置的第八函数被所述操作***调用时，所述装置将加密数据发送给所述智能密钥设备，接收所述智能密钥设备返回的解密数据，所述装置将解密数据组织成验证数据返回给所述操作***。
根据本发明的另外一个方面，提供了一种智能密钥设备登录***的装置，其包括：
第四操作模块、第五操作模块、第六操作模块、第七操作模块、第八操作模块；
所述第四操作模块，用于向所述智能密钥设备发送获取登录验证方式的指令，接收所述 智能密钥设备返回的验证方式信息，将所述验证方式信息组织成第五数据结构返回给所述操作***；
所述第五操作模块，用于获取第五函数参数中的登录界面窗口句柄，并将所述登录界面窗口句柄保存到第二数据结构中，向所述操作***返回调用响应值；
所述第六操作模块，用于根据所述第五操作保存在第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，接收用户输入的PIN码，向所述智能密钥设备发送验证PIN指令；
所述第六操作模块，还用于接收所述智能密钥设备返回的PIN码验证结果数据，判断所述PIN码验证是否成功，是则提示用户在所述智能密钥设备上输入生物特征信息进行验证，向所述智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
所述第六操作模块，还用于接收所述智能密钥设备返回的生物特征验证结果数据，判断生物特征验证是否成功，是则向所述操作***返回验证成功信息，否则提示生物特征验证失败；
所述第七操作模块，用于将待签名数据发送给所述智能密钥设备，接收所述智能密钥设备返回的签名数据，将签名数据组织成凭据信息返回给所述操作***；
所述第八操作模块，用于将加密数据发送给所述智能密钥设备，接收所述智能密钥设备返回的解密数据，将解密数据组织成验证数据返回给所述操作***。
根据本发明，通过装置获取智能密钥设备可支持的验证方式，根据验证方式向操作***返回验证类型，以使操作***根据验证类型组织登录界面窗口句柄，接收操作***发送的登录界面窗口句柄，根据登录界面窗口句柄弹出验证提示框，提示用户验证PIN码和生物特征信息。因此，采用本发明，能够在每次验证登录时对用户身份进行PIN码和生物特征进行双层验证，提高了用户使用智能密钥设备进行登录操作***的安全性，从而保证了用户的利益。
附图说明
图1是根据本发明实施例1的一种智能密钥设备登录***的方法流程图；
图2-1、图2-2是根据本发明实施例2的一种智能密钥设备登录***的方法流程图；
图3是根据本发明实施例3的一种智能密钥设备登录***的装置框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图，对本发明的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例1：
本发明实施例1提供一种智能密钥设备登录***的方法，该方法应用于包括装置、操作***、智能密钥设备的***中，如图1所示，该方法包括：
当装置的第四函数***作***调用时，装置向智能密钥设备发送获取登录验证方式的指令，接收智能密钥设备返回的验证方式信息，装置将验证方式信息组织成第五数据结构返回给操作***；
当装置的第五函数***作***调用时，装置获取第五函数参数中的登录界面窗口句柄， 并将登录界面窗口句柄保存到第二数据结构中，向操作***返回信息；
当装置的第六函数***作***调用时，装置根据第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，当接收到用户输入的PIN码时，向智能密钥设备发送验证PIN指令；
当装置接收到智能密钥设备返回的PIN码验证结果数据时，判断PIN码验证是否成功，是则提示用户在智能密钥设备上输入生物特征信息进行验证，向智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
当装置接收到智能密钥设备返回的生物特征验证结果数据时，判断生物特征验证是否成功，是则向操作***返回验证成功信息，否则提示生物特征验证失败；
当装置的第七函数***作***调用时，装置将待签名数据发送给智能密钥设备，接收智能密钥设备返回的签名数据，装置将签名数据组织成凭据信息返回给操作***；
