CN101488111A - Identification authentication method and system - Google Patents

Abstract

The invention discloses an identity authentication method. First, a portable storage device loads the same session key generation mechanism as itself and a decryption mechanism corresponding to its own encryption mechanism to a terminal; then, the portable storage device uses its own session key key to encrypt the session ticket generated by itself; the terminal generates a session key according to the same session key generation mechanism as the portable storage device, and uses its own session key to decrypt the encrypted session ticket from the portable storage device, and then decrypts the decrypted The obtained session ticket is returned to the portable storage device; after that, the portable storage device can compare the received session ticket with the session ticket generated by itself, so as to realize identity authentication. At the same time, the invention also discloses an identity authentication system, and the method and system can improve the security of identity authentication between the terminal and the portable storage device.

Description

An identity authentication method and system

technical field

The invention relates to the field of information security, in particular to an identity authentication method and system.

Background technique

When a terminal (such as a PC, mobile phone, etc.) accesses a portable storage device (such as a smart card, a memory card, etc.), the portable storage device needs to perform identity authentication on the accessed terminal. Figure 1 is a flow chart of an identity authentication method in the prior art picture. As shown in Figure 1, the identity authentication method in the prior art includes the following steps:

Step 101, when a terminal detects a portable storage device, it powers on the portable storage device, and the portable storage device sends an identity authentication request to a terminal requesting access.

Step 102: After receiving the identity authentication request sent by the portable storage device, the terminal prompts the user to input a personal identification number (PIN) through the human-computer interaction interface, and the user inputs the PIN according to the prompt of the human-computer interaction interface.

Step 103, the terminal returns an identity authentication request response to the portable storage device, and the identity authentication request response carries the PIN entered by the user in plain text.

Step 104, after the portable storage device receives the PIN input by the user, it compares the PIN input by the user with the PIN stored in advance by itself, and if the two are consistent, the identity authentication is passed; otherwise, the identity authentication fails.

Step 105, the portable storage device returns the identity authentication result to the terminal, if the identity authentication passes, the terminal can access the portable storage device; otherwise, the terminal cannot access.

In the existing identity authentication method, since the terminal sends the PIN entered by the user to the portable storage device in clear text for identity authentication, the PIN sent by the terminal is easily stolen or intercepted by the illegal user, and the illegal user may also gain access to the device. Portable storage device permissions, so the security of the existing identity authentication method is not high.

Contents of the invention

In view of this, the main purpose of the present invention is to provide an identity authentication method to improve the security of identity authentication between a terminal and a portable storage device.

Another object of the present invention is to provide an identity authentication system to improve the security of identity authentication between a terminal and a portable storage device.

In order to achieve the above object, the technical solution of the present invention is specifically realized in the following way:

An identity authentication system, the system includes: a terminal, a portable storage device,

The portable storage device includes: an identity authentication module, a security processing module loading unit, wherein,

The identity authentication module uses its own session key to encrypt the session ticket generated by itself;

The security processing module loading unit loads the security processing module in the terminal;

The security processing module carries the same session key generation mechanism as the identity authentication module, and generates its own session key according to the same session key generation mechanism as the identity authentication module; the security processing module also carries the encryption mechanism corresponding to the identity authentication module. decryption mechanism, and use its own session key to decrypt the encrypted session ticket from the identity authentication module, and return the decrypted session ticket to the identity authentication module;

Moreover, the identity authentication module is also used to compare the received session ticket with the session ticket generated by itself.

The identity authentication module includes: a first session key generation unit, a first session ticket generation unit, an encryption unit, and an identity authentication unit; the security processing module includes: an identity information entry and storage unit, a second session key generation unit , decryption unit; where,

A first session key generating unit, configured to use the identity information of the portable storage device itself as a key seed to generate a first session key;

The first session ticket generating unit is used to generate the first session ticket and send the first session ticket to the encryption unit and the identity authentication unit;

An encryption unit, configured to use the first session key to encrypt the first session ticket, and send the encrypted first session ticket to the decryption unit;

An identity information entry and storage unit, used for user entry of identity information and storage of user entry identity information;

The second session key generation unit is used to use the identity information entered by the user as the key seed to generate the second session key according to the generation mechanism of the first session key;

The decryption unit is configured to use the second session key to decrypt the encrypted first session ticket from the encryption unit according to the decryption mechanism corresponding to the encryption mechanism, and send the decrypted second session ticket to the identity authentication unit;

The identity authentication unit is used to compare whether the second session ticket from the decryption unit is consistent with the first session ticket from the first session ticket generation unit, and if they are consistent, the identity authentication of the terminal is passed; otherwise, the identity authentication fails.

