TWI803907B - System for confirming identity on different devices by verifying valid certification and method thereof - Google Patents

Abstract

A system for confirming identity on different devices by verifying a valid certification and a method thereof are provided. By signing personal data to generate a signature value by a first client, generating a coded message by a server after verifying the signature value, transmitting the coded message from the server to the first client, obtaining the coded message through the first client by a second client, transmitting he personal data and a token from the second client to the server based on connection information after the second client decodes the coded message for obtaining the connection information, the personal data and the token, inputting a verification password by the second client after the server confirms the token, and comparing a confirmation password inputted by the first client with the verification password to confirm user identity, the system and the method can confirm user identity via server, and can achieve the effect of using certificates to confirm users of different devices are the same one.

Description

System and method for confirming identity on different devices by verifying valid credentials

An identity verification system and method thereof, in particular to a system and method for confirming identity on different devices by verifying valid certificates.

Electronic credentials, also known as digital credentials, are an identification mechanism used in computer systems. An electronic certificate is a signature added to a digital ID card by an identity authentication agency, which means that the identity authentication agency has identified the user who has a digital ID card. An electronic certificate is one or a group of computer files, which record the owner's identity information and a set of public information (public key), where the public key corresponds to a set of private keys exclusive to the owner of the electronic certificate. The owner of the electronic certificate can authenticate his identity to the computer system through the private key, so as to access or use a specific computer service.

In recent years, due to the popularization of network services, identification methods on the Internet have become more and more important. Currently, one of the main methods of identification on the Internet is to use electronic certificates. However, the current application process for electronic vouchers requires identity verification, that is, applicants are required to bring their identity documents to the counter of the application for electronic vouchers in person. Once the applicant is inconvenient to go to the counter for personal or environmental factors , the application for electronic vouchers cannot be completed, which is inconvenient for applicants of electronic vouchers.

To sum up, it can be seen that there has been a problem in the prior art for a long time that the applicant needs to go to the counter to confirm the identity in order to apply for an electronic certificate, which causes inconvenience to the applicant. Therefore, it is necessary to propose an improved technical means to solve this problem.

In view of the problem in the prior art that the applicant needs to personally visit the counter to confirm the identity of the application of the electronic certificate, which causes inconvenience to the applicant, the present invention discloses a system and method for verifying the identity on different devices through the verification of valid certificates, in which:

The system disclosed in the present invention for confirming identity on different devices by verifying valid certificates at least includes: a first client for inputting personal data and confirming passwords, and signing personal data to generate a signature value; a server, It is used to receive the personal data and signature value sent by the first client, and to verify the personal data and signature value, and to generate a verification token after the personal data and signature value are verified, and to generate a token containing personal data, Verify the coded message of the token and connection information, and send the coded message to the first client; the second client is used to obtain the coded message through the first client, and decode the coded message to send personal data and information based on the connection information Verify the token to the server, make the server confirm the verification token, and use it to enter the verification password after the verification token is confirmed by the server, and send the verification password to the server, so that the server compares the verification password with the confirmation password to confirm the user identity.

The method disclosed in the present invention for confirming identity on different devices by verifying valid certificates, the steps at least include: the first client enters personal data and confirms the password, and signs the personal data to generate a signature value; the first client Send the personal data and signature value to the server, and the server verifies the personal data and signature value; the server generates a verification token after the personal data and signature value are verified; the server generates a token containing personal data, verification token, and link The encoded message of the online information, and send the encoded message to the first client; the second client obtains the encoded message through the first client; the second client decodes the encoded message to send personal data and verification tokens to the server according to the connection information , so that the server confirms the verification token; the second client enters the verification password after the verification token is confirmed by the server, and sends the verification password to the server; the server compares the verification password and the confirmation password to confirm the identity of the user.

The system and method disclosed in the present invention are as above, and the difference from the prior art is that the present invention generates an encoded message and sends it back to the first client after the server verifies the signature value generated by the personal data signature of the first client After the second client obtains the encoded message through the first client, it decodes the encoded message to obtain connection information, personal data and verification token, and sends the personal data and verification token to the server according to the connection information, so that the server can confirm Verify the token, and compare the confirmation data entered by the first client with the verification password entered by the second client after the token is verified to confirm the user's identity, so as to solve the problems existing in the prior art, and can achieve electronic Vouchers confirm the same technical performance for users of different devices.