当装置的第八函数***作***调用时，装置将加密数据发送给智能密钥设备，接收智能密钥设备返回的解密数据，装置将解密数据组织成验证数据返回给操作***。
优选地，在本实施例1中，装置将验证方式信息组织成第五数据结构返回给操作***，具体为：装置从接收到的智能密钥设备返回的验证方式信息中获取验证策略标识，根据验证策略标识判断是否为生物特征验证，是则将验证类型设置为第一预设值，否则将验证类型设置为第二预设值，根据设置的验证类型组织第五数据结构，将第五数据结构返回给操作***；
优选地，在本实施例1中，该方法还包括：当装置的第三函数***作***调用时，装置根据传入参数向智能密钥设备发送获取指定索引容器的公钥信息的指令，接收智能密钥设备返回的公钥信息，将公钥信息组织成第四数据结构返回给操作***；
优选地，在本实施例1中，该方法还包括：当装置的第二函数***作***调用时，装置获取传入的参数文件名称，根据文件名称向智能密钥设备发送获取文件信息的指令，接收智能密钥设备返回的文件信息，根据文件信息组织成第三结构数据返回给操作***；
优选地，在本实施例1中，装置获取传入的参数文件名称，根据文件名称向智能密钥设备发送获取文件信息的指令，接收智能密钥设备返回的文件信息，根据文件信息组织成第三结构数据返回给操作***具体包括：
装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第一文件名称时，装置根据第一文件名称向智能密钥设备发送获取智能密钥设备序列号指令，接收智能密钥设备返回的第一文件信息，获取第一文件信息中的序列号，根据序列号组织成第三数据结构返回给操作***；
优选地，在本实施例1中，装置获取传入的参数文件名称，根据文件名称向智能密钥设备发送获取文件信息的指令，接收智能密钥设备返回的文件信息，根据文件信息组织成第三结构数据返回给操作***具体包括：
装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第二文件名称时，装置根据第二文件名称向智能密钥设备发送获取智能密钥设备中存储的证书的指令，接收智能密钥设备返回的证书信息，将获取的证书信息组织成第三数据结构返回给操作***；
优选地，在本实施例1中，装置获取传入的参数文件名称，根据文件名称向智能密钥设备发送获取文件信息的指令，接收智能密钥设备返回的文件信息，根据文件信息组织成第三结构数据返回给操作***具体包括：
装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第三文件名称时，装置将获取的证书内容组织成数据结构返回给操作***；
优选地，在本实施例1中，该方法还包括：当装置的第一函数***作***调用时，装置将函数地址列表返回给操作***；
优选地，在本实施例1中，装置将函数地址列表返回给操作***，具体为：装置初始化第一数据结构，获取第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址，创建自定义的第二数据结构并将其保存到第一数据结构中，并将第一数据结构返回给操作***。
实施例2：
本发明实施例2提供一种智能密钥设备登录***的方法，该方法应用于包括装置、操作***、智能密钥设备的***，如图2-1、2-2所示，包括：
当操作***接收到登录触发信息时，提示用户***智能密钥设备；当操作***检测到智能密钥设备***时调用第一函数；
步骤101：当第一函数被调用时，装置将函数地址列表返回给操作***；
具体地，在本实施例2中，第一函数为CardAcquireContext，其中，传入的参数包括：第一数据结构；装置将函数地址列表返回给操作***包括：初始化第一数据结构，获取第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址，创建自定义的第二数据结构并将其保存到第一数据结构中；操作***会根据第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址调用对应的函数；优选的，第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址为第二函数指针、第三函数指针、第四函数指针、第五函数指针、第六函数指针、第七函数指针、第八函数指针；