The terminal is a PC, or a mobile phone, or an automatic teller machine (ATM);

The portable storage device is a smart card, or a memory card, or a USBKey.

An ISO7816 interface protocol, or a universal memory card interface protocol, or a USB interface protocol, or a wireless interface protocol is used between the terminal and the portable storage device.

The identity information is a personal identification number PIN, or biometric information.

The identity information entry and storage unit includes a soft keyboard.

The first session ticket and the second session ticket are generated according to the current session time.

A kind of identity authentication method, this method comprises the following steps:

The portable storage device loads the same session key generation mechanism as itself and the decryption mechanism corresponding to its own encryption mechanism to the terminal;

The portable storage device uses its own session key to encrypt the session ticket generated by itself;

The terminal generates a session key according to the same session key generation mechanism as the portable storage device, and uses its own session key to decrypt the encrypted session ticket from the portable storage device, and then returns the decrypted session ticket to the portable storage device;

The portable storage device compares the received session ticket with its own generated session ticket.

The method for the terminal and the portable storage device to generate their own session keys according to the same session key generation mechanism is as follows: the portable storage device uses its own identity information as the key seed to generate the first session key, and the terminal generates the first session key with the identity information entered by the user. The information is the key seed to generate the second session key according to the generation mechanism of the first session key;

The method for the portable storage device to use its own session key to encrypt the session ticket generated by itself is as follows: the portable storage device generates a first session ticket, and uses the first session key to encrypt the first session ticket;

The method that the terminal uses its own session key to decrypt the encrypted session ticket from the portable storage device is as follows: the terminal uses the second session key to decrypt the encrypted first session ticket from the portable storage device according to the decryption mechanism corresponding to the encryption mechanism ;

The method for the portable storage device to compare the received session ticket with the session ticket generated by itself is as follows: the portable storage device compares whether the second session ticket from the terminal is consistent with the first session ticket generated by itself, and if they are consistent, the terminal identity Authentication passed; otherwise, identity authentication failed.

The terminal is a PC, or a mobile phone, or an automatic teller machine (ATM);

The portable storage device is a smart card, or a memory card, or a USBKey.

The terminal and the portable storage device are connected through an ISO7816 interface, or a universal memory card interface, or a USB interface, or a wireless interface.

The identity information is a personal identification number PIN, or biometric information.

The method for the user to input identity information is as follows: the user uses a soft keyboard to input the identity information.

The first session ticket and the second session ticket are generated according to the current session time.

It can be seen from the above technical solution that the present invention firstly loads the same session key generation mechanism as itself and the decryption mechanism corresponding to its own encryption mechanism to the terminal by the portable storage device; then, the portable storage device uses its own session key Encrypt the session ticket generated by itself; correspondingly, the terminal generates a session key according to the same session key generation mechanism as the portable storage device, and uses its own session key to decrypt the encrypted session ticket from the portable storage device, and then The session ticket obtained after decryption is returned to the portable storage device; thereafter, the portable storage device can compare the received session ticket with the session ticket generated by itself, so as to realize identity authentication. In this way, since the PIN entered by the user is not directly transmitted between the terminal and the portable storage device, identity information such as the PIN is prevented from being stolen by an illegal user, thereby improving the security of identity authentication between the terminal and the portable storage device.

Description of drawings

Fig. 1 is the flowchart of identity authentication method in the prior art;

Fig. 2 is a structural diagram of an identity authentication system provided by the present invention;

Fig. 3 is a flow chart of an identity authentication method provided by the present invention;

Fig. 4 is a flowchart of an embodiment of an identity authentication method provided by the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

FIG. 2 is a structural diagram of an identity authentication system provided by the present invention. As shown in FIG. 2 , the identity authentication system includes: a terminal 201 and a portable storage device 202 .