The features and implementation methods of the present invention will be described in detail below in conjunction with the drawings and embodiments, the content is enough to enable anyone familiar with the relevant art to easily and fully understand the technical means used to solve the technical problems of the present invention and implement them accordingly, thereby realizing The effect that the present invention can achieve.

The present invention can verify the user's valid certificate on the first client through the server so that the second client used by the user can confirm the user's identity through the server. Among them, the valid certificate mentioned in the present invention is a digital certificate that can be verified by the certificate verification server (Validation Authority, VA), including but not limited to financial certificates, natural person certificates, business certificates, etc.

The server, the first client and the second client mentioned in the present invention can all be computing devices. The computing device mentioned in the present invention includes but is not limited to one or more processing modules, one or more memory modules, and hardware such as buses connecting different hardware components (including memory modules and processing modules). body element. Through the included multiple hardware components, the computing device can load and execute the operating system, so that the operating system can run on the computing device, and can also execute software or programs. In addition, the computing device also includes a casing, and the above-mentioned hardware components are arranged in the casing.

The bus of the computing device mentioned in the present invention can include one or more types, such as data bus (data bus), address bus (address bus), control bus (control bus), expansion function bus ( expansion bus), and/or local bus (local bus) and other types of bus. Buses for computing devices include, but are not limited to, Industry Standard Architecture (ISA) buses, Peripheral Component Interconnect (PCI) buses, Video Electronics Standards Association (VESA) boards Domain bus, and serial universal serial bus (Universal Serial Bus, USB), fast peripheral component interconnection (PCI Express, PCI-E/PCIe) bus, etc.

The processing module of the computing device mentioned in the present invention is coupled to the bus bar. The processing module includes a register group or register space, which can be completely set on the processing chip of the processing module, or all or part of it is set outside the processing chip and coupled to the handle wafer via dedicated electrical connections and/or via bus bars. The processing module can be a central processing unit, a microprocessor or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processing modules, the processing modules included in the computing device are all the same or similar, and are coupled and communicated through a bus. A processing module can interpret a computer instruction or a series of multiple computer instructions to perform specific calculations or operations, such as mathematical operations, logical operations, data comparison, copying/moving data, etc., to drive other hardware in the computing device components or run the operating system or execute various programs and/or modules.

Computing devices usually also contain one or more chipsets (Chipsets). The processing module of the computing device can be coupled to the chip set or electrically connected to the chip set through a bus bar. The chipset is composed of one or more integrated circuits (Integrated Circuit, IC), including memory controllers and peripheral input/output (I/O) controllers, etc., that is, memory controllers and peripheral I/O controllers A circuit breaker can be contained in one integrated circuit or implemented using two or more integrated circuits. Chipsets usually provide input/output and memory management functions, and provide multiple general and/or special registers, timers, etc., wherein the above general and/or special registers and timers can be coupled or Accessed or used by one or more processing modules electrically connected to the chipset.

The processing module of the computing device can also access the data in the memory module and the mass storage area installed on the computing device through the memory controller. The above-mentioned memory modules include any type of volatile memory (volatile memory) and/or non-volatile (non-volatile memory, NVRAM) memory, such as static random access memory (Static Random Access Memory, SRAM) , Dynamic Random Access Memory (Dynamic Random Access Memory, DRAM), Read-Only Memory (Read-Only Memory, ROM), Flash memory (Flash memory), etc. The above-mentioned large-capacity storage area can include any type of storage device or storage medium, such as hard disk drive, optical disc (optical disc), flash drive (flash drive), memory card (memory card), solid state hard disk (Solid State Disk) , SSD), or any other storage device, etc. That is to say, the memory controller can access data in SRAM, DRAM, flash memory, hard disk drive, and solid-state hard disk.

