TWI657350B - APP certification system and method - Google Patents

Abstract

The present invention discloses an APP authentication system, including an authenticated end, an authentication end, and an auxiliary authentication end: wherein the authenticated end is configured to send the software ID card ID of the authenticated end, the authentication end attribute value, and the main device attribute. The value is sent to the auxiliary authentication end, and the verification key generated by the auxiliary authentication end is sent to the authentication end; the auxiliary authentication end is used to use the software ID card ID stored therein to receive the software ID card ID received from the authenticated end. Performing a check, if the check is passed, generating an auxiliary authentication check key according to the authentication end attribute value and the main device attribute value received from the authenticated end and transmitting the auxiliary authentication check key to the authenticated end; the authentication end is used to obtain according to the self. The authentication end attribute value and the main device attribute value verify the verification key. The technical solution of the present invention enables the external device to perform secure authentication on the APP to improve the security of the external device data, which is not only easy to implement, but also easy to promote, and can improve the stability of the business process.

Description

APP certification system and method

The present invention relates to a system and method for APP authentication, and more particularly to a system and method for authenticating an APP by an external device.

Adding an external device to a complete terminal system is currently the main method for extending the functions of the terminal system. In order to match the external device with the terminal system, a matching APP (Application, Computer Application) program is usually loaded in the terminal system. To complete the assistance work. However, in the process of communication between the external device and the APP, the external device cannot verify the authenticity and legality of the APP, which may easily cause the risk of data leakage in the external device. In addition, because the external device cannot authenticate the legitimacy of the APP, it may cause an illegal APP or device to intercept the external device data, which may cause security problems.

The object of the present invention is to provide a method for authenticating the authenticity and authenticity of an APP to solve the security problem of mutual authentication of an external device and an APP.

According to an aspect of the present invention, an APP authentication method is provided, including: the authenticated end sends the software ID number, the authentication end attribute value, and the main device attribute value of the authenticated end to the auxiliary authentication end; the auxiliary authentication end receives the software ID card. The ID, the authentication end attribute value, and the main device attribute value; the auxiliary authentication end uses the software ID ID stored in the auxiliary authentication end to verify the software ID ID received from the authenticated end; if the verification passes, the auxiliary authentication The certificate end generates an auxiliary authentication check key according to the authentication end attribute value and the main device attribute value received from the authenticated end, and sends the auxiliary authentication check key to the authenticated end; the authenticated end sends the auxiliary authentication check key generated by the auxiliary authentication end to the authentication end. The authentication end verifies the auxiliary authentication check key according to the authentication end attribute value and the main device attribute value obtained by the authentication end; and if the verification succeeds, the authentication end completes the authenticity authentication of the authenticated end.

Through the technical solution of the present invention, it is possible to enable the external device to perform secure authentication on the APP to improve the security of the external device data, which is not only easy to implement but also easy to promote. In addition, the technical solution of the present invention can also improve the stability of the business process.

1 is a schematic diagram of an APP authentication system in accordance with the present invention.

2 is a flow chart of an APP authentication method in accordance with the present invention.

FIG. 3 is a flowchart of an APP authentication method according to a first embodiment of the present invention.

4 is a flow chart of an APP authentication method according to a second embodiment of the present invention.

The present invention proposes a system and method for authenticating the authenticity and authenticity of an APP, thereby solving the security problem of mutual authentication of an external device and an APP. The external device referred to herein may be a card detachable from the host device, an integrated card, a USB interface device, or the like.

The APP authentication system and authentication process of the present invention will be described below with reference to FIGS. 1 and 2. 1 is a schematic diagram of an APP authentication system in accordance with the present invention. Figure 2 is a flow chart of an APP authentication method according to the present invention.

As shown in FIG. 1 and FIG. 2, the system for authenticating an APP includes: at least one external device end serves as an authentication end, one APP end serves as an authenticated end, and one background end serves as an auxiliary authentication end. The background end is usually a server corresponding to the APP.

The authentication end has at least one channel 1 that can communicate with the authenticated end, and the authentication end can obtain its own unique attribute value and acquire the unique attribute value of the master device through the master device. The term "master device" as used herein refers to an APP host system device, which may be a mobile phone terminal or a computer terminal.

The authenticated end has at least one channel 2 that can communicate with the auxiliary authentication end, and is attached to the main device side and can obtain the unique attribute value of the authentication end and the attribute value of the main device through an API (Application Program Interface) interface.

In addition, there is no need to have a communication channel between the authentication end and the auxiliary authentication end, but both have consistent verification algorithms and can generate consistent verification results.