步骤102：操作***通过第一函数的返回值判断初始化是否成功，是则操作***根据第二函数指针调用对应的第二函数，执行步骤103，否则结束；
在本实施例2中，步骤102具体为：操作***判断第一函数的返回值，如为函数地址列表则初始化成功，否则初始化失败；
步骤103：当第二函数被调用时，装置根据文件名称从智能密钥设备中获取对应的文件内容并组织成第三结构数据返回给操作***；
具体地，在本实施例2中，第二函数为CardReadFile，传入的参数包括文件名称；其中，第一名称为CardID，第二名称为Cmapfile，第三名称为cardcf、kxc00、kxc01；
优选地，装置根据文件名称获取对应的文件内容并返回给操作***，具体为：装置获取传入的参数文件名称，判断文件名称，若装置判断文件名称为第一名称时执行步骤A1，若文件名称为第二名称时执行步骤A2；若文件名称为第三名称时时执行步骤A3；
步骤A1：装置向智能密钥设备发送获取智能密钥设备序列号指令，并将接收到的序列号组织成数据结构返回给操作***；
步骤A2：装置向智能密钥设备发送获取智能密钥设备中存储的证书，判断是否接收到智能密钥设备返回的证书信息，是则将获取的证书信息组织成数据结构返回给操作***，否则结束；
具体地，在本实施例2中，证书信息具体包括：证书个数、密钥类型、长度、功能等；
其中，将获取的证书信息组织成数据结构CMapFile为：
Figure PCTCN2021082644-appb-000001
Figure PCTCN2021082644-appb-000002
步骤A3：装置将获取证书的内容组织成数据结构返回给操作***。
步骤104：操作***通过第二函数的返回值判断获取文件是否成功，是则操作***根据第三函数指针调用对应的第三函数，执行步骤105，否则结束；
步骤105：当第三函数被调用时，装置根据传入参数向智能密钥设备发送获取指定索引容器的公钥信息的指令，接收智能密钥设备返回的公钥信息，将公钥信息组织成第四数据结构返回给操作***；
具体地，在本实施例2中，第三函数为CardGetContainerInfo；
***传入参数为：指定索引容器标识；
例如，第四数据结构ContainerInfo为：
Figure PCTCN2021082644-appb-000003
步骤106：操作***通过第三函数的返回值判断获取公钥信息是否成功，是则操作***根据第四函数指针调用对应的第四函数，执行步骤107，否则结束；
步骤107：当第四函数被调用时，装置向智能密钥设备发送获取登录验证方式的指令，接收智能密钥设备返回的验证方式信息，将其组织成第五数据结构返回给操作***；
具体地，在本实施例2中，第四函数为CardGetProperty，传入的参数包括第五数据结构，将其组织成第五数据结构返回给操作***具体为：装置从接收到的智能密钥设备返回的验证方式信息中获取验证策略标识，根据验证策略标识判断是否为指纹验证，是则将验证类型设置为第一预设值，否则将验证类型设置为第二预设值，根据设置的验证类型组织第五数据结构，将第五数据结构返回给操作***，；
其中，将验证类型设置为第一预设值，表示登录验证方式为指纹验证；将验证类型设置为第二预设值，表示登录验证方式为PIN码验证；
其中，验证策略标识为TouchPolicy；验证类型为PinType；第一预设值ExternalPinType；第二预设值AuthenticationPin；
例如，第五数据结构PIN_INFO为：
Figure PCTCN2021082644-appb-000004
Figure PCTCN2021082644-appb-000005
步骤108：操作***通过第四函数的返回值判断登录验证类型，若登录验证类型为第一预设值，则操作***根据第五函数指针调用对应的第五函数，执行步骤109，否则结束；
在本实施例2中，还包括：操作***根据第五数据结构中的验证类型组织登录界面窗口句柄；
操作***调用装置的第五函数时，将组织得到的登录界面窗口句柄作为参数传入。
步骤109：当第五函数被调用时，装置获取第五函数参数中的登录界面窗口句柄，并将登录界面窗口句柄保存到第二数据结构中，向操作***返回调用响应值；
