CN101414909B - Network application user authentication system, method and mobile communication terminal - Google Patents

Abstract

The invention discloses a network application user identity verification system, method and mobile communication terminal, which are used to improve the universality of network application user identity verification. In the embodiment of the present invention, the mobile communication terminal device, which is carried by more and more people, stores the identity digital certificate, provides a device that does not need dynamic networking, and realizes the dynamic password verification technology, thereby greatly improving the application system at low cost and portability. security.

Description

Network application user authentication system, method and mobile communication terminal

technical field

The invention relates to network application technology, in particular to a network application user identity verification technology. the

Background technique

In the era of highly developed information networks, mobile e-commerce business fields are also being more and more concerned and used by everyone. At present, most e-commerce applications and e-banking systems use the traditional account plus user password for user identity verification. The password in this method may be stolen because the input environment is not secret and related to the user's characteristic information. There are security risks. the

At present, there are three solutions to solve the problem of user password security:

1. USB key hardware identity digital certificate scheme

This solution is currently widely used by enterprises. USB Key is a hardware device with USB interface. It adopts a strong two-factor authentication mode combining software and hardware. It has a built-in single-chip microcomputer or smart card chip, which can store user passwords or digital certificates. Using USB Key The built-in password algorithm realizes the verification of user identity. However, USB Key can only be used on devices with USB sockets, which limits the scope of use. In addition, because it must be connected to a computer, there is still a potential safety hazard that the USBKey password or certificate is stolen in the case of a corresponding Trojan horse virus. the

2. One-time Password Token

This technology means that the user's password is constantly changing dynamically according to the time or the number of times of use, and each password is only used once. This technique is a common solution for secure authentication today. the

The existing dynamic password token technology uses built-in power supply, high-precision clock, password generation chip and special hardware of the display screen. The password generation chip runs a special password generation algorithm, generates the current electronic password according to the current time or the number of times of use and displays it on the display. screen. The authentication server uses the same algorithm to calculate the current valid password. Since the electronic password used each time must be generated by a dynamic password token, only legitimate users hold the token hardware, so as long as the dynamic password verification passes, the system can consider the user's identity to be reliable. The shortcoming of this kind of dynamic password token technology and method is that most of them need to be precisely related to time, so special hardware with a high-precision clock is required, resulting in high hardware cost, and the special hardware token is also inconvenient to carry and has poor versatility. the

3. Mobile communication terminal SMS verification technology

Mobile communication terminal short message verification technology Before each transaction, the system sends a dynamic verification code to the user in the form of a short message, thereby realizing the function of a dynamic password. This method is safer than the dynamic password token method, but the secret dynamic password information needs to be transmitted in plain text in the unsecured mobile communication network, and sending short messages requires a certain cost. In addition, there is a possible delay problem in the short message method. the

Contents of the invention

Embodiments of the present invention provide a network application user identity verification system, method and mobile communication terminal, which are used to improve the versatility of network application user identity verification. the

A network application user authentication system, comprising:

The key and user management subsystem is used to generate and save the identity digital certificate of the user using the network application; when receiving the verification request containing the identity digital certificate, generate random information according to the verification request and output it, and use the set algorithm to generate Effective user verification password information within the set time period is output, and the calculation parameters of the user verification password information include: the identity digital certificate contained in the verification request and the random information generated according to the verification request;

The mobile communication terminal is used to obtain the user's identity digital certificate from the key and user management subsystem, and output the identity digital certificate to the network application and verification subsystem when the user performs identity verification of the network application; receive the user's input The key and the random information generated by the user management subsystem use the set algorithm to generate a user authentication password, and the calculation parameters of the user authentication password include: the random information input by the user and the saved identity digital certificate;

The network application and verification subsystem is used to obtain the identity digital certificate from the mobile communication terminal when the user requests identity verification of the network application, generate the verification request and send it to the key and user management subsystem; receive the key and the random information output by the user management subsystem, receive the user authentication password input by the user, receive the key and the user verification password information output by the user management subsystem, and obtain Validation results. the

Preferably, the network application and verification subsystem specifically includes:

The network server is used to provide the interactive interface of the network application and the verification subsystem, and when the user requests identity verification of the network application through the interactive interface, establish a communication connection with the mobile communication terminal and transfer the mobile communication terminal to the mobile communication terminal through the communication connection. Obtain the identity digital certificate, generate the verification request and forward it; receive the random information and display it to the user through the interactive interface of the application and verification subsystem, receive the user authentication password input by the user through the interactive interface of the application and verification subsystem and send Forward, and receive verification results;

The dynamic password verification server is used to receive the verification request output by the network server and forward it to the key and user management subsystem, receive the random information output by the key and user management subsystem and forward it to the network server; receive the The user authentication password and key forwarded by the network server and the user authentication password information output by the user management subsystem, and the verification result is obtained according to the user authentication password and the user authentication password information, and the verification result is sent to the network server . the

Further: the key and user management subsystem is also used to receive the user password input by the user through the key and user management subsystem interaction interface and store the corresponding user's identity digital certificate; When valid user verification password information is set within the duration, the calculation parameters of the user verification password information also include the user password input by the user; and the mobile communication terminal is also used to receive the user password input by the user through the mobile communication terminal interactive interface , and when using the set algorithm to generate the user authentication password, the calculation parameters of the user authentication password also include the user password input by the user. the

Further: the key and user management subsystem is also used to maintain the first serial number that identifies the cumulative value of user verification times according to the set rules, and use the set algorithm to generate valid user verification within the set time length In the case of password information, the calculation parameters of the user verification password information also include: the first serial number; and the mobile communication terminal is also used to maintain the second serial number that identifies the accumulated value of the number of verification times requested by the user according to the set rules, And when using the set algorithm to generate the user authentication password, the calculation parameters of the user authentication password further include: the second serial number. the

And, the user verification password information valid within the set time length generated by the key and user management subsystem using the set algorithm includes: using a set number of first serial numbers including the current value of the first serial number Each of the serial number values corresponds to a group of user verification passwords generated respectively; and the dynamic password verification server, according to the user authentication password and user verification password information, When any one of them is consistent, the result of verification is obtained, otherwise the result of verification failure is obtained. the

The mobile communication terminal and the network application and verification subsystem transmit the user's identity digital certificate by establishing a communication connection, and the establishment of the communication connection specifically includes:

A wired connection via the USB port; or

A wireless connection via Bluetooth; or

Wireless connection established via infrared emulation serial port. the

A network application user authentication method, comprising:

The mobile communication terminal outputs the user's identity digital certificate obtained from the key and user management subsystem to the network application and verification subsystem when the user performs identity verification of the network application;

When the network application and verification subsystem receives the user's identity digital certificate, it generates a verification request including the identity digital certificate and sends it to the key and user management subsystem;

The key and user management subsystem generates random information according to the received verification request and uses a set algorithm to generate valid user verification password information within a set time period, and outputs the random information and user verification password information to network applications and The verification subsystem, the calculation parameters of the user verification password information include: the identity digital certificate contained in the verification request and the random information generated according to the verification request;

The network application and verification subsystem receives the key, random information and user verification password information output by the user management subsystem, and receives the user authentication password input by the user. The user authentication password is the mobile communication terminal according to the password input by the user. The key and the random information generated by the user management subsystem, which are generated and displayed to the user by using the set algorithm, and the calculation parameters of the user authentication password include: the random information input by the user and the saved identity digital certificate;

The network application and verification subsystem verifies the identity of the user according to the user authentication password and the valid user verification password information within a set period of time. the

A mobile communication terminal, comprising:

A unit for obtaining the user's identity digital certificate from the key and user management subsystem;

A unit for establishing a communication connection with the network application and the verification subsystem and outputting the identity digital certificate through the communication connection when the user performs identity verification of the network application;

A unit for receiving the key input by the user through the interactive interface of the mobile communication terminal and the random information generated by the user management subsystem;

A unit for generating a user authentication password using a set algorithm and displaying it on the interactive interface of the mobile communication terminal. The calculation parameters of the user authentication password include the random information input by the user and the stored identity digital certificate. the

In the embodiment of the present invention, the electronic certificate dynamic password verification technology is realized by using the mobile communication terminal device, which is more and more carried by more and more people, to store the identity digital certificate and provide a universal medium that does not need to dynamically connect to the Internet and a high-precision clock during the verification work. , thereby greatly improving the versatility and portability of the network application verification mechanism at low cost. the