The authenticated end can obtain a unique software ID, and the uniqueness of the ID value guarantees the distinction between the APP and other APPs. The software ID ID update is saved in the auxiliary authentication terminal when the APP is released.

In the authentication process, the authentication end sends the verification request information to the auxiliary authentication end through the channel 2 between the authentication end and the auxiliary authentication end. The request information includes the encrypted software ID of the authenticated end and the authentication end attribute value. , the main device attribute value. After receiving the verification request command, the secondary authentication end acquires and decrypts the software ID number and the authentication end attribute of the authenticated end. Value, primary device attribute value. It should be noted that the above encryption and decryption processing may employ any encryption and decryption method known to those skilled in the art, and details are not described herein.

Then, the auxiliary authentication end verifies the decrypted software ID card and the software ID ID saved by itself, and if the verification fails, the error information is returned to the authenticated end; if the verification passes, the verification algorithm is passed. The auxiliary authentication check key is generated according to the received authentication end attribute value and the main device attribute value, and the generated auxiliary authentication check key is returned to the authenticated end. The verification key is used as an authentication key in identity authentication, and is a security code used for legality authentication.

After the authenticated end receives the correct check result and the auxiliary authentication check key from the auxiliary authentication end, the authenticated end initiates the inclusion of the check data (ie, the auxiliary authentication check key) to the authentication end through the channel between the authenticated end and the authenticated end. Authentication request.

After the authentication end obtains the authentication request, the authentication end obtains the verification key through the verification algorithm by using the authentication end's own attribute value and the main device attribute value obtained by the authentication end, and uses the calculated verification key to receive the verification key. The secondary authentication check key is checked. If the two are consistent, the authentication end completes the authenticity authentication of the to-be-authenticated end, and then performs subsequent service processing. If the two are inconsistent, the result of the authentication failure is returned, and further communication with the end to be authenticated is rejected.

Therefore, the authentication end and the authenticated end verify the authenticity and legality through the auxiliary authentication end.

The SIM card and Ukey are certified as follows with reference to FIG. 3 and FIG. 4, respectively. The two embodiments of the present invention are described by way of example.

First embodiment

In this embodiment, a Bluetooth SIM (Subscriber Identity Module) card is used as an authentication end, a mobile APP is used as an authenticated end, and a server is used as an auxiliary authentication end. In addition, the Bluetooth SIM card and the mobile APP are connected through a BLE (Bluetooth Low Energy) channel, and the mobile APP is connected to the auxiliary authentication terminal (server) via an Internet Internet channel.

The Bluetooth SIM card terminal can obtain its own IMSI (International Mobile Subscriber Identification Number) and the IMEI (International Mobile Equipment Identity) data of the mobile terminal, and has a school consistent with the server end. Algorithm.

The mobile APP can obtain the IMSI and the IMEI through the API interface, and obtain the software ID ID of the APP itself.

The server side stores the same software ID ID as the mobile APP, and has a verification algorithm consistent with the Bluetooth SIM card end.

The authentication process of the authentication end, the authenticated end, and the secondary authentication end is shown in FIG.

As shown in FIG. 3, before the mobile APP and the Bluetooth SIM card are authenticated, the mobile APP needs to be connected to the server through the Internet, and the software ID ID, IMSI, and IMEI of the mobile APP are encapsulated (for example, encrypted) as a request. The verification data is sent to the server.

Then, the server will request verification data parsing (for example, decryption) After that, the software ID ID of the APP received from the APP is verified according to the software ID ID stored in the server. If the verification is wrong, the information of the verification error is returned to the mobile APP. If the verification is correct, the verification key algorithm generates a verification key value from the IMSI and the IMEI in the request verification data and returns the generated verification key value to the mobile APP.

Then, after receiving the correct verification result and the verification key sent by the server, the mobile APP sends the verification key as the authentication request data to the Bluetooth SIM card.

Finally, the Bluetooth SIM card calculates the verification key by using the IMSI and the IMEI obtained as the check data by the check algorithm, and performs comparison check with the check key in the authentication request data sent by the mobile APP. If it is correct, the authenticity verification of the mobile phone APP by the Bluetooth SIM card is completed, otherwise it is determined to be an illegal request for authentication.

Second embodiment

In this embodiment, Ukey is used as the authentication end, the computer APP is used as the authenticated end, and the server is used as the auxiliary authentication end. In addition, Ukey and the computer APP are connected through a USB (Universal Serial Bus) channel, and the computer APP and the server end are connected through an Internet Internet channel. Among them, UKey is a small-sized storage device that is directly connected to a computer via USB, has a password verification function, and is reliable and high-speed.

