TW201328280A - Instant communication identity authentication system and method - Google Patents

Abstract

The invention provides a system and method for identity authentication on an instant communication network. The system is composed of an identity verification module attached to the instant communication software, an authentication server and the user's certificate and key carrier (such as an IC card). The digital certificate authenticated by a public trust authority allows the user identity to be linked with the key carrier, and then the purpose of authenticating the user identity in the instant communication network can be achieved through this system and method.

Description

Instant messaging identity authentication system and method

The present invention relates to a system and method for authenticating an identity, and more particularly to a system and method for performing identity with instant messaging, without the need to identify identity by video, voice, etc.

The immediacy and convenience of instant messaging have been widely welcomed by users. It has become an important tool for modern people to communicate. It can replace the functions of E-mail and telephone to some extent, thus changing the mode of interpersonal interaction. When communicating on instant messaging, most of them have already defaulted to trusting each other as people we think, but in fact, most of the authentication technologies of instant messaging are based on account passwords, through e-mail as the initial authentication mechanism, even if it is Free mailboxes can usually be used as well, so the degree of trustworthiness is not high, and it is easy for a person with a heart to deliberately use a similar name to create a security hole.

Moreover, in order to receive messages from other people at any time, the instant messaging system usually does not log out even if it is not used for a long time after login, so there are also physical security concerns, even for valid and valid account passwords. It may be exploited by others to steal instant messaging systems.

Based on the above points, although instant messaging is the starting point for interpersonal communication, it is actually a lack of guarantees for the actual connection with "people." For example, instant messaging is often a communication tool for discussion or meeting at work, but we are There is no way to confirm the identity of the other party directly by instant messaging. It must be a friend who knows, in order to carry out identity authentication by means of mobile phones, video and other additional methods.

Not only does general interpersonal communication require identity verification and content certification mechanisms, but online robot service activities require such mechanisms to ensure the client and transaction content. If the mechanism for identity verification and content certification cannot be provided, it will enable instant messaging in business. The application of critical content such as finance and finance is greatly limited.

In the online world, to ensure identity, information security experts recognize that public key infrastructure (PKI) mechanisms are the safest and most secure way to achieve personal identity verification and ensure non-repudiation in online services today. Achievable technology. Under the public key infrastructure, the certificate is the proof of identity, but at present, there is no practical system and method for instant messaging, which can be combined with the hardware key carrier to identify the user identity.

After intensive research, the inventor of this case finally succeeded in researching and developing the system and method for carrying out this identity through instant messaging combined with public key infrastructure (PKI) technology.

The object of the present invention is to provide a system and method for authenticating the identity of an instant messaging user, so that any instant messaging user, even an instant messaging robot, can use the system and method to perform unilateral, bidirectional or even multidirectional Mutual authentication makes communication on instant messaging more secure and certified.

The system for achieving identity authentication through instant messaging, which is based on the above-mentioned invention, is based on a digital signature and verification technology. The system includes: two or more identity verification modules, at least one of which is an instant messaging client and another One is an instant messaging server, and a verification server can be connected to the instant messaging server through a secure channel.

The identity verification module is a software component that is used together with the instant messaging software. The identity verification module has the function of reading the user's credentials and operating the user's key carrier, and can make a digital signature and send it through the instant messaging software. The identity verification module can also be connected to the verification server for verification requirements. The verification server can accept the identity verification module verification requirement, perform digital signature verification and voucher verification functions, and respond to the result.

In addition, the present invention discloses a method for identity authentication through instant messaging, which enables the instant messaging server to authenticate the identity of the instant messaging client by the authentication server during the communication process, where the client can also authenticate with the server. When the connection is made, the server and the client can complete the two-way authentication by simply swapping the identity, and the same reason can be derived for the mutual authentication of the instant messaging users.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The preferred embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a schematic diagram of a system for authenticating an instant messaging user identity provided by the present invention. As shown in FIG. 1 , the instant messaging software 12 is respectively connected to the client and the server through the instant messaging network 11 , and both the client and the server include the identity verification module 200 . The instant messaging server is additionally coupled to the authentication server 100. The instant messaging client user has a key carrier 21 (such as an IC card, etc.) containing a private key (Private Key), and a public certificate 22 containing a public key paired with the above-mentioned private key (Public Key) ) and user information. This certificate is issued by a Certificate Authority, where the certificate center must be trusted by the instant messaging server, so the certificate can be used to authenticate the client identity.

The instant messaging software 12 can be divided into a client and a server in Figure 1, but the nature is not different, only the role of the example is different. The instant messaging software 12 can communicate with other instant messaging software 12 via the instant messaging network 11 and can interface with the identity verification module 200. Such instant messaging software includes Microsoft Windows Live Messenger, Yahoo Messenger, Google Google Talk, and the like. In the present invention, the above-described instant messaging software is not limited, and any software having the same function as the above-described instant messaging software is also within the scope of the present invention.

The identity verification module 200 can operate the key carrier 21 on the client side, perform a private key operation such as signing or decryption, and can also read the voucher 22. On the general IC card, the voucher is also stored on the card. The identity verification module 200 can be connected to the verification server on the server side to perform the verification of the signature and the voucher. However, since the instant messaging software is not necessarily the client or the server, all the identity verification modules 200 can be executed. The above actions.

The key carrier 21 is a special hardware, which contains a private key in the cryptography, and cannot be known to the outside world. Only the private key operation can be performed by the vehicle, thereby ensuring the gold. The privacy and security of the key. Common keys include an IC card, a hardware security module (HSM), a Trusted Platform Module (TPM), and the like.

The voucher 22, also known as a digital voucher, refers to a digital certificate signed by a Certificate Authority (CA) to record and confirm the digital data of the public key and user information.

The verification server 100 can perform cryptographic operations to confirm the validity of the digital signature and can verify the validity of the certificate 22. The verification server 100 can be located on the same physical machine as the instant messaging server 12, or at the same time in the secure area. In the network, the communication between the two is not sneaked or attacked by the outside world. If the Internet connection is used, the connection may be established by the SSL or other security technology and the identity verification module 200.

The instant messaging identity authentication method can be referred to FIG. 2, and FIG. 2 is a schematic diagram of the identity authentication process of the instant messaging, wherein the instant messaging client 12 and the instant messaging server 12 are connected by the instant messaging network 11, and the instant messaging client has The key carrier and the ready voucher are connected, and the instant messaging server is connected to the authentication server.

Step 01: The instant messaging client sends an initial communication request and sends it to the instant messaging server through the instant messaging network.

Step 02: The instant messaging server sends any random number or data to the instant messaging client, and asks the client to sign the random number or data. This step is to prevent replay attack, by random random number Or the information makes the malicious attacker unable to know what the data to be signed later.

Step 03: The instant messaging client operates the key carrier by the identity verification module, and performs the signature action on the random data and other authentication data required by the server, and reads the voucher data.

Step 04: The instant messaging client sends back the digital signature and credentials to the instant messaging server via the instant messaging network.

Step 05: The instant messaging server forwards the digital signature and the certificate to the verification server for verification. If the instant messaging server and the verification server are the same machine, the correctness and legality of the signature and the certificate are directly verified.

Step 06: The verification server sends the signature and the correctness of the voucher back to the instant messaging server, and the instant messaging confirms the identity of the instant messaging client according to the verification result.

11. . . Instant messaging network

12. . . Instant messaging software (character is divided into client and server)

twenty one. . . Key carrier

twenty two. . . certificate

100. . . Authentication server

200. . . Identity verification module

01~06. . . Identity certification step

FIG. 1 is a schematic diagram of instant messaging identity authentication according to the present invention.

FIG. 2 is a flow chart of instant messaging identity authentication according to the present invention.

11. . . Instant messaging network

12. . . Instant messaging software

twenty one. . . Key carrier

twenty two. . . certificate

100. . . Authentication server

200. . . Identity verification module

Claims (4)

An instant messaging identity authentication system for instant messaging users to perform identity authentication. The system includes: A, multiple identity verification modules, and software components for instant messaging software for operating user key carriers and parsing credentials It can be divided into instant messaging client and instant messaging server. B. A verification server can accept the identity verification module requirements, perform digital signature verification and voucher verification functions, and respond to the results through a secure channel. C, an instant messaging network and multiple instant messaging software, instant messaging software is a software that can transmit instant messages to each other through an instant messaging network. D, a key carrier, used to store and manipulate the private key, and to avoid being informed of the private key information, can be hardware or software. A digital certificate issued by a credible certificate authority containing user information, public key and digital signature of the certificate authority. For example, the instant messaging identity authentication system described in claim 1 wherein the identity verification module can communicate with each other through an instant messaging software, and the identity verification module can assist the instant messaging software in parsing the user credentials and operating the user key. With the completion of the digital signature action, and can accept the server verification results through the secure pipeline. The instant messaging identity authentication system described in claim 1, wherein the verification server can provide a digital signature verification function, a credential verification function, and can accept and respond to an authentication request of the instant messaging module. A method for identity authentication through instant messaging, which enables an instant messaging user to perform identity authentication, comprising the following steps: A, an instant messaging client, sending an initial communication signal to another instant messaging server through an instant messaging network; The instant messaging server responds with a random number or arbitrary data, requires the instant messaging client to sign the signature; C, the instant messaging client performs the digital signature through the identity verification module; D, the instant messaging client will digitally sign through the instant messaging network The certificate is sent to the instant messaging server; the instant messaging server sends the client digital signature to the verification server for verification; the verification server sends the verification result back to the instant messaging server through the secure pipeline. This security channel means that the information will not be tampered with or forged by a third party; G, the instant messaging server is informed by the authentication server whether the instant messaging client identity is correct.