The processing module of the computing device can also be connected and communicated with peripheral devices or interfaces such as peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers through the peripheral I/O controller via the peripheral I/O bus. The peripheral input device can be any type of input device, such as keyboard, mouse, trackball, touch pad, joystick, etc., and the peripheral output device can be any type of output device, such as display, printer, etc., peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface may include a wireless communication interface and/or a wired communication interface, and the wireless communication interface may include support for a wireless local area network (such as Wi-Fi, Zigbee, etc.), Bluetooth, infrared, near-field communication (Near-field communication, NFC), 3G/4G/5G and other mobile communication network (cellular network) or other wireless data transmission protocol interface, wired communication interface can be Ethernet device, DSL modem, cable (Cable) modem, asynchronous transmission Mode (Asynchronous Transfer Mode, ATM) device, or optical fiber communication interface and/or components, etc. The processing module can periodically poll (polling) various peripheral devices and interfaces, so that the computing device can input and output data through various peripheral devices and interfaces, and can also communicate with another computing device with the hardware components described above to communicate.

In the following, the system architecture of the present invention will be described by using the "Fig. 1" system structure diagram of the system architecture for verifying identity on different devices through verification of valid certificates mentioned in the present invention. As shown in FIG. 1 , the system of the present invention includes a first client 110 , a server 120 , and a second client 130 . Wherein, the first client 110 and the server 120 and between the server 120 and the second client 130 can transmit data or signals to each other through wired or wireless networks.

The first client 110 is responsible for inputting personal information and confirming password. The personal data input by the first client 110 includes user identification data, wherein the user identification data can be the user's ID card number, passport number, etc., but the present invention is not limited thereto; the confirmation password can be obtained by A certain number of letters, numbers, and symbol arrangements are generated. Generally speaking, the first client 110 can provide a data input interface for inputting personal data and confirming a password.

The first client 110 is also responsible for using the private key (private key) corresponding to the public key (public key) in the valid certificate to sign the input personal data to generate a signature value corresponding to the personal data. In some embodiments, the first client 110 may also use the personal data and the confirmation password as a combined data and sign the combined data to generate a signature value.

The first client 110 is also responsible for sending the input personal data and confirmation password, and the generated signature value to the server 120 , and is responsible for receiving the coded message sent by the server 120 . The coded information mentioned in the present invention is the data that can obtain the connection method of the server 120 and one or more data generated by the server 120, and can be presented in the form of text, barcode, or graphics, but the present invention does not mean that limit. Among them, the above-mentioned methods of obtaining data include but are not limited to decoding coded messages or connecting to a specific target (such as a specific host or server) for downloading according to coded messages.

The server 120 is responsible for receiving the personal data, confirmation password, and signature value sent by the first client 110, and responsible for verifying the personal data and the signature value. Since the method of verifying based on the personal data and the corresponding signature value is already known, the present invention will not further describe it.

The server 120 is also responsible for generating a verification token (token) after the personal data and the signature value are verified. The verification token generated by the server 120 includes a verification value. Generally speaking, the verification value is generated by the server 120 in a certain way, for example, randomly generated or generated using the current time value, etc., but the present invention is not limited thereto . In some embodiments, the verification token may also include a time stamp, where the time stamp may represent the current time or the effective time.

The server 120 is also responsible for generating the encoded message, and responsible for sending the generated encoded message to the first client 110 . Generally speaking, the server 120 can use various well-known algorithms to generate text, barcode, or graphic encoded messages. The coded message generated by the server 120 may include the personal data received by the server 120 , the verification token generated by the server 120 , and the connection information of the server 120 . The connection information includes but not limited to URI/URL Scheme and/or API provided by the server 120 .

In some embodiments, the server 120 can also provide the first client 110 to set the hook value corresponding to the encoded message, and when receiving the same hook value sent by the second client 130, the corresponding The encoded message is sent to the second client 130 .

The server 120 is also responsible for storing the generated verification token and the received confirmation password. Generally speaking, the server 120 can store the generated verification token and authentication data as a piece of data in the data correspondence table. In some embodiments, the server 120 can also generate authentication information when generating the authentication token, that is, after the personal data and the signature value are verified, and can use the generated authentication token, confirmation password, and authentication information It is stored as a piece of data in the data correspondence table. The way the server 120 generates authentication data can be randomly generated or based on serial numbers, but the present invention is not limited thereto. Any method that can generate unique values or is sufficient to identify multiple specific data within a certain period of time is acceptable. It can be used by the server 120 to generate authentication information.