The Ukey can obtain its own ID and computer MAC (Media Access Control) value, and has a verification algorithm consistent with the server.

The PC app can obtain the ID and power of the Ukey terminal through the API interface. The MAC value of the brain device, and the software ID ID of the APP can be obtained.

The server side stores the same software ID ID as the computer APP, and has a verification algorithm consistent with the Ukey end.

The authentication process of the authentication end, the authenticated end, and the secondary authentication end is shown in FIG.

As shown in Figure 4, before the computer APP and Ukey communication authentication, the computer APP first needs to connect with the server through the Internet, and encapsulates the software ID ID, Ukey ID and computer MAC value of the computer APP as request verification. The data is sent to the server.

Then, after the server side requests the verification data to be parsed, the software ID of the APP sent by the computer APP is verified according to the software ID number of the APP stored in the server. If the verification is wrong, the information of the verification error is returned to the mobile APP. If the verification is correct, the verification key is used to generate a verification key value from the ID and MAC in the request verification data and return the generated verification key value to the computer APP.

Then, after receiving the correct verification result and the verification key sent by the server, the PC APP sends the verification key as the authentication request data to the Ukey.

Finally, the Ukey uses the ID obtained by itself and the MAC value of the computer as the check factor to calculate the check key through the check algorithm, and compares it with the check key in the authenticated request data sent by the computer APP. If the test is correct, the Ukey end authenticates the authenticity of the computer APP, otherwise it is determined to be an illegal request for authentication.

As described above, in the technical solution of the present invention, the authentication end is assisted The authenticator verifies the validity of the authenticated end, and then generates a authenticity check key from the valid authenticated end parameter, thereby using the check key to request the authenticator to verify the authenticity of the APP. The authentication end and the auxiliary authentication end are dynamically independent of each other, so as to ensure the security of each, and the authenticity verification is performed on the premise of ensuring the legitimacy of the authenticated end, thereby preventing the illegally authenticated end from stealing the check key. The camouflage further enhances the authenticity of the authenticity of the authenticated end through the verification of authenticity.

Two specific embodiments have been described above in the first embodiment and the second embodiment, but the present invention is not limited thereto, and many extensions are possible. For example, the authentication end may be an SD card, a Bluetooth smart card, a smart cipher key or the like in addition to the above-mentioned Bluetooth SIM and Ukey, and such modifications are all included in the scope of the present invention.

It should be noted that the various embodiments described above with reference to the drawings are only intended to illustrate the invention and not to limit the scope of the invention, and those of ordinary skill in the art should understand that without departing from the spirit and scope of the invention. Modifications or equivalent substitutions of the invention are intended to be included within the scope of the invention. In addition, unless the context indicates otherwise, words in the singular include plural and vice versa. In addition, all or a portion of any embodiment can be used in combination with all or a portion of any other embodiment, unless otherwise stated.

Claims (7)