Description of drawings

Fig. 1 is a schematic diagram of the realization principle of the network application user identity verification system provided by the embodiment of the present invention;

Figure 2 is a schematic diagram of a specific network architecture of the network application user identity verification system provided by the embodiment of the present invention;

Fig. 3 is a schematic diagram of the account opening process of a network application user in the user identity verification method provided by the embodiment of the present invention;

4 is a schematic flow diagram of a network application user downloading an identity digital certificate to a mobile communication terminal in the user identity verification method provided by an embodiment of the present invention;

5 is a schematic flow diagram of activating the identity digital certificate on the mobile communication terminal in the user identity verification method provided by the embodiment of the present invention;

FIG. 6 is a schematic flowchart of identity verification using an identity digital certificate provided by an embodiment of the present invention. the

Detailed ways

PKI (Public Key Infrastructure) is a public key system. It is a key management platform that follows established standards. It can provide cryptographic services such as encryption and digital signatures and the necessary key and certificate management systems for all network applications. In other words, PKI is the infrastructure for providing security services established using public key theory and technology. PKI technology is the core of information security technology, and also the key and basic technology of e-commerce. In the PKI system, the CA (Certificate Authority) certification center is an authoritative certification management organization, which can issue digital certificates with unique identities to users, and provide digital certificate verification mechanisms together with network application provider equipment. the

As shown in Figure 1, the embodiment of the present invention is based on the dynamic password technology of the PKI mechanism, provides a verification system for realizing user identity verification, and uses the identity digital certificate issued by the CA with the authoritative organization to realize the legalization of the user identity of the network application. Sex verification, the verification system mainly includes: mobile communication terminal 12, network server 13, dynamic password verification server 14 and key and user management subsystem 11, wherein:

Key and user management subsystem 11, as a CA device in the PKI system, is used to issue and manage identity digital certificates, and complete user identity verification together with mobile communication terminal 12, application management server, and dynamic password verification server 14. verification; the identity digital certificate is actually a user-related information record stored in the key and user management subsystem 11, and can also be regarded as a statement issued by the CA to prove that the certificate subject (after the certificate applicant has the identity digital certificate) That is to say, it becomes the only corresponding relationship between the certificate subject) and the public key contained in the certificate. The identity digital certificate includes the name and related information of the certificate applicant, the applicant's public key, the digital signature of the CA that issued the certificate, and the validity period of the certificate. If the user needs to update the identity digital certificate, he can go to the CA to go through the procedure again. the

The mobile communication terminal 12 is used to download the identity digital certificate issued to the network application user from the key and user management subsystem 11, and when the user needs to perform identity verification, through the USB port, bluetooth or infrared simulation serial port of the mobile communication terminal 12 , transmit the identity digital certificate to the network server 13 to indicate the identity of the network application user, and together with the network server 13, the dynamic password verification server 14, and the key and user management subsystem 11, use the identity digital certificate, reserved in The user password on the key and user management subsystem 11 and the random information provided by the key and user management subsystem 11 within the set period of time are valid to complete the verification of user identity;

The network server 13 and the dynamic password verification server 14, as the equipment of the network application provider, form the network application and verification subsystem, provide the user with the network application interaction interface, and together with the mobile communication terminal 12 and the key and the user management subsystem 11 Complete user identity verification. the

Before the user downloads the identity digital certificate, according to different network applications, it is necessary to open an account through the counter of the CA, including reserving the basic user information and user password to the CA, and the CA saves the basic user information and user password reserved by the user to the key And in the user management subsystem, the key and user management subsystem provides a unique identity digital certificate for the user who applies for the digital certificate and generates a corresponding digital certificate activation code. The CA provides the digital certificate activation code to the user, and the user passes the authentication server. The own digital identity certificate is downloaded to the client of the mobile communication terminal 12, and the identity digital certificate is activated with the activation code. the

Still referring to shown in Fig. 1, in the embodiment of the present invention, the concrete process that mobile communication terminal 12 utilizes identity digital certificate to complete the verification of user identity includes the following steps:

S101, the mobile communication terminal 12 establishes a communication connection with the network server 13 and outputs the user's identity digital certificate obtained from the key and user management subsystem 11 through the communication connection when the user performs identity verification of the network application;

S102, when the network server 13 receives the identity digital certificate of the user, generates a verification request including the identity digital certificate and sends a dynamic password verification server 14;

S103, the dynamic password verification server 14 forwards the verification request to the key and user management subsystem 11;

S104, the key and user management subsystem 11 generates random information according to the received verification request and utilizes the set algorithm to generate valid user verification password information within the set time length, and outputs the random information and user verification password information to the dynamic password Verification server 14, the calculation parameter of user verification password information includes the identity digital certificate contained in the verification request and the random information generated according to the verification request;

S105, the dynamic password verification server 14 forwards the random information to the network server 13, and saves the user verification password information;

S106, the network server 13 displays random information to the user through the application interaction interface;

S107, the user can see the random information through the application interaction interface, and input the random information into the mobile communication terminal 12 through the interaction interface of the mobile communication terminal 12;

S108, the mobile communication terminal 12 generates a user authentication password according to the random information input by the user and the user identity certificate, and displays the user authentication password on the interactive interface of the mobile communication terminal 12;

S109, the user inputs the user authentication password displayed on the interactive interface of the mobile communication terminal 12 into the network server 13;

S110, the network server 13 forwards the user authentication password to the dynamic password verification server 14;

S111. The dynamic password verification server 14 verifies the identity of the user according to the user authentication password forwarded by the network server 13 and the previously saved user verification password information valid within the set time period. the

S112, the dynamic password verification server 14 returns the verification result to the network server 13. the

In the above verification process, the calculation parameters of the user authentication password and the user verification password information include the user's identity digital certificate and random information. The user's identity digital certificate is the user's unique The security of the identity digital certificate can guarantee the security of the verification result. The random information is temporarily generated and has timeliness. According to the timeliness of the random information, the key and user management subsystem 11 sets the effective duration for the generated user verification password information, which ensures that each user authentication used for verification The password and user verification password information is the current valid dynamic password, thereby improving the security of the authentication mechanism. the

Generally, the network server 13 includes a foreground device that a user can operate through an interactive interface, such as a computer, a game machine, an ATM machine, a POS machine, etc., and the dynamic password verification server 14 performs specific verification operations as a background device. For security reasons, it should set separately. However, for some applications with low security requirements or simple networking, they can also be combined and set up as a network application and authentication subsystem to jointly undertake the interaction and authentication functions of network applications. the

For the mobile communication terminal 12 and the network server 13, it is necessary to install a dedicated client according to the solution provided by the embodiment of the present invention, provide a corresponding interactive interface for the user, and perform related operations input by the user through the interactive interface, according to the embodiment of the present invention The provided technical solutions and the development of related interactive interfaces are well known to those skilled in the art, and will not be described in detail here. the

In the embodiment of the present invention, the random information can be a random number, or a combination of numbers and letters, etc., and the generation method is such as a pseudo-random number generation algorithm, etc. The generation technology of the random information is also well known to those skilled in the art, and will not be described in detail here . the

In the embodiment of the present invention, the electronic certificate dynamic password verification technology is realized by using the mobile communication terminal device, which is more and more carried by more and more people, to store the identity digital certificate and provide a universal medium that does not need to dynamically connect to the Internet and a high-precision clock during the verification work. , thereby greatly improving the versatility and portability of the network application verification mechanism at low cost. the

In the embodiment of the present invention, the password algorithm generally adopts an irreversible hash algorithm, such as SHA1, MD5, and the like. the

In order to further increase the security of the authentication mechanism, in the embodiment of the present invention, the user can also reserve a user password in the key and user management subsystem 11, and input the user password when inputting random information, from when calculating the user verification password information , the calculation parameters may further include: the user pre-stored in the key and the user password in the user management subsystem 11; and when calculating the user authentication password, the calculation parameters may further include: Enter random information. the