具体地，在本实施例2中，第五函数为CardSetProperty，传入的参数为第一数据结构和登录界面窗口句柄，将登录界面窗口句柄保存到第二数据结构中具体为：装置将登录界面窗口句柄保存到第一数据结构中的第二数据结构中；
步骤110：操作***获取所有用户证书并显示，提示用户选择进行登录所使用的证书；当操作***接收到用户选择地进行登录所使用的证书时，根据第六函数指针调用对应的第六函数，执行步骤111；
步骤111：当第六函数被调用时，装置根据第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，当接收到用户输入的PIN码时，向智能密钥设备发送验证PIN指令；装置接收验证结果数据，判断验证是否成功，是则执行步骤112；否则提示验证失败；
具体地，在本实施例2中，第六函数为CardAuthenticateEx，
优选地，装置提示PIN码验证失败具体包括：装置判断PIN码输入剩余次数是否为0，是则提示智能密钥设备锁定，结束；否则等待接收用户输入PIN码；
步骤112：装置提示用户在智能密钥设备上输入指纹信息进行验证，向智能密钥设备发送验证指纹指令；装置接收验证结果数据，判断验证是否成功，是则向操作***返回验证成功信息，执行步骤113；否则提示验证失败；
优选地，装置提示指纹验证失败具体包括：装置判断指纹验证剩余次数是否为0，是则提示智能密钥设备锁定，结束；否则等待接收用户输入指纹信息；
步骤113：操作***根据第七函数指针调用对应的第七函数，执行步骤114；
具体地，在本实施例2中，第七函数为CardSignData；***将容器索引、签名算法标识、待签名数据作为参数调用第七函数；
步骤114：当第七函数被调用时，装置将待签名数据发送给智能密钥设备，智能密钥设备使用第七函数的参数定位签名私钥和签名算法，使用签名私钥根据签名算法对待签名数据进行运算生成登录操作***所需的凭据信息，装置将凭据信息返回给操作***；
具体地，在本实施例2中，其中，智能密钥设备使用第七函数的参数定位签名私钥和签名算法包括：智能密钥设备分别根据第七函数的参数中的容器索引和签名算法标识获取对应容器中的签名私钥和签名算法；如智能密钥设备签名不成功则给操作***返回签名失败信息， 第七函数返回错误信息；
例如，本实施例2中的待签名数据可以包括：用户名、域名、随机数等；
例如，凭据信息为：
Figure PCTCN2021082644-appb-000006
步骤115：操作***通过第七函数的返回值判断计算签名是否成功，是则执行步骤116，否则提示登录失败，结束；
具体地，在本实施例2中，如第七函数返回凭据信息则计算签名成功，否则计算签名失败；
步骤116：操作***使用用户选择的证书对凭据信息进行验证，如验证成功则执行步骤117，如验证失败则拒绝登录；
具体地，在本实施例2中，使用用户选择的证书对签名结果进行验证，具体为：操作***使用用户选择的证书中的签名公钥对签名结果进行解密，对待签名数据进行哈希计算，判 断哈希计算结果和解密结果是否一致，是则验证成功，否则验证失败；
步骤117：操作***根据第八函数指针调用对应的第八函数，执行步骤118；
步骤118：当第八函数被调用时，装置将加密数据发送给智能密钥设备，智能密钥设备使用第八函数的参数定位解密私钥和解密算法，使用解密私钥根据解密算法对加密数据进行运算生成登录操作***所需的验证数据，装置将验证数据返回给操作***；
具体地，在本实施例2中，第八函数为CardRSADecrypt；***将容器索引、加密算法标识、加密数据作为参数调用第八函数；
例如，验证数据为：
Figure PCTCN2021082644-appb-000007
步骤119：操作***对验证数据进行验证，如验证成功则允许登录，如验证失败则拒绝登录；
具体地，在本实施例2中，操作***对验证数据进行验证，具体为：操作***判断验证数据和加密前的数据是否一致，是则验证成功，否则验证失败。
在本实施例2中，智能密钥设备***操作***时声明自身为usb设备；
进一步地，智能密钥设备可以替换为智能卡，其中，当智能卡借助读卡器***操作***时，智能卡与智能密钥设备同样能够实现本发明实施例2提供的方案。
实施例3：