The terminal 201 includes at least: a security processing module 2011 and a second interface unit 2015; the portable storage device 202 includes at least: a security processing module loading unit 2021, an identity authentication module 2022, and a first interface unit 2027.

The security processing module loading unit 2021 loads the security processing module 2011 to the terminal 201 through the first interface unit 2027 and the second interface unit 2015. The security processing module 2011 carries the same session key generation mechanism as the identity authentication module 2022, and the identity authentication The decryption mechanism corresponding to the encryption mechanism in the module; the security processing module 2011 and the identity authentication module 2022 generate their own session keys according to the same session key generation mechanism; the identity authentication module 2022 uses its own session key to pair the session ticket generated by itself To encrypt, the security processing module 2011 uses its own session key to decrypt the encrypted session ticket from the identity authentication module 2022, and returns the decrypted session ticket to the identity authentication module through the first interface unit 2027 and the second interface unit 2015 2022: The identity authentication module 2022 compares the received session ticket with the session ticket generated by itself.

The security processing module 2011 includes at least: an identity information entry and storage unit 2012, a second session key generation unit 2013, and a decryption unit 2014; the identity authentication module 2022 includes at least: a first session key generation unit 2023, a first session ticket generation unit 2024, an encryption unit 2025, and an identity authentication unit 2026.

Wherein, the first session key generation unit 2023 is used to generate the first session key with the identity information of the portable storage device 202 itself as the key seed; the first session ticket generation unit 2024 is used to generate the first session ticket and The first session ticket is sent to the encryption unit 2025 and the identity authentication unit 2026; the encryption unit 2025 is configured to use the first session key to encrypt the first session ticket, and pass the encrypted first session ticket through the first interface unit 2027 and the second interface The unit 2015 sends it to the decryption unit 2014; the identity information entry and storage unit 2012 is used to enter the identity information of the user and save the identity information entered by the user; the second session key generation unit 2013 is used to use the identity information entered by the user as a key The seed generates a second session key according to the generation mechanism of the first session key; the decryption unit 2014 is configured to use the second session key to decrypt the first session ticket from the encryption unit 2025 according to a decryption mechanism corresponding to the encryption mechanism, and The second session ticket obtained after decryption is sent to the identity authentication unit 2026 through the first interface unit 2027 and the second interface unit 2015; the identity authentication unit 2026 is used to compare the second session ticket from the decryption unit 2014 with the first session ticket Whether the first session ticket of the generating unit 2024 is consistent, if consistent, the identity authentication of the terminal 201 is passed; otherwise, the identity authentication fails.

In addition, it should be noted that after the identity authentication is completed, the security processing module 2011 used for this identity authentication will be automatically deleted from the terminal 201, and when the next identity authentication is performed, a new security processing module will be loaded to terminal 201.

In practical applications, the terminal 201 can be a PC, a mobile phone, an automatic teller machine (ATM), etc. Correspondingly, the first interface unit 2027 and the second interface unit 2015 connecting the terminal 201 and the portable storage device 202 can adopt the ISO7816 interface protocol, universal storage Card interface protocol, USB interface protocol, if the wireless communication module (not shown) is embedded in the terminal 201 and the portable storage device 202, the first interface unit 2027 and the second interface unit 2015 connecting the terminal 201 and the portable storage device 202 A wireless interface protocol may be used.

In practical applications, the identity information used for identity authentication may be a PIN, or biometric information, such as fingerprint information, iris information, and the like. When the identity information is a PIN, the identity authentication entry and storage unit 2012 may include a soft keyboard for the user to input a PIN.

Based on the above-mentioned identity authentication system, Fig. 3 is a flowchart of an identity authentication method provided by the present invention. As shown in Fig. 3, the identity authentication method includes the following steps:

In step 301, the portable storage device loads the same session key generation mechanism as itself and the decryption mechanism corresponding to its own encryption mechanism to the terminal.

Step 302, the terminal and the portable storage device generate their own session keys according to the same session key generation mechanism, specifically, the portable storage device uses its own identity information as the key seed to generate the first session key, and the terminal uses the user-entered The identity information is the key seed to generate the second session key according to the generation mechanism of the first session key.