The server 120 is also responsible for receiving the personal data and the verification token sent by the second client 130, and confirming the received verification token. For example, the server 120 can judge whether the received verification token exists in the data correspondence table, if so, the server 120 can judge that the received verification token has passed the verification, and can confirm the received verification token, If not, that is, there is no identical verification token in the data correspondence table, the server 120 may determine that the received verification token has not passed the verification. The server 120 can also judge whether the verification token has been received, if so, it can judge that the received verification token has not passed the verification, if the verification token has not been received, that is, the verification token has not been recorded as received, then the server 120 can Record the received verification token as received, and judge whether the verification token passes the verification according to whether the received verification token exists in the data correspondence table.

In some embodiments, when the server 120 confirms the verification token, it can also check whether the validity period of the received verification token is valid, that is, to determine whether the time indicated by the timestamp in the verification token is within the valid time, for example , when the time represented by the timestamp is the current time when the verification token is generated, the server 120 can judge whether the validity period of the verification token is valid according to whether the time difference between the time represented by the timestamp and the current time is within a predetermined range. When the time indicated by the stamp is the validity time of the verification token, the server 120 can judge whether the validity period of the verification token is valid according to whether the time represented by the time stamp is later than the current time. When the validity period of the verification token is valid, the server 120 It can be judged that the received verification token has not passed the verification, otherwise, the server 120 can judge that the received verification token has not passed the verification; the server 120 can also check whether the verification token has been confirmed, that is, check the verification value in the verification token Whether it has been received, if so, the server 120 can judge that the received verification token has not passed the verification, if not, the server 120 can judge that the received verification token has passed the verification.

The server 120 may also read the authentication data stored as the same data as the verification token from the data correspondence table after confirming the verification token, and send the read authentication data to the second client 130 .

The server 120 is also responsible for receiving the verification password sent by the second client 130, and comparing the received verification password with the previously stored confirmation password to confirm the user's identity, and can generate the user's identity confirmation result and The generated identity confirmation result is sent back to the second client 130 . In more detail, the server 120 can search from the data correspondence table whether there is a confirmation password that is the same as the verification password, and when there is a confirmation password that is the same as the verification password, the server 120 can determine whether the first client 110 and the second client 130 users are the same, and then confirm the user identity, otherwise, when there is no confirmation password identical to the verification password in the data correspondence table, the server 120 can request the second client 130 to resend the verification password, and can be in the data correspondence When there is no confirmation password identical to the verification password in the table and the number of times reaches a predetermined value, it is determined that the users of the first client 110 and the second client 130 are different.

In some embodiments, the server 120 can receive the authentication information when receiving the authentication password, and can read the confirmation password from the data correspondence table according to the received authentication information, and compare the received authentication password and whether the read confirmation password is the same.

The second client 130 is responsible for obtaining the encoded message generated by the server 120 through the first client 110 . In more detail, the second client 130 can retrieve the coded message displayed by the first client 110, receive the coded message pushed by the first client 110, and send the The device 120 downloads the coded message, receives the coded message sent by the first client 110 through email or instant message, or receives the coded message from the first client 110 through a cross APP.

The second client 130 is also responsible for decoding the obtained coded message to obtain the connection information, personal data and verification token represented by the coded message, wherein the second client 130 can use the decoding algorithm corresponding to the generated coded message to decode the code message to obtain connection information, personal data and verification token, or the second client 130 can also connect to a specific target to download connection information, personal data and verification token according to the coded message. However, the manner in which the second client 130 decodes the encoded message is not limited to the above.

The second client 130 is also responsible for sending the obtained verification token and all or part of the personal data to the server 120 according to the obtained connection information. For example, the second client 130 can directly send personal data and verification tokens to the server 120 according to the API of the server 120 included in the connection information; Open a specific application and provide the API, personal data and verification token of the server 120 to the opened application, so that the opened application sends all or part of the personal data and verification token to the server according to the API of the server 120 server 120, but the way the second client 130 transmits the verification token and personal data to the server 120 according to the connection information is not limited to the above.