Furthermore, in order to increase the security of the verification mechanism, in the embodiment of the present invention, the mobile communication terminal 12 maintains locally the accumulated value of the verification request triggered by the user, the key and the user's According to the same setting rules, the management subsystem 11 updates the cumulative value every time it receives a verification request and generates random information and user verification password information. For the calculation of information, in order to prevent the misoperation of the user, the user verification password information calculated by the key and the user management subsystem 11 includes a group of user verification passwords calculated with the current cumulative value and several values greater than the current cumulative value respectively, As long as the user authentication password is consistent with any one of a group of user verification passwords, the result of verification can be obtained, otherwise the result of verification failure can be obtained. the

The specific architecture of a network application authentication system provided by an embodiment of the present invention is shown in Figure 2, wherein:

The key and user management subsystem specifically includes: user management server, CA server, user information database and mobile communication terminal software download server, among which: user management server can be connected to the counter terminal, mainly used for the issuance and management of personal digital certificates, Including receiving the user's basic information and user password reserved by the user when opening an account network application, generating an identity digital certificate and activation code for the user, and generating random information and verification password information when the user requests identity authentication. The user information base is mainly used as a database to store relevant information such as the identity digital certificate of each user. The mobile communication terminal client download server provides users with related software of various network application clients. Users can log in to the server to download or update the client of network applications. If the operator's network supports it, the address can be pushed to the user by means of WapPush. On the mobile communication terminal, the user can also directly log in to the server to download through the mobile communication terminal wirelessly. Of course, it can also be pre-installed on the terminal device or the SIM/USIM module of the terminal device by the mobile communication terminal equipment manufacturer. the

The network application and verification subsystem specifically includes: business terminals, network (WEB) servers, dynamic password verification servers and business application servers, among which: business terminals provide interactive interfaces for network applications, network servers provide login management for network applications, and dynamic passwords The verification server performs password verification, and users who pass the verification can enter the business application server to perform specific services. the

The various processes involved in the present invention will be described in detail below with preferred embodiments in conjunction with the accompanying drawings. the

1. User account opening process

As shown in Figure 3, before using the network application, the user must first apply for an account at the counter provided by the CA. The specific account opening process includes the following steps:

S301. The user or the teller fills in the application form on behalf of the user, and the teller needs to enter the user's basic information into the key and the user management subsystem, including: ID number id_num and the phone number phone_num of the mobile communication terminal used by the user;

S302, the user enters the selected user password passwd into the key and the user management subsystem, and the user password as the user password can participate in the calculation of the authentication password and the verification password, further strengthening the security of the verification mechanism;

Furthermore, it is also possible to call the password system to modify the password process for the user to modify the password. the

S303, the key and user management subsystem generates an identity digital certificate and its activation code;

There are many ways to generate an identity digital certificate, which can be generated based on ID number, telephone number, user password or other basic information, and those skilled in the art can flexibly choose the generation method according to needs. the

There are also many ways to generate the activation code of the identity digital certificate, which can be generated according to the user password or other basic information. Those skilled in the art can flexibly choose other activation code generation methods according to the needs. The embodiment of the present invention provides the following specific implementation methods:

The key and user management subsystem calculates passwd through the irreversible algorithm f _save to obtain the original password storage form save_pass, where: calculation parameters include passwd and phone_num, etc.:

save_pass = f _save (passwd, phone_num)

Store save_pass with phone_num as index. The key management subsystem does not directly save user passwords, and because it uses an irreversible algorithm, passwd cannot be deciphered through save_pass. the

The key and user management subsystem generates the activation code act_key through the irreversible algorithm f _act :

act_key=f _act (passwd, phone_num, id_num)

Finally, print phone_num/act_key and issue it to the user to complete the account opening process. the

2. Identity digital certificate download process

As shown in Figure 4, after the user has completed the application for opening an account, he will obtain an activation code, and download the identity digital certificate to the mobile communication terminal through the download server in the key and user management subsystem. The specific process includes the following steps:

S401, log in to the web page of the download website;

S402. The user inputs the user number of the mobile communication terminal, the user ID number (if selected), and the activation code on the input interface of the web page, and sends a request to the mobile communication terminal software download server for the identity digital certificate License'. The mobile communication terminal software download server extracts the identity digital certificate from the CA server according to the user ID number (if selected) and the activation code, and sends it to the mobile communication terminal according to the user number of the mobile communication terminal;

License'=f _lic (passwd, phone_num, id_num, act_key).