Step 303, the portable storage device uses its own session key to encrypt the session ticket generated by itself, and the terminal uses its own session key to decrypt the encrypted session ticket from the portable storage device, and returns the decrypted session ticket to the portable The storage device, specifically, the portable storage device generates the first session ticket, encrypts the first session ticket with the first session key, and sends the encrypted first session ticket to the terminal, and the terminal uses the second session key according to the encryption mechanism A corresponding decryption mechanism decrypts the encrypted first session ticket from the portable storage device.

Step 304, the portable storage device compares the received session ticket with the session ticket generated by itself, specifically, the portable storage device compares whether the second session ticket from the terminal is consistent with the first session ticket generated by itself, and if they are consistent, the terminal's Identity authentication passed; otherwise, identity authentication failed.

An identity authentication method provided by the present invention will be described in detail below through an embodiment.

Fig. 4 is a flowchart of an embodiment of an identity authentication method provided by the present invention. As shown in Fig. 4, the identity authentication method includes the following steps:

Step 401, the portable storage device loads the same session key generation mechanism as itself and the decryption mechanism corresponding to its own encryption mechanism to the terminal.

When the terminal detects the portable storage device, the portable storage device is powered on. This method can be based on the method of the prior art, and then the portable storage device immediately uses the same session key generation mechanism as itself and the encryption mechanism corresponding to the portable storage device. The decryption mechanism is loaded to the terminal.

Step 402, the user inputs a PIN, and the terminal saves the PIN input by the user.

Preferably, in this embodiment, the user uses a soft keyboard to enter a PIN. The advantage of using the soft keyboard is that when the user enters the PIN each time, the position of each character in the soft keyboard is different. If there is a Trojan horse program in the terminal, the Trojan horse program cannot steal the PIN by recording the sequence of the characters typed by the user.

Step 403, the terminal sends an identity authentication request to the portable storage device.

Step 404, the portable storage device generates a first session ticket T and uses the PIN of the portable storage device itself as a key seed to generate a first session key K.

In the prior art, the session ticket is usually in the form of a string of random numbers. Preferably, in this embodiment, the first session ticket T can be generated according to the current session time, and at the same time, the first session key K can be generated The method is the same as the method for generating the key in the prior art, for example, hash operation, XOR operation and the like are adopted.

Step 405, the portable storage device uses the first session key K to encrypt the first session ticket T to obtain an encrypted first session ticket E(T).

The encryption method usually adopts the encryption method in the prior art.

Step 406 , the portable storage device sends an identity authentication request response to the terminal, and the identity authentication request response carries the encrypted first session ticket E(T) obtained in step 405 .

In step 407, the security authentication module in the terminal uses the PIN input by the user in step 402 as a key seed, and generates a second session key K' according to the generation mechanism of the first session key.

Step 408, the terminal uses the second session key K' generated in step 406 to decrypt the received encrypted first session ticket E(T) according to the decryption mechanism corresponding to the encryption mechanism, to obtain the second session ticket T'.

Step 409, the terminal sends the second session ticket T' to the portable storage device.

Step 410, the portable storage device verifies whether the received second session ticket T' is consistent with the first session ticket T generated in step 404, and if they are consistent, the identity authentication of the terminal is passed.

In step 411, the portable storage device returns the identity authentication result to the terminal. If the identity authentication is passed, the terminal is allowed to access the portable storage device; otherwise, enter the next cycle of authentication process or deny the terminal's access to the portable storage device.

So far, this process ends.

To sum up, the above are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (14)

1. An identity authentication system, the system comprising: a terminal, a portable storage device, characterized in that,

the portable storage device includes: an identity authentication module, a security processing module loading unit, wherein,

the identity authentication module encrypts a session bill generated by the identity authentication module by using a session key of the identity authentication module;

the safety processing module loading unit loads a safety processing module in the terminal;

the security processing module carries a session key generation mechanism which is the same as that of the identity authentication module, and generates respective session keys according to the same session key generation mechanism as that of the identity authentication module; the security processing module also carries a decryption mechanism corresponding to the encryption mechanism in the identity authentication module, decrypts the encrypted session bill from the identity authentication module by using the session key of the security processing module, and returns the session bill obtained after decryption to the identity authentication module;

and the identity authentication module is also used for comparing the received session ticket with the session ticket generated by the identity authentication module.