The second client 130 is also responsible for inputting the verification password after the obtained verification token is confirmed by the server 120 , or after receiving the verification information sent by the server 120 . Generally speaking, the second client 130 may provide a password input interface for inputting a verification password.

The second client 130 is also responsible for sending the input verification password to the server 120. If the second client 130 has received the authentication data, the second client 130 can also send the authentication data and the verification password to the server 120.

The second client 130 can also receive the identity confirmation result sent by the server 120, and when the identity confirmation result shows that the server 120 judges that the verification password is the same as the confirmation password, use the obtained personal information and the input verification password to send A certificate server (not shown in the figure) applies for a digital certificate.

Next, an embodiment is used to explain the operating system and method of the present invention, and please refer to "FIG. 2A" for the flow chart of the method for verifying identity on different devices through valid certificate verification proposed by the present invention. In this embodiment, it is assumed that the first client 110 is a personal computer or a notebook computer, and the second client 130 is a smart phone, but the present invention is not limited thereto.

When the user intends to perform identity verification on the second client 130 to apply for a digital certificate, if he chooses to use the present invention, the user can operate the first client 110 that already has a valid digital certificate, and in the first client Input the personal data and confirm the password at 110 , so that the first client 110 signs the input personal data to generate a signature value (step 210 ). In this embodiment, it is assumed that the user can operate the first client 110 to perform a browser connection to the server 120, and then the browser can display a data input interface to provide the user with inputting personal information and confirming the password, and can be used After completing the input of personal information and confirmation password, the user uses the private key corresponding to the digital certificate to sign the input personal information and confirmation password to generate a corresponding signature value.

After the first client 110 generates the signature value, the first client 110 can transmit the input personal data and the generated signature value to the server 120, and the server 120 can receive the signature value from the first client 110. After sending the personal data and signature value, verify the received personal data and signature value (step 220). In this embodiment, it is assumed that the first client 110 can send the personal data, the confirmation password, and the signature value generated by signing the personal data and the confirmation password to the server 120, and the server 120 can send the personal data, confirmation password Password, and signature value for verification.

If the personal data (, confirmation password) and the signature value have not passed the verification of the server 120, then the server 120 may not generate a prompt message, and may send the generated prompt message back to the first client 110, so that the first client The terminal 110 displays the prompt message generated by the server 120; and if the personal data (and confirmation password) and the signature value are verified by the server 120, the server 120 can generate a verification token (step 231). In this embodiment, it is assumed that the server 120 can randomly generate the verification value in the verification token, and can add a time stamp indicating the validity period to the verification token. At the same time, the server 120 can also send the received personal data The user identification data, the received confirmation password and the generated verification token are stored in the data correspondence table as a piece of data.

After the server 120 generates the verification token, the server 120 can generate an encoded message, and can send the generated encoded message to the first client 110 (step 235 ). In this embodiment, it is assumed that the server 120 can generate a coded message that records the personal data received from the first client 110, the generated verification token, and the connection information of the server 120, and the coded message is presented in a QR code .

After the first client 110 receives the encoded message sent by the server 120 , the second client 130 can obtain the encoded message generated by the server 120 through the first client 110 (step 240 ). In this embodiment, it is assumed that the first client 110 can display the coded information received from the server 120 through the included display module such as a touch screen, and the second client 130 can display the encoded information received from the server 120 through the included image capture module ( Such as a camera lens and a photosensitive element) to capture the coded information displayed by the first client 110 .

After the second client 130 obtains the encoded message generated by the server 120, the second client 130 can decode the obtained encoded message to obtain the personal data, verification token, and connection information contained in the encoded message, and can according to The connection information sends the verification token and all or part of the personal data to the server 120 (step 250). In this embodiment, assuming that the second client 130 can obtain the data recorded in URL Scheme after decoding the encoded message, the second client 130 can obtain the corresponding application according to the application identifier in the URL Scheme. The name of the program is displayed on the user interface 310 as in "Figure 3A". When the user clicks on the block 311 of "Open APP" in the user interface 310, the corresponding application program is opened, and through the second client 130 The operating system sends the personal data, verification token, and connection information as parameters to the opened application program, so that the opened application program can use the personal data according to the connection information after being executed by the second client 130. The user identification data and verification token are sent to the server 120.