S403. The mobile communication terminal installs the identity digital certificate with phone_num as an index according to the user operation. the

3. Activate the identity digital certificate downloaded to the mobile communication terminal

The identity digital certificate can only be used after it is activated, and during the activation process, the binding of the user number of the mobile communication terminal and the personal digital certificate can be completed at the same time, as shown in Figure 5, which specifically includes the following steps:

S501. The user inputs the mobile communication terminal card number phone_num that needs to use this function on the mobile communication terminal, and the mobile communication terminal will save the card number;

S502. The user enters the user password passwd reserved when opening an account in the mobile communication terminal;

S503. The user enters the basic user information reserved when opening an account in the mobile communication terminal: ID number id_num (optional);

S504. The mobile communication terminal uses the same irreversible algorithm f _act as the key and user management subsystem to calculate act_key':

act_key'=f _act (passwd, phone_num, id_num)

S505. The user inputs the activation code act_key. If the act_key' is inconsistent with the act_key, the activation fails. the

S506. The key and user management subsystem binds the mobile communication terminal with the personal digital certificate. the

The embodiment of the present invention provides a specific binding process:

The characteristic information of the mobile communication terminal is used as the phone_mask, for example, the IMEI number of the mobile communication terminal is used as the phone_mask, if the IMEI number cannot be obtained, a random information is generated as a seed with other characteristic information (such as the current available memory capacity) of the mobile communication terminal as the phone_mask. phone_mask is used to distinguish different mobile communication terminals in order to bind specific mobile communication terminals;

Use the irreversible algorithm f _bind to calculate the binding code bind_key and save it on the mobile communication terminal:

bind_key = f _bind (phone_num, phone_mask)

The storage form save_pass of the original password is calculated by the irreversible algorithm f _save (save_pass is not saved here, it is only used to encrypt and transmit the key to bind_key to ensure that only legitimate users can complete the binding):

save_pass = f _save (passwd, phone_num)

Use save_pass as the key to encrypt phone_num/bind_key and send it to the key and user management subsystem;

The key and user management subsystem decrypts with save_pass to obtain bind_key;

Take random information as the synchronization code syn;

Initialize the server-side calculation sequence seq_svr=0;

Store bind_key/syn/seq_svr with phone_num as the index;

The key and user management subsystem returns syn to the mobile communication terminal;

The mobile communication terminal stores syn;

Initialize the mobile communication terminal calculation sequence seq_mob=0;

It should be noted that the user password and the synchronization code syn can be used as parameters for calculating the verification password and the authentication password during later verification, thereby further strengthening the security of the verification mechanism. the

Activation succeeded. the

Through account opening, downloading and activation processes, the mobile communication terminal successfully obtains the user's identity digital certificate. the

4. Verification process

After the user completes the account opening process and obtains the identity digital certificate, the daily use process is more convenient. The verification process in the specific use process is shown in Figure 6, including the following steps:

S601. When the user logs in to the network server to use the network application, the network server first requests the user to present the digital identity certificate, the network server establishes a communication connection with the mobile communication terminal, and the mobile communication terminal transmits the user's digital identity certificate to the network server according to the user's operation;

S602. The network server generates a verification request containing the user's identity digital certificate and sends it to the key and user management subsystem through the dynamic password verification server, and receives the random information returned by the key and user management subsystem, and prevents machine identification Ways to display random information challenge, such as displaying in the form of anti-automatic identification graphics;

At the same time, the key and user management subsystem also calculates the verification password "valid Window" and send the verification password "Valid Window" to the dynamic password verification server:

OTP' _i = f _OTP (save_pass, syn, seq_svr+i, bind_key, challenge): i = 1...n

S603. The mobile communication terminal calculates the user authentication password OTP;

The mobile communication terminal is based on the user password passwd and challenge input by the user. The user password input by the user is only valid during this calculation, and is not stored in the mobile communication terminal or transmitted on the network to ensure that it will not be stolen. Moreover, the mobile communication terminal is not connected to the Internet during the process of calculating the authentication password. the

The software on the mobile communication terminal calculates the storage form save_pass of the user password through the irreversible algorithm f _save :

save_pass = f _save (passwd, card_num)