2. The system of claim 1, wherein the identity authentication module comprises: the system comprises a first session key generation unit, a first session bill generation unit, an encryption unit and an identity authentication unit; the secure processing module includes: the device comprises an identity information input and storage unit, a second session key generation unit and a decryption unit; wherein,

the first session key generation unit is used for generating a first session key by taking the identity information of the portable storage device as a key seed;

the first session bill generating unit is used for generating a first session bill and sending the first session bill to the encryption unit and the identity authentication unit;

the encryption unit is used for encrypting the first session ticket by using the first session key and sending the encrypted first session ticket to the decryption unit;

the identity information input and storage unit is used for inputting identity information by a user and storing the identity information input by the user;

the second session key generation unit is used for generating a second session key according to a generation mechanism of the first session key by taking the identity information input by the user as a key seed;

the decryption unit is used for decrypting the encrypted first session ticket from the encryption unit according to a decryption mechanism corresponding to the encryption mechanism by using the second session key and sending the decrypted second session ticket to the identity authentication unit;

the identity authentication unit is used for comparing whether the second session bill from the decryption unit is consistent with the first session bill from the first session bill generation unit or not, and if so, the identity authentication of the terminal is passed; otherwise, the identity authentication fails.

3. The system according to claim 1 or 2,

the terminal is a PC (personal computer), a mobile phone or an ATM (automatic teller machine);

the portable storage device is a smart card, a memory card or a USBKey.

4. The system according to claim 2, wherein an ISO7816 interface protocol, a universal memory card interface protocol, a USB interface protocol, or a wireless interface protocol is adopted between the terminal and the portable storage device.

5. The system of claim 2, wherein the identity information is a Personal Identification Number (PIN) or biometric information.

6. The system of claim 2, wherein the identity information entry and retention unit comprises a soft keyboard.

7. The system of claim 2, wherein the first session ticket and the second session ticket are generated based on a current session time.

8. An identity authentication method, characterized in that the method comprises the steps of:

the portable storage device loads a session key generation mechanism which is the same as the portable storage device and a decryption mechanism which corresponds to an encryption mechanism of the portable storage device to the terminal;

the portable storage device encrypts a self-generated session ticket by using a self-session key;

the terminal generates a session key according to a session key generation mechanism which is the same as that of the portable storage device, decrypts the encrypted session ticket from the portable storage device by using the session key of the terminal, and then returns the session ticket obtained after decryption to the portable storage device;

the portable storage device compares the received session ticket with the session ticket generated by itself.

9. The method of claim 8,

the method for generating respective session keys by the terminal and the portable storage device according to the same session key generation mechanism comprises the following steps: the portable storage equipment generates a first session key by taking the identity information of the portable storage equipment as a key seed, and the terminal generates a second session key by taking the identity information input by the user as the key seed according to a generation mechanism of the first session key;

the method for encrypting the session ticket generated by the portable storage device by using the session key of the portable storage device comprises the following steps: the portable storage device generates a first session ticket and encrypts the first session ticket using a first session key;

the method for the terminal to decrypt the encrypted session ticket from the portable storage device by using the session key of the terminal comprises the following steps: the terminal decrypts the encrypted first session ticket from the portable storage device according to a decryption mechanism corresponding to the encryption mechanism by using the second session key;

the method for comparing the received conversation bill with the self-generated conversation bill by the portable storage device comprises the following steps: the portable storage device compares whether the second session bill from the terminal is consistent with the first session bill generated by the portable storage device, and if so, the identity authentication of the terminal is passed; otherwise, the identity authentication fails.

10. The method according to claim 8 or 9, characterized in that the terminal is a PC, or a mobile phone, or an automatic teller machine ATM;

the portable storage device is a smart card, a memory card or a USBKey.

11. The method according to claim 9, wherein the terminal and the portable storage device are connected through an ISO7816 interface, or a universal memory card interface, or a USB interface, or a wireless interface.

12. The method of claim 9, wherein the identity information is a Personal Identification Number (PIN) or biometric information.

13. The method of claim 9, wherein the method for the user to enter identity information is: the user enters identity information using a soft keyboard.

14. The method of claim 9, wherein the first session ticket and the second session ticket are generated based on a current session time.

Images