After the server 120 receives the personal data and the verification token sent by the second client 130 , it can confirm the received verification token (step 260 ). In this embodiment, it is assumed that the server 120 can read the verification token stored as the same data from the data correspondence table according to the user identification data in the received personal data, and can compare the read verification tokens. Whether the token is the same as the received verification token, if the two verification tokens are the same, the server 120 can confirm that the received verification token is valid, otherwise, the server 120 can confirm that the verification token is invalid. The server 120 can also confirm whether the verification token is recorded as received, and if so, the server 120 can confirm that the received verification token is invalid. In addition, the server 120 can also determine whether the validity period contained in the verification token is earlier than the current time after comparing the read verification token with the received verification token, and if so, the server 120 can confirm the verification token Invalid, if not, then the server 120 can confirm that the verification token is valid, or the server 120 can further judge whether the verification value in the verification token has been verified, that is, determine whether the server 120 has ever received a verification token that contains the same verification value , if yes, the server 120 can confirm that the verification token is invalid; if not, the server 120 can confirm that the verification token is valid.

If the server 120 confirms that the received verification token is invalid, the server 120 can generate a confirmation result message indicating that the verification token is invalid, and can send the generated confirmation result message to the second client 130; and if the server 120 After confirming that the verification token is valid, the second client 130 may input the verification password, and transmit the input verification password to the server 120 (step 270 ). In this embodiment, it is assumed that the server 120 can generate a confirmation result message indicating that the verification token is valid or invalid after confirming whether the verification token is valid, and can transmit the generated confirmation result message to the second client 130, the second client The previously opened application program executed by the terminal 130 may display a prompt message corresponding to the confirmation result message when it determines that the confirmation result message indicates that the verification token is invalid after receiving the confirmation result message, or may display a prompt message corresponding to the confirmation result message when the confirmation result message indicates that the verification token is invalid. When valid, provide the user with a password input interface 320 (as shown in "Figure 3B") containing the user identification data in the received personal data, so that the user can input the verification password into the In the application program executed by the second client 130 .

After the server 120 receives the verification password sent by the second client 130, the server 120 can compare the verification password received from the second client 130 with the confirmation password received from the first client 110, and can The user identity is confirmed against the result (step 280). In this embodiment, it is assumed that the server 120 can read the corresponding confirmation password (stored as the same data) from the data correspondence table according to the verification value in the received verification token, and compare the received The verification password and the read confirmation password, when the verification password is different from the confirmation password, the server 120 can generate a corresponding identity confirmation message and send the generated identity confirmation message to the second client 130 (and the first client 110), so that the second client 130 (and the first client 110) display a corresponding prompt message according to the identity confirmation message generated by the server 120; and if the verification password is the same as the confirmation password, the server 120 can confirm the use of If the identity of the user is correct, that is, it is judged that the users of the first client 110 and the second client 130 are the same, the server 120 can generate a corresponding identity confirmation message, and can send the generated identity confirmation message to the second client End 130.

In this way, through the present invention, the second client 130 can confirm the identity of the user through the first client 110 and the server.

In the above embodiment, after the second client 130 receives the identity confirmation message sent by the server 120, if the identity confirmation message indicates that the user's identity is correct, then the second client 130 can execute the operation that the user wants to perform, such as As shown in the flow of "FIG. 2B", the second client 130 can apply for a digital certificate from the certificate server according to the received personal information and the verification password input by the user (step 290).

In addition, the above embodiment can also be shown in the process shown in "Fig. 2C", before or after the server 120 generates the verification token (step 231), the server 120 can generate authentication data (step 233), such as a serial number. Afterwards, the server 120 can generate a coded message including connection information, personal data and verification token and send the coded message to the first client 110 (step 235), so that the second client 130 can obtain the code through the first client 110 message (step 240).