本发明实施例3提供一种智能密钥设备登录***的装置，如图3所示，该装置包括：第四操作模块301、第五操作模块302、第六操作模块303、第七操作模块304、第八操作模块305；
第四操作模块301，用于向智能密钥设备发送获取登录验证方式的指令，接收智能密钥设备返回的验证方式信息，将验证方式信息组织成第五数据结构返回给操作***；
第五操作模块302，用于获取第五函数参数中的登录界面窗口句柄，并将登录界面窗口句柄保存到第二数据结构中，向操作***返回调用响应值；
第六操作模块303，用于根据第五操作保存在第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，接收用户输入的PIN码，向智能密钥设备发送验证PIN指令；
第六操作模块303，还用于接收智能密钥设备返回的PIN码验证结果数据，判断PIN码验证是否成功，是则提示用户在智能密钥设备上输入生物特征信息进行验证，向智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
第六操作模块303，还用于接收智能密钥设备返回的生物特征验证结果数据，判断生物特征验证是否成功，是则向操作***返回验证成功信息，否则提示生物特征验证失败；
第七操作模块304，用于将待签名数据发送给智能密钥设备，接收智能密钥设备返回的签名数据，将签名数据组织成凭据信息返回给操作***；
第八操作模块305，用于将加密数据发送给智能密钥设备，接收智能密钥设备返回的解密数据，将解密数据组织成验证数据返回给操作***；
优选地，在本实施例3中，第四操作模块301具体用于从接收到的智能密钥设备返回的验证方式信息中获取验证策略标识，根据验证策略标识判断是否为生物特征验证，是则将验证类型设置为第一预设值，否则将验证类型设置为第二预设值，根据设置的验证类型组织第五数据结构，将第五数据结构返回给操作***，以使所述操作***根据所述第五数据结构中的验证类型组织登录界面窗口句柄；
优选地，在本实施例3中，该装置还包括第三操作模块；
第三操作模块，用于根据操作***传入的参数向智能密钥设备发送获取指定索引容器的公钥信息的指令，接收智能密钥设备返回的公钥信息，将公钥信息组织成第四数据结构返回给操作***；
优选地，在本实施例3中，该装置还包括第二操作模块；
第二操作模块，用于获取操作***传入的参数文件名称，根据文件名称向智能密钥设备发送获取文件信息的指令，接收智能密钥设备返回的文件信息，根据文件信息组织成第三结构数据返回给操作***；
优选地，在本实施例3中，第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第一文件名称时，根据第一文件名称向智能密钥设备发送获取智能密钥设备序列号指令，接收智能密钥设备返回的第一文件信息，获取第一文件信息中的序列号，根据序列号组织成第三数据结构返回给操作***；
优选地，在本实施例3中，第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第二文件名称时，根据第二文件名称向智能密钥设备发送获取智能密钥设备中存储的证书的指令，接收智能密钥设备返回的证书信息，将获取的证书信息组织成第三数据结构返回给操作***；
优选地，在本实施例3中，第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第三文件名称时，将获取的证书内容组织成数据结构返回给操作***；
优选地，在本实施例3中，该装置还包括第一操作模块；
第一操作模块，用于将函数地址列表返回给操作***；
优选地，在本实施例3中，第一操作模块具体用于初始化第一数据结构，获取第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址，创建自定义的第二数据结构并将其保存到第一数据结构中，并将第一数据结构返回给操作***。
本发明技术方案在Window函数中通过使用外部PIN码验证和指纹验证两种验证方式的结合，提高了用户登录Windows***的安全性。
以上对本发明所提供的一种智能密钥设备登录***的方法及装置进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上，本说明书内容不应理解为对本发明的限制。