According to the syn, the current calculation sequence seq_mob and the user password passwd and challenge, the mobile communication terminal uses the irreversible algorithm f _OTP consistent with the background system to calculate its current user authentication password and display the authentication password on the interactive interface of the mobile communication terminal. and increment the current evaluation order:

OTP = f _OTP (save_pass, syn, seq_mob, bind_key, challenge)

S604, a password verification process. the

The user inputs OTP on the application interaction interface of the network server _, and the network server transmits the OTP to the dynamic password verification server. Pass, otherwise the verification fails, and the verification result is returned to the network server and the key and user management subsystem, and the network server continues subsequent processing according to the verification result.

In the embodiment of the present invention, the mobile communication terminal device, which is carried by more and more people, stores the identity digital certificate, provides a medium that does not need dynamic networking, and realizes the dynamic password verification technology, thereby greatly improving network application at low cost. Versatility and portability of authentication mechanisms. the

Apparently, those skilled in the art can make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (11)

1. a verifying network application user identification system is characterized in that, comprising:

Key and user management subsystem are used to generate and preserve the identity digital certificate that the user uses network application; When receiving the checking request that comprises the identity digital certificate, generate random information and output according to this checking request, and utilize set algorithm to be created on and set effectively user rs authentication password information and output in the duration, the calculating parameter of described user rs authentication password information comprises: identity digital certificate that comprises in the checking request and the random information that generates according to this checking request;

Mobile communication terminal is used for obtaining user's identity digital certificate from key and user management subsystem, and when the user carries out the authentication of network application, this identity digital certificate is exported to network application and checking subsystem; Receive the described key of user's input and the random information that user management subsystem generates, utilize described set algorithm to generate the subscription authentication password, the calculating parameter of described subscription authentication password comprises: the random information of user's input and the identity digital certificate of preservation;

Network application and checking subsystem are used for obtaining the identity digital certificate from mobile communication terminal when the authentication of network application is carried out in user's request, generate described checking request and send to key and user management subsystem; Receive the random information of described key and user management subsystem output, receive the subscription authentication password of user's input, receive the user rs authentication password information of described key and user management subsystem output, and obtain the checking result according to described subscription authentication password and user rs authentication password information.

2. the system as claimed in claim 1 is characterized in that, described network application and checking subsystem specifically comprise:

The webserver, be used to provide the interactive interface of network application and checking subsystem and when the user carries out the authentication of network application by this interactive interface request, establish a communications link with described mobile communication terminal and obtain the identity digital certificate, generate described checking request and forwarding by described communicating to connect from mobile communication terminal; Receive described random information and the interactive interface by network application and checking subsystem is shown to the user, receive the user by the interactive interface input of network application and checking subsystem the subscription authentication password and transmit and Receipt Validation result;

The verifying dynamic password server is used to receive the checking request of described webserver output and be transmitted to key and user management subsystem, receives the random information of described key and user management subsystem output and is transmitted to the webserver; Receive the subscription authentication password of described webserver forwarding and the user rs authentication password information of key and user management subsystem output, and obtain the checking result, and described checking result is sent to the webserver according to described subscription authentication password and user rs authentication password information.

3. system as claimed in claim 2 is characterized in that:

Described key and user management subsystem also are used to receive the user and preserve by key and the user cipher of user management subsystem interactive interface input and the identity digital certificate of respective user; And when utilizing described set algorithm to be created on to set in the duration effectively the user rs authentication password information, the calculating parameter of described user rs authentication password information also comprises the user cipher that the user imports; And

Described mobile communication terminal also is used to receive the user cipher of user by the input of mobile communication terminal interactive interface, and when utilizing described set algorithm to generate the subscription authentication password, the calculating parameter of described subscription authentication password also comprises the user cipher that the user imports.

4. as claim 2 or 3 described systems, it is characterized in that:

Described key and user management subsystem also are used for safeguarding first sequence number of identifying user checking number of times aggregate-value according to setting rule, and when utilizing described set algorithm to be created on to set in the duration effectively the user rs authentication password information, the calculating parameter of described user rs authentication password information also comprises: described first sequence number; And

Described mobile communication terminal also is used for safeguarding second sequence number of identifying user requests verification number of times aggregate-value according to setting rule, and when utilizing described set algorithm to generate the subscription authentication password, the calculating parameter of described subscription authentication password also comprises: described second sequence number.

5. system as claimed in claim 4, it is characterized in that, the effective user rs authentication password information in setting duration that described key and user management subsystem utilize described set algorithm to generate comprises: utilize each in setting several first sequence number value that comprise the described first sequence number currency, respectively one group of user rs authentication password of corresponding generation; And

Described verifying dynamic password server is according to described subscription authentication password and user rs authentication password information, when the subscription authentication password is consistent with in one group of user rs authentication password any, obtains the result that checking is passed through, otherwise obtains the result of authentication failed.

6. as claim 1,2 or 3 arbitrary described systems, it is characterized in that described mobile communication terminal and network application and checking subsystem are by the identity digital certificate of the transmission user that establishes a communications link, described establishing a communications link specifically comprises:

Wired connection by USB interface foundation; Perhaps

Wireless connections by bluetooth foundation; Perhaps

Wireless connections by the foundation of infrared ray emulation serial ports.

7. a verifying network application user identification method is characterized in that, comprising:

When mobile communication terminal carries out the authentication of network application the user, export from the user's of key and user management subsystem acquisition identity digital certificate to network application and checking subsystem;

Network application and checking subsystem are when receiving user's identity digital certificate, and generation comprises the checking request of identity digital certificate and sends to key and user management subsystem;

Key and user management subsystem are according to the checking request that receives, generate random information and utilize set algorithm to be created on effective user rs authentication password information in the setting duration, and described random information and user rs authentication password information exported to network application and checking subsystem, the calculating parameter of described user rs authentication password information comprises: the identity digital certificate that comprises in the checking request and according to the random information of this checking request generation;

Network application and checking subsystem receive the random information and the user rs authentication password information of key and user management subsystem output, receive the subscription authentication password of user's input, the described subscription authentication password random information that to be mobile communication terminal generate according to the described key of user's input and user management subsystem also utilizes described set algorithm to generate and is shown to the user, and the calculating parameter of described subscription authentication password comprises: the random information of user's input and the identity digital certificate of preservation;

Network application and checking subsystem according to described subscription authentication password and in setting duration effective user rs authentication password information, user identity is verified.

8. method as claimed in claim 7 is characterized in that:

The calculating parameter of described user rs authentication password information also comprises: the user is kept at the user cipher in key and the user management subsystem in advance; And

The calculating parameter of described subscription authentication password also comprises: during random information that the user generates by mobile communication terminal interactive interface input key and user management subsystem, and Shu Ru user cipher also.

9. as claim 7 or 8 described methods, it is characterized in that:

The calculating parameter of described user rs authentication password information also comprises: key and user management subsystem are according to setting first sequence number that is used for identifying user checking number of times aggregate-value that rule is safeguarded; And

The calculating parameter of described subscription authentication password also comprises: mobile communication terminal is according to described second sequence number that is used for identifying user requests verification number of times aggregate-value of setting the rule maintenance.

10. method as claimed in claim 9 is characterized in that, described user rs authentication password information comprises: utilize each in setting several first sequence number value that comprise the described first sequence number currency, the corresponding respectively one group of user rs authentication password that generates; And

Described network application and checking subsystem are according to subscription authentication password and user rs authentication password information, user identity verified specifically comprise: when the subscription authentication password is consistent with in described one group of user rs authentication password any, obtain the result that checking is passed through, otherwise obtain the result of authentication failed.

11. a mobile communication terminal is characterized in that, comprising:

Be used for from the unit of key and user management subsystem acquisition user's identity digital certificate;

Be used for when the user carries out the authentication of network application, with network application and the checking subsystem establish a communications link and by communicate to connect output this identity digital certificate the unit;

Be used to receive the user and pass through the described key of mobile communication terminal interactive interface input and the unit of the random information that user management subsystem generates;

The unit that is used to utilize set algorithm to generate the subscription authentication password and shown by the mobile communication terminal interactive interface, the calculating parameter of described subscription authentication password comprise the random information that the user imports and the identity digital certificate of preservation.

Images