Then, the second client 130 can decode the coded message to obtain connection information, personal data and verification token, and can transmit the personal data and verification token to the server 120 according to the connection information (step 250), so that the server 120 can send the previously generated authentication information to the second client 130 after confirming the verification token (step 260) (step 265), so that the second client 130 can receive the authentication information sent by the server 120 Input the verification password, and transmit the input verification password and the received authentication information to the server 120 (step 275 ).

After the server 120 receives the verification password and authentication information sent by the second client 130, it can compare whether the received authentication information is the same as the authentication information sent. When the two authentication information are the same, the server 120 can compare Verify the identity of the user with the received verification password and the read confirmation password (step 280 ).

To sum up, it can be seen that the difference between the present invention and the prior art lies in that after the server verifies the signature value generated by the personal data signature of the first client, an encoded message is generated and sent back to the first client, and the second After the client obtains the encoded message through the first client, it decodes the encoded message to obtain connection information, personal data and verification token, and sends the personal data and verification token to the server according to the connection information, so that the server confirms the verification token, and Compare the confirmation data entered by the first client with the verification password entered by the second client after the token is verified to confirm the user's identity. This technical method can solve the problem of electronic application in the prior art. The certificate requires the applicant to personally visit the counter to confirm the identity, which causes inconvenience to the applicant, and then achieves the same technical effect of using electronic certificates to confirm users of different devices.

Furthermore, the method for confirming identity on different devices by verifying valid certificates of the present invention can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or distributed with different components Implemented in a decentralized manner over several interconnected computer systems.

Although the embodiments disclosed in the present invention are as above, the content described is not intended to directly limit the scope of protection of the present invention. Anyone with ordinary knowledge in the technical field of the present invention, without departing from the spirit and scope disclosed in the present invention, makes some changes and modifications to the form and details of the implementation of the present invention, all of which belong to the patent protection of the present invention scope. The scope of patent protection of the present invention shall still be defined by the scope of the attached patent application.

110: The first client 120: server 130: Second client 310: user interface 311: block 320: password input interface Step 210: the first client enters the personal data and confirms the password, and signs the personal data to generate a signature value Step 220: The first client sends the personal data and signature value to the server, and the server verifies the personal data and signature value Step 231: The server generates a verification token after the personal data and the signature value are verified Step 233: The server generates authentication information Step 235: The server generates a coded message including personal data, verification token and connection information, and sends the coded message to the first client Step 240: The second client obtains the encoded message through the first client Step 250: The second client decodes the encoded message to send the personal data and verification token to the server according to the connection information Step 260: The server confirms the authentication token Step 265: The server sends the authentication data to the second client Step 270: The second client enters the verification password after the verification token is confirmed by the server, and sends the verification password to the server Step 275: The second client enters the verification password after receiving the verification data, and sends the verification password and verification data to the server Step 280: The server compares the verification password and the confirmation password to confirm the user identity Step 290: When the server determines that the verification password is the same as the confirmation password, the second client uses the personal information and the verification password to apply for a digital certificate

Figure 1 is a system architecture diagram of the present invention for verifying identities on different devices through verification of valid certificates. FIG. 2A is a flow chart of a method for verifying identities on different devices by verifying valid credentials proposed by the present invention. FIG. 2B is a flow chart of an additional method for verifying identities on different devices by verifying valid credentials proposed by the present invention. FIG. 2C is a detailed flow chart of the method for confirming the identity of the user by the server proposed in the present invention. FIG. 3A is a schematic diagram of an operation screen for opening an application program according to an embodiment of the present invention. FIG. 3B is a schematic diagram of the verification password input screen proposed by the embodiment of the present invention.

Step 210: the first client enters the personal data and confirms the password, and signs the personal data to generate a signature value

Step 220: The first client sends the personal data and signature value to the server, and the server verifies the personal data and signature value

Step 231: The server generates a verification token after the personal data and the signature value are verified

Step 235: The server generates a coded message including personal data, verification token and connection information, and sends the coded message to the first client

Step 240: The second client obtains the encoded message through the first client

Step 250: The second client decodes the encoded message to send the personal data and verification token to the server according to the connection information

Step 260: The server confirms the authentication token

Step 270: The second client enters the verification password after the verification token is confirmed by the server, and sends the verification password to the server

Step 280: The server compares the verification password and the confirmation password to confirm the user identity

Claims (10)

A system for confirming identities on different devices by verifying valid certificates, the system at least includes: a first client for inputting a personal data and a confirmation password, and signing the personal data to generate a signature value; The server is used to receive the personal data, the confirmation password and the signature value sent by the first client, verify the personal data and the signature value, and use the personal data and the signature value After passing the verification, generate a verification token and a coded message, and send the coded message to the first client, wherein the coded message includes the personal data input by the first client, the verification token, and connection information of the server; and a second client, used to obtain the coded message generated by the server through the first client, and decode the coded message to obtain the first client The inputted personal data, the verification token generated by the server, and the connection information of the server, and sending the personal data and the verification token to the server according to the connection information, so that the server Confirm the verification token, and input a verification password after the verification token is confirmed by the server, and send the verification password to the server, so that the server compares the verification password with the confirmation password to determine the Whether the users of the first client and the second client are the same. The system for verifying identities on different devices by verifying valid certificates as described in Claim 1, wherein the second client is further used to use the personal data and the Verify the password to apply for a digital certificate. The system for verifying identity on different devices by verifying valid certificates as described in Claim 1, wherein the server is further used to generate and store an authentication data when generating the verification token, and in After confirming the authentication token, read and send the authentication information to the second client, and the second client is further used to send the authentication password and the authentication information to the server, so that the server can read the authentication information based on the authentication information. Output the confirmation password to compare with the verification password. The system for confirming identities on different devices by verifying valid certificates as described in Claim 1, wherein the second client retrieves the coded message displayed by the first client and receives the push broadcast by the first client the coded message, download the coded message from the server according to the hook value agreed with the first client, receive the coded message sent by the first client via email or instant message, or pass the cross-application ( cross APP) to receive the coded message to obtain the coded message through the first client. The system for confirming identity on different devices by verifying a valid certificate as described in Claim 1, wherein the server is to confirm whether the verification token exists, whether the validity period of the verification token is valid, and/or whether the verification token has been Confirm to confirm the verification token. A method for confirming identities on different devices by verifying valid certificates, the method at least includes the following steps: a first client enters a personal data and a confirmation password, and signs the personal data to generate a signature value; A client sends the personal data, the confirmation password and the signature value to a server, and the server verifies the personal data and the signature value; after the personal data and the signature value are verified by the server, Generate a verification token; the server generates a coded message including the personal data input by the first client, the verification token generated by the server, and the connection information of the server, and transmits the code send a message to the first client; A second client obtains the encoded message generated by the server through the first client; the second client decodes the encoded message to obtain the personal data input by the first client, the information generated by the server The verification token, and the connection information of the server, and send the personal data and the verification token to the server according to the connection information, so that the server can confirm the verification token; Enter a verification password after the token is confirmed by the server, and send the verification password to the server; and the server compares the verification password with the confirmation password to determine the use of the first client and the second client are the same. The method for confirming identity on different devices by verifying a valid certificate as described in claim 6, wherein the method further includes the second client on the server after the step of comparing the verification password with the confirmation password at the server When the device judges that the verification password is the same as the confirmation password, use the personal information and the verification password to apply for a digital certificate. The method for confirming identity on different devices by verifying a valid certificate as described in Claim 6, wherein the method further includes a step for the server to generate an authentication data after the step for the server to generate the verification token, and the method After the server confirms the verification token, it further includes the server sending the verification data to the second client, and the second client sending the verification password and the verification data to the server. The method for confirming identity on different devices by verifying a valid certificate as described in Claim 6, wherein the step of obtaining the coded message by the second client through the first client is for the second client to obtain the first client The coded message displayed on the terminal, the first client pushes the coded message to the second client, and the second client sends the coded message to the server according to the hook value agreed with the first client. carry the encoded message, the first client transmits the encoded message to the second client via email or instant message, or transmits the encoded message from the first client to the second client in a cross-application manner end. The method for confirming identity on different devices by verifying a valid certificate as described in claim item 6, wherein the step of confirming the verification token by the server is to confirm whether the verification token exists, whether the validity period of the verification token is valid, and/or Whether the verification token has been confirmed.

Images