Claims (18)

  1. 一种智能密钥设备登录***的方法，其特征在于，所述方法应用于包括装置、操作***、智能密钥设备的***中，所述方法包括：
    当所述装置的第四函数被所述操作***调用时，所述装置向所述智能密钥设备发送获取登录验证方式的指令，接收所述智能密钥设备返回的验证方式信息，所述装置将所述验证方式信息组织成第五数据结构返回给所述操作***；
    当所述装置的第五函数被所述操作***调用时，所述装置获取第五函数参数中的登录界面窗口句柄，并将所述登录界面窗口句柄保存到第二数据结构中，向所述操作***返回调用响应值；
    当所述装置的第六函数被所述操作***调用时，所述装置根据第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，当接收到用户输入的PIN码时，向所述智能密钥设备发送验证PIN指令；
    当所述装置接收到所述智能密钥设备返回的PIN码验证结果数据时，判断所述PIN码验证是否成功，是则提示用户在所述智能密钥设备上输入生物特征信息进行验证，向所述智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
    当所述装置接收到所述智能密钥设备返回的生物特征验证结果数据时，判断生物特征验证是否成功，是则向所述操作***返回验证成功信息，否则提示生物特征验证失败；
    当所述装置的第七函数被所述操作***调用时，所述装置将待签名数据发送给所述智能密钥设备，接收所述智能密钥设备返回的签名数据，所述装置将签名数据组织成凭据信息返回给所述操作***；以及
    当所述装置的第八函数被所述操作***调用时，所述装置将加密数据发送给所述智能密钥设备，接收所述智能密钥设备返回的解密数据，所述装置将解密数据组织成验证数据返回给所述操作***。
  2. 根据权利要求1所述的方法，其特征在于，所述装置将验证方式信息组织成第五数据结构返回给所述操作***，具体为：所述装置从接收到的所述智能密钥设备返回的验证方式信息中获取验证策略标识，根据所述验证策略标识判断是否为生物特征验证，是则将验证类型设置为第一预设值，否则将验证类型设置为第二预设值，根据设置的验证类型组织第五数据结构，将所述第五数据结构返回给所述操作***，以使所述操作***根据所述第五数据结构中的验证类型组织登录界面窗口句柄。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：当所述装置的第三函数被所述操作***调用时，所述装置根据传入参数向所述智能密钥设备发送获取指定索引容器的公钥信息的指令，接收所述智能密钥设备返回的公钥信息，将所述公钥信息组织成第四数据结构返回给所述操作***。
  4. 根据权利要求1所述的方法，其特征在于，所述方法还包括：当所述装置的第二函数被所述操作***调用时，所述装置获取传入的参数文件名称，根据文件名称向所述智能密钥设备发送获取文件信息的指令，接收所述智能密钥设备返回的文件信息，根据所述文件信息组织成第三结构数据返回给所述操作***。
  5. 根据权利要求4所述的方法，其特征在于，所述装置获取传入的参数文件名称，根据文件名称向所述智能密钥设备发送获取文件信息的指令，接收所述智能密钥设备返回的文件 信息，根据所述文件信息组织成第三结构数据返回给所述操作***具体包括：
    所述装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第一文件名称时，所述装置根据第一文件名称向所述智能密钥设备发送获取智能密钥设备序列号指令，接收所述智能密钥设备返回的第一文件信息，获取第一文件信息中的序列号，根据序列号组织成第三数据结构返回给所述操作***。
  6. 根据权利要求4所述的方法，其特征在于，所述装置获取传入的参数文件名称，根据文件名称向所述智能密钥设备发送获取文件信息的指令，接收所述智能密钥设备返回的文件信息，根据所述文件信息组织成第三结构数据返回给所述操作***具体包括：
    所述装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第二文件名称时，所述装置根据第二文件名称向所述智能密钥设备发送获取所述智能密钥设备中存储的证书的指令，接收所述智能密钥设备返回的证书信息，将获取的证书信息组织成第三数据结构返回给所述操作***。
  7. 根据权利要求4所述的方法，其特征在于，所述装置获取传入的参数文件名称，根据文件名称向所述智能密钥设备发送获取文件信息的指令，接收所述智能密钥设备返回的文件信息，根据所述文件信息组织成第三结构数据返回给所述操作***具体包括：
    所述装置获取传入的参数文件名称，判断获取的文件名称，若文件名称为第三文件名称时，所述装置将获取的证书内容组织成数据结构返回给所述操作***。
  8. 根据权利要求1所述的方法，其特征在于，所述方法还包括：当所述装置的第一函数被所述操作***调用时，所述装置将函数地址列表返回给所述操作***。
  9. 根据权利要求8所述的方法，其特征在于，所述装置将函数地址列表返回给所述操作***，具体为：所述装置初始化第一数据结构，获取第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址，创建自定义的第二数据结构并将其保存到所述第一数据结构中，并将第一数据结构返回给所述操作***。
  10. 一种智能密钥设备登录***的装置，其特征在于，所述装置包括：第四操作模块、第五操作模块、第六操作模块、第七操作模块、第八操作模块；
    所述第四操作模块，用于向所述智能密钥设备发送获取登录验证方式的指令，接收所述智能密钥设备返回的验证方式信息，将所述验证方式信息组织成第五数据结构返回给所述操作***；
    所述第五操作模块，用于获取第五函数参数中的登录界面窗口句柄，并将所述登录界面窗口句柄保存到第二数据结构中，向所述操作***返回调用响应值；
    所述第六操作模块，用于根据所述第五操作保存在第二数据结构中的登录界面窗口句柄弹出验证提示框，提示用户输入PIN码，接收用户输入的PIN码，向所述智能密钥设备发送验证PIN指令；
    所述第六操作模块，还用于接收所述智能密钥设备返回的PIN码验证结果数据，判断所述PIN码验证是否成功，是则提示用户在所述智能密钥设备上输入生物特征信息进行验证，向所述智能密钥设备发送验证生物特征指令，否则提示PIN码验证失败；
    所述第六操作模块，还用于接收所述智能密钥设备返回的生物特征验证结果数据，判断生物特征验证是否成功，是则向所述操作***返回验证成功信息，否则提示生物特征验证失败；
    所述第七操作模块，用于将待签名数据发送给所述智能密钥设备，接收所述智能密钥设备返回的签名数据，将签名数据组织成凭据信息返回给所述操作***；以及
    所述第八操作模块，用于将加密数据发送给所述智能密钥设备，接收所述智能密钥设备返回的解密数据，将解密数据组织成验证数据返回给所述操作***。
  11. 根据权利要求10所述的装置，其特征在于，所述第四操作模块具体用于从接收到的所述智能密钥设备返回的验证方式信息中获取验证策略标识，根据所述验证策略标识判断是否为生物特征验证，是则将验证类型设置为第一预设值，否则将验证类型设置为第二预设值，根据设置的验证类型组织第五数据结构，将所述第五数据结构返回给所述操作***，以使所述操作***根据所述第五数据结构中的验证类型组织登录界面窗口句柄。
  12. 根据权利要求10所述的装置，其特征在于，还包括第三操作模块；
    所述第三操作模块，用于根据操作***传入的参数向所述智能密钥设备发送获取指定索引容器的公钥信息的指令，接收所述智能密钥设备返回的公钥信息，将所述公钥信息组织成第四数据结构返回给所述操作***。
  13. 根据权利要求10所述的装置，其特征在于，还包括第二操作模块；
    所述第二操作模块，用于获取操作***传入的参数文件名称，根据文件名称向所述智能密钥设备发送获取文件信息的指令，接收所述智能密钥设备返回的文件信息，根据所述文件信息组织成第三结构数据返回给所述操作***。
  14. 根据权利要求13所述的装置，其特征在于，所述第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第一文件名称时，根据第一文件名称向所述智能密钥设备发送获取智能密钥设备序列号指令，接收所述智能密钥设备返回的第一文件信息，获取第一文件信息中的序列号，根据序列号组织成第三数据结构返回给所述操作***。
  15. 根据权利要求13所述的装置，其特征在于，所述第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第二文件名称时，根据第二文件名称向所述智能密钥设备发送获取所述智能密钥设备中存储的证书的指令，接收所述智能密钥设备返回的证书信息，将获取的证书信息组织成第三数据结构返回给所述操作***。
  16. 根据权利要求13所述的装置，其特征在于，所述第二操作模块具体用于获取传入的参数文件名称，判断获取的文件名称，若文件名称为第三文件名称时，将获取的证书内容组织成数据结构返回给所述操作***。
  17. 根据权利要求10所述的装置，其特征在于，还包括第一操作模块；
    所述第一操作模块，用于将函数地址列表返回给所述操作***。
  18. 根据权利要求17所述的装置，其特征在于，所述第一操作模块具体用于初始化第一数据结构，获取第二函数地址、第三函数地址、第四函数地址、第五函数地址、第六函数地址、第七函数地址、第八函数地址，创建自定义的第二数据结构并将其保存到所述第一数据结构中，并将第一数据结构返回给所述操作***。
PCT/CN2021/082644 2020-07-14 2021-03-24 一种智能密钥设备登录***的方法及装置 WO2022012080A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/834,689 US20230161858A1 (en) 2020-07-14 2021-03-24 Method and apparatus for logging into system using smart key device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010671810.5 2020-07-14
CN202010671810.5A CN111563247A (zh) 2020-07-14 2020-07-14 一种智能密钥设备登录***的方法及装置

Publications (1)

Publication Number Publication Date
WO2022012080A1 true WO2022012080A1 (zh) 2022-01-20

Family

ID=72073957

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/082644 WO2022012080A1 (zh) 2020-07-14 2021-03-24 一种智能密钥设备登录***的方法及装置

Country Status (3)

Country Link
US (1) US20230161858A1 (zh)
CN (1) CN111563247A (zh)
WO (1) WO2022012080A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111563247A (zh) * 2020-07-14 2020-08-21 飞天诚信科技股份有限公司 一种智能密钥设备登录***的方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101256700A (zh) * 2008-03-31 2008-09-03 浙江大学城市学院 一种混合型用户身份认证的自动取款机
CN107241192A (zh) * 2017-05-27 2017-10-10 飞天诚信科技股份有限公司 一种使用指纹key进行登录的方法及装置
CN109088733A (zh) * 2018-07-11 2018-12-25 飞天诚信科技股份有限公司 一种智能卡应用扩展的实现方法及装置
CN111563247A (zh) * 2020-07-14 2020-08-21 飞天诚信科技股份有限公司 一种智能密钥设备登录***的方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI330032B (en) * 2006-11-24 2010-09-01 Mstar Semiconductor Inc Method for authorized-user verification and related apparatus
CN102510333B (zh) * 2011-09-30 2014-07-30 飞天诚信科技股份有限公司 一种授权认证方法及***
CN108199834B (zh) * 2018-01-16 2021-07-02 飞天诚信科技股份有限公司 一种智能密钥设备工作的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101256700A (zh) * 2008-03-31 2008-09-03 浙江大学城市学院 一种混合型用户身份认证的自动取款机
CN107241192A (zh) * 2017-05-27 2017-10-10 飞天诚信科技股份有限公司 一种使用指纹key进行登录的方法及装置
CN109088733A (zh) * 2018-07-11 2018-12-25 飞天诚信科技股份有限公司 一种智能卡应用扩展的实现方法及装置
CN111563247A (zh) * 2020-07-14 2020-08-21 飞天诚信科技股份有限公司 一种智能密钥设备登录***的方法及装置

Also Published As

Publication number Publication date
CN111563247A (zh) 2020-08-21
US20230161858A1 (en) 2023-05-25

Similar Documents

Publication Publication Date Title
CN108768970B (zh) 一种智能设备的绑定方法、身份认证平台及存储介质
US8225384B2 (en) Authentication system for enhancing network security
US8839357B2 (en) Method, system, and computer-readable storage medium for authenticating a computing device
CN107196922B (zh) 身份认证方法、用户设备和服务器
CN107430658B (zh) 安全软件认证及验证
US20080215890A1 (en) System and method for secure remote biometric authentication
EP3213459A1 (en) A multi-user strong authentication token
CN109903043B (zh) 基于区块链的安全交易方法、装置、设备及存储介质
TW200844880A (en) Settlement terminal and IC card
US8397281B2 (en) Service assisted secret provisioning
JP5613596B2 (ja) 認証システム、端末装置、認証サーバ、およびプログラム
CN109005155A (zh) 身份认证方法及装置
WO2020035009A1 (zh) 认证***及其工作方法
CN104506321B (zh) 一种更新动态令牌中种子数据的方法
US20090119505A1 (en) Transaction method and verification method
WO2017084569A1 (zh) 在智能终端中获取登陆凭证的方法、智能终端以及操作***
US20190182229A1 (en) Advanced application security utilizing an application key
CN113591057A (zh) 生物特征离线身份识别方法及***
US11251951B2 (en) Remote authentication for accessing on-premises network devices
WO2018099407A1 (zh) 账户认证登录方法及装置
WO2022012080A1 (zh) 一种智能密钥设备登录***的方法及装置
CN111970117B (zh) 证书下载方法、装置及设备
EP2985712B1 (en) Application encryption processing method, apparatus, and terminal
CN116886357A (zh) 一种移动平台分布式数字身份认证方法、装置及介质
WO2021077627A1 (zh) 一种智能密钥设备及其验证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21842833

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21842833

Country of ref document: EP

Kind code of ref document: A1