An APP authentication system includes: an authenticated end, an authentication end, and a secondary authentication end; wherein the authenticated end is configured to send the unique software ID number, the authentication end unique attribute value, and the main device unique attribute value of the authenticated end to the The auxiliary authentication end; and the auxiliary authentication check key generated by the auxiliary authentication end is sent to the authentication end; the main device refers to the APP host system device, which is a mobile phone terminal or a computer terminal; the authentication end is separable from the main device, An integrated card or USB interface device; the auxiliary authentication end is configured to verify, by using the software ID card saved in the auxiliary authentication end, the unique software ID ID received from the authenticated end, if the verification is passed And generating the auxiliary authentication check key according to the authentication end unique attribute value and the primary device unique attribute value received from the authenticated end, and sending the auxiliary authentication check key to the authenticated end; the authentication end is used to obtain according to the self-acquired The authentication end unique attribute value and the primary device unique attribute value verify the secondary authentication check key. The APP authentication system as claimed in claim 1, wherein the APP authentication system includes: an external device end as the authentication end, an APP end as the authenticated end, and a background end as the auxiliary authentication end, and the background end is the same as the APP The server corresponding to the end; The authentication terminal is a Bluetooth SIM, a Ukey, an SD card, a Bluetooth smart card, and a smart cipher key. The APP authentication system as claimed in claim 1 or 2, wherein the authentication end is a Bluetooth SIM card, the authenticated end is a mobile phone APP, and the auxiliary authentication end is a server; the Bluetooth SIM card end can acquire its own IMSI and the mobile phone IMEI. Data, and has a verification algorithm consistent with the server; the mobile APP can obtain the IMSI and IMEI through the API, and obtain the unique software ID of the mobile APP itself; the server stores the APP with the mobile phone The same software ID card, and has a verification algorithm consistent with the Bluetooth SIM card end; the Bluetooth SIM card is connected to the mobile APP via a Bluetooth low energy channel, and the mobile APP and the auxiliary authentication terminal are connected to the Internet. Channel connection. The APP authentication system as claimed in claim 1 or 2, wherein the authentication end is Ukey, the authenticated end is a computer APP, and the auxiliary authentication end is a server; wherein the Ukey can obtain the self ID and the MAC value of the computer device. And having a verification algorithm consistent with the server; the computer APP can obtain the ID of the Ukey and the MAC value of the computer device through an API interface, and can obtain the unique software ID of the computer APP; The server stores the same software ID ID as the computer APP, and has a verification algorithm consistent with the Ukey; the Ukey is connected to the computer APP via a USB channel, and the computer APP and the server are connected through the Internet. The roadway is connected, wherein the UKey is a small-sized storage device that is directly connected to the computer terminal through a USB interface, has a password verification function, and is reliable and high-speed. A method for APP authentication, which uses the APP authentication system as recited in claim 1 or 2, and includes the following steps: the authenticated end sends the unique software ID number, the authentication end unique attribute value, and the main device unique attribute value. The auxiliary authentication end; the main device refers to the APP host system device; the auxiliary authentication end uses the software ID ID saved in the auxiliary authentication end to verify the unique software ID card received from the authenticated end; If the verification succeeds, the secondary authentication end generates the secondary authentication verification key according to the authentication end unique attribute value and the primary device unique attribute value received from the authenticated end, and sends the secondary authentication verification key to the authenticated end; The authentication end sends the auxiliary authentication check key generated by the auxiliary authentication end to the authentication end; the authentication end performs the auxiliary authentication check key according to the unique attribute value of the authentication end acquired by the authentication end and the unique attribute value of the primary device. check. A method for APP authentication, which uses the APP authentication system as described in claim 3, and includes the following steps: before the mobile phone APP and the Bluetooth SIM card are authenticated, the mobile APP is first connected to the server through the Internet. And the unique software ID ID of the mobile phone APP, the IMSI of the Bluetooth SIM card, and the IMEI of the mobile phone are encapsulated and sent as the request verification data to the server; and then the server parses the request verification data. And verifying the unique software ID of the mobile phone APP received from the mobile phone APP according to the software ID ID stored in the server, and if the verification is incorrect, returning the verification error information to the mobile APP If the verification is correct, the verification algorithm is used to generate a verification key value from the IMSI of the Bluetooth SIM card in the request verification data and the mobile phone IMEI, and return the generated verification key value to the mobile phone APP; After receiving the correct verification result sent by the server and the verification key value, the mobile phone APP sends the verification key value as the authentication request data to the Bluetooth SIM card; finally, the Bluetooth SIM card will be The acquired IMSI and the IMEI are used as the check data to calculate the check key by the check algorithm, and are compared with the check key value in the authenticated request data sent by the mobile APP, and if yes, the check is completed. The Bluetooth SIM card authenticates the authenticity of the mobile phone APP, otherwise it is deemed to be an illegal request for authentication. A method for APP authentication, which uses the APP authentication system as described in claim 4, and includes the following steps: before the computer APP and the Ukey communication authentication, the computer APP first needs to be connected to the server through the Internet, and the method The unique software ID card, the Ukey ID, and the computer device MAC value of the computer APP are encapsulated and sent to the server as request verification data; then, the server parses the request verification data according to the server. The stored software ID of the APP is verified by the software APP ID of the computer APP sent by the computer APP. If the verification is incorrect, the verification error information is returned to the mobile APP, and if the verification is correct, And using a verification algorithm to generate a verification key value from the Ukey ID in the request verification data and the computer device MAC value, and return the generated verification key value to the computer APP; then, the computer APP is After receiving the correct verification result sent by the server and the verification key value, the verification key value is sent to the Ukey as the authentication request data; finally, the Ukey obtains the ID and the computer set by itself. The MAC value is used as a check factor to calculate a check key by using a check algorithm, and is compared with the check key value in the authenticated request data sent by the computer APP. If the value is correct, the Ukey pair is completed. The authenticity of the computer APP is authenticated, otherwise it is considered illegal to